Fighting malware and spam

Strip Mining

TA!Strip!Image

  16 October 2006

Description

Using an animated GIF, with transparent frames, to build up an image the contains the spam message.

Submitted by Nick FitzGerald.

Example

Each of the 17 horizontal strips cuts fairly randomly through the text making OCR on each strip not very useful. The spammer has then mounted each strip in its correct position on a transparent background and put each strip into an animated GIF. Here, for example, are a couple of strips:

The end result is that only once the entire image animation has completed is the complete spam visible making this a challenge for spam filters. And the spammer has thrown in a couple of frames at the end of the image, that get displayed after such a long delay (8 minutes) that they essentially never get shown. But those final frames are there just to throw off a spam filter trying to find the actual image.

See also this blog entry.

Poll

Virus Bulletin

• A commitment to quality and reliability
• The road less truvelled: W32/Truvel
• New memory persistence threats
• Reversing Python modules
• Advertising database poisoning
• Sunbelt Software VIPRE Antivirus + Antispyware
• Spear phishing – on the rise?