Reader Robert submitted a phishing email (msg file).
.msg files are compound file binary format files (aka ole files), and as such can be analyzed with oledump.py.
And I have plugins specific for .msg files: plugin_msg.py and plugin_msg_summary.py.
Robert’s submission inspired me to add a small feature to plugin_msg_summary: it will now search through all streams for URLs, and report them.
This way, one can now immediately see the phishing URLs in phishing emails:
Didier Stevens
Senior handler
Microsoft MVP
blog.DidierStevens.com
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
