Subj : .pls?
To   : Daniel Path
From : August Abolins
Date : Tue Mar 02 2021 05:49 pm

Hello Daniel Path!

DP> i'm wondering what's inside the pls...

It turns out to be nothing.  The "trick" was to make it look
like there was a 59Byte attachment, when indeed there was
nothing!

The real vector to deliver the payload was this line:

X-PHP-Script: crystal.net.in/mat/metoo.php for 20.52.179.36
                                ^^^^^^^^^


--
 ../|ug

--- OpenXP 5.0.49
* Origin:  (2:221/1.58)