Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've got a situation where one of my clients sent me an e-mail with what appears to be obfuscated shell code. The really bizarre thing here is that I see no trace of this e-mail showing up in the mail server and the headers are almost blank.

Has anyone seen anything like this? Is this a cause for concern?

The (obfuscated code) is listed below.

-----Original Message-----
From: 
Sent: Thursday, January 17, 2013 11:30 AM
Subject: 

----boundary_64354_0d34ef45-e6e9-4610-8382-1fdd2040fd60
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64

**BASE64 data** 

----boundary_64354_0d34ef45-e6e9-4610-8382-1fdd2040fd60
Content-Type: text/html; charset="utf-8"
Content-Transfer-Encoding: base64

PGh0bWw+DQogIDxoZWFkPg0KICAgIDxNRVRBIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg

(truncated)

share|improve this question
    
A note: we removed the original edit to this posting because the encoded data contained an individual's airline flight confirmation. –  Jeff Ferland Jan 17 '13 at 20:50
add comment

1 Answer

up vote 3 down vote accepted

This is not obfuscated code, it is just base64. You can decode it on this site. It is an email containing a flight reservation confirmation. I don't know if it should be publicly available, maybe you should edit your post. You can read more about email encoding here.

share|improve this answer
    
Wow that's very interesting - thanks for the post. –  DKNUCKLES Jan 17 '13 at 17:57
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.