Email Attachment Analysis

---

1. Save the attachment to computer
   • Via email client
   • or with emldump.py
     • part of DidierStevensSuite of tools
     • Check streams: python3 emldump.py <email>
       • select the stream to extract
     • python3 emldump.py -s <stream number> -d <email> > <file-name>
2. Collect file hash
   • e.g., sha256sum
   • or use eioc.py script to extract email indicators and hashes
   • in PowerShell:
     • Get-FileHash -Algorithm <algorithm> .\<file-name>
3. Check file hash reputation
   • Check on VirusTotal
   • Check on Cisco Talos
4. Document findings throughout
   • Use screenshots and PDF reports
   • Links may not always be available