TryHackMe · 2026-07-01 · 3 min read
Phishing Emails 5
TryHackMe phishing analysis room focused on investigating an email sample through headers, sender artifacts, SPF and DMARC checks, attachment hashing, and VirusTotal.
CTF Room: Phishing Emails 5
- Link to room
- Difficulty: Easy
- Category: Phishing, Email Analysis, Headers, Threat Intelligence
- OS: Linux
1. Brief
A sales executive at Greenholt PLC reported a suspicious email from a known customer. The message had several phishing indicators: a generic greeting, an unexpected money transfer request, and an unsolicited attachment.
The goal was to inspect the email, extract artifacts, validate the sender infrastructure, and assess the attachment.
2. Lab Setup
After starting the TryHackMe lab machine, I opened the provided challenge.eml file in Thunderbird.
For header-level checks, I also opened the .eml file in a text editor so I could inspect the raw message source.
3. Email Triage
What is the Transfer Reference Number listed in the email's Subject line?
The transfer reference number was visible in the Thunderbird subject line as the TRN.
Answer
09674321What is the display name of the sender?
The display name was visible in Thunderbird.
Answer
Mr. James JacksonWhat is the sender's email address?
I opened the .eml file in a text editor and inspected the real sender address in the message source.
Answer
[email protected]What email address will receive a reply to this email?
The reply-to address did not match the real sender domain, which was one of the key signs that the email should not be trusted.
Answer
[email protected]4. Header Analysis
What is the originating IP address of this email?
In the message source, I reviewed the Received headers and found the originating IP associated with the mutawamarine.com domain.
Answer
192.119.71.157Who is the owner of the originating IP?
I searched the IP address in a WHOIS lookup. The owner returned for the IP was HostPapa.
Answer
HostPapa5. Domain Authentication
What is the full SPF record for this domain?
I checked the SPF record for the return-path domain with MXToolbox.
SPF Record
v=spf1 include:spf.protection.outlook.com -allAnswer
v=spf1 include:spf.protection.outlook.com -allWhat is the complete DMARC record for this domain?
Using the same lookup workflow, I checked the DMARC policy for the return-path domain.
DMARC Record
v=DMARC1; p=quarantine; fo=1Answer
v=DMARC1; p=quarantine; fo=16. Attachment Analysis
What is the file name of the attachment found in the email?
The attachment name was visible in Thunderbird.
Answer
SWT_#09674321____PDF__.CABUsing the sha256sum command, what is the SHA256 hash of the file?
I downloaded the attachment into the lab VM and generated its SHA256 hash.
Command
sha256sum SWT_#09674321____PDF__.CABOutput
SWT_#09674321____PDF__.CABAnswer
What is the attachment's file size in KB?
I searched the SHA256 hash in VirusTotal and checked the file details.
VirusTotal
https://www.virustotal.com/gui/home/searchAnswer
400.26 KBWhat is the actual file type of the attachment?
VirusTotal identified the real file type in the details tab.
Answer
RAR7. Summary
This email showed multiple phishing indicators: a suspicious reply-to mismatch, an unexpected transfer request, and an attachment whose extension did not clearly reflect its actual archive type.
Inspecting the raw headers, validating SPF and DMARC records, hashing the attachment, and checking the hash in VirusTotal gave enough evidence to treat the message as malicious.