I've got a situation where one of my clients sent me an e-mail with what appears to be obfuscated shell code. The really bizarre thing here is that I see no trace of this e-mail showing up in the mail server and the headers are almost blank.

Has anyone seen anything like this? Is this a cause for concern?

The (obfuscated code) is listed below.

-----Original Message-----
Sent: Thursday, January 17, 2013 11:30 AM

Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64

**BASE64 data** 

Content-Type: text/html; charset="utf-8"
Content-Transfer-Encoding: base64



  • 1
    A note: we removed the original edit to this posting because the encoded data contained an individual's airline flight confirmation. – Jeff Ferland Jan 17 '13 at 20:50

This is not obfuscated code, it is just base64. You can decode it on this site. It is an email containing a flight reservation confirmation. I don't know if it should be publicly available, maybe you should edit your post. You can read more about email encoding here.

| improve this answer | |
  • Wow that's very interesting - thanks for the post. – DKNUCKLES Jan 17 '13 at 17:57
  • if you know python, you could also do "encodedstring".decode("base64"), I prefer that to websites as it's quicker and at least I know my base64 isn't being stored somewhere :-) – Nomad Oct 3 '18 at 14:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.