<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: analyzing-malicious-attachments
description: >-
  Safely analyze email attachments for malicious content including macro-enabled
  documents, embedded executables, archive-based payloads, and polyglot files.
  Covers static analysis, sandbox detonation, and IOC extraction.
domain: cybersecurity
subdomain: phishing-defense
tags:
  - malware-analysis
  - email-attachments
  - sandbox
  - oletools
  - static-analysis
  - macro-analysis
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1566.001"]
---

# Analyzing Malicious Attachments

## Overview

Malicious email attachments remain a primary initial access vector (MITRE T1566.001).
This skill covers safe handling, static analysis using oletools and YARA, dynamic
sandbox detonation, and IOC extraction from Office documents, PDFs, archives, and
disk image files. All analysis should occur in isolated environments.

## Prerequisites

| Requirement | Install |
|---|---|
| Python 3.10+ | Agent tooling runtime |
| oletools | `pip install oletools` |
| YARA | `pip install yara-python` |
| `file` | File type identification (built-in) |
| `xxd` / `hexdump` | Binary inspection |
| Sandbox (optional) | Any.Run, Joe Sandbox, or local Cuckoo |

## Key Concepts

### Dangerous Attachment Types

| Extension | Risk | Technique |
|---|---|---|
| `.docm`, `.xlsm` | Critical | VBA macro execution |
| `.doc`, `.xls` | High | Legacy format with embedded macros |
| `.iso`, `.img` | High | Disk image bypasses Mark-of-the-Web |
| `.lnk` | High | Shortcut with embedded command |
| `.html`, `.htm` | High | HTML smuggling payload |
| `.zip`, `.7z`, `.rar` | Medium | Password-protected archive hiding payload |
| `.pdf` | Medium | JavaScript or embedded objects |
| `.one` | Medium | OneNote with embedded scripts |
| `.wsf`, `.js`, `.vbs` | Critical | Direct script execution |

### Analysis Workflow

```
Attachment Received
├── 1. Safe Handling (isolated VM, no network)
├── 2. File Type Identification (magic bytes, not extension)
├── 3. Static Analysis
│   ├── Hash generation (MD5, SHA256)
│   ├── String extraction
│   ├── Macro extraction (oletools)
│   ├── YARA rule matching
│   └── Metadata inspection
├── 4. Dynamic Analysis (sandbox)
│   ├── Behavior monitoring
│   ├── Network capture
│   ├── Process tree
│   └── File system changes
└── 5. IOC Extraction
    ├── URLs, IPs, domains
    ├── File hashes
    ├── Registry modifications
    └── C2 infrastructure
```

## Workflow

### 1. Safe Handling

```bash
# NEVER open attachments on production systems
# Use an isolated VM or analysis sandbox

# Identify file type by magic bytes (not extension)
file suspicious_attachment.docx
xxd suspicious_attachment.docx | head -5

# Generate hashes for threat intel lookup
sha256sum suspicious_attachment.docx
md5sum suspicious_attachment.docx

# Check hash against VirusTotal (API)
# curl -s "https://www.virustotal.com/api/v3/files/<sha256>" \
#   -H "x-apikey: ${VT_API_KEY}"
```

### 2. Static Analysis — Office Documents

```bash
# Extract and analyze VBA macros
olevba suspicious.docm

# Check for OLE objects
oleid suspicious.docm

# Detect DDE (Dynamic Data Exchange) attacks
msodde suspicious.docx

# Extract embedded objects
oleobj suspicious.docm

# Automated analysis
node agent.js analyze suspicious.docm
```

### 3. Static Analysis — Other Formats

```bash
# PDF analysis
pdfid suspicious.pdf
pdf-parser --search javascript suspicious.pdf

# Archive inspection (without extraction)
7z l suspicious.zip
unzip -l suspicious.zip

# LNK file analysis
python3 -c "import pylnk3; print(pylnk3.parse('suspicious.lnk'))"

# HTML smuggling detection
grep -iE 'atob|Uint8Array|Blob|createObjectURL' suspicious.html
```

### 4. IOC Extraction

```bash
# Extract strings
strings -n 8 suspicious_attachment > /tmp/strings.txt

# Find URLs in strings
grep -oP 'https?://[^\s"]+' /tmp/strings.txt

# Find IPs
grep -oP '\b(?:\d{1,3}\.){3}\d{1,3}\b' /tmp/strings.txt

# YARA scan
yara -r /path/to/rules/ suspicious_attachment

# Automated IOC extraction
node agent.js extract-iocs suspicious.docm
```

## Detection

```yaml
title: Malicious Attachments Detection
id: 19f88f6e-8474-437a-9d5f-f7ef09f9eb61
status: experimental
description: Detects suspicious activity related to analyzing malicious attachments techniques in phishing defense context
logsource:
  category: email
  service: o365
detection:
  selection:
    Subject: "*urgent*"
  condition: selection
level: high
tags:
  - attack.t1566.001
  - attack.initial_access
falsepositives:
  - Security awareness training platform sending simulated phishing emails
```

## Verification

| Check | Method |
|---|---|
| File type confirmed | `file` command matches expected type |
| Hashes generated | SHA256 and MD5 computed |
| VT lookup done | Hash checked against VirusTotal |
| Macros extracted | `olevba` run on Office documents |
| IOCs collected | URLs, IPs, domains extracted |
| YARA rules matched | Scanned against detection ruleset |
| Sandbox report | Dynamic analysis completed if warranted |

## References

- [oletools Documentation](https://github.com/decalage2/oletools)
- [YARA Documentation](https://yara.readthedocs.io/)
- [VirusTotal API](https://developers.virustotal.com/reference)
- [MITRE T1566.001 — Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
- [Any.Run Sandbox](https://any.run/)
