search

hatching / sflock

Sample staging & detonation utility to be used in combination with Cuckoo Sandbox.
83 stars 46 forks source link

Support TNEF #9

Open jbremer opened 7 years ago

jbremer commented 7 years ago

See also https://sourceforge.net/p/ytnef/tnef-samples/1/, https://github.com/Yeraze/ytnef, and most importantly https://github.com/koodaamo/tnefparse.

idiom commented 7 years ago

Yeah, we could switch the code in the .msg unpacker to use tnefparse instead of parsing the OLE streams directly. I can take a look at this if you want.

jbremer commented 7 years ago

Eh, that would also be a possibility ;-) If you have some spare time that'd be great!