North American Network Operators Group
Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: dealing with w32/bagle

  • From: Jeffrey I. Schiller
  • Date: Wed Mar 03 16:20:28 2004
  • Spam-alum-prob: 0.000000
  • Spam-alum-time: 1.195335
Turns out that the ZIP file format that all of these beasties are
using is a little bit non-standard. Specifically they are all version
1.0 zip archives and the first (and only) component is not
compressed.

At MIT we are matching these two strings to recognize the infected ZIP
files while letting most (actually I have seen no false positives) if
not all "real" ZIP files. We are matching them anywhere within an
attachment (well, within the first 16K). However you really only need
to see if they are the beginning characters (this is a ZIP file
header).

What follows are the base64 encoded strings. I have put an asterisk
between the first and second character, so my own filters won't reject
this message, do remove that before using...

U*EsDBAoAAAAAA   <= Matches unencrypted ZIP file
U*EsDBAoAAQAAA   <= Matches encrypted version.

			    -Jeff