On 02/12/2014 09:02 PM, Joe Quinn wrote:
This pattern has been showing up in a good 80% of spam I have looked at
in the past month.
Spammers take a few paragraphs out of a large body of text and put it at
the end of their email. My favorite is one that had the scene where
Daisy first meets Jay Gatsby.
Sometimes they add some munging, or like in this example they insert
base64-encoded hashes. We have a rule for the plaintext hashes, but does
anyone on the list have a good way of detecting this?
Example: http://pastebin.com/zCStErch
btw - how many BASE8 strings will you find in ham? .-)
that should give you a pointer for a decent rule.
