13

I guess this is the worst case. I have a file which was initially base64 encoded. This step was easy. But now all I can see is a bunch of rubbish. No structure, nearlly a maximum of entropy, no periods nothing. I have no more information except:

  • the size of 5120 KByte
  • there is more than one file inside of this
  • they are all of the same type
  • the used encryption or compression or whatever algorithm is used is some "standard" one

I tested so many things ... Does anyone of you has a clue on how to go forward? I am running out of ideas.

Edit: The histogram which has been now deleted was not correct. Anyway I have no idea how to go on further. Trying to open it with truecrypt to be sure it is not a container didn't work. Do you have any more tips on how to find the files in this?

Improve this question
5
  • Can you please explain, what do you want to achieve with this analysis - what files does, it's structure, etc. ?
    – PhoeniX
    Commented Sep 1, 2013 at 11:24
  • It is something like a test. And I do not have any other information except the ones I already told. All I can say is that the file was initially a base64 attachment within an email. I extracted it and decoded it to this ... No more information. I am sorry.
    – Andre
    Commented Sep 1, 2013 at 11:33
  • There are programs to find TrueCrypt volumes, but that only works in some cases. Normally they should be indistinguishable. Also, normally you'd have the program to which that data belongs for analysis. Looks like a tricky case. Assuming this is strong cryptography, you are out of luck entirely.
    – 0xC0000022L ♦
    Commented Sep 1, 2013 at 13:47
  • Thank you for the comments. Well it is a test and I'm running out of ideas. It could be truecrypt but any software like tchunt or tchead says: it is not a truecrypt container.
    – Andre
    Commented Sep 1, 2013 at 15:11
  • Every 76th character is a NewLine in formatting emails with Base 64 encoding. github.com/wildbit/postmark-dotnet/issues/11 If newLines are being changed to periods 0x2E maybe that gives you some information. Without seeing more of the file -- hard to be more help -- sorry.
    – dcaswell
    Commented Sep 9, 2013 at 0:07

3 Answers 3

Reset to default
9

You can try to use binwalk. It can be used in various ways:

  • Embedded file identification and extraction
  • Executable code identification
  • Entropy analysis and graphing (useful for compression and encryption identification)
  • "Smart" strings analysis

You could also try to open your file with 7zip, since it supports a shitload of compression formats.

Improve this answer
1
  • thank you for your comment. 7zip wasn't able to decompress it. I will give it a try again to binwalk and experiment with it.
    – Andre
    Commented Sep 5, 2013 at 9:09
5

I would start with checking the first bytes of a file after base64 decoding. Those would indicate what file format is.

  • MZ(5A4D) - meaning this is an executable file and you can start with executing it in save (virtual) environment with SysInternals utilities open - ProcMon and Process explorer. In addition, calculate its MD5 value and look it in the Net, VirusTotal. If you have reversing/low tech skills, I also recommend to download a free copy of IDA 5.0 and try to check it there.
  • Other file format, then try to look for it's first bytes in hex format in the Net too. One of the good places is FILE SIGNATURES TABLE
  • Try to load the decoded file in hex editor and check if there any strings, that might look familiar or with some meaning.
Improve this answer
6
  • Those are the first four (magic) bytes: C9 DE F2 43
    – Andre
    Commented Sep 1, 2013 at 11:47
  • Are you sure it was encoded with base64?
    – PhoeniX
    Commented Sep 1, 2013 at 11:53
  • Yes. Within the initial file was an e-mail with a base64 attachment. Propably created by Outlook. I also found the correct syntax for sending attachments so I am pretty sure. Every 76 character was a . but afaik this shouldn't be helpful here.
    – Andre
    Commented Sep 1, 2013 at 11:55
  • check the original file for magic number, just in case.
    – PhoeniX
    Commented Sep 1, 2013 at 11:58
  • It is this: 0E 27 AC 8A but I do not find anything useful. "file" under linux isn't also successful.
    – Andre
    Commented Sep 1, 2013 at 12:12
4

You could give a shot at dynamic binary visualization. There's an excellent presentation given by Christopher Domas at REcon as well at BlackHat 2013. The deck for REcon is available here.

I believe the tool is out now in beta so you could give a try at it.

Improve this answer
3
  • at least it is not available or i didn't find anything. I used the 3d visualization of cryptool and it doesn't show any structures. only random data. i also could not compress the file.
    – Andre
    Commented Sep 6, 2013 at 9:20
  • @LuckyB56, can you please explain, how will this help to solve the issue with the unknown file?
    – PhoeniX
    Commented Sep 7, 2013 at 7:55
  • @ph0sec To at least figure out if it's executable file at all. It should not happen that after banging your head for few days you realize it's a part of png file or anything of that sort. Since I haven't had chance to try the tool yet, but the presentation describes about it.
    – LuckyB56
    Commented Sep 24, 2013 at 19:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.