Static triage of email attachments: hashes, file types, and macro inspection

Work in isolation

Do attachment work in a dedicated analysis VM with no access to production networks and no shared folders, and never open files in the native application. Static triage reads the file’s structure without executing anything, which answers most questions safely.

Identify before you inspect

Extract attachments from the .eml, hash each, and check the true type with file, since extensions are easy to fake. Archives, disk images, HTML files, shortcut files, and Office documents with macros are the most common delivery formats.

python3 - <<'EOF'
import email, hashlib, pathlib
m = email.message_from_file(open('sample.eml'))
for p in m.walk():
    if p.get_filename():
        data = p.get_payload(decode=True)
        out = pathlib.Path('att') / p.get_filename(); out.parent.mkdir(exist_ok=True); out.write_bytes(data)
        print(hashlib.sha256(data).hexdigest(), out)
EOF
file att/*

Lab: inspect a benign macro document

In your analysis VM, create a harmless Word document containing a macro that only shows a message box, save it as .docm, and treat it as your sample. Run oleid to see risk indicators, then olevba to list the macro source and suspicious keywords. Compare with a clean .docx, which should show no VBA. This builds the reading skill without handling real malware.

python3 -m pip install --user oletools
oleid sample.docm
olevba --decode sample.docm | less
olevba clean.docx     # expect: No VBA macros found

When to escalate

If static triage shows auto-execution keywords such as AutoOpen or Document_Open, obfuscation, or download behavior, or the hash is known malicious, stop and escalate to your malware analysis team or an approved sandbox. Record the hash, type, and findings in the case so the gateway can block the file.

• Auto-execution keywords
• Heavy obfuscation or encoded strings
• Known-bad hash
• Unexpected file type for the context