i run
spamassassin -V
SpamAssassin version 4.0.2
running on Perl version 5.42.2
it's invoked as a milter in my postfix setup.
a phish just snuck by ...
once submitted to Bayes and re-scanned, it *is* pushed over threshhold.
i'm looking at why it snuck by in the first place.
there _is_ a phishing URL, deeply embedded; my current setup fails to
find/act-on it.
the message structure MIME tree has two parts, nothing suspicious on the
surface:
multipart/related
|-- text/html
|-- application/octet-stream base64, filename=DHL_SHIPPING_LETTER.html
the phishing URL is not obviously in that MIME tree.
it's buried inside that octet-stream attachment -- 4 decode steps deep.
my SA missed it.
manually, i can grab it
(1) base64-decode the attachment
--> an HTML document
(2) read its <embed src="data:...pdf;base64,...">
--> data: URI
(3) base64-decode that data: URI
--> a PDF
(4) read the PDF's /URI link annotation
--> the phishing URL
i.e., the phising URL sits four layers down:
MIME part --> base64 --> HTML --> data: URI --> base64 --> PDF --> /URI
annotation.
SA sees only that first, single opaque attachment.
it never performs the four in-payload decodes.
how to config SA 4.0.x to find/exctract that "deep" URL?
iiuc, neither out-of-the-box ExtractText nor OLEVBMacro are sufficient?
is a custom, multi-step ExtractText extractor script needed? e.g., that:
decodes the octet-stream HTML
pulls the data:application/pdf;base64 blob
base64-decodes it
extracts the PDF /URI annotation
emits the URLs as actionable plain text
?
or is there something that already exists?
is chained/recursive extraction configurable in ExtractText, or other?
even once you reach the PDF, running pdftotext via ExtractText doesn't appear
to emit /URI link annotations.
it can't surface the URL.
i think pdftohtml/mutool could, but pdftohtml emits HTML, which ExtractText
documents as unsupported output,
@
https://spamassassin.apache.org/full/4.0.x/doc/Mail_SpamAssassin_Plugin_ExtractText.html
"...
External tool must output plain text, not HTML or other
non-textual result.
..."
