I received a pretty blatantly spammy email to my Gmail account. I'm not really sure how it made it through the spam filters, since it has all of the telltale signs. The FROM field is spoofed as firstname.lastname@example.org, but the headers reveal the sender's IP as 18.104.22.168... which points back to an ISP in Kazakhstan.
Anyway, attached to the email is a supposed HTML file. My first hunch was that it was probably one of the following:
- A nasty executable file masquerading as a simple HTML file, or
- An actual HTML file meant to be opened in a browser in a phishing attack
(edit: Or one of the others mentioned by @Adnan)
My guess is that it really is an HTML file, since Gmail claims the attachment is only 1K in size.
I know I should probably just mark this as spam and get on with my life, but my curiosity is getting the best of me... I really want to know what's in that attachment. Is there a safe way to go about downloading it to a sandboxed location and inspecting the contents? I'm at the beginning of a career shift into the security field, and I would love to pick apart this real world example of something potentially nasty and see how it ticks.
I'm thinking a LiveCD or a VM would be a safe environment... I would prefer to do it in a clean, un-networked environment, but in any case, I'll still be logging into my Gmail account to download the thing.
Anyway, I wasn't originally planning on running the suspicious file... I mostly wanted to see the source code. Now I'm tempted to set up a little something like @Adnan recommends and give it a go.