Which attachment is the dropper

Four files were pulled from a phishing campaign. Use file, strings, and a YARA rule that checks the MZ header to find the Windows dropper and the URL it fetches.

Terminal mission
Intermediate
4 objectives
0 of 4 solved

Briefing

The mail gateway quarantined four attachments from the same campaign. They are in /srv/quarantine with neutral names.

Extensions lie, headers do not. Windows executables start with the bytes MZ, which YARA reads as uint16(0) == 0x5A4D. Checking the header first stops a rule from firing on text files that merely mention a URL.

analyst@malware-ws

malware-ws · YARA triage

Type help for the command list and objectives for your tasks. Everything runs in this browser.

analyst@malware-ws:~$

Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.