Carefully Checking Mail Attachment for Viruses — Tutorial
August 21th, 2018
Today I got an e-mail from Claudia Schärer. I do not know this person and the e-mail sender looks suspicious. However — she is making me aware of an open invoice in German language. My mother tongue is Swiss German.
“Please find the invoice in this e-mail attached”
I often do IT security awareness campaigns with the clients of Compass Security and thus, I am happy to describe how I did carefully check the e-mail attachment for viruses.
Important Notice
Please make sure you are not double-clicking the suspicious looking attachment in your Outlook or other mail program. Just copying the file from your prefered mail tool to your Desktop without opening the file is secure and recommended, as it also triggers your local anti-virus tool.
Step 1: Local Check
Please right-click the suspicious file on your desktop and let your local anti-virus tool checking the file. If your anti-virus tool has the latest updates applied, you are good and the virus will be detected. But not in my case (and video see at the very end of this tutorial) — as the local anti-virus was not giving any alerts.
Step 2: Remote Check
I have chosen to upload the suspicious file into a great site called “VirusTotal”. This page runs almost any available anti-virus scanner against your uploaded file. Needless to say you should not upload confidential files — but in my case having the invoice checked has a higher priority to me than the risk the people at VirusTotal gain insighs from my uploaded files.
Results
With the steps taken carefully checking the Outlook MS word file, I came to the conclusion the file looks dangerous and I will delete the copy on my desktop and from within my e-mail inbox.
YouTube Video
If you like to see my carefully checking, please watch the YouTube video below.
Thank you for Reading
If you made your reading until here, I would like to thank you for your attention and hope this will help more people understanding and learning how a mail attachment could be carefully checked.
Regards, Ivan Bütler
Founder of Compass Security & Hacking-Lab
ivan.buetler@compass-security.com
