Phishing Analysis Fundamentals

• Email dates back to what time frame?

1970s

• What port is classified as Secure Transport for SMTP?

465

• What port is classified as Secure Transport for IMAP?

993

• What port is classified as Secure Transport for POP3?

995

• What email header is the same as "Reply-to"?

Return-Path

• Once you find the email sender's IP address, where can you retrieve more information about the IP?

http://www.arin.net

• In the above screenshots, what is the URI of the blocked image?

https://i.imgur.com/LSWOtDI.png

• In the above screenshots, what is the name of the PDF attachment?

Payment-updateid.pdf

• In the attached virtual machine, view the information in email2.txt and reconstruct the PDF using the base64 data. What is the text within the PDF?

THM{BENIGN_PDF_ATTACHMENT}

• What trusted entity is this email masquerading as?

Home Depot

• What is the sender's email?

support@teckbe.com

• What is the subject line? 

Order Placed : Your Order ID OD2321657089291 Placed Successfully

• What is the URL link for - CLICK HERE? (Enter the defanged URL)

hxxp[://]t[.]teckbe[.]com/p/?j3=EOowFcEwFHl6EOAyFcoUFV=TVEchwFHlUFOo6lVTTDcATE7oUE7AUET==