eml

Documentation

Overview

Package eml triages a raw email message (.eml / RFC 5322) for phishing indicators.

The email is the delivery envelope for the payloads the other malware-triage tools decode (a .lnk / weaponised PDF / macro doc arrives as an attachment). This parses the message with the Go stdlib (net/mail headers + mime/multipart body) and layers the analyst triage on top: the From / Reply-To / Return-Path identities and their domains, the SPF / DKIM / DMARC results from Authentication-Results, the Received-hop count, every attachment (filename, type, size) with a danger flag for executable / script / double-extension / archive files, and the URLs in the body (IP-literal and punycode called out).

No confidently-wrong output: parsing uses the stdlib RFC 5322 / MIME parsers; fields absent from the message are left empty, never guessed; the suspicious verdict is a labelled heuristic (a From↔Reply-To domain mismatch, an auth failure, or a dangerous attachment) — a clean result is not a guarantee of safety; attachment bytes are size-capped and never executed.

Wrap-vs-native: native — Go stdlib net/mail + mime + mime/multipart, no new go.mod dependency. Deeply nested multipart and S/MIME-encrypted bodies are walked best-effort (encrypted parts are surfaced, not decrypted).

Index

• type Attachment
• type Auth
• type Result
  • func Decode(raw []byte) (*Result, error)

Types

type Attachment

type Attachment struct {
	Filename     string `json:"filename"`
	ContentType  string `json:"content_type"`
	Disposition  string `json:"disposition,omitempty"`
	Bytes        int    `json:"bytes"`
	Dangerous    bool   `json:"dangerous,omitempty"`
	DangerReason string `json:"danger_reason,omitempty"`
}

Attachment is one decoded MIME attachment.

type Auth

type Auth struct {
	SPF   string `json:"spf,omitempty"`
	DKIM  string `json:"dkim,omitempty"`
	DMARC string `json:"dmarc,omitempty"`
}

Auth holds the SPF / DKIM / DMARC results from Authentication-Results.

type Result

type Result struct {
	Format string `json:"format"`

	From          string `json:"from,omitempty"`
	FromAddr      string `json:"from_address,omitempty"`
	FromDomain    string `json:"from_domain,omitempty"`
	To            string `json:"to,omitempty"`
	Subject       string `json:"subject,omitempty"`
	Date          string `json:"date,omitempty"`
	MessageID     string `json:"message_id,omitempty"`
	ReplyTo       string `json:"reply_to,omitempty"`
	ReplyToDomain string `json:"reply_to_domain,omitempty"`
	ReturnPath    string `json:"return_path,omitempty"`
	XMailer       string `json:"x_mailer,omitempty"`
	ReceivedHops  int    `json:"received_hops"`

	Auth        Auth         `json:"auth"`
	Attachments []Attachment `json:"attachments,omitempty"`
	URLs        []string     `json:"urls,omitempty"`

	ReplyToMismatch    bool     `json:"reply_to_mismatch"`
	ReturnPathMismatch bool     `json:"return_path_mismatch"`
	Suspicious         bool     `json:"suspicious"`
	SuspiciousReasons  []string `json:"suspicious_reasons,omitempty"`
	Note               string   `json:"note"`
}

Result is the email triage.

func Decode

func Decode(raw []byte) (*Result, error)

Decode triages a raw email message.