Is this a hash file? Then what it is? How do I decipher it?

Printable View

November 4th, 2011, 01:15 AM
bob_dylan

Is this a hash file? Then what it is? How do I decipher it?

I have this file, which has content in it for sure, I know what format it should be, but the extension of the file is ".txt". It should be an mp3, but it isn't, here is what the file looks like:

http://www.antionline.com/images/ieimages/2011/11/1.png

Does anyone know what is the name for what happen there? I mean, what kind of file is? Like, the name, to Wikipedia this phenomena, you know, to investigate what it is. The keyword, how are this file types named. Hash files? Are this hash files? And if not, what are they? Because hash files don't have so much character types, right? Then how are this named?

I would like to ask in advance: what software I can use to decrypt this?
November 4th, 2011, 01:26 AM
bob_dylan

What is and how to decipher this?

This question is for advanced-expert computer users. I have this file, which has content in it for sure, I know what format it should be, but the extension of the file is ".txt". It should be media content, but it isn't, here is what the file looks like:

Ãˆ]y)nXÂÃ¹ Â¯%-Ã‹?auÃ¦%Â¸kÂ«Â¨WtÃ©YBiJ9/ÂªÂ¬Å’~|Â¼â€*|[XÅ¾Â·Â¨ÃµÃˆ'ÃºLÃÃ¾
&Å¾Ã¢qÂ¶oÂ¯9ÃœZÃ˜0Â«RÃ˜ â€ºÃ³eÂºÂ¶Â©[Ã„â€“ÃŠâ€š[â€ºUÃ”Â¤0Qâ€žÂ®uÃŒÅ“Å“Ã™â„¢6Å“-ZUAÂ®Ã›Å’vÃ¾Ãž4Â¦Ã‡tÃžÂ±Â±flÂ¤Ã“pOV'FÂlKâ€”(@qÃ¶Ã‚`â€œÃ¦HÃž)q2Ã½Ã§ÂÂ£=Â

(and it goes on for about 398kb more of text)

Does anyone know what is the name for what happen there? I mean, what kind of file is? Like, the name, to Wikipedia this phenomena, you know, to investigate what it is. The keyword, how are this file types named. Hash files? Are this hash files? And if not, what are they? Because hash files don't have so much character types, right? Then how are this named?

I would like to ask in advance: what software I can use to decrypt this?
November 4th, 2011, 10:27 AM
Steve R Jones

You can rename ANY media file to a .TXT extension and see the same type of stuff.

If you don't know where the file came from - get rid of it.
November 4th, 2011, 12:44 PM
nihil

Hi, are you sure that it is media.................or should your:

Quote:

(and it goes on for about 398kb more of text)

read 398MB. You won't get much media content in a 398 Kilobyte file?

As Steve says, you can rename any file to the .txt extension, however, you say that you know what format it should be??? so have you tried renaming the file to that extension?

Personally, I would scan it for malware FIRST!.......... perhaps submit it to Jotti and/or VirusTotal?

If you open it in Notepad or Wordpad, is what you have posted the very start of the file. Frequently you will see some plaintext that gives you a clue.

One thing I can tell you for certain is that it is not a "normal" text file; so it must have been renamed before you got it. That leaves a number of questions IMO:

1. Is it compressed?
2. Is it encrypted?
3. What should its format be?
4. What have you tried to open it with?
5. Is it malicious?

Please be very careful here, and ask yourself why it is not in the format you think it ought to be :eek:

You don't say, but I will assume that you are using some sort of Windows. Get a trial of WinRar and try renaming the file to .zip, .rar etc and see what WinRar says about it. What you are looking for is a message that says that the format is unrecognisable, a prompt for a password, or an offer to open the file.

Similarly, get VLC MediaPlayer and try renaming the file to whatever media formats you think appropriate.

I still think that your first move should be to carefully examine the start and end of the file in notepad or wordpad (Not Word or similar!..........they can execute things!)

Then quickly scan through the body of the file............if it isn't compressed/encrypted you should see isolated pockets of plain text, depending on what the file really is. That might give you a clue as to the original format.

Please remember that renaming files to .txt is a fairly standard way of circumventing restrictions on attachments for whatever reason.......I suspect that you are expected to know what to rename it back to to open it.

:)

EDIT:

I have merged your two threads as they are about the same thing and the other thread has additional information.

Try renaming the file to .mp3

It certainly isn't a hash file, way too large and complex IMO, and a hash file on its own is totally useless.

What surprises me is that there doesn't seem to be a recognisable header so I wonder if a lot of players might not have problems recognising it.
November 8th, 2011, 09:05 AM
SirDice

You should be able to identify the filetype by looking at the first few bytes. If they are random the file is just garbage.
November 8th, 2011, 01:22 PM
Cider

Quote:

Originally Posted by SirDice

You should be able to identify the filetype by looking at the first few bytes. If they are random the file is just garbage.

interesting SD - what would .mp3 be as the first few bytes? Care to give an example?
November 9th, 2011, 02:59 AM
westin

Quote:

Originally Posted by Cider

interesting SD - what would .mp3 be as the first few bytes? Care to give an example?

I could be wrong, but I think MP3s start with ID3.

Just open one with a text editor, or cat/more/less out the file using a terminal if you are running *nix.
November 9th, 2011, 09:00 AM
SirDice

Quote:

Originally Posted by westin

I could be wrong, but I think MP3s start with ID3.

Yep.

Code:

dice@molly:/storage/media/Music/Godmachine/The God Machine - One Last Laugh In A Place Of Dying>hexdump -C God\ Machine,\ The\ -\ 01\ -\ The\ Tremolo\ Song.mp3|head 00000000 49 44 33 03 00 00 00 00 02 56 54 49 54 32 00 00 |ID3......VTIT2..| 00000010 00 11 00 00 00 54 68 65 20 54 72 65 6d 6f 6c 6f |.....The Tremolo| 00000020 20 53 6f 6e 67 54 41 4c 42 00 00 00 26 00 00 00 | SongTALB...&...| 00000030 4f 6e 65 20 4c 61 73 74 20 4c 61 75 67 68 20 49 |One Last Laugh I| 00000040 6e 20 41 20 50 6c 61 63 65 20 4f 66 20 44 79 69 |n A Place Of Dyi| 00000050 6e 67 2e 2e 2e 54 50 45 31 00 00 00 11 00 00 00 |ng...TPE1.......| 00000060 47 6f 64 20 4d 61 63 68 69 6e 65 2c 20 54 68 65 |God Machine, The| 00000070 54 43 4f 4e 00 00 00 0c 00 00 00 48 65 61 76 79 |TCON.......Heavy| 00000080 20 4d 65 74 61 6c 54 59 45 52 00 00 00 05 00 00 | MetalTYER......| 00000090 00 31 39 39 34 54 52 43 4b 00 00 00 05 00 00 00 |.1994TRCK.......|

Zip files start with "PK", a rar file with "Rar!", a windows executable with "MZ" and a whole bunch more. File extensions are soo 1970's.
November 9th, 2011, 01:52 PM
Cider

Quote:

Originally Posted by SirDice

Yep.

Code:

dice@molly:/storage/media/Music/Godmachine/The God Machine - One Last Laugh In A Place Of Dying>hexdump -C God\ Machine,\ The\ -\ 01\ -\ The\ Tremolo\ Song.mp3|head 00000000 49 44 33 03 00 00 00 00 02 56 54 49 54 32 00 00 |ID3......VTIT2..| 00000010 00 11 00 00 00 54 68 65 20 54 72 65 6d 6f 6c 6f |.....The Tremolo| 00000020 20 53 6f 6e 67 54 41 4c 42 00 00 00 26 00 00 00 | SongTALB...&...| 00000030 4f 6e 65 20 4c 61 73 74 20 4c 61 75 67 68 20 49 |One Last Laugh I| 00000040 6e 20 41 20 50 6c 61 63 65 20 4f 66 20 44 79 69 |n A Place Of Dyi| 00000050 6e 67 2e 2e 2e 54 50 45 31 00 00 00 11 00 00 00 |ng...TPE1.......| 00000060 47 6f 64 20 4d 61 63 68 69 6e 65 2c 20 54 68 65 |God Machine, The| 00000070 54 43 4f 4e 00 00 00 0c 00 00 00 48 65 61 76 79 |TCON.......Heavy| 00000080 20 4d 65 74 61 6c 54 59 45 52 00 00 00 05 00 00 | MetalTYER......| 00000090 00 31 39 39 34 54 52 43 4b 00 00 00 05 00 00 00 |.1994TRCK.......|

Zip files start with "PK", a rar file with "Rar!", a windows executable with "MZ" and a whole bunch more. File extensions are soo 1970's.

Woah, are we supposed to know this ? Got a list? :)
November 9th, 2011, 03:55 PM
ua549

Here is a list of file signatures aka magic numbers. I don't know how accurate or up to date the list is.
Here is a more comprehensive list of file signatures.
November 10th, 2011, 08:38 AM
SirDice

Exactly. Never trust an extension (or MIME type for that matter).

A Windows WMA file can contain active content (like javascript for instance). A true MP3 cannot. But you can rename a WMA file to MP3 and Windows mediaplayer will happily play it, including it's active content.

If you're looking for a content scanner you always need to make sure it doesn't only look at the extension or MIME type, both can be faked or changed easily. A proper content scanner will analyze the file to see what it really is and block or allow it based on that.