Phishing Analysis Tools
Learn the tools used to aid an analyst to investigate suspicious emails.
What Information Should We Collect?
Pertinent information an analyst is to collect from the email header:
Sender email address
Sender IP address
Reverse lookup of the sender IP address
Email subject line
Recipient email address (this information might be in the CC/BCC field)
Reply-to email address (if any)
Date/time
Afterward, draw attention to the email body and attachment(s) (if any).
2.16.107.24:443Artifacts an analyst needs to collect from the email body:
Any URL links (if an URL shortener service was used, obtain the real URL link)
The name of the attachment
The hash value of the attachment (hash type MD5 or SHA256, preferably the latter)
Warning: Be careful not to click on any links or attachments in the email accidentally.
Email Header Analysis
Some information to collect can be obtained visually from an email or web client while other information can only be obtained via the email header.
It is good to have multiple resources to refer to as each tool might reveal information that another tool may not reveal.
Below are tools that can help analyze information about the sender's IP address:
Email Body Analysis
Tip: Note the root domain for the extracted URLs to perform an analysis on the root domain as well.
After extracting the URLs, next check the reputation of the URLs and root domain using any of the tools mentioned. If the email has an attachment, obtain the attachment safely.
How can you manually get the location of a hyperlink?
Copy link location
Malware Sandbox
Malware analysis skills are not needed as Defenders to dissect and reverse engineer malicious attachments as online tools and services (malware sandboxes) allow malicious file uploads for provided analysis to under the malware.
Some online malware sandboxes:
PhishTool
Phishing Case 1
Scenario: As a Level 1 SOC Analyst, several suspicious emails have been forwarded from other coworkers. Obtain details from each email to implement the appropriate rules to prevent colleagues from receiving additional spam/phishing emails.
What brand was this email tailored to impersonate?
Netflix
What is the From email address?
JGQ47wazXe1xYVBrkeDg-JOg7ODDQwWdR@JOg7ODDQwWdR-yVkCaBkTNp.gogolecloud.com
What is the originating IP? Defang the IP address.
209[.]85[.]167[.]226
From what you can gather, what do you think will be a domain of interest? Defang the domain.
etekno[.]xyz
What is the shortened URL? Defang the URL.
hxxps[://]t[.]co/yuxfZm8KPg?amp=1
Phishing Case 2
Scenario: As a Level 1 SOC Analyst, several suspicious emails have been forwarded from other coworkers. Obtain details from each email to implement the appropriate rules to prevent colleagues from receiving additional spam/phishing emails.
What does AnyRun classify this email as?
What is the name of the PDF file?
Payment-updateid.pdf
What is the SHA 256 hash for the PDF file?
What two IP addresses are classified as malicious? Defang the IP addresses. (answer: IP_ADDR,IP_ADDR)
What Windows process was flagged as Potentially Bad Traffic?
Phishing Case 3
Scenario: As a Level 1 SOC Analyst, several suspicious emails have been forwarded from other coworkers. Obtain details from each email to implement the appropriate rules to prevent colleagues from receiving additional spam/phishing emails.
What is this analysis classified as?
What is the name of the Excel file?
CBJ200620039539.xlsx
What is the SHA 256 hash for the file?
What domains are listed as malicious? Defang the URLs & submit answers in alphabetical order. (answer: URL1,URL2,URL3)
What IP addresses are listed as malicious? Defang the IP addresses & submit answers from lowest to highest. (answer: IP1,IP2,IP3)
What vulnerability does this malicious attachment attempt to exploit?
Conclusion
Other tools not covered:
Last updated
