ActiveMime

From Just Solve the File Format Problem
(Difference between revisions)
Jump to: navigation, search
(Category:Microsoft)
m (Sample files)
 
(3 intermediate revisions by 2 users not shown)
Line 14: Line 14:
  
 
== Magic Number ==  
 
== Magic Number ==  
 
 
The structure is partially reversed engineered by phishme on GitHub. Once decoded from [[Base64]] the magic number of the format is: '''41 63 74 69 76 65 4d 69 6d 65 00 00''' - 'ActiveMime' + null terminators.
 
The structure is partially reversed engineered by phishme on GitHub. Once decoded from [[Base64]] the magic number of the format is: '''41 63 74 69 76 65 4d 69 6d 65 00 00''' - 'ActiveMime' + null terminators.
  
== Other Links ==
+
== Software ==
 +
* [https://github.com/idiom/activemime-format activemime-format (extractor)]
  
 +
== Sample files ==
 +
* {{DexvertSamples|archive/activeMime}}
 +
 +
== Other Links ==
 
* [https://github.com/phishme/python-amime/ Python Amime: Library for working with ActiveMime]
 
* [https://github.com/phishme/python-amime/ Python Amime: Library for working with ActiveMime]
 
* [https://isc.sans.edu/forums/diary/XML+A+New+Vector+For+An+Old+Trick/19423/ XML: A New Vector For An Old Trick] describing malware distribution with an ActiveMime binary payload
 
* [https://isc.sans.edu/forums/diary/XML+A+New+Vector+For+An+Old+Trick/19423/ XML: A New Vector For An Old Trick] describing malware distribution with an ActiveMime binary payload

Latest revision as of 03:25, 28 December 2023

File Format
Name ActiveMime
Ontology
Extension(s) .mso
MIME Type(s) application/x-mso

Documented by phishme on GitHub, ActiveMime is an undocumented Microsoft file format often seen used to encode Microsoft Office Macros.

ActiveMime binary objects may reside in Microsoft Web Archive (MHT) files documented by Cyren.

There is little official documentation that can be searched for. The earliest references indexed by Google seem to come from 2012 but not much earlier.

There is more information and a further call for collaboration or corrections on what is documented on the Pishme GitHub README.

Contents

[edit] Magic Number

The structure is partially reversed engineered by phishme on GitHub. Once decoded from Base64 the magic number of the format is: 41 63 74 69 76 65 4d 69 6d 65 00 00 - 'ActiveMime' + null terminators.

[edit] Software

[edit] Sample files

[edit] Other Links

Personal tools
Namespaces

Variants
Actions
Navigation
Toolbox