om393/emailparser

parse emails

Email Parser

(Maintainer: ThreatLead)

Parses email, extracts attachment. Written to parse emails uploaded to VT.

Example:

>>> import emailparser
>>> email_file = 'test.msg' or 'test.eml'
>>> e = emailparser.parse(email_file)
>>> print(vars(e))
{'attachments': [AttachmentObject, ...],
 'body': ...,
 'receiver': ...,
 'sender': ...,
 'sha_256': ...,
 'subject': ...,
 'timestamp': datetimeObject
}
>>> a = e.attachments[0]
>>> print(a.name)
INVOICE_.zip
>>> temp_folder = os.path.join(tempfile.gettempdir(), a.sha256))
>>> print(a.unpack(outdir=temp_folder))
['/tmp/7cb1ea71c373c890d7a1c2e38f57fa3a862332c14798e58a569529c49573073e/document_copy.js']
>>>