Re: QR phish missed

Hi,

> On Sat, Aug 17, 2024 at 12:14 PM <[email protected]> wrote:
>
>> On 8/16/24 2:03 PM, Alex wrote:
>> > The body was empty with a PDF attachment. It's too big for pastebin.
>> >
>> https://drive.google.com/file/d/1FzBgTKoBgRp7TWkqjWqSqqESYmCGH0G2/view?usp=sharing
>> <
>> https://drive.google.com/file/d/1FzBgTKoBgRp7TWkqjWqSqqESYmCGH0G2/view?usp=sharing
>> >
>> >
>> > Any success stories with setting up zbar for QR code spam would also be
>> appreciated :-)
>>
>> With this rule the QR-code is extracted correctly.
>>
>> extracttext_external    zbar            /usr/local/bin/zbarimg -q -D {}
>> extracttext_use         zbar            .jpg .png .pdf .webp
>> image/(?:jpeg|png) application/pdf
>> add_header              all             ExtractText-Uris _EXTRACTTEXTURIS_
>>
>
> Is it possible zbar is competing with pdftotext for which content it
> contains? Looks like it's either unable to identify the image or unable to
> extract the link, perhaps because pdftotext is processing it instead?
>
> X-Spam-ExtractText-Uris:
> X-Spam-ExtractText-Chars: 323
> X-Spam-ExtractText-Words: 35
> X-Spam-ExtractText-Tools: pdftotext
> X-Spam-ExtractText-Types: application/pdf
> X-Spam-ExtractText-Extensions: pdf
> X-Spam-ExtractText-Flags:
>

I must have missed this the first time

dbg: extracttext: [3209409] (/usr/bin/zbarimg) finished: exit 1
dbg: extracttext: [3209409] (/usr/bin/zbarimg) stderr output: execvp
failed, errno = 2 (No such file or directory)
warn: extracttext: error from /usr/bin/zbarimg, please verify
configuration: execvp failed, errno = 2 (No such file or directory)

but zbarimg is very much at that location:
# ls -l /usr/bin/zbarimg
-rwxr-xr-x 1 root root 28344 Apr 14 20:00 /usr/bin/zbarimg

# QR-code decoder
extracttext_external    zbar            /usr/bin/zbarimg -q -D {}
extracttext_use         zbar            .jpg .png .pdf .webp
image/(?:jpeg|png) application/pdf
add_header              all             ExtractText-Uris _EXTRACTTEXTURIS_

This is also a bit different than the example provided in ExtractText.pm.
This happens when I run SA on an email as root:

# spamassassin -t -D extracttext < buck-qr-code.eml

# spamassassin --version
SpamAssassin version 4.0.2-r1919157
  running on Perl version 5.38.2