Re: SA 4.0.x: extracting a phishing URL buried 4 decode layers deep -- in a base64 HTML attachment wrapping a data: URI PDF?

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--------------qAXHIuS0mRCBBVb8NhXcvbCg
Content-Type: multipart/mixed; boundary="------------IvZ5KEcltk3y0Lyi2DaEZ3Wg";
 protected-headers="v1"; hp="clear"
Message-ID: <[email protected]>
Date: Thu, 30 Jul 2026 18:58:00 +0200
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
From: [email protected]
Subject: Re: SA 4.0.x: extracting a phishing URL buried 4 decode layers deep
 -- in a base64 HTML attachment wrapping a data: URI PDF?
To: [email protected]
References: <[email protected]>
Content-Language: en-US
Autocrypt: [email protected]; keydata=
 xsFNBFfuNQkBEAC7d3uN4LejxenGqvQFJESNQFr8Gs8+1KfnUMk1WPVWTKhphh0m000bVyVr
 ICQITJX7ex1CdZrMdlQ5K3gvoRkOTOrExiyU0eknoalkDRXscleaz4y5WlizYF5FS1tL46LN
 MIE4FByOlZE9pwLFQhSMioLukAqxke6B45R8lXFa65QNBu2eUw0/hD87w2xtkpx8GYyWgV71
 xfzh0ZJhLJvKCD7Sb/PPCAW2VUJv+XWoPJUon3grll9maIC2PJG5w7yuOWBqGJ59UbI/5/F5
 sUqTVl6PGh6UbOETz3a6gEgycm7VhLuvIF8HNJDSEzZ4OMcJQton1oRfPOwTKHhjJNhmIkQO
 Wbp5ubetrbuXtgkNeOgBmdIQe6x8vqr7p2QpNbzp3qW4fOqYO4HbXkDWTtxrbWEtA8wPHXCc
 8iWujIOpxbhVuj9z2c2L4MZHsa+8WGhfEpXWRzicfFU2NePjXI/bIZHGlN/PdirY8VkWTHfU
 iz6d8MXdOVyYIMTzYeaxi/WfJaX5RqMdxEZtrYP1xk4lvjQAnX9F9CDDZ2FSqxxOLBv3Mjzk
 5BVc8ccc7x0lVxkB4N6thXPvLjNRqg1Oocjb6a/t4Mj5bVb+5POaZhTENmMXcw/qdlM56P8L
 NhRfL+B4clZJ9iPoXezmdgejcECzm+NzdLdcL3htRPANPcl9jQARAQABzSRHaW92YW5uaSBC
 ZWNoaXMgPGdpb3Zhbm5pQHBhY2xhbi5pdD7CwZEEEwEKADsCGyMFCwkIBwIGFQgJCgsCBBYC
 AwECHgECF4AWIQSqDdOcbpHepgzGX3j6vuoJiXJY5QUCWuMqEQIZAQAKCRD6vuoJiXJY5VA8
 D/0XJHDUNT+57qlKxXB9RLffd/UFn2OCNAxJ3V0GQL55AvLKs6WqbWAmFsy56hXSJo7BGsgq
 P4m1Bkwvc6FZlC0gEu3EJT3MLYQwtn1sNrbCsQQLdd3X+xc0gjFfa0qvhecfKDL3KLKaIZHy
 kGZWAk5bAjTm66gSYBsqTCuCN1hYMZx/wGqld33siIZhRLH9vdZCaZQr+aQ9yQ1lOxVU4gNZ
 U+bAcyPGk0Qv+sutlApgkcEJV4yW5NduKewqfBak2tF07Cofth+w5TLlEl4tae3RrTL2G1Bp
 Ll0uDP5dSeuW45xfYZzBphK1r5n7NjLBxGA/mAxInV8NswM2nDoe5GlNmXXzoTvEgHEokvCQ
 BdmHWtBbwPOp+bDWfsHCKGGVkmQVT119ppMtEVewE7vwkENOegBEoi3JQXeGuHsLrGbqNdz/
 k82vBT4/AGWyaGkDeJ23fQ5dyTQi0m1fO+nB87KIds0UUpygnylFHrdAu+8WIsbNs879Te4R
 6T3zwyQcj/tNlLvm5sKR+BcxTyOon3fWu16Xs8hjZycF68YYKQIBy1LbzuUkW2+ss/ELTWFM
 y7cppbGbAbNjTVdCbMzVzwa9faNsEJxZ1i7b23N6iiSzl1J9gH8OpkDHhS1KtmQRUKIWyq57
 E/7A3FPck3Pue6LLaV800gmR5tytR9sy2NKKis7BTQRX7jUJARAAxOE7lAVUlIIWJXDAJtok
 AsLVAoi1EQrNFJCvp4ycdLBiqTrZHQ4X/+Iw1OgNSgAQQmhrW4+WliUFRJWTBxZ7c/i2wFCf
 OfkXkOQBko5TfVgoMx8LH6onMmsnlpa5HdJkbhSK07+Xi02KvYPgkdhNGjv8L8JW3/fnVD6o
 UKufoDYNsUF8WxvJZUGKM4dUo1aiuRRA2Taf46Qe7EuKKwthjG4YXCoUnfWXNDRzG3BIqDZq
 fAE9ZVNKBGj/SvNlcjUyLUYhSWGW9Y0gCGins7uNWcBaAivg5tq0SuCsf7TNW5Tli5y1pZVw
 jtRpwA/vA4UDuUucNlskGdsrKMHJNaHbgAfK6+bZUgUjpu4SGYUlGUW9oG/OeRZi49DLHewy
 anBeKWO75d4YVNlnYFLa9Rd8hSOKLevAkOenoPgoINwFOoS1hkZDJxqx+DK0q/EuXCwkwdBW
 lDbIpvfwZHJ9SwKAj9BOxmPBhNkqeIbACJLIy15dPimRjL6A+gvvPspvSFmKy2HqE9zReZTM
 zvt+L1cVOoF/jDYRwy7AySnXE5SskcBYOf9GtUIv5cElT/5hrxhYlLoDlBOOMxIYVbXQGh3V
 lvP7LcVAkSe4B5UzSl00JLx29ZBkYvuCQ3nu0RuWWvEZMfFl9z73f8nr0tWH+EblQzUlfW39
 j8LvonAcfPjHOtsAEQEAAcLBdgQYAQoAIAIbDBYhBKoN05xukd6mDMZfePq+6gmJcljlBQJa
 hZPuAAoJEPq+6gmJcljl7D4P/ikutqkJK99tZEFXQiCbjGbJeA7QMY+MAY3v7qE/zcxHMvCs
 95jX/4LPA3kRa8X71ASB7Ul8/qQjKNsmgzID96S/EzUt23RwX3Rpfitpn3zrZ8Ty26BM1Rzz
 ITmVKphJsPgiX6A0N8ivdW4/rrypbjWHRP7hWNgGohRd494wp3eipqaRS2JVpDU/kxPor0+7
 k65BToFVJRU6cea43H0+XxTzauop+fjc8wOV2x8k/i0JAntqT6Pyr/xyzkeF63zjE5bm1mNI
 JOCfZrnV0DqSasI1kNTkQTnx1UC8cOtx/LOR/PbfpecQHpuQGiRO4vRxM/n5C/cRe7DHOa6t
 wYoVXc/MxNO9H+lQpbolEjmCbOzbUg0kp+TLddgivAd/yUxDFEIYMOjrWEzvaPRYk0EC2fWr
 /kuyNEUfx6cvN2th2d/QY3shimDxSW33O14SbzgAUcwZ+03o9xM08eL3HX5pCBy4chbO/nWl
 b95F0TNiFj39nwx0PcU+Fbe5E1WZ3FUG+BTH8D+ck5ot1qIgBDEWFQZW5JV+RhzwN4hrX1fp
 +RtYFOQto56d+vl3dfR2batkCcC2WQfFuzkw1aD8FgOv+TKZeFGFEGkCiJgCHPCgWRJH2GNJ
 /SpIyKTgVKvwmtSmUN/bLan8k52lo3Dnt+fCdCKwr8UjiWgQZnsbmJVKNsK9
In-Reply-To: <[email protected]>

--------------IvZ5KEcltk3y0Lyi2DaEZ3Wg
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: base64

T24gNy8yMy8yNiAyOjE0IFBNLCBwZ25kIHdyb3RlOg0KPiANCj4gaSBydW4NCj4gDQo+ICDC
oMKgwqDCoHNwYW1hc3Nhc3NpbiAtVg0KPiAgwqDCoMKgwqDCoMKgwqAgU3BhbUFzc2Fzc2lu
IHZlcnNpb24gNC4wLjINCj4gIMKgwqDCoMKgwqDCoMKgIHJ1bm5pbmcgb24gUGVybCB2ZXJz
aW9uIDUuNDIuMg0KPiANCj4gaXQncyBpbnZva2VkIGFzIGEgbWlsdGVyIGluIG15IHBvc3Rm
aXggc2V0dXAuDQo+IA0KPiBhIHBoaXNoIGp1c3Qgc251Y2sgYnkgLi4uDQo+IG9uY2Ugc3Vi
bWl0dGVkIHRvIEJheWVzIGFuZCByZS1zY2FubmVkLCBpdCAqaXMqIHB1c2hlZCBvdmVyIHRo
cmVzaGhvbGQuDQo+IA0KPiBpJ20gbG9va2luZyBhdCB3aHkgaXQgc251Y2sgYnkgaW4gdGhl
IGZpcnN0IHBsYWNlLg0KPiB0aGVyZSBfaXNfIGEgcGhpc2hpbmcgVVJMLCBkZWVwbHkgZW1i
ZWRkZWQ7IG15IGN1cnJlbnQgc2V0dXAgZmFpbHMgdG8gZmluZC9hY3Qtb24gaXQuDQo+IA0K
PiB0aGUgbWVzc2FnZSBzdHJ1Y3R1cmUgTUlNRSB0cmVlIGhhcyB0d28gcGFydHMsIG5vdGhp
bmcgc3VzcGljaW91cyBvbiB0aGUgc3VyZmFjZToNCj4gDQo+ICDCoCBtdWx0aXBhcnQvcmVs
YXRlZA0KPiAgwqAgfC0tIHRleHQvaHRtbA0KPiAgwqAgfC0tIGFwcGxpY2F0aW9uL29jdGV0
LXN0cmVhbcKgwqAgYmFzZTY0LCBmaWxlbmFtZT1ESExfU0hJUFBJTkdfTEVUVEVSLmh0bWwN
Cj4gDQo+IHRoZSBwaGlzaGluZyBVUkwgaXMgbm90IG9idmlvdXNseSBpbiB0aGF0IE1JTUUg
dHJlZS4NCj4gaXQncyBidXJpZWQgaW5zaWRlIHRoYXQgb2N0ZXQtc3RyZWFtIGF0dGFjaG1l
bnQgLS0gNCBkZWNvZGUgc3RlcHMgZGVlcC4NCj4gbXkgU0EgbWlzc2VkIGl0Lg0KPiANCj4g
bWFudWFsbHksIGkgY2FuIGdyYWIgaXQNCj4gDQo+ICDCoMKgwqDCoCgxKSBiYXNlNjQtZGVj
b2RlIHRoZSBhdHRhY2htZW50DQo+ICDCoMKgwqDCoMKgwqDCoCAtLT4gYW4gSFRNTCBkb2N1
bWVudA0KPiAgwqDCoMKgwqAoMikgcmVhZCBpdHMgPGVtYmVkIHNyYz0iZGF0YTouLi5wZGY7
YmFzZTY0LC4uLiI+DQo+ICDCoMKgwqDCoMKgwqDCoCAtLT4gZGF0YTogVVJJDQo+ICDCoMKg
wqDCoCgzKSBiYXNlNjQtZGVjb2RlIHRoYXQgZGF0YTogVVJJDQo+ICDCoMKgwqDCoMKgwqDC
oCAtLT4gYSBQREYNCj4gIMKgwqDCoMKgKDQpIHJlYWQgdGhlIFBERidzIC9VUkkgbGluayBh
bm5vdGF0aW9uDQo+ICDCoMKgwqDCoMKgwqDCoCAtLT4gdGhlIHBoaXNoaW5nIFVSTA0KPiAN
Cj4gaS5lLiwgdGhlIHBoaXNpbmcgVVJMIHNpdHMgZm91ciBsYXllcnMgZG93bjoNCj4gIMKg
wqDCoMKgTUlNRSBwYXJ0IC0tPiBiYXNlNjQgLS0+IEhUTUwgLS0+IGRhdGE6IFVSSSAtLT4g
YmFzZTY0IC0tPiBQREYgLS0+IC9VUkkgYW5ub3RhdGlvbi4NCj4gU0Egc2VlcyBvbmx5IHRo
YXQgZmlyc3QsIHNpbmdsZSBvcGFxdWUgYXR0YWNobWVudC4NCj4gaXQgbmV2ZXIgcGVyZm9y
bXMgdGhlIGZvdXIgaW4tcGF5bG9hZCBkZWNvZGVzLg0KPiANCj4gaG93IHRvIGNvbmZpZyBT
QSA0LjAueCB0byBmaW5kL2V4Y3RyYWN0IHRoYXQgImRlZXAiIFVSTD8NCj4gDQo+IGlpdWMs
IG5laXRoZXIgb3V0LW9mLXRoZS1ib3ggRXh0cmFjdFRleHQgbm9yIE9MRVZCTWFjcm8gYXJl
IHN1ZmZpY2llbnQ/DQo+IA0KPiBpcyBhIGN1c3RvbSwgbXVsdGktc3RlcCBFeHRyYWN0VGV4
dCBleHRyYWN0b3Igc2NyaXB0IG5lZWRlZD8gZS5nLiwgdGhhdDoNCj4gIMKgwqDCoMKgZGVj
b2RlcyB0aGUgb2N0ZXQtc3RyZWFtIEhUTUwNCj4gIMKgwqDCoMKgcHVsbHMgdGhlIGRhdGE6
YXBwbGljYXRpb24vcGRmO2Jhc2U2NCBibG9iDQo+ICDCoMKgwqDCoGJhc2U2NC1kZWNvZGVz
IGl0DQo+ICDCoMKgwqDCoGV4dHJhY3RzIHRoZSBQREYgL1VSSSBhbm5vdGF0aW9uDQo+ICDC
oMKgwqDCoGVtaXRzIHRoZSBVUkxzIGFzIGFjdGlvbmFibGUgcGxhaW4gdGV4dA0KPiA/DQo+
IA0KPiBvciBpcyB0aGVyZSBzb21ldGhpbmcgdGhhdCBhbHJlYWR5IGV4aXN0cz8NCj4gDQo+
IGlzIGNoYWluZWQvcmVjdXJzaXZlIGV4dHJhY3Rpb24gY29uZmlndXJhYmxlIGluIEV4dHJh
Y3RUZXh0LCBvciBvdGhlcj8NCj4gDQp5b3UgY2FuIHdyaXRlIGEgc2hlbGwgc2NyaXB0IHRo
YXQgZG9lcyB0aGF0DQoNCj4gZXZlbiBvbmNlIHlvdSByZWFjaCB0aGUgUERGLCBydW5uaW5n
IHBkZnRvdGV4dCB2aWEgRXh0cmFjdFRleHQgZG9lc24ndCBhcHBlYXIgdG8gZW1pdCAvVVJJ
IGxpbmsgYW5ub3RhdGlvbnMuDQo+IGl0IGNhbid0IHN1cmZhY2UgdGhlIFVSTC4NCj4gDQo+
IGkgdGhpbmsgcGRmdG9odG1sL211dG9vbCBjb3VsZCwgYnV0IHBkZnRvaHRtbCBlbWl0cyBI
VE1MLCB3aGljaCBFeHRyYWN0VGV4dCBkb2N1bWVudHMgYXMgdW5zdXBwb3J0ZWQgb3V0cHV0
LA0KPiANCm1heWJlIGBwZGZ0b2h0bWxgICsgYGx5bnggLWR1bXBgIG1pZ2h0IHdvcmsNCg0K
ICBDaGVlcnMNCiAgIEdpb3Zhbm5pDQoNCj4gIMKgwqDCoMKgQCBodHRwczovL3NwYW1hc3Nh
c3Npbi5hcGFjaGUub3JnL2Z1bGwvNC4wLngvZG9jL01haWxfU3BhbUFzc2Fzc2luX1BsdWdp
bl9FeHRyYWN0VGV4dC5odG1sDQo+IA0KPiAgwqDCoMKgwqDCoMKgwqAgIi4uLg0KPiAgwqDC
oMKgwqDCoMKgwqAgRXh0ZXJuYWwgdG9vbCBtdXN0IG91dHB1dCBwbGFpbiB0ZXh0LCBub3Qg
SFRNTCBvciBvdGhlciBub24tdGV4dHVhbCByZXN1bHQuDQo+ICDCoMKgwqDCoMKgwqDCoCAu
Li4iDQoNCg==

--------------IvZ5KEcltk3y0Lyi2DaEZ3Wg--

--------------qAXHIuS0mRCBBVb8NhXcvbCg
Content-Type: application/pgp-signature; name="OpenPGP_signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="OpenPGP_signature.asc"

-----BEGIN PGP SIGNATURE-----

wsF5BAABCAAjFiEEqg3TnG6R3qYMxl94+r7qCYlyWOUFAmprgpgFAwAAAAAACgkQ+r7qCYlyWOXw
SA/+PMd0ohyEdXCBxuGwXgbncoN5ZUang82ciumznO2oKGwc26eEFn7KkFvhgCzyHA/ibVc8Nnok
n6hHjqS9pMPcG5adef+Sl5NqJ64nDx1Ef7ARTp4kdXLCTtm+1DRZhihWdnTaXBZ6qJsCVTTo3y7T
OkrFxPnh+X/SqQBnQGupXP+Wo48HQi8gcCk+TiGSXa8O+9fImRxSB8fpYhvWgsY64GzaJPKJJ9HJ
zwcwFLBDPkjSSW1R0wYggYQRhCZG+YSaZgKCNP2OKuMY/2pqz/fZYy5LC7LUDWMChBuKgnYR1/PO
4v9QFJ5fbjYM5BdP58esPtwze9VN+vkwz3gT5Im95wO/klH+NHQ4GNOOvsEV195nAMnHA9OHYjvn
BzVHjPBObqbgqDZhL2BrInGF9AkrNQtQSWoWpmGcwJcakupRmkzbkWGZiNGefRkFULuc86S+4nnE
KxmaNVwPKowQp1vVh3zRM4iVdJcGw5gAW30J0m8hSqMPfuAdCfCsOjFSLndcdWjFZxATCz135vGj
jdLtw9HBpsGy55SJyjOMhBREW3DM90wH998Z7yQEZEnxUOhlxACFzAI5R1H5hWAj08y9aIAkBdFZ
DPnn54aHPVdtmhBtxg4QyodtNVK1EkF15gRSkLSELmuF9qR5pBQRzbtbWsXUOrM9OY93Ug2A77R8
M5I=
=b3Dj
-----END PGP SIGNATURE-----

--------------qAXHIuS0mRCBBVb8NhXcvbCg--