Re: Phish with xps attachment

2018-08-07 Thread Martin Gregorie
On Tue, 2018-08-07 at 17:28 -0400, Bill Cole wrote: > Maybe check how you did that. Using the mimeexplode tool from the > Perl MIME-Tools package: > > # mimeexplode /tmp/xpsspam > Message: msg0 (/tmp/xpsspam) > Part: msg0/msg-53100-1.txt (text/plain) > Part: msg0/msg-53100-2.html

Re: Phish with xps attachment

2018-08-07 Thread Bill Cole
On 7 Aug 2018, at 15:31 (-0400), Martin Gregorie wrote: On Tue, 2018-08-07 at 14:09 -0400, Alex wrote: Anyone have ideas for viewing inside of an XPS file or otherwise blocking phish attempts with xps attachments? https://pastebin.com/KtMnNPAg I don't think this is validly base64 encoded. I

Re: Phish with xps attachment

2018-08-07 Thread RW
On Tue, 07 Aug 2018 20:31:25 +0100 Martin Gregorie wrote: > On Tue, 2018-08-07 at 14:09 -0400, Alex wrote: > > > Anyone have ideas for viewing inside of an XPS file or otherwise > > blocking phish attempts with xps attachments? > > > > https://pastebin.com/KtMnNPAg > > > I don't think this

Re: Phish with xps attachment

2018-08-07 Thread Pedro David Marco
XPS is a ZIP compressed document format.  I may be wrong but  Is any serious software/company using .XPS for invoices? to me, PDF is the facto standard for invoices...   maybe you can score the mix of .XPS + "due invoice" text -PedroD >On Tuesday, August 7, 2018, 8:10:08 PM

Re: Phish with xps attachment

2018-08-07 Thread Martin Gregorie
On Tue, 2018-08-07 at 14:09 -0400, Alex wrote: > Anyone have ideas for viewing inside of an XPS file or otherwise > blocking phish attempts with xps attachments? > > https://pastebin.com/KtMnNPAg > I don't think this is validly base64 encoded. I chopped it down to just the supposed base64 text

Phish with xps attachment

2018-08-07 Thread Alex
Hi, Anyone have ideas for viewing inside of an XPS file or otherwise blocking phish attempts with xps attachments? https://pastebin.com/KtMnNPAg Still not detected by virus scanners and passing through Mimecast.