Jump to content

Identifying attachment: picture vs. virus?


Recommended Posts

I received a blank email with an attachment with a file extension I didn't recognize -- ".cpl"

I looked it up and it can be an executable windows control panel extension, or one of two things called "Compel Presentation" or "Corel Color Palette" which sounds like a picture.

I put the code in a base 64 decoder at opinionatedgeek.com, and it has snatches of readable text like "cplstub.exeOpen" and "Kernel32.dll" so I'm betting it's the executable and not reporting it to SpamCop.

But is there any way of knowing which of several programs will open a file extension which seems to have multiple meanings?

Link to comment
Share on other sites

Ah, the catch is, the .cpl is more normally associated with "control panel" files ... if you're running Windows ... Start | Settings | Control Panel ..... all those items there will be files named xxxx.cpl ... which would more likely be the fit for the payload file you've seen. To answer "which file opens what file extension" ... that depends on what "you" have associated with that file type. For example, even the plain .TXT file type ... one person ties it to NotePad, another changed to WordPad, another went full bore and pegged it to use Word (usually until he/she finds out that Word really screws up plain text <g>) ...and that's just looking at the "standard" mix of Windows apps

Link to comment
Share on other sites

So the other extensions would only be recognized by Mac, for instance, since you couldn't run Windows without .cpl being associated with control panel?

First of all, just going with the flow that your special file was targeted to a Windows system. The description of what happens when clicking on a file under Windows was a simplistic description ... there are some other items, such as the leading data bits at the start of the file that indicate what kind of file it actually is .... in your Mac experience, equate some of this to things like resorce fork data (though for Windows, not near as comprehensive)

Link to comment
Share on other sites

Archived

This topic is now archived and is closed to further replies.

×
×
  • Create New...