Subj : .pls?
To   : Daniel Path
From : August Abolins
Date : Tue Mar 02 2021 05:49 pm

Hello Daniel Path!

 DP> i'm wondering what's inside the pls...

It turns out to be nothing.  The "trick" was to make it look  
like there was a 59Byte attachment, when indeed there was  
nothing!

The real vector to deliver the payload was this line:

X-PHP-Script: crystal.net.in/mat/metoo.php for 20.52.179.36
                                 ^^^^^^^^^


--
  ../|ug

--- OpenXP 5.0.49
 * Origin:  (2:221/1.58)

.