What it means
The file has something out of the ordinary. It can be:
- a program or a script inside a compressed file, such as
invoice.pdf.exe; - a password-protected file, which this analysis cannot read inside;
- a compressed file that takes up an enormous amount of space when opened.
What the risk is
A program inside a compressed file runs when you open it. Attackers use the password so that the email antivirus cannot check the content. A file that expands too much can leave your computer without memory.
What to do
Do not open or unpack the file. If you expected it, confirm with the sender, through another channel, that they sent it and what it contains. Do not use a password that comes in the same message without that confirmation.
Sources
- MITRE ATT&CK: T1204.002, malicious file
- MITRE ATT&CK: T1027.013, encrypted or encoded file
- CWE-409: improper handling of highly compressed data
What it means
The file is a program or contains programs. The most common types are:
- a program that installs or runs;
- a file of instructions (a script);
- a shortcut;
- a disk image, which is a file that works like a virtual disk.
What the risk is
Opening it can run harmful programs on your computer. A shortcut can launch a hidden command. A disk image can carry programs that Windows does not watch in the same way.
What to do
Do not open the file. People and companies rarely send this type of file by email.
Sources
What it means
The file is a web page or an SVG image, and it carries more than text or drawing. It can be:
- a script, which are instructions that the browser runs when it is opened;
- a field to type a password, such as a fake sign-in page saved in a file;
- a script that builds a file in your browser and downloads it, a technique called “HTML smuggling”;
- in an SVG image, instructions that run when it is opened.
What the risk is
A page opened from a file can imitate the sign-in of a bank or of your email. What you type can reach the attacker. A script can create and download a program without going through the email filter. An SVG image with instructions runs them when it is opened in the browser.
What to do
Do not open the file. If you expected it, confirm with the sender, through another channel, that they sent it. Never type a password into a page that reached you as an attachment.
Sources
- MITRE ATT&CK: T1027.006, HTML smuggling
- MITRE ATT&CK: T1566.001, spearphishing attachment
- MDN: the SVG script element
What it means
The file is not what its name suggests. It can happen in three ways:
- the name says one type of file and the content is another;
- the name has two endings, such as
invoice.pdf.exe, and Windows can hide the last one; - the name includes an invisible character that reverses the order of the letters, so the real ending looks like another.
This analysis looks at the content of the file and not only at its name.
What the risk is
A program can pass as a document and run when it is opened. Attackers use this trick in email attachments.
What to do
Do not open the file. If you expected it, ask the sender, through another channel, what it is called and what type it is.
Sources
- MITRE ATT&CK: T1036.007, double file extension
- MITRE ATT&CK: T1036.002, right-to-left override
- MITRE ATT&CK: T1204.002, malicious file
What it means
The Office document carries instructions that can run when it is opened. One form is macros, which are small programs stored inside the document. Another is a DDE field, an old Office function able to launch a program on the computer.
What the risk is
A macro or a DDE field can install a harmful program on your computer. Office asks for permission before running them, and attackers ask for it with texts such as “Enable content to view the document”.
What to do
Do not click “Enable content” and do not agree to update links or fields. If you expected the document, confirm with the sender, through another channel, that it should have macros.
Sources
- Microsoft: macros from the Internet are blocked by default in Office
- MITRE ATT&CK: T1059.005, Visual Basic
- MITRE ATT&CK: T1559.002, dynamic data exchange
What it means
The Office document includes something that comes from outside. It can be:
- an embedded object, which is another file stored inside the document;
- a template that is downloaded from the internet or from a shared network folder when it is opened;
- an image or other content that is loaded from an external address.
What the risk is
An external template can bring macros that are downloaded when the document is opened. An embedded object can be a disguised program. An external address tells the attacker that you opened the document. If it points to a shared Windows folder, it can also send data from your sign-in.
What to do
Do not open the document. If you already opened it, do not enable the content and close it without saving. If you need its content, ask the sender to send it as a PDF.
Sources
- MITRE ATT&CK: T1221, template injection
- MITRE ATT&CK: T1187, forced authentication
- MITRE ATT&CK: T1204.002, malicious file
What it means
This analysis could not read all the content of the file. It may be damaged, too large or complex, or made to confuse review programs.
What the risk is
What this analysis could not read was not checked. The result may be incomplete.
What to do
Treat the file as unchecked. If you did not expect it, do not open it. If you did, confirm with the sender, through another channel, that they sent it.
Sources
What it means
The PDF carries something beyond displaying a document. It can be:
- JavaScript, which are instructions that the PDF reader runs when it is opened;
- an action that tries to launch a program on your computer;
- a file stored inside the PDF.
What the risk is
The instructions and the actions that launch programs can run something harmful on your computer. This is more likely if the PDF reader has unfixed flaws. A file stored inside can be a disguised program. A normal PDF rarely carries these things. Some electronic invoices do carry a data file.
What to do
Do not open the PDF if you did not expect it. If you did, confirm with the sender, through another channel, that they sent it. Keep your PDF reader up to date.
Sources
What it means
The RTF document carries an embedded object, which is another file or program stored inside the document.
What the risk is
Attackers use the objects of RTF documents to take advantage of flaws in Word and run a program on your computer. It can happen when the document is opened, without clicking anything else. A normal RTF document almost never carries objects.
What to do
Do not open the document. If you expected it, ask the sender to send it as a PDF. Keep Word and Windows up to date.
Sources
- MITRE ATT&CK: T1203, exploitation for client execution
- MITRE ATT&CK: T1566.001, spearphishing attachment
What it means
The file is larger than 25 MB. To avoid freezing your browser, this analysis does not read it.
What the risk is
There is no analysis of the content of the file.
What to do
Treat it as an unreviewed file. If you need it, open it only on a separate computer with no important data.
Sources
What it means
The address that replies go to, or the address that error notices go to, belongs to a site different from the sender’s.
What the risk is
If you reply, the reply goes to someone else. Legitimate bulk mailings also use another site for error notices.
What to do
Before replying, check which address your reply goes to.
Sources
What it means
The technical data of the email says whether the server that received it could check that it is authentic. Those checks are called SPF, DKIM and DMARC. A fail or a softfail means the sender’s site did not authorise that sending. A digital signature from another site means the signature does not belong to the sender.
What the risk is
An email that fails these checks can be forged. A pass does not prove that the email is legitimate.
Only the first Authentication-Results field was added by your own mail server. Anyone can write the others.
What to do
Take the result as one more hint. If in doubt, confirm the message through another channel.
If the technical data has no such field, the authenticity of the email cannot be read.
Sources
What it means
The times of the mail journey, which each server records in the Received field, do not add up:
- a step is earlier than the one before it;
- there is a long delay;
- the date of the message is far from the first step.
What the risk is
It can indicate a message that was held or forwarded. It also happens in legitimate mail with failures or queues.
What to do
Take it as a weak signal. Give it more weight if it appears together with others.
Sources
What it means
The address has an unusual form for a company site:
- numbers instead of the name of a site;
- an extra number after the name, such as
:8080; - an unencrypted connection, that is, without a padlock;
- many parts before the name of the site;
- a long name that looks random.
What the risk is
The sites of legitimate companies usually have their own name, an encrypted connection and a simple address. One of these forms proves nothing on its own.
What to do
If the message says it comes from a company, go in through the address you know and not through the link.
Sources
What it means
The site name looks like the name of a well-known brand or contains it, but the site does not belong to that brand. It does so in one of these ways:
- it changes a letter;
- it uses a digit that looks like a letter;
- it uses another address ending;
- it puts the brand at the start of the address;
- it puts the brand next to other words.
What the risk is
Whoever reads the message sees the brand name and assumes the site is theirs. The owner is shown by the site name, which is the last word before the ending, such as .com.
What to do
Check which name it is. Go in through the official address of the company.
This check uses a list of brands and can flag a legitimate site with a similar name.
Sources
What it means
The link goes to a service where anyone can publish pages, files or forms, such as a free site, online storage or a form. The site name belongs to the service and not to the company that signs the message.
What the risk is
A well-known name does not guarantee that the content is legitimate, because anyone can publish there. Attackers use these services to go unnoticed.
What to do
Confirm with the person who sent you the link that they sent it and why. Do not type passwords or personal data into a form you did not expect.
Sources
What it means
The link leads to the download of a file. By its name, it can be a program, a document with macros (automatic instructions inside the document) or a compressed file.
This analysis does not open the link, so it does not know which file the site delivers.
What the risk is
A downloaded program can install harmful software when it is opened. A document with macros can run instructions when you click “Enable content”. A compressed file can hide either of the two.
What to do
Do not download the file from the message. If you expected it, ask the sender for it through another channel.
Office blocks macros in files that come from the Internet. Do not remove that block on a file you do not know.
Sources
- MITRE ATT&CK: T1204.001, malicious link
- Microsoft: macros from the Internet are blocked by default in Office
What it means
The address includes an email address, sometimes written with special symbols.
What the risk is
The link is made for whoever receives it, because it carries their address. Legitimate bulk messages also do this, for example to unsubscribe or to confirm a subscription.
What to do
Do not sign in from that link. Go in through the official address of the site.
Sources
What it means
The site name includes letters from other alphabets, or mixes alphabets in one word, such as a Cyrillic “а” inside a word written in Latin letters. Browsers store those names with the prefix xn--.
What the risk is
Letters from different alphabets can look identical. So a name can look like a brand without being one. A name with xn-- can also be legitimate, for example if it has accented letters.
What to do
If you do not recognise the site, do not click the link. Type the address yourself.
Sources
What it means
The address contains another address written inside it, such as ?url= or ?redirect=. The first site sends the person on to the second.
What the risk is
The first site can be legitimate and still lead somewhere else. An attacker uses it so that the link looks like it belongs to a trusted site.
What to do
Read the second address: that is where the link goes. If you do not recognise it, do not click.
Sources
What it means
The ending of the address, such as .zip, .top or .click, is on a list of endings that are often used for abuse.
What the risk is
Many legitimate sites use those endings. Reputation reports, such as those from Spamhaus, point out some of them, such as .top. The list in this analysis is an estimate and not an official classification. On its own, the ending is a weak signal.
What to do
Give it more weight if it appears together with other signals.
Sources
What it means
The link does not open a web page. Some links run instructions directly and others open a program on your computer.
What the risk is
A link of this kind can show a fake page or run instructions without leaving the message. One of them, ms-msdt:, opens the Windows diagnostic tool. That tool had a serious flaw, called Follina, which attackers exploited.
What to do
Do not click the link. A legitimate message almost never uses this type of link.
Sources
What it means
A service shortens the link, so you cannot see where it leads.
What the risk is
A shortened link hides the destination site. The United States cybersecurity agency (CISA) lists it among the signs of message fraud.
What to do
Do not click the link. Ask the sender for the full address.
Sources
What it means
The text of the link shows one address and the link goes to another.
What the risk is
Whoever writes the message decides the text of the link and nobody checks it. Seeing a familiar address does not guarantee that the link goes there.
What to do
Do not click the link. If you want to visit that site, type the address into the browser yourself.
Sources
What it means
The address has a name before an at sign, such as paypal.com@site.example. What comes before the at sign is not the site. The real site is what comes after.
What the risk is
A familiar name at the start makes the link look as if it belongs to that company, even though it leads to another site.
What to do
Read the address from the at sign to the right. If that site is not the one you expect, do not click the link.
Sources
What it means
The link first goes through a mail protection service, such as SafeLinks or Proofpoint. This analysis reads the real address inside, without opening anything.
What the risk is
The address of the service is legitimate and says nothing about the destination. According to Microsoft, a link can be legitimate on delivery and harmful later.
What to do
Read the destination address and the signals for that destination.
Sources
What it means
The site name in the sender address looks like that of a well-known brand or mixes alphabets.
What the risk is
Anyone can write an address that looks like a company’s. A similar address does not prove that the message comes from it.
What to do
Do not reply or click links. Type the official address of the company yourself to get in touch.
Sources
What it means
The displayed name does not match the real address. It names a brand from another site, shows a different address or is a brand writing from a free mailbox.
What the risk is
The sender writes the visible name and nobody checks it.
What to do
Look at the full address, because the name can be anything. A company usually writes from its own site.
Sources
What it means
The message asks you to call a number that appears in the same message.
What the risk is
Whoever answers can pretend to be the company to ask for data or payments.
What to do
Do not call the number in the message. Look for the official phone number on your card, on an invoice or on the official site.
Sources
What it means
The message asks you to verify the account or to give a password, a verification code or card details.
What the risk is
With that data someone can enter your account or use your card. Companies do not usually ask for a password or a verification code by message.
What to do
Do not reply or type any data. Enter your account by typing the address yourself.
If you already gave data, change the password and tell your bank.
Sources
What it means
The message gives a password to open an attached file.
What the risk is
A password-protected file stops automatic analysis from seeing its content. MITRE describes attackers who use this technique to deliver fraud files.
What to do
Do not open the file. Confirm with the sender, through another channel, that they sent it and that it should carry a password.
Sources
What it means
The message asks for payment by a means such as gift cards, cryptocurrency, an urgent transfer or SINPE Móvil, or it mentions a pending payment.
What the risk is
These means of payment are usually hard to reverse.
What to do
Do not pay. Confirm the debt through an official channel.
If you already paid, tell your bank or whoever issued the payment straight away.
Sources
What it means
The text uses typical pressure phrases: haste, a threat, a prize, an authority, secrecy or a greeting that does not use your name.
What the risk is
These phrases aim to make you act before you think. Legitimate messages can also use them, so they are a weak signal and not proof.
What to do
Stop and verify through another channel. Call the official number of the company and not the one in the message.
Sources
What it means
The message or a page asks you to open a Windows window with the Windows and R keys (Win+R) or a terminal. Then it asks you to paste some text and run it. This technique is called ClickFix.
What the risk is
Text pasted this way runs with your permissions and goes around the defences of the browser and the mail. Microsoft documented this technique for installing programs that steal information.
What to do
Do not paste or run anything. Close the page.
If you already did, disconnect the computer from the Internet and change your passwords from another device.
Sources