-
November 4th, 2011, 01:15 AM
#1
Junior Member
Is this a hash file? Then what it is? How do I decipher it?
I have this file, which has content in it for sure, I know what format it should be, but the extension of the file is ".txt". It should be an mp3, but it isn't, here is what the file looks like:
Does anyone know what is the name for what happen there? I mean, what kind of file is? Like, the name, to Wikipedia this phenomena, you know, to investigate what it is. The keyword, how are this file types named. Hash files? Are this hash files? And if not, what are they? Because hash files don't have so much character types, right? Then how are this named?
I would like to ask in advance: what software I can use to decrypt this?
-
November 4th, 2011, 01:26 AM
#2
Junior Member
What is and how to decipher this?
This question is for advanced-expert computer users. I have this file, which has content in it for sure, I know what format it should be, but the extension of the file is ".txt". It should be media content, but it isn't, here is what the file looks like:
È]y)nXù ¯%-Ë?auæ%¸k«¨WtéYBiJ9/ª¬Œ~|¼*|[Xž·¨õÈ'úLÍþ
&žâq¶o¯9ÜZØ0«RØ ›óeº¶©[Ä–Ê‚[›UÔ¤0Q„®uÌœœÙ™6œ-ZUA®ÛŒvþÞ4¦ÇtÞ±±fl¤ÓpOV'FlK—(@qöÂ`“æHÞ)q2ýç£=
(and it goes on for about 398kb more of text)
Does anyone know what is the name for what happen there? I mean, what kind of file is? Like, the name, to Wikipedia this phenomena, you know, to investigate what it is. The keyword, how are this file types named. Hash files? Are this hash files? And if not, what are they? Because hash files don't have so much character types, right? Then how are this named?
I would like to ask in advance: what software I can use to decrypt this?
-
November 4th, 2011, 10:27 AM
#3
You can rename ANY media file to a .TXT extension and see the same type of stuff.
If you don't know where the file came from - get rid of it.
-
November 4th, 2011, 12:44 PM
#4
Hi, are you sure that it is media.................or should your:
(and it goes on for about 398kb more of text)
read 398MB. You won't get much media content in a 398 Kilobyte file?
As Steve says, you can rename any file to the .txt extension, however, you say that you know what format it should be??? so have you tried renaming the file to that extension?
Personally, I would scan it for malware FIRST!.......... perhaps submit it to Jotti and/or VirusTotal?
If you open it in Notepad or Wordpad, is what you have posted the very start of the file. Frequently you will see some plaintext that gives you a clue.
One thing I can tell you for certain is that it is not a "normal" text file; so it must have been renamed before you got it. That leaves a number of questions IMO:
1. Is it compressed?
2. Is it encrypted?
3. What should its format be?
4. What have you tried to open it with?
5. Is it malicious?
Please be very careful here, and ask yourself why it is not in the format you think it ought to be
You don't say, but I will assume that you are using some sort of Windows. Get a trial of WinRar and try renaming the file to .zip, .rar etc and see what WinRar says about it. What you are looking for is a message that says that the format is unrecognisable, a prompt for a password, or an offer to open the file.
Similarly, get VLC MediaPlayer and try renaming the file to whatever media formats you think appropriate.
I still think that your first move should be to carefully examine the start and end of the file in notepad or wordpad (Not Word or similar!..........they can execute things!)
Then quickly scan through the body of the file............if it isn't compressed/encrypted you should see isolated pockets of plain text, depending on what the file really is. That might give you a clue as to the original format.
Please remember that renaming files to .txt is a fairly standard way of circumventing restrictions on attachments for whatever reason.......I suspect that you are expected to know what to rename it back to to open it.
EDIT:
I have merged your two threads as they are about the same thing and the other thread has additional information.
Try renaming the file to .mp3
It certainly isn't a hash file, way too large and complex IMO, and a hash file on its own is totally useless.
What surprises me is that there doesn't seem to be a recognisable header so I wonder if a lot of players might not have problems recognising it.
Last edited by nihil; November 4th, 2011 at 01:11 PM.
Reason: merged threads
-
November 8th, 2011, 09:05 AM
#5
You should be able to identify the filetype by looking at the first few bytes. If they are random the file is just garbage.
Oliver's Law:
Experience is something you don't get until just after you need it.
-
November 8th, 2011, 01:22 PM
#6
Originally Posted by SirDice
You should be able to identify the filetype by looking at the first few bytes. If they are random the file is just garbage.
interesting SD - what would .mp3 be as the first few bytes? Care to give an example?
The world is a dangerous place to live; not because of the people who are evil, but because of the people who don't do anything about it.
Albert Einstein
-
November 9th, 2011, 02:59 AM
#7
Originally Posted by Cider
interesting SD - what would .mp3 be as the first few bytes? Care to give an example?
I could be wrong, but I think MP3s start with ID3.
Just open one with a text editor, or cat/more/less out the file using a terminal if you are running *nix.
Last edited by westin; November 9th, 2011 at 03:03 AM.
\"Those of us that had been up all night were in no mood for coffee and donuts, we wanted strong drink.\"
-HST
-
November 9th, 2011, 09:00 AM
#8
Originally Posted by westin
I could be wrong, but I think MP3s start with ID3.
Yep.
Code:
dice@molly:/storage/media/Music/Godmachine/The God Machine - One Last Laugh In A Place Of Dying>hexdump -C God\ Machine,\ The\ -\ 01\ -\ The\ Tremolo\ Song.mp3|head
00000000 49 44 33 03 00 00 00 00 02 56 54 49 54 32 00 00 |ID3......VTIT2..|
00000010 00 11 00 00 00 54 68 65 20 54 72 65 6d 6f 6c 6f |.....The Tremolo|
00000020 20 53 6f 6e 67 54 41 4c 42 00 00 00 26 00 00 00 | SongTALB...&...|
00000030 4f 6e 65 20 4c 61 73 74 20 4c 61 75 67 68 20 49 |One Last Laugh I|
00000040 6e 20 41 20 50 6c 61 63 65 20 4f 66 20 44 79 69 |n A Place Of Dyi|
00000050 6e 67 2e 2e 2e 54 50 45 31 00 00 00 11 00 00 00 |ng...TPE1.......|
00000060 47 6f 64 20 4d 61 63 68 69 6e 65 2c 20 54 68 65 |God Machine, The|
00000070 54 43 4f 4e 00 00 00 0c 00 00 00 48 65 61 76 79 |TCON.......Heavy|
00000080 20 4d 65 74 61 6c 54 59 45 52 00 00 00 05 00 00 | MetalTYER......|
00000090 00 31 39 39 34 54 52 43 4b 00 00 00 05 00 00 00 |.1994TRCK.......|
Zip files start with "PK", a rar file with "Rar!", a windows executable with "MZ" and a whole bunch more. File extensions are soo 1970's.
Last edited by SirDice; November 9th, 2011 at 09:03 AM.
Oliver's Law:
Experience is something you don't get until just after you need it.
-
November 9th, 2011, 01:52 PM
#9
Originally Posted by SirDice
Yep.
Code:
dice@molly:/storage/media/Music/Godmachine/The God Machine - One Last Laugh In A Place Of Dying>hexdump -C God\ Machine,\ The\ -\ 01\ -\ The\ Tremolo\ Song.mp3|head
00000000 49 44 33 03 00 00 00 00 02 56 54 49 54 32 00 00 |ID3......VTIT2..|
00000010 00 11 00 00 00 54 68 65 20 54 72 65 6d 6f 6c 6f |.....The Tremolo|
00000020 20 53 6f 6e 67 54 41 4c 42 00 00 00 26 00 00 00 | SongTALB...&...|
00000030 4f 6e 65 20 4c 61 73 74 20 4c 61 75 67 68 20 49 |One Last Laugh I|
00000040 6e 20 41 20 50 6c 61 63 65 20 4f 66 20 44 79 69 |n A Place Of Dyi|
00000050 6e 67 2e 2e 2e 54 50 45 31 00 00 00 11 00 00 00 |ng...TPE1.......|
00000060 47 6f 64 20 4d 61 63 68 69 6e 65 2c 20 54 68 65 |God Machine, The|
00000070 54 43 4f 4e 00 00 00 0c 00 00 00 48 65 61 76 79 |TCON.......Heavy|
00000080 20 4d 65 74 61 6c 54 59 45 52 00 00 00 05 00 00 | MetalTYER......|
00000090 00 31 39 39 34 54 52 43 4b 00 00 00 05 00 00 00 |.1994TRCK.......|
Zip files start with "PK", a rar file with "Rar!", a windows executable with "MZ" and a whole bunch more. File extensions are soo 1970's.
Woah, are we supposed to know this ? Got a list?
The world is a dangerous place to live; not because of the people who are evil, but because of the people who don't do anything about it.
Albert Einstein
-
November 9th, 2011, 03:55 PM
#10
Here is a list of file signatures aka magic numbers. I don't know how accurate or up to date the list is.
Here is a more comprehensive list of file signatures.
Last edited by ua549; November 9th, 2011 at 04:02 PM.
Similar Threads
-
By cheyenne1212 in forum Miscellaneous Security Discussions
Replies: 7
Last Post: February 1st, 2012, 02:51 PM
-
By gore in forum Operating Systems
Replies: 3
Last Post: March 7th, 2004, 08:02 AM
-
By rcgreen in forum The Security Tutorials Forum
Replies: 1
Last Post: October 4th, 2002, 05:07 AM
-
By ahmedmamuda in forum AntiVirus Discussions
Replies: 2
Last Post: March 20th, 2002, 02:03 AM
-
By Gbin@ryR in forum AntiOnline's General Chit Chat
Replies: 8
Last Post: February 28th, 2002, 05:52 PM
Posting Permissions
- You may not post new threads
- You may not post replies
- You may not post attachments
- You may not edit your posts
-
Forum Rules
|
|