Talk:1247: The Mother of All Suspicious Files
LNK and ZDA...Link and Zelda? 76.64.65.200 13:43, 5 August 2013 (UTC)
http://www.ip-tracker.org/locator/ip-lookup.php?ip=65.222.202.53, some place in the USA. Looks random, but still... - Actually this IP hosted some javascript that exploited some FF17 weaknesses on Windows NT during the last LEA TOR raid.
The IP address 65.222.202.53 geolocates to a Starbucks just outside the beltway in Washington. DC.
Someone mentioned you see the word Hackers as well as a pirated movie... In fact the pirated movie is the 1995 movie named Hackers. Edited it to make the reference clear. -- Sonofaresiii (talk) (please sign your comments with ~~~~)
I am missing DMG or other "Mac" suspect executable -- 145.64.134.242 (talk) (please sign your comments with ~~~~)
WRBT.OBJ.O.H WhiteRabbit.obj from Jurassic Park. Not sure about the O.H Andym (talk) 14:56, 5 August 2013 (UTC)
Fixed .O.H - these are file extensions with C compilers and C headers, respectively.BlackHatm
.tar.gz stands for tarred and gzipped (archive) files; here .co. was introduced to make it look like a domain name
.obj can also be a http://en.wikipedia.org/wiki/Relocatable_Object_Module_Format
cia-bin is a play on cgi-bin Sebastian --178.26.118.249 15:06, 5 August 2013 (UTC)
After the reference to the FBI in the (currently) final paragraph I was thinking of adding something like the following:
- This would also 'explain' the initial directory structure of "/PUB/CIA-BIN/ETC", something like an FTP /pub/ directory for publicly open files, and conflating the CIA with /cgi-bin/ as a somewhat common location for dynamic web-pages, then /etc/ which is another Linux/Unix directory reference, strangely stored underneath a doubley-referenced 'tilde' directory, what with ~foo as the root directory generally redirecting to the home directory for user "foo". These are all usually lower-case (and case-sensitive), but if the INIT.DLL has anthing to do with it it might mean it's an uppercase-dominated and yet actually case-insensitive Windows-based system, with that Windows Dynamically Linked Library as a dynamic responder.
...but I've rushed that and it looks messy/may have errors in it, so feel free to clean it up if it inspires you. Or not... 178.98.215.19 16:34, 5 August 2013 (UTC)
I think [SCR] actually refers to a screener. -- 83.160.118.125 (talk) (please sign your comments with ~~~~)
> Agreed. The capitalization and brackets are the standard formatting in pirated movie titles, and before a movie release, Screeners (much better quality than theater cams) are excellent bait on fake downloads. Updated in the wiki. Daemonf (talk) 23:09, 5 August 2013 (UTC)
Of course, if the user is on Windows, the only extension that matters is the last one which is ".exe" - an executable. Hax (talk) 16:43, 5 August 2013 (UTC)
I edited the line on the 'save' button being greyed out. This doesn't change with HTTPS, but is instead a modern browser feature preventing a user from agreeing indiscriminately or with a mistaken click. I hope I didn't step on anybody's toes. 72.29.184.195 00:12, 6 August 2013 (UTC)
- That's incorrect, the web server can identify if it's a secure connection or not and render the content of the page depending on this.--Dgbrt (talk) 06:48, 6 August 2013 (UTC)
What is the joke?That the prescence of a huge number of extensions makes this file extremely suspicious?And the punch is that he is suggesting a secure connection to download this file?--117.194.199.185 01:24, 6 August 2013 (UTC)
"...CO - looks like a top-level domain. Many countries use .co.tld in front of their main TLD, e.g. .co.uk...." Aha! I always thought co.uk meant "Cornwall, United Kingdom." And I couldn't figure out why all their domains were mediated through Cornwall. Every day, I meet a new opportunity to feel clueless... -- 24.79.13.247 (talk) (please sign your comments with ~~~~)
On a scale of 'party' to 'judge' in the 'Sketchiness' scale ( http://www.explainxkcd.com/wiki/index.php?title=Sketchiness ), how sketchy is this file? Greyson (talk) 13:38, 6 August 2013 (UTC)
"UNIX" with all caps is a trademark, whereas "Unix" is probably what you should use when you refer to the family of OSes. -- 108.85.129.37 (talk) (please sign your comments with ~~~~)
