Is this a hash file? Then what it is? How do I decipher it?

[bob_dylan]

I have this file, which has content in it for sure, I know what format it should be, but the extension of the file is ".txt". It should be an mp3, but it isn't, here is what the file looks like:



Does anyone know what is the name for what happen there? I mean, what kind of file is? Like, the name, to Wikipedia this phenomena, you know, to investigate what it is. The keyword, how are this file types named. Hash files? Are this hash files? And if not, what are they? Because hash files don't have so much character types, right? Then how are this named?

I would like to ask in advance: what software I can use to decrypt this?

[bob_dylan]

This question is for advanced-expert computer users. I have this file, which has content in it for sure, I know what format it should be, but the extension of the file is ".txt". It should be media content, but it isn't, here is what the file looks like:

È]y)nXÂ�ù ¯%-Ë?auæ%¸kǬWtéYBiJ9/ª¬Œ~|¼â€*|[Xž·¨õÈ'úLÃ�þ
&žâq¶o¯9ÃœZØ0«RØ ›óeº¶©[Ä–Ê‚[›UÔ¤0Q„®uÌœœÙ™6Å“-ZUA®ÛŒvþÞ4¦ÇtÞ±±fl¤ÓpOV'FÂ�lK—(@qöÂ`“æHÞ)q2ýçÂ�£=Â�

(and it goes on for about 398kb more of text)

Does anyone know what is the name for what happen there? I mean, what kind of file is? Like, the name, to Wikipedia this phenomena, you know, to investigate what it is. The keyword, how are this file types named. Hash files? Are this hash files? And if not, what are they? Because hash files don't have so much character types, right? Then how are this named?

I would like to ask in advance: what software I can use to decrypt this?

[Steve R Jones]

You can rename ANY media file to a .TXT extension and see the same type of stuff.

If you don't know where the file came from - get rid of it.

[nihil]

Hi, are you sure that it is media.................or should your:

(and it goes on for about 398kb more of text)

read 398MB. You won't get much media content in a 398 Kilobyte file?

As Steve says, you can rename any file to the .txt extension, however, you say that you know what format it should be??? so have you tried renaming the file to that extension?

Personally, I would scan it for malware FIRST!.......... perhaps submit it to Jotti and/or VirusTotal?

If you open it in Notepad or Wordpad, is what you have posted the very start of the file. Frequently you will see some plaintext that gives you a clue.

One thing I can tell you for certain is that it is not a "normal" text file; so it must have been renamed before you got it. That leaves a number of questions IMO:

1. Is it compressed?
2. Is it encrypted?
3. What should its format be?
4. What have you tried to open it with?
5. Is it malicious?

Please be very careful here, and ask yourself why it is not in the format you think it ought to be

You don't say, but I will assume that you are using some sort of Windows. Get a trial of WinRar and try renaming the file to .zip, .rar etc and see what WinRar says about it. What you are looking for is a message that says that the format is unrecognisable, a prompt for a password, or an offer to open the file.

Similarly, get VLC MediaPlayer and try renaming the file to whatever media formats you think appropriate.

I still think that your first move should be to carefully examine the start and end of the file in notepad or wordpad (Not Word or similar!..........they can execute things!)

Then quickly scan through the body of the file............if it isn't compressed/encrypted you should see isolated pockets of plain text, depending on what the file really is. That might give you a clue as to the original format.

Please remember that renaming files to .txt is a fairly standard way of circumventing restrictions on attachments for whatever reason.......I suspect that you are expected to know what to rename it back to to open it.



EDIT:

I have merged your two threads as they are about the same thing and the other thread has additional information.


Try renaming the file to .mp3

It certainly isn't a hash file, way too large and complex IMO, and a hash file on its own is totally useless.

What surprises me is that there doesn't seem to be a recognisable header so I wonder if a lot of players might not have problems recognising it.

[SirDice]

You should be able to identify the filetype by looking at the first few bytes. If they are random the file is just garbage.

[Cider]

You should be able to identify the filetype by looking at the first few bytes. If they are random the file is just garbage.

interesting SD - what would .mp3 be as the first few bytes? Care to give an example?

[westin]

interesting SD - what would .mp3 be as the first few bytes? Care to give an example?

I could be wrong, but I think MP3s start with ID3.

Just open one with a text editor, or cat/more/less out the file using a terminal if you are running *nix.

[SirDice]

I could be wrong, but I think MP3s start with ID3.

Yep.

dice@molly:/storage/media/Music/Godmachine/The God Machine - One Last Laugh In A Place Of Dying>hexdump -C God\ Machine,\ The\ -\ 01\ -\ The\ Tremolo\ Song.mp3|head
00000000  49 44 33 03 00 00 00 00  02 56 54 49 54 32 00 00  |ID3......VTIT2..|
00000010  00 11 00 00 00 54 68 65  20 54 72 65 6d 6f 6c 6f  |.....The Tremolo|
00000020  20 53 6f 6e 67 54 41 4c  42 00 00 00 26 00 00 00  | SongTALB...&...|
00000030  4f 6e 65 20 4c 61 73 74  20 4c 61 75 67 68 20 49  |One Last Laugh I|
00000040  6e 20 41 20 50 6c 61 63  65 20 4f 66 20 44 79 69  |n A Place Of Dyi|
00000050  6e 67 2e 2e 2e 54 50 45  31 00 00 00 11 00 00 00  |ng...TPE1.......|
00000060  47 6f 64 20 4d 61 63 68  69 6e 65 2c 20 54 68 65  |God Machine, The|
00000070  54 43 4f 4e 00 00 00 0c  00 00 00 48 65 61 76 79  |TCON.......Heavy|
00000080  20 4d 65 74 61 6c 54 59  45 52 00 00 00 05 00 00  | MetalTYER......|
00000090  00 31 39 39 34 54 52 43  4b 00 00 00 05 00 00 00  |.1994TRCK.......|

Zip files start with "PK", a rar file with "Rar!", a windows executable with "MZ" and a whole bunch more. File extensions are soo 1970's.

[Cider]

Yep.

dice@molly:/storage/media/Music/Godmachine/The God Machine - One Last Laugh In A Place Of Dying>hexdump -C God\ Machine,\ The\ -\ 01\ -\ The\ Tremolo\ Song.mp3|head
00000000  49 44 33 03 00 00 00 00  02 56 54 49 54 32 00 00  |ID3......VTIT2..|
00000010  00 11 00 00 00 54 68 65  20 54 72 65 6d 6f 6c 6f  |.....The Tremolo|
00000020  20 53 6f 6e 67 54 41 4c  42 00 00 00 26 00 00 00  | SongTALB...&...|
00000030  4f 6e 65 20 4c 61 73 74  20 4c 61 75 67 68 20 49  |One Last Laugh I|
00000040  6e 20 41 20 50 6c 61 63  65 20 4f 66 20 44 79 69  |n A Place Of Dyi|
00000050  6e 67 2e 2e 2e 54 50 45  31 00 00 00 11 00 00 00  |ng...TPE1.......|
00000060  47 6f 64 20 4d 61 63 68  69 6e 65 2c 20 54 68 65  |God Machine, The|
00000070  54 43 4f 4e 00 00 00 0c  00 00 00 48 65 61 76 79  |TCON.......Heavy|
00000080  20 4d 65 74 61 6c 54 59  45 52 00 00 00 05 00 00  | MetalTYER......|
00000090  00 31 39 39 34 54 52 43  4b 00 00 00 05 00 00 00  |.1994TRCK.......|

Zip files start with "PK", a rar file with "Rar!", a windows executable with "MZ" and a whole bunch more. File extensions are soo 1970's.

Woah, are we supposed to know this ? Got a list?

[ua549]

Here is a list of file signatures aka magic numbers. I don't know how accurate or up to date the list is.
Here is a more comprehensive list of file signatures.