Phishing Analysis Fundamentals

Prompts and answers

• Email dates back to what time frame?
  1970s
• What port is classified as Secure Transport for SMTP?
  465
• What port is classified as Secure Transport for IMAP?
  993
• What port is classified as Secure Transport for POP3?
  995
• What email header is the same as "Reply-to"?
  Return-Path
• Once you find the email sender's IP address, where can you retrieve more information about the IP?
  http://www.arin.net
• In the above screenshots, what is the URI of the blocked image?
  https://i.imgur.com/LSWOtDI.png
• In the above screenshots, what is the name of the PDF attachment?
  Payment-updateid.pdf
• In the attached virtual machine, view the information in email2.txt and reconstruct the PDF using the base64 data. What is the text within the PDF?
  THM{BENIGN_PDF_ATTACHMENT}
• What trusted entity is this email masquerading as?
  Home Depot
• What is the sender's email?
  support@teckbe.com
• What is the subject line?
  Order Placed : Your Order ID OD2321657089291 Placed Successfully
• What is the URL link for - CLICK HERE? (Enter the defanged URL)
  hxxp[://]t[.]teckbe[.]com/p/?j3=EOowFcEwFHl6EOAyFcoUFV=TVEchwFHlUFOo6lVTTDcATE7oUE7AUET==
• What is BEC?
  Business Email Compromise