Somehow, I doubt the payload here is in fact from NSA, nor covered by any
DOD restrictions. Have at it, forensics junkies. ;)
And thank you Fedora Rawhide for breaking GnuPG on me. ;)
--- Begin Message ---
>From [email protected] Wed Dec 9 12:53:08 2009
Return-Path: <[email protected]>
Received: from turing-police.cc.vt.edu (localhost [IPv6:::1]) by
turing-police.cc.vt.edu (8.14.3/8.14.3) with ESMTP id nB9Hr8AK010357
for <[email protected]>; Wed, 9 Dec 2009 12:53:08 -0500
MIME-version: 1.0
Content-transfer-encoding: 8BIT
Content-type: TEXT/PLAIN
Received: from imap.vt.edu [198.82.183.77] by turing-police.cc.vt.edu with
IMAP (fetchmail-6.3.13) for <[email protected]>
(single-drop); Wed, 09 Dec 2009 12:53:08 -0500 (EST)
Received: from rikku.cc.vt.edu ([198.82.161.187]) by ems1.cc.vt.edu (Sun
Java(tm) System Messaging Server 6.3-5.02 (built Oct 12 2007; 32bit)) with
ESMTP id <[email protected]> for [email protected]; Wed, 09 Dec 2009
12:49:58 -0500 (EST)
Original-recipient: rfc822;[email protected]
Received: from localhost (localhost [127.0.0.1]) by rikku.cc.vt.edu (MOS
3.10.8-GA) id HOZ18700; Wed, 09 Dec 2009 12:49:57 -0500 (EST)
Received: from steiner.cc.vt.edu (steiner.cc.vt.edu [198.82.163.51]) by
rikku.cc.vt.edu (MOS 3.10.8-GA) with ESMTP id HOZ18674; Wed, 09 Dec 2009
12:49:53 -0500 (EST)
Received: from slfc.virtual.vps-host.net (EHLO
newsocketworks.virtual.vps-host.net) ([216.154.216.196]) by
steiner.cc.vt.edu (MOS 4.1.8-GA FastPath queued) with ESMTP id DRT98136;
Wed, 09 Dec 2009 12:49:52 -0500 (EST)
Received-SPF: pass (newsocketworks.virtual.vps-host.net: domain of
[email protected] designates 127.0.0.1 as permitted
sender) receiver=newsocketworks.virtual.vps-host.net; client-ip=127.0.0.1;
helo=newsocketworks.virtual.vps-host.net;
[email protected]; x-software=spfmilter
0.97 http://www.acme.com/software/spfmilter/ with libspf2-1.0.0;
Received: from newsocketworks.virtual.vps-host.net (localhost.localdomain
[127.0.0.1]) by newsocketworks.virtual.vps-host.net (8.13.8/8.13.8) with ESMTP
id nB9HnpvK015990 for <[email protected]>; Wed, 09 Dec 2009 12:49:51
-0500
Received: (from apa...@localhost) by newsocketworks.virtual.vps-host.net
(8.13.8/8.13.8/Submit) id nB9Hnpk9015989; Wed, 09 Dec 2009 12:49:51 -0500
Date: Wed, 09 Dec 2009 12:49:51 -0500
Message-id: <[email protected]>
To: [email protected]
Subject: CYBER-PMESII =?UNKNOWN?Q?COMMANDER=E2S?= ANALYSIS
From: [email protected]
X-Mirapoint-Received-SPF: 216.154.216.196 newsocketworks.virtual.vps-host.net
[email protected] 4 softfail
X-Mirapoint-IP-Reputation: reputation=Fair-1, source=Queried,
refid=0001.0A020301.4B1FE33F.01A8, actions=DELAY SPF TAG
X-Junkmail-Info: (45) SPF_HELO_SOFTFAIL,SUBJECT_NEEDS_ENCODING,SUBJ_ALL_CAPS
X-Junkmail-Status: score=45/50, host=steiner.cc.vt.edu
X-Junkmail-SD-Raw: score=unknown,
refid=str=0001.0A020205.4B1FE341.00D3:SCGSTAT602704,ss=1,fgs=0,
ip=216.154.216.196, so=2009-09-22 00:05:22, dmn=2009-09-10 00:05:08,
mode=multiengine
X-Junkmail-IWF: false
X-Mirapoint-Loop-Id: 763ff37a0e5c69fe40c175a6112b0e14
AFRL-RI-RS-TR-2009-136
Final Technical Report
December 2009
CYBER-PMESII COMMANDERÂS ANALYSIS OF FORECAST EFFECTS (CYBERCAFE)
INFORMATION SUBJECT TO EXPORT CONTROL LAWS
WARNING - This document contains technical data whose export is restricted by
the Arms Export
Control Act (Title 22, U.S.C., Sec 2751 et seq.) or the Export Administration
Act of 1979, as amended
(Title 50, U.S.C. App. 2401, et seq.). Violations of these export laws are
subject to severe criminal
penalties. Disseminate IAW DoDD 5230.25.
DESTRUCTION NOTICE - For classified documents, follow the procedures in DOD
5220.22-M, National
Industrial Security Manual (NISPOM), section 5-705 or DOD 5200.1-R, Information
Security Program,
Chapter VI. For unclassified limited documents, destroy by any method that will
prevent disclosure of
contents or reconstruction of the document.
Export of the attached information (which includes, in some circumstances,
release to
foreign nationals within the United States) without first obtaining approval or
license from
the Department of State for items controlled by the International Traffic in
Arms
Regulation (ITAR), or the Department of Commerce for items controlled by the
Export
Administration Regulation (EAR), may constitute a violation of law.
Download:
http://www.zeropaid.com/bbs/includes/CYBERCAFE.zip
or
http://rapidshare.com/files/318309046/CYBERCAFE.zip.html
http://www.sendspace.com/file/fmbt01
--- End Message ---
_______________________________________________
Fun and Misc security discussion for OT posts.
https://linuxbox.org/cgi-bin/mailman/listinfo/funsec
Note: funsec is a public and open mailing list.
