CustomFunction to Modify Subject based on message

[Roger Meier]

Hi their,

I wan't to add a customscript which modifies the subject based on
content in the email.

The reason for this are two points of some new spam/fake mails which are
going around on our
customers.

the first one are mails which look like they come from a contact of one
of our customers, but in
the body is a url to a maleware site. most of the url's aren't currently
in the phishing list or on
other url blacklists. But all of this mails have one part which had
always the same structure.

On some clients it looks like:
From: a.wellknown-customer at domain.com <unknown at somedomain.de>

On the message header their is the first part not visible, because its
UTF-8 mime encoded, and looks like:

=?UTF-8?B?ZnJlZHkud29sZkB3b2xmLWVsZWt0cm8uY2g=?= <unknown at somedomain.de>

I wan't now to implement a custom function for each message which look
if this is a mail of this format,
and if yes, then decode the first part and compare it with the second
part if both are email addresses.
If they are not the same i wan't to modify the message for add some
stuff to the subject, modify the from
mail part and/or the spam score.

My first try as to use the config paramters "Scanned Modify Subject"
together with "Scanned Subject Text",
but when i add a custom script to "Scanned Subject Text" i can modify
the subject with text i wan't but i
don't receive any message content with:

 my($message) = @_;

Another part is to write some algorithm to detect mails like:
https://www.govcert.admin.ch/blog/28/the-rise-of-dridex-and-the-role-of-esps

when they are new and not already known by phishing and maleware lists.

Greetings
Roger Meier