Page 207 - Cyber Defense eMagazine August 2024

Static analysis of a phishing email in ANY.RUN using the Rspamd spam-filtering module

1. Investigating Spam and Phishing Emails: Sandboxes offer email previews, display
metadata, and list Indicators of Compromise (IOCs), enabling you to examine email content
and origin details without opening the email itself. Moreover, sandboxes can effectively handle
malicious archive attachments, such as ZIP, tar.gz, .bz2, and RAR files, which are often used
to evade basic detection.

While static analysis is a powerful technique, it is important to note that it is not always sufficient on its
own. This is why sandboxes should also offer interactivity to manually engage with files and links when
needed.

4. Interactivity and Flexibility

Interactivity is a key feature of advanced malware sandboxes that enables security teams to gain a more
complete understanding of the behavior and capabilities of suspicious software.

Cyber Defense eMagazine – August 2024 Edition 207
Copyright © 2024, Cyber Defense Magazine. All rights reserved worldwide.