Phishing Emails 3

Prompts and answers

• How can you manually get the location of a hyperlink?
  Copy Link Location
• Look at the Strings output. What is the name of the EXE file?
  454326_PDF.exe
• What brand was this email tailored to impersonate?
  netflix
• ![[Pasted image 20221014132552.png]]
  N e t f l i x<JGQ47wazXe1xYVBrkeDg-JOg7ODDQwWdR@JOg7ODDQwWdR-yVkCaBkTNp.gogolecloud.com
• ![[Pasted image 20221014132329.png]]
  209[.]85[.]167[.]226
• What is the shortened URL? Defang the URL.
  etekno[.]xyz
• CyberChef can help you with this.
  hxxps[://]t[.]co/yuxfZm8KPg?amp
• *hxxps[://]t[.]co/yuxfZm8KPg?amp*
  *using phishtool*
• What does AnyRun classify this email as?
  Suspicious activity
• What is the name of the PDF file?
  Payment-updateid.pdf
• What is the SHA 256 hash for the PDF file?
  CC6F1A04B10BCB168AEEC8D870B97BD7C20FC161E8310B5BCE1AF8ED420E2C24
• ![[Pasted image 20221014135455.png]]
  2[.]16[.]107[.]24,2[.]16[.]107[.]83
• What Windows process was flagged as Potentially Bad Traffic?
  svchost.exe
• What is this analysis classified as?
  Malicious activity
• What is the name of the Excel file?
  CBJ200620039539.xlsx
• What is the SHA 256 hash for the file?
  5F94A66E0CE78D17AFC2DD27FC17B44B3FFC13AC5F42D3AD6A5DCFB36715F3EB
• What domains are listed as malicious? Defang the URLs & submit answers in alphabetical order. (answer: URL1,URL2,URL3)
  findresults[.]site,biz9holdings[.]com,ww38[.]findresults[.]site
• What IP addresses are listed as malicious? Defang the IP addresses & submit answers from lowest to highest. (answer: IP1,IP2,IP3)
  103[.]224[.]182[.]251,204[.]11[.]56[.]48,75[.]2[.]11[.]242
• What vulnerability does this malicious attachment attempt to exploit?
  CVE-2017-11882