Phishing Analysis Tools | TryHackMe — Write-Up/Walkthrough

Dhruv Tripathi

5 min read

·

Sep 9, 2026

--

Listen

Share

Press enter or click to view image in full size

Room Link: Phishing Analysis Tools
Original Github Writeup: Phishing Analysis Tools

Task 1

I am ready to learn about phishing analysis!

• Answer: No answer needed

Task 2

I understand the key indicators to look for when analyzing an email.

• Answer: No answer needed

Task 3

According to the Messageheader analysis shown in this task, what is the SPF result for the email?

• We can see the SPF result in green

Press enter or click to view image in full size

• Answer: pass

Task 4

What command can you use in a Linux environment to obtain the SHA256 hash value of an attachment?

• Answer: sha256sum

Task 5

I understand the available sandbox environments for safely analyzing files and URLs.

• Answer: No answer needed

Task 6

According to the VirusTotal analysis from above, which vendor categorized the URLs as phishing?

• There was only one vendor who categorized it as phishing

Press enter or click to view image in full size

• Answer: SafeToOpen

Task 7

What reputable brand is this email tailored to impersonate?

• We can see this email is tailored to impersonate one of most famous video streaming services

Press enter or click to view image in full size

• Answer: Netflix

Based on the email headers, who is the intended recipient of this message?

• The recipient is right below the display name Netflix

Press enter or click to view image in full size

• Answer: redacted@yahoo.com

In Thunderbird mail use View → Message Source. What is the Received: from IP address?

• The originating IP is listed at the top

Press enter or click to view image in full size

• Answer: 10.197.37.234

Check out the Return-Path field in the message source. What would you consider a domain of interest based on this field?

• Looking at the Return-Path field, the domain is after the @ symbol

Press enter or click to view image in full size

• Answer: etekno.xyz

Investigate the UPDATE ACCOUNT NOW button. What is the shortened URL?

• I first hovered over the URL and right-clicked and selected Copy Link Location

Press enter or click to view image in full size

• I pasted it into Notepad and we can see the shortened URL

Press enter or click to view image in full size

• Answer: https://t.co/yuxfZm8KPg?amp=1

Task 8

How does ANYRUN classify this suspected phishing email?

• In the right hand corner, we can see what ANY.RUN classifies this phishing email as

Press enter or click to view image in full size

• Answer: Suspicious activity

What is the name of the PDF attachment?

• The name is listed right below the classification

Press enter or click to view image in full size

• Answer: Payment-updateid.pdf

Investigate the email attachment. What is the SHA256 hash of the PDF file?

• I clicked on Payment-updateid.pdf and we can see below in the third row what the SHA256 hash is of this file

Press enter or click to view image in full size

• Answer: cc6f1a04b10bcb168aeec8d870b97bd7c20fc161e8310b5bce1af8ed420e2c24

Check out the ANYRUN text report on the phishing email. Which IP address associated with the process AcroRd32.exe is flagged as malicious?

• We can open up the Text report by clicking on Results

Press enter or click to view image in full size

• I scrolled down to the Connections section and there is only one IP address associated with AcroRd32.exe that is flagged as malicious

Press enter or click to view image in full size

• Answer: 2.16.107.24

Continue investigating the text report. Which Windows process is classed as Potentially Bad Traffic?

• I scrolled down to Threats and there is only one process that is marked as Potentially Bad Traffic

Press enter or click to view image in full size

• Answer: svchost.exe

Task 9

How does ANYRUN classify the .xlsx attachment?

• Like the previous task, the classification is on the top right hand corner

Press enter or click to view image in full size

• Answer: Malicious activity

What is the file name of the Excel attachment?

• The name is listed right below the classification

Press enter or click to view image in full size

• Answer: CBJ200620039539.xlsx

Investigate the Excel attachment. What is the SHA256 hash value?

• We can see the SHA256 hash value below

Press enter or click to view image in full size

• Answer: 5f94a66e0ce78d17afc2dd27fc17b44b3ffc13ac5f42d3ad6a5dcfb36715f3eb

Check out the ANYRUN text report. What IP address is associated with the malicious domain biz9holdings.com?

• Scrolling down to the DNS requests section, we can see the IP address associated with the domain biz9holdings.com

Press enter or click to view image in full size

• Answer: 204.11.56.48

Which other domain is classified as malicious?

• We can see there is one other domain below biz9holdings.com that is also flagged as malicious

Press enter or click to view image in full size

• Answer: findresults.site

What vulnerability does this malicious attachment attempt to exploit?

• The vulnerability is located here

Press enter or click to view image in full size

• Answer: CVE-2017-11882

Thanks for reading! Hope you found this helpful. Happy learning! :)