[sf-lug] Suspicious email from LinuxMafia

Wed Mar 9 08:18:33 PST 2016

     I do minor administration for the sf-lug mailing list,
working under the name of Saunders^H^H^H^H^H^H^H^H
sf-lug-owner at linuxmafia.com

     sf-lug-owner at linuxmafia.com got email today. I'd like
help figuring it out.

* The sender appears as admin <adm79 at linuxmafia.com>
* The Subject field is  DOC-418DF795B8DB

* The message body seems empty.
* There's an attachment  DOC-418DF795B8DB.zip  (2.7KB)

I've copied the complete header information below; I myself
have not sufficient experience to be confident in my interpretation
of the header and other info.
* It seems to have gotten to me via the well, which got it from
   a sender named mailmanbounces at linuxmafia.com
* at the bottom are a couple of Apple-Mail clauses that
   seem to encapsulate the attachment, which claims
   to be 7-bit ASCII.

The message source below shows the following
(beware: read-only, there may be malicious code hidden) :

----------------------------------------------------------------

 From - Wed Mar  9 15:27:50 2016
X-Account-Key: account1
X-UIDL: 366774.jSfAttEYpPpZ1gscU,LPY8mBuMZznl2XWCRvStObEEk=
X-Mozilla-Status: 0005
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Return-Path: mailman-bounces at linuxmafia.com
Received: from zimbra.well.com (LHLO zimbra.well.com) (172.30.1.189) by
  zimbra.well.com with LMTP; Wed, 9 Mar 2016 05:00:33 -0800 (PST)
Received: from localhost (localhost.localdomain [127.0.0.1])
	by zimbra.well.com (Postfix) with ESMTP id ABE8D100B9839
	for <jim at well.com>; Wed,  9 Mar 2016 05:00:33 -0800 (PST)
X-Virus-Scanned: amavisd-new at well.com
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Level:
X-Spam-Status: No, score=-1.9 tagged_above=-10 required=5
	tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001,
	SPF_HELO_PASS=-0.001, TVD_SPACE_RATIO=0.001]
	autolearn=ham autolearn_force=no
Received: from zimbra.well.com ([127.0.0.1])
	by localhost (zimbra.well.com [127.0.0.1]) (amavisd-new, port 10024)
	with ESMTP id p0-W4jevKv6I for <jim at well.com>;
	Wed,  9 Mar 2016 05:00:33 -0800 (PST)
Received: from xmx.well.com (xmx.well.com [172.30.1.105])
	by zimbra.well.com (Postfix) with ESMTP id 2130B100B982C
	for <jim at zimbra.well.com>; Wed,  9 Mar 2016 05:00:33 -0800 (PST)
X-Date: Wed, 9 Mar 2016 05:00:32 -0800
Received: from linuxmafia.com (linuxmafia.COM [198.144.195.186])
	by xmx.well.com (8.14.4/8.14.3) with ESMTP id u29D0VLY003339
	(version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=NO)
	for <jim at well.com>; Wed, 9 Mar 2016 05:00:32 -0800
Received: from localhost ([127.0.0.1] helo=linuxmafia.com)
	by linuxmafia.com with esmtp (Exim 4.72)
	(envelope-from <mailman-bounces at linuxmafia.com>)
	id 1addj5-0000GO-30
	for jim at well.com; Wed, 09 Mar 2016 05:00:31 -0800
Received: from [5.239.148.71] (helo=Olive)
	by linuxmafia.com with esmtp (Exim 4.72)
	(envelope-from <adm79 at linuxmafia.com>) id 1addj0-0000GE-4T
	for sf-lug-owner at linuxmafia.com; Wed, 09 Mar 2016 05:00:29 -0800
Content-Type: multipart/mixed;
	boundary=Apple-Mail-A6B670A7-7D07-F956-841E-2BDC62E0408E
Content-Transfer-Encoding: 7bit
From: admin <adm79 at linuxmafia.com>
Mime-Version: 1.0 (1.0)
Date: Wed, 09 Mar 2016 16:30:17 +0430
Message-Id: <2EFC41B8-150B-7388-875F-0C60C5DC at linuxmafia.com>
To: sf-lug-owner at linuxmafia.com
X-Mailer: iPhone Mail (11B554a)
X-Scanned-By: CanIt (www . roaringpenguin . com)
Subject: DOC-418DF795B8DB
Sender: mailman-bounces at linuxmafia.com
Errors-To: mailman-bounces at linuxmafia.com
X-SA-Exim-Connect-IP: 127.0.0.1
X-SA-Exim-Mail-From: mailman-bounces at linuxmafia.com
X-SA-Exim-Scanned: No (on linuxmafia.com); SAEximRunCond expanded to false

--Apple-Mail-A6B670A7-7D07-F956-841E-2BDC62E0408E
Content-Type: text/plain;
	charset=us-ascii
Content-Transfer-Encoding: 7bit

--Apple-Mail-A6B670A7-7D07-F956-841E-2BDC62E0408E
Content-Type: application/zip;
	name=DOC-418DF795B8DB.zip
Content-Disposition: attachment;
	filename=DOC-418DF795B8DB.zip
Content-Transfer-Encoding: base64

UEsDBBQAAgAIALxxaUhGlKN/cQoAANIYAAAQAAAATEVKNTA0MzIzOTIwMi5qc8VYa3MbtxX9
npn8B3gzyVCyRFqx6/hRTSrZdOLGr1q0447ED9hdkIQJAmsAK5F29N977sUuKdJkOp1pp5oh
CS1wL+7j3Nf2eteiP69cUCLUVeV8FJfSBzFyXhTOXiqrlS1Wm8fiTH/+bFR39eDL9eNvvwGR
mL+S9Ss/waPz7HV2u5N5aaeqzA6y3OvxJDqL5Uxao60KAesQcWJsFJZX+Wm2dzsbMd1YRsX7
Uyzw+7yf7R2IbH6W3c5evjOLOKZTMzmbuTjB/sTNVNDFtGE7xlNdYFG4WaWitmOs3xP7z6Ps
QHSyShex9sS5qlVuHBZS+8pIS8/6czpaSVviur691B6/jm4cGRkmiR1WwfEVl8rjt1SF8zLq
S+JgZ8rGM+ISvbagHkMskX1PPCyMNqlnufKGbjjIRtoYNtKgTxQvcfzN93S89zavnqh5Jm6L
rEuk0lo90Qa3sCWNKyTbbqQ9M4h1EXhHEaO5IiZv2Q9qrGd0UtuRtFEzVW5kMYUYfsFqQE/4
mcxXW7b2SUGklXdlXTR6hairenm/+lTrSMRR032XEFx9YDlhmkIn1xULeLtkE72mU/lHOoZP
EUm837E6w0WZ1xWRAlXKAxZ166DajqW2hq6BKEbP05Xw7Ky2OkS6vkuMzyZEnytZTFiL3IOu
tYUx7PcQZZ4n/0XlZ9pKQ0eheamLVq0cBNDBFxMoTdvAxSIRhUoZk7ua/bYC0cmM7vi7O4Ue
Vf8d6fWShIFBAUDwzdngal7oBoxj5cZeVkCpNIRf6cvD3OmEAwbOB4L6ix/xza53VdQzPls6
yA06EtXDBSo0PD+8fEGEv9LxqOSMRC89BysbrPaB1VHzyjiWezB4k+0NEbw9JAHxrirhMjE2
LpeGkoCWkDsIUbqiJkAjrrF8zA/6Rs3S/7zVbRf0HD+PV1TPw6+Dly9w9pYOELGzYrfXpI1f
3kx/r3/7gCMI23DeZJHzozt3bt+/f3h0f//oznDYnPX6iZ/ipFVXLV2nJfhpuMe69Pb3hdgX
ZyqG5WWHXgG3qryhl6O0lsuAh87iaiWK2nsSbCkhuPytkl7OxJdGsT9e5x9VEa/FOQ4NxYkV
Km0I5MslneNDIjpRI6/iJ6jIN6xx9gr4sUF8aXm+bR7skKVHbJ6unNEm4rWHo9oWBOSOsK5U
Yk98EaSzmMjwhMDo1YGgbxsPBDuJjEknf+afrruyyi/5/fFH2nwkKq9GyBWqxF7jizd2Opns
8MXDdV88VREaBgEAMMPwZ6Yli25YVu6w3KlzRkl7LQa+VkKPRolYB1BYZw8Zeu2lbEIG4cp4
7b8rszEDNpvYADWxRbLXIw3IcH0EeIK4miiPu8lVKtiLLIoFvK3mSE7g0Ql1MREyCONkiUCF
kFAaZNqK531xKL679+Du3b3kpM0Lj5M0P/wgOrT42jn0dG9L8CUDfcXv580nXbLLK8gjbh0f
i4uM7HWRwd0jZEb1WCwre3g3WEAcDr9lhP44HC4dfne4hzrV/ncvZRXRQFoo6c0CqjPgNCl/
KY0u2bXGK1kugG0D78OydKyTkHm8yjCkLdYs8GBRJYEf0tNb9HhT0+TADTPAMN9+w6g9z5yl
a5FeF/igLkQqSwXXEGR5P6NECWcvHLcEQRapxFokf0qiSL/ItWOVDW+AR3Rw7bff4GLWobnJ
J54umtSd5FTvqW5JM0pMlSRm5QJi0Fn0BQUfKJwhmzjPZO4qVF5zwUNNG7J17i0vpD/y1Gwq
30fz8XW5EZjZCbG+dEBjkCPSSV6h6vD9M+REK7F4+pprHyoEYI62LxUW58fS6s98lIpr4MpT
GKnJSk9J9tNuashQVXWqqcTDpoJzxkxzVMGm3MEQuZbJjiQELSKxoUYLlSuj3NEqtVTonHqw
jLuEyhVTZPemw3NBN6V7rL0csXIK/hl2bvIhNJ6lnvURRd7Dw6OjA9Evx8gL4qRA6xNW4bmE
DBLJCEqJ2lL8IjN7uAGBQhDRoIDTS2qRS0QN0iNcJTof/1EDOOK7o7sP797fa/DcSUl3rWaq
kaxNfK/V1R7FeDrRja5icDcECclroh8dNQhrSWRZ9tGpxxfIOQopoiXasd2BAkmhC/QqafUr
mlGj/EGKfLHDAzFhGe0ZGdnVaOrxu+B+OcXC0YbJ122OfHd0B+UWyUAIyvRBrSsSI/o3FnZT
h9UOie/sDgUgObMWW+W/IoRpVmLirih/Q3y0sShPYRlZbeC+bTpVxC6wSj1hrksVNrpPxXOL
KxfZcB1u16K3L04iJoC8jlTxDv8rfyhiW1XjwHCj0SRNFTMVucfLXYyOs5nE3KEoShzHY+WM
9BwpGHAcTyzcMaLM29B0rMifaKJ5EtMcoBRm5OU7uwPrrw/w7D2VyQXCRUYxVnFpBWRkaeD8
toDLlXkgNqp0RKPhEFxRk8VQ9uaFqqjBBecHIk/lPiComvGze4PDMcpsAGlnVcxLfdnWcn3Z
LWho42pHtU5fZI9XNeIWHbgpauciW56/yAhV11uDohvkpRq4Z2jeO1wmD8SPG3kHOADnpjR1
wt7pYv9/iwZoioH+q/T3ZKKKKcXbSppwuhjIMekIffeh59I1HKRNCxZW9t5G+u8tLytUg/IJ
htdyNQB0UVNRMdCWsl0uMrp+b4tPdsnaNcqO4+Sma6hhoU9EAkZlTA83EfpwhzpPbuDDWx7m
u5QYboi843x7fcocPDXTKxUu7h9lsZqZHadKSiwIpE72C6eiAoijcLuUtY1M1B/QCE6DeyU1
RSkuqmepHE9irB71emPiFCpZqC5N04hxsAKn2BRZiAhq5E5Vc//AQ3ItewFthpr1jBuH3sMH
i0n+0/17ZVfx2wLO/aTLdrshdW8F0eniebnEzRIy+UJYso0QA8wzuXdTZTeJkKUmrqQxjRtn
jNRTUVeUAzAeo50gXczikMYn4hVoZglpqpLC0yAuMY7HdUCzR8hva27m+/4cqGms3QArbXc1
kaKlQZJyawDdigsWoOlMd2x3Wm5iG4pbGMEEfmGMDvzqJiL5eWmp6ARO4didtq+3sK08Ya59
5YEqsGqAyJPPn4qRRpKlRDvShrqaVHs3jZSs0Z9XvksE5xfZ86cXa41uR+jygF4PRjVfFmrm
FdGau1G71d1wdxoy4DUFxtwzoe3ZeFHQcEvNLO7czookSLli6YwZxptzfA8xvpwPeeuaM8JK
GVJ6hzrtvXQt1RQGiy67iCGDGOsIX1sVCllhfh61y0aCRoCtM+Rylwe4jQKjS0p51MinK5PQ
j5uvpj/abP/u936iJxumxVBF1dMrw683aOKUyd/odHwsahpGSwiBIvyVaxuUrE93f6HpLhU0
NMrZ2Lz752+jjKXNQnkyfvOJquKnZ+FZ8Rq2yohDO5s+83LMc1ga9pvwnqBSinH/dPBKbLR/
LQQ/Bblpt9b/n6ipPlNpIDoxBliT48YB7GfxKLuB9v+nx4kjv3A4buPhK+e/ou2t4cB/W8+3
gFlDPd8DMn55g6G6VjvxhMooChmLiehchcFg8NszQxJfty8AUVzXw35w8ksy258W/5/BfmUI
OOU/zAw3WH1tkB1g2NoUNID4F1BLAQIUABQAAgAIALxxaUhGlKN/cQoAANIYAAAQAAAAAAAA
AAEAIAAAAAAAAABMRUo1MDQzMjM5MjAyLmpzUEsFBgAAAAABAAEAPgAAAJ8KAAAAAA==

--Apple-Mail-A6B670A7-7D07-F956-841E-2BDC62E0408E--