4 ms·

This is technically accurate since I found out myself this week when browsing the AKP email leak. Some of the attachments in the emails were clearly malware of

This is technically accurate since I found out myself this week when browsing the AKP email leak. Some of the attachments in the emails were clearly malware of some sort. See for example: https://wikileaks.org/akp-emails/emailid/27482 https://wikileaks.org/akp-emails/emailid/27482

nchelluri 10y ago
The exact same thing happened to me when I was downloading a email containing a MIME base64 encoded PDF. I was curious as to what it was so I clicked the download button and Chrome warned me that it was malicious. Funny, it doesn't give that same warning on this URL now. I've downloaded it and base64 decoded it but I'm slightly afraid to open it; I don't know how I'd do it safely. On a VM with no internet connection maybe? https://wikileaks.org/dnc- https://wikileaks.org/dnc- emails/emailid/829 Space-broken URL provided above, if anyone wants it.
- x0x0 10y ago
  use a disposable amazon desktop vm
  - popey456963 10y ago
    You can start a spot instance or something like pence and then remove it minutes later.
- caffeinewriter 10y ago
  Submitted it to Hybrid Analysis, and this particular attachment appears to be benign, and is in fact an e-ticket for American Airlines. Doesn't seem to contain any embedded malware readily apparent in the analysis. https://www.hybrid-analysis.com/sample/043de244fc5ca9fd20a96dd96fca3b8ae2048567a60f79bd56d8e4a49ab37067?environmentId=100 https://www.hybrid-analysis.com/sample/043de244fc5ca9fd20a96...
- deleted 10y ago
  [deleted]
- __m 10y ago
  do a static binary analysis, for the fun, or just submit it to something like virustotal.
mrlambchop 10y ago
Hear hear. My bet on the reason for the status ping ponging is the site was auto flagged through some automated scanning, someone at Google contacted wikileaks (maybe after some press was seen!), wikileaks started cleaning up their shit and the Goog kept re-scanning, probably coordinated on a fascinating email chain.

nchelluri 10y ago

The exact same thing happened to me when I was downloading a email containing a MIME base64 encoded PDF. I was curious as to what it was so I clicked the download button and Chrome warned me that it was malicious. Funny, it doesn't give that same warning on this URL now. I've downloaded it and base64 decoded it but I'm slightly afraid to open it; I don't know how I'd do it safely. On a VM with no internet connection maybe? https://wikileaks.org/dnc- https://wikileaks.org/dnc- emails/emailid/829 Space-broken URL provided above, if anyone wants it.

x0x0 10y ago
use a disposable amazon desktop vm
- popey456963 10y ago
  You can start a spot instance or something like pence and then remove it minutes later.
caffeinewriter 10y ago
Submitted it to Hybrid Analysis, and this particular attachment appears to be benign, and is in fact an e-ticket for American Airlines. Doesn't seem to contain any embedded malware readily apparent in the analysis. https://www.hybrid-analysis.com/sample/043de244fc5ca9fd20a96dd96fca3b8ae2048567a60f79bd56d8e4a49ab37067?environmentId=100 https://www.hybrid-analysis.com/sample/043de244fc5ca9fd20a96...
deleted 10y ago
[deleted]
__m 10y ago
do a static binary analysis, for the fun, or just submit it to something like virustotal.

mrlambchop 10y ago

Hear hear. My bet on the reason for the status ping ponging is the site was auto flagged through some automated scanning, someone at Google contacted wikileaks (maybe after some press was seen!), wikileaks started cleaning up their shit and the Goog kept re-scanning, probably coordinated on a fascinating email chain.