Some observations and assumptions:

• Lines in the sample file end on CR (0x0D). Maybe you need to take care of that?
• For larger files computing MD5 incrementally might yield better performance than appending the file line by line to $content... That's what I thought until I did a short speed comparison. There was no significant difference for files up to 150MB here (after caching). Anyway, I would recommend to use the incremental MD5 computation for memory efficiency when treating large files.
• Since you have your own idea on how a digest is constructed, I would recommend to put this procedure into a separate module and harness it with a lot of tests. Reproducible digest computation offers a lot of pitfalls - keep them in known territory.

FWIW, here's something that works for your sample:

use strict;
use warnings;
use MD5;

my $in_attachment = 0;  # 0: mail; 1: attachm. header 2: attachm. cont
+ent
my $subject_seen  = 0;
my $md5           = new MD5;

# read until (Subject: ...)
while ( <DATA> ) {
  $subject_seen = 1 if /^Subject:\s/;
  next if not $subject_seen;
  ## When in doubt:
  #  die "didn't expect that [$.]: $_"
  #      if /^Content-Type:\s/i and not /application\/x-gzip/i
  $in_attachment = 1,              next  if  not $in_attachment and /^
+Content-Type: /;
  $in_attachment = ++$in_attachment % 3  if      $in_attachment and /^
+\s*$/;
  next if $in_attachment; # skip MD5 computation while in attachment
  $md5->add($_);          # incremental calculation
}

# MD5 of "Subject: .... " .. "CREATED_ON=..."
# MD5: a138724a0766a9b685ccc60ce9c85de3
print "MD5: ", $md5->hexdigest(),"\n";


__DATA__
Message-Id: <200707020704.l6274QG9029301@smtp2.corp.abb.com>
Subject: System Alert from XUZ of sts WARNING
Mime-Version: 1.0

dhcp 0
ip 172.19.22.255
netmask 255.255.255.255
gateway 192.168.1.1
HOSTNAME=ABB
dns.enable on
ab_to_abb[0]
ab_to_local[0]
plex_to_abb[1]
plex_to_local[1]
ab_to_abb[1]
Content-Type: application/x-gzip
Content-Disposition: attachment; filename="sys_logs.gz"
Content-Transfer-Encoding: base64

H4sIAHujiEYCA+1dW2/bOhJ+D5DwIN9aAukqqirrcUukJM2pznIpUjScxZYLApZlhJtZMm
+rS9Ls27znSElx4ouiWXasRMVhW1J5MfhcDgcfhlJO3979I8cR1fkL5QkqR2nJPUnLrnIQ
+vJ7
FhBCiaJYqm5p8EOWzZ2dpsppnIWOnbpjYqel6qqlGJZm8urk1vMDN4amko/JbSArH289lV
+zb
CUmus5SMo7tQkqTd3R34f3B0eEGCyLEDkrjxLdSKwqI+/5KJzyumfng1VnO9tkZSodQ1Yn
+C
cUImUew+H7dGork+UQP7pFPy7fMl+eesLxZUl5I0mk7dsXVnxyHI8C8rx7TIu/lO03d/JX
+lR
0dDK6qDVdmitAj299T3JDoJjP7xJPoMurYPzo8ujg/1jaGIO2fdkahEoSAIsydS+u/N1//
+jSIk6QJSmMzRSsM4RvHJvUvnFDEuHgvfcmH3AEq+KYTBy0u90dsttsum44rlo9M1t90Gr
+1StOU

CREATED_ON=Mon Jul  2 00:04:28 2007
[download]

---

---

Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!

Titles consisting of a single word are discouraged, and in most cases are disallowed outright.

Read Where should I post X? if you're not absolutely sure you're posting in the right place.

Please read these before you post! —

• How do I compose an effective node title?
• How do I post a question effectively?
• Markup in the Monastery

Posts may use any of the Perl Monks Approved HTML tags:

a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr

You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)

	For:		Use:
	&		&
	<		&lt;
	>		&gt;
	[		&#91;
	]		&#93;

Link using PerlMonks shortcuts! What shortcuts can I use for linking?

See Writeup Formatting Tips and other pages linked from there for more info.