Welcome everyone to another video of Expert Malware analysis and reverse engineer course. In this video 1
we are going to analyze email headers which is a part of our delivery phase. To begin the analysis, 2
Let's head to our windows VM and here are a bunch of malicious email examples that I want to share 3
with you all today. 4
So the first one is .msg format and the next two are .eml 5
They both are standard e-mail formats. 6
I'll be using Microsoft Outlook in order to view these three emails. To how Microsoft Outlook on your 7
machine 8
You should have Microsoft Office package installed. 9
You can find more details about it on Microsoft's Web site. 10
If you don't want to use Microsoft there are other options as well. 11
For example you can use open email clients like Thunderbird. So let us look at the first e-mail here. 12
So if if I launch it in Outlook this is what I see. 13
I see that the e-mail comes from account payable. 14
It has been sent to this particular person and the message says that "please find enclosed statement 15
of account and due balance as requested." 16
So there is an attachment as well which say that current_statement_of_account.xls 17
So if you remember from our previous slide we said that to analyze an email the first thing that you 18
should look at would be the sender and the sender's email address. The sender 19
Here is account_payable and the e-mail address is registered with one yahoo.com. 20
So this definitely seems suspicious it doesn't seem like something that it's coming from your own accounts 21
department. Plus it has a suspicious attachment as well, an excel file. 22
So outlook has a pretty cool feature of previewing your Office formats like XLS or DOC 23
or PPT. 24
So we can basically click on this attachment and we can look at a preview of the file. 25
It's not really executing the file but it's just loading it within the outlook environment. 26
So it seems like this is an excel sheet. 27
It has three sheets and it's basically saying that this document was created with an earlier version 28
of Windows macro is required to view the document and it asks you to enable the macros. 29
Now this is a kind of technique that the attackers have been using to enable macros in your office environment. 30
We'll be understanding this a bit more in detail. 31
Once we start analyzing these particular malicious files. Let us come back to our email again. 32
So if you remember we also talked about analyzing e-mail headers. 33
So in Outlook you can get the e-mail headers by simply clicking on this small "down" arrow here which gives 34
you all the message options. 35
So once you click here you'll see the internet headers you can just copy the entire thing. 36
Open it in a notepad 37
paste it here. 38
So here we can see the complete e-mail header. 39
Let us quickly parse through it and understand it. So the first line says that received from friterm.com 40
com So this is basically the recipient organization and that's its particular e-mail exchange server 41
where the email was received then it has some details about time stamps and if you go further down you'll 42
have more information about where that e-mail got received. 43
And there are some information about the hosting of that particular e-mail. 44
And you see the e-mail has been sent to this particular e-mail address and it has been sent from this 45
user an e-mail. 46
That's the information about when the e-mail was sent. 47
And then there is the hash digest of the e-mail. Scrolling down you'll see some exchange information 48
which are pretty much the exchange headers that are appended by the company's e-mail exchange service. 49
So this is how we located the e-mail headers. 50
And this is more like the raw information that gets added to a given e-mail when it bounces to 51
multiple exchanges or when it gets resolved into which location where you could get delivered to. 52
at our second example here. 53
So if you look at the second e-mail again it has been sent by someone named Maria. 54
That's the e-mail address. 55
And there is an attachment called inquiry_rfq.doc 56
So this time there is a doc file which is an attachment and it's a pretty long e-mail. 57
There are a lot of things in this e-mail where they're talking about some business dealings and all 58
those things. 59
So these are some of the ways that the attackers implement to create a very unique e-mail so that it 60
doesn't look like that if it was just randomly sent. It tries to incorporate as much originality 61
as possible. 62
Let us look at the e-mail headers here as well. 63
So again we have pretty much similar information where that e-mail came from, whom it got delivered to 64
to. 65
And there are MIME version information 66
Then there is the e-mail degest 67
And if you come down there are some interesting information in this case. 68
If you see there is a User-Agent which tells us about the particular e-mail client that was used, then 69
there is an Anti-abuse information as well. 70
So if your exchange was able to detect that this e-mail doesn't seem to be coming from where it claims, 71
then it basically adds an anti abuse header into the e-mail. 72
This basically keeps track of any abusive e-mails that the e-mail client things got delivered into your 73
network. 74
So it seems that the primary hostname of the abused e-mail is this and the original domain from where 75
This email has been sent is firstampumps.com 76
So this is the information that the e-mail exchange service has appended to this e-mail. 77
If you come all the way to the bottom it says that the sender did not meet the SPF rules. 78
That's why this e-mail was classified as spam. 79
So it's important to understand what exactly SPF means here.