Hacker News Reader

Comment by user837728 | Hacker News Reader

This is technically accurate since I found out myself this week when browsing the AKP email leak. Some of the attachments in the emails were clearly malware of some sort. See for example: https://wikileaks.org/akp-emails/emailid/27482

View on HN

The exact same thing happened to me when I was downloading a email containing a MIME base64 encoded PDF. I was curious as to what it was so I clicked the download button and Chrome warned me that it was malicious.

Funny, it doesn't give that same warning on this URL now. I've downloaded it and base64 decoded it but I'm slightly afraid to open it; I don't know how I'd do it safely. On a VM with no internet connection maybe?

https://wikileaks.org/dnc- emails/emailid/829

Space-broken URL provided above, if anyone wants it.

use a disposable amazon desktop vm

You can start a spot instance or something like pence and then remove it minutes later.

Submitted it to Hybrid Analysis, and this particular attachment appears to be benign, and is in fact an e-ticket for American Airlines. Doesn't seem to contain any embedded malware readily apparent in the analysis.

https://www.hybrid-analysis.com/sample/043de244fc5ca9fd20a96...

do a static binary analysis, for the fun, or just submit it to something like virustotal.

Hear hear. My bet on the reason for the status ping ponging is the site was auto flagged through some automated scanning, someone at Google contacted wikileaks (maybe after some press was seen!), wikileaks started cleaning up their shit and the Goog kept re-scanning, probably coordinated on a fascinating email chain.

Reply on news.ycombinator.com