diff --git a/pymisp/tools/emailobject.py b/pymisp/tools/emailobject.py index 4de2a46b..a19f3c5c 100644 --- a/pymisp/tools/emailobject.py +++ b/pymisp/tools/emailobject.py @@ -158,7 +158,10 @@ def _build_eml(self, message: EmailMessage, body: dict[str, Any], attachments: l body.get('html'), body.get('rtf')] if i is not None] # If this a non-multipart email then we only need to attach the payload - if message.get_content_maintype() != 'multipart': + if ( + message.get_content_maintype() != "multipart" and + "application/ms-tnef" not in message.get("content-type", message.get_content_maintype()) + ): for _body in body_objects: if "text/{}".format(_body['subtype']) == message.get_content_type(): message.set_content(**_body) @@ -219,12 +222,13 @@ def _build_eml(self, message: EmailMessage, body: dict[str, Any], attachments: l for attch in attachments: # Add attachments at the end. if attch.cid not in related_content.keys(): _content_type = attch.getStringStream('__substg1.0_370E') - maintype, subtype = _content_type.split("/", 1) - message.add_attachment(attch.data, - maintype=maintype, - subtype=subtype, - cid=attch.cid, - filename=attch.longFilename) + if _content_type is not None: + maintype, subtype = _content_type.split("/", 1) + message.add_attachment(attch.data, + maintype=maintype, + subtype=subtype, + cid=attch.cid, + filename=attch.longFilename) if p := message.get_payload(): if isinstance(p, list): cur_attach = p[-1]