URL & Attachment Analysis — From Click to Indicator

Clicking a phishing URL is the most common way breaches start. Your job as an analyst is to examine URLs and attachments without clicking — extracting every indicator you need from the structure, metadata, and behavior without triggering the payload on a production machine.

URL Analysis

URL Anatomy

Every URL has components worth examining independently:

https://secure-update.m1crosoft.com.evil.net/auth/login?token=abc&redirect=aHR0cHM6Ly9ldmls
  │        │                        │           │              │          │
  scheme   subdomain              real TLD     path          param    b64-encoded next hop
           (looks like            (evil.net,
            microsoft)            not microsoft.com)

Common URL tricks:

Step 1: Deconstruct the URL (Without Clicking)

Read the domain right-to-left. The actual registered domain is the part immediately before the TLD.

secure-update.m1crosoft.com.evil.net
                                ^^^
                            TLD = .net
              registered domain = evil.net
           subdomains = secure-update.m1crosoft.com

The URL displays “microsoft” in the middle of the hostname, but the actual domain is evil.net.

Check the redirect chain:

# Follow redirects without loading content (HEAD requests only)
curl -I -L --max-redirs 20 'https://bit.ly/3xK9mP'

# Alternative: use the '+' trick for bit.ly
# https://bit.ly/3xK9mP+ shows a preview page

Decode base64-encoded query parameters:

echo "aHR0cHM6Ly9ldmlsLmNvbS9zdGVhbA==" | base64 -d
# → https://evil.com/steal

Step 2: WHOIS & Domain Age

New domains are high-suspicion. Phishing campaigns register domains days before use. Established legitimate services use domains registered years ago.

WHOIS record for evil-corp-update.net:
  Creation Date: 2024-08-10   ← 4 days before phishing campaign
  Registrar: Namesilo LLC
  Registrant: REDACTED (privacy-protected)
  Name Servers: ns1.parkingcrew.net  ← parking service, not real mail server

Indicators:

• Domain age < 30 days: high suspicion
• Privacy-protected WHOIS with recent registration: very high suspicion
• Name servers pointing to known bulletproof hosting, parking services, or VPS providers

Step 3: URL Sandbox Submission

Submit unknown URLs to sandbox before manual investigation:

Attachment Analysis

Step 1: Hash + VirusTotal

Before anything else, compute the file hash and check reputation:

# Hash a suspicious attachment
sha256sum suspicious.pdf
md5sum suspicious.pdf

# Or on macOS:
shasum -a 256 suspicious.pdf

# Then: submit to VirusTotal
# https://www.virustotal.com/gui/file/<sha256>

If VT returns detections → you have the malware family and behavior report. No need to sandbox.

Step 2: Magic Bytes — File Type vs. Extension

A file named invoice.pdf may not be a PDF. Check the actual file type:

file suspicious.pdf
# If output is: "MS-DOS executable" or "PE32 executable" → it's an EXE disguised as PDF

Common magic bytes (file signatures):

An email attachment with extension .pdf whose first two bytes are 4D 5A is a Windows executable. This is a common evasion technique.

Step 3: Office Document Analysis

Office documents are the most common phishing attachment type. Analysis options:

Without opening the file:

# Install oletools: pip install oletools

# List VBA macros and their content
olevba suspicious.docm

# If olevba shows: "AutoOpen" or "Document_Open" → macro auto-executes on open
# Look for: Shell(), CreateObject("WScript.Shell"), PowerShell keywords, StrConv/Base64

# Check for external links (DDE, template injection)
oleobj suspicious.docx  # extracts embedded OLE objects

Key macro indicators:

• AutoOpen or Document_Open → auto-execution without user interaction
• Shell() or WScript.Shell → OS command execution
• CreateObject("MSXML2.XMLHTTP") → HTTP download
• Long encoded strings (Base64, Chr() concatenation) → obfuscated payload

Template injection (no macros needed):

A .docx file is a ZIP containing XML. A malicious .docx can reference an external template URL that delivers the macro:

unzip -p suspicious.docx word/_rels/settings.xml.rels
# Look for: Target="http://evil.com/template.dotm"
# If found: the doc downloads and executes a remote macro-bearing template

Step 4: PDF Analysis

PDFs can contain JavaScript and embedded executables:

# Install: pip install pdfid pdf-parser

# Quick scan for risky features
pdfid suspicious.pdf
# Look for: /JS (JavaScript), /AA (auto-action), /Launch (launches process), /EmbeddedFile