An automated python tool designed to analyze the raw email artifacts (eml files) to identify phishing intent and threat vectors. The application parses metadata, inspects IP Addresses, Domains, attachments using the VirusTotal threat intelligence API, and leverages a local Large Language Model (LLM) Ollama to perform email forensics and generate an analysis report.
🔎 Table of Content
Step 1 & 2: Users upload a raw .eml file through the Streamlit-based frontend, which parses the message into different data.
Step 3: The backend queries the VirusTotal API to retrieve static reputation data for all extracted artifacts, including domains, URLs, IP addresses, and file hashes.
Step 4: The backend orchestrates a request to the local Ollama engine, utilizing the Llama 3.1 LLM model to perform a context-based linguistic analysis of the email's tone, urgency, and the use of social engineering.
Step 5: The application correlates the data from VirusTotal and the prediction results from the AI model to generate a comprehensive, exportable Threat Analysis Report.
- numpy 2.5.1
- openai 2.44.0
- pandas 3.0.3
- python-dotenv 1.2.2
- streamlit 1.59.1
- vt-py 0.22.0
- Llama 3.1
I tested the application with a real phishing email from the PhishStrike Lab on CyberDefenders
Select and upload a suspect .eml file.
The file was successfully uploaded.
You can view the extracted email contents: subject, sender, attachment and hash value, email body.
Click the "Analyze Email Now" button and wait for the forensics audit under 2 minutes.
After the analysis is finished, VirusTotal Verdict and AI Prediction result will be generated.
VirusTotal provides static threat intelligence for sender domains, URLs, IP addresses, and file hashes.
The AI Prediction result provided a context-based analysis of the email. It correlated the VirusTotal's detection with the email's linguistic characteristics such as urgency, authority, tone and the use of social engineering tactics to deliver a comprehensive threat verdict.
A comprehensive threat analysis report can also be exported with a structured format.
- AI Verdict and confidence level
- VirusTotal Intel Detection Logs
- Executive AI Summary
- Detailed Forensics Analysis
I tested the appliction with a normal email. Although the domain of the sender was classified as clean, the AI model did not eliminate the possibility of phishing based on the languages and the tone used in the email.