Lesson 2.18: Malicious attachments
Attachments are the other half of phishing. How attackers disguise programs (double extensions, icons), and the containers they use to get past filters: macro-enabled Office files, disk images with shortcut files inside, and HTML files that assemble a download inside the browser (HTML smuggling). In the lab you examine four attachments from this week's reports without opening them: identify their real types, look for macro and script indicators with strings, check their hashes against the threat-intelligence feed, and quarantine them.
17 min
You will learn to
- Recognise double extensions
- Identify real file types with file
- Find macro, script and smuggling indicators with strings and grep
- Match hashes against an intelligence feed
- Quarantine samples safely
Key terms
- Double extension
- A file name with a harmless-looking extension before the real one.
- Macro
- A program embedded in an Office document (VBA) that can run commands when the document opens.
- Disk image and LNK
- ISO/IMG files open like a folder in Windows; inside, a shortcut (.lnk) can run any command with a document icon.
- HTML smuggling
- An HTML attachment or page that builds a malicious file inside the browser from embedded data, so network filters never see the file.
- Threat-intelligence feed
- A regularly updated list of indicators (hashes, domains, IPs) from known attacks.
← Getting help on the command line · All lessons · Subnets and CIDR: dividing a network →