[Mimedefang] Incredible spam obfuscation

Joseph Brennan brennan at columbia.edu
Thu Feb 19 11:36:59 EST 2004


The most obfuscated spam I have ever seen follows.

The "unencoded" message is at the end.

This was disabled by Mimedefang.  We change '<script' to '<no-script'
to stop virus and other activity by scripts.  Below, I changed the
tag back to '<script' to show how it was when it came in.

Joseph Brennan
Academic Technologies Group, Academic Information Systems (AcIS)
Columbia University in the City of New York







This is a multi-part message in MIME format...

------=_NextPart_000_0097_01C3F98E.919503E8
Content-Type: multipart/alternative;
    boundary="----------=_1077191447-17138-721"
Content-Transfer-Encoding: binary
MIME-Version: 1.0
X-Mailer: MIME-tools 5.411 (Entity 5.404)

This is a multi-part message in MIME format...

------------=_1077191447-17138-721
Content-Type: text/plain;
	charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

text partthis is plain text part
------------=_1077191447-17138-721
Content-Type: text/html;
	charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; charset=3Dutf-8">
<STYLE></STYLE>
</HEAD>
<BODY><B>This message</B> has an attach</BODY></HTML>
------------=_1077191447-17138-721--

------=_NextPart_000_0097_01C3F98E.919503E8
Content-Type: text/html;
	name="pasts.html"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: attachment; filename="pasts.html"

<script language=3D"JavaScript">
twill =3D new Array(85,
134,251,113,73,196,166,2,172,204,138,
190,225,48,76,68,160,160,114,70,152,
160,167,72,49,23,27,141,42,108,46,
114,42,43,1,8,96,40,169,86,189,
64,8,122,201,146,112,233,195,155,98,
142,64,40,91,251,158,186,56,54,16,
64,208,246,111,158,127,236,213,152,85,
244,0,166,47,6,248,116,222,194,241,
42,75,124,111,69,116,138,188,66,2,
146,59,236,176,127,100,33,85,19,244,
53,122,16,110,150,85,177,11,27,166,
55,72,144,119,24,88,166,25,102,226,
211,86,86,174,106,250,62,174,99,5,
218,234,40,11,220,105,7,83,20,13,
151,241,230,28,93,171,236,69,101,73,
246,177,166,182,54,140,198,218,131,140,
241,211,211,228,228,55,199,103,201,137,
224,3,14,172,112,7,115,213,16,133,
170,154,116,24,49,185,249,143,129,22,
94,221,75,189,126,91,6,141,39,143,
114,231,135,116,232,6,93,59,235,157,
172,182,133,183,23,35,84,204,172,90,
99,202,155,56,145,228,185,252,184,32,
70,0,160,241,10,108,226,195,247,84,
49,16,30,138,41,34,96,63,105,35,
14,18,124,122,227,7,245,43,109,37,
133,146,122,229,216,140,127,195,25,110,
8,180,209,175,56,49,13,21,154,220,
69,142,33,179,145,154,28,169,15,242,
103,0,242,50,143,133,248,40,90,44,
44,5,46,138,241,85,88,201,125,183,
167,117,123,32,19,19,163,117,37,92,
127,218,8,164,67,127,201,124,9,158,
126,0,92,173,85,101,147,245,114,106,
153,71,193,82,215,82,105,243,203,14,
11,251,72,60,98,9,127,231,129,128,
58,113,147,163,103,23,57,155,215,176,
199,84,253,178,177,238,132,161,156,136,
165,169,98,156,100,213,199,252,92,68,
230,32,88,28,176,89,129,170,202,40,
81,62,184,176,160,232,20,89,219,66,
188,124,4,84,143,104,149,110,162,212,
111,247,16,20,57,191,205,233,245,159,
188,20,40,71,210,160,122,74,148,223,
54,157,233,247,138,208,88,31,80,249,
255,19,37,242,196,166,26,114,19,25,
144,40,112,49,110,117,40,0,18,113,
122,248,1,251,67,90,54,136,144,35,
227,214,146,48,222,72,40,88,222,183,
230,103,116,29,64,205,254,102,250,111,
148,160,232,46,233,65,201,18,38,189,
90,172,180,185,16,126,71,16,46,123,
191,152,100,123,169,7,131,129,83,65,
71,121,121,229,83,24,8,15,163,113,
145,47,95,134,14,61,247,81,43,27,
234,7,119,215,249,121,112,211,30,156,
0,215,99,5,160,213,90,74,228,72,
33,105,9,127,177,198,206,45,123,141,
238,43,22,125,215,255,130,215,23,164,
248,246,237,235,251,205,220,230,181,103,
135,115,155,197,183,123,116,179,48,9,
78,253,18,201,235,219,112,3,51,177,
249,143,138,7,68,217,20,224,115,23,
87,159,125,215,48,233,151,114,255,76,
26,54,239,144,189,237,197,171,10,52,
31,135,234,107,20,212,195,124,204,170,
165,138,158,29,110,101,212,148,60,4,
208,233,208,24,88,34,87,171,24,86,
63,112,0,26,72,47,37,28,217,45,
196,6,51,91,157,230,81,217,151,194,
112,205,75,54,84,254,158,184,35,122,
17,77,131,142,36,164,115,172,197,219,
7,161,6,232,122,86,254,119,141,148,
252,44,29,50,105,12,52,150,165,22,
68,205,119,167,238,50,60,44,15,95,
170,118,36,90,124,196,4,146,59,66,
243,112,73,156,33,37,97,153,27,25,
145,193,94,74,205,117,250,62,201,61,
70,200,240,59,127,193,110,8,39,114,
18,128,131,249,22,75,195,227,115,69,
117,204,175,202,216,20,243,143,153,236,
185,238,142,144,236,189,101,213,35,197,
130,250,73,87,241,34,7,66,240,92,
203,135,241,36,1,118,182,168,196,133,
29,13,139,77,170,50,17,95,153,106,
223,58,232,132,35,159,105,92,105,254,
222,224,188,141,181,69,115,10,139,225,
104,64,136,137,54,157,233,247,138,208,
88,31,80,249,255,19,37,242,196,166,
26,114,19,25,144,40,112,49,110,117,
97,31,66,8,80,183,24,161,71,11,
125,218,220,62,162,218,155,49,216,16,
120,89,166,205,249,39,122,32,104,207,
192,9,207,35,181,130,212,86,234,2,
227,41,0,248,96,193,222,165,113,79,
50,88,96,103,136,241,87,91,205,106,
172,238,50,106,107,65,72,160,104,105,
22,54,143,84,188,93,6,172,96,23,
209,107,76,82,175,79,120,141,247,55,
108,159,71,213,77,203,6,123,232,213,
64,4,167,83,43,115,1,107,228,141,
195,54,115,208,182,58,78,116,214,244,
216,159,16,160,238,177,238,189,166,138,
143,224,229,55,199,96,152,219,187,77,
12,142,10,52,116,227,3,151,229,159,
97,79,91,221,201,167,222,92,88,221,
67,163,98);
Heinlein =3D new Array(105,
238,143,28,37,250,171,8,161,198,135,
180,221,82,35,32,217,158,127,76,149,
170,155,56,17,118,119,228,77,2,19,
80,73,78,111,124,5,90,139,104,129,
38,103,20,189,178,3,128,185,254,95,
172,117,10,123,152,241,214,87,68,45,
98,243,176,41,174,79,220,229,186,107,
200,97,134,71,116,157,18,227,224,153,
94,63,12,85,106,91,248,209,54,55,
164,13,194,211,16,9,14,47,60,197,
26,75,40,65,230,39,212,125,114,195,
64,121,190,31,108,53,202,59,88,177,
150,23,4,237,34,179,112,233,110,15,
156,165,122,43,136,33,70,7,52,93,
210,163,160,89,30,255,204,21,42,27,
184,145,246,247,100,205,130,147,208,201,
206,239,252,133,218,11,232,1,166,231,
148,61,50,131,0,57,126,223,44,245,
138,251,24,113,86,215,196,173,226,115,
48,169,46,207,92,101,58,235,72,225,
6,199,244,29,146,99,96,25,222,191,
140,213,234,219,120,81);
healthful =3D 1064;
acre =3D 217;
var decreases =3D "";
for(Nielsen =3D 0; Nielsen < healthful; Nielsen++)
  decreases =3D decreases + String.fromCharCode(twill[Nielsen] ^ Heinlein[N=
ielsen % acre]);
document.write(decreases);
</script>

------=_NextPart_000_0097_01C3F98E.919503E8--








The above turns into this:



<html>
<body>
<p align="center"><font size="4" color="#FF0000">ARE YOU A GUY LOOKING FOR
SEX? IF YOU ANSWERED YES, YOU NEED TO CHECK THIS OUT.</font></p>
<p align="center"><font color="#FF0000">IT'S A SITE WHERE MARRIED WOMEN GO 
TO
PUT UP AN ADD LOOKING FOR SEX.</font></p>
<p align="center"><font color="#FF0000">THERE IS NOTHING ELSE TO IT, SEARCH
THROUGH PERSONALS, FIND THE WOMAN YOU LIKE, THEN YOU WRITE HER.</font></p>
<p align="center"><font color="#FF0000">SHE RESPONDS AND YOU MEET UP FOR A
QUICKIE OR AN ALL NIGHT AFFAIR.  NO STRINGS ATTACHED.</font></p>
<p align="center"><font color="#FF0000"><a 
href="http://rmt566.com/z/1/ez/100000_EZ.html">TO
ENTER THE NEWEST AND NEXT LEVEL OF SEXUAL FANTASY, CLICK HERE</a></font></p>
<p align="center"></p>
<p align="center"></p>
<p align="center"></p>
<p align="center"> </p>
<p align="center"> </p>
<p align="center"> </p>
<p align="center"> </p>
<p align="center"> </p>
<p align="center"> </p>
<p align="center">get no more of <a 
href="http://221.232.160.105/html/z/done.html">this</a></p>
</body>
</html>





More information about the MIMEDefang mailing list