EmlParser_1_1 not parsing .msg files

[mgabriel-silva]

Request Type

Bug

Work Environment

Question	Answer
OS version (server)	Debian
Cortex Analyzer Name	EmlParser_1_1
Cortex Analyzer Version	1.1
Cortex Version	2.1.2

Description

Saved an e-mail from MS Outlook as .msg file
Added to TheHive as an observable
Using EmlParser to analyze
Getting the error:
Unexpected Error: 'utf-8' codec can't decode byte 0xd0 in position 0: invalid continuation byte

Complementary information

The e-mails I tried have no attachments

[jeromeleonard]

EmlParser does not parse .msg messages from Outlook. This analyzer is made for email saved to file using MIME RFC 822. For Outlook (.msg) messages (which are compressed archives) you can use FileInfo analyzer : it will leverage its outlook submodule for this type of file.