Identifying Malicious Emails
Question
A user receives a potentially malicious email that contains spelling errors and a PDF document.
A security analyst reviews the email and decides to download the attachment to a Linux sandbox for review.
Which of the following commands would MOST likely indicate if the email is malicious?
Answers
Explanations
Click on the arrows to vote for the correct answer
A. B. C. D.A.
The most appropriate command for indicating if the email attachment is malicious would be B. file ~/Desktop/file.pdf.
The first step in analyzing a potentially malicious email attachment is to determine if it is actually a legitimate file type. Attackers often try to disguise malicious files by changing the extension or embedding malicious code within a file. The file command in Linux is useful for identifying the file type by analyzing the file header and provides information about the file's content.
The sha256sum command (option A) is used to generate a checksum hash for the file, which can be used to verify the file's integrity. This command can be helpful in determining if a file has been tampered with, but it does not provide information about the file's content or whether it is malicious.
The strings command (option C) is used to display the printable characters in a file. The command is often used for analyzing binary files, such as executables, to identify embedded strings and other data. The grep "<script" option in this command searches for the presence of JavaScript code within the PDF file. However, this option may not be effective in detecting other types of malicious code or file formats.
The cat command (option D) is used to display the contents of a file. The grep -i .exe option in this command searches for the presence of an executable file within the PDF file. However, this option may not be effective in detecting other types of malicious code or file formats.
In conclusion, option B. file ~/Desktop/file.pdf would be the most appropriate command for analyzing the email attachment because it can help determine the file type and whether it is legitimate or malicious.
