Refer to the exhibit. Which element in this email is an indicator of attack?

The correct answer is C. attachment: "Card-Refund". Attachments in emails--especially with file extensions like .xlsm--are high-risk indicators when analyzing suspicious or phishing emails. Malicious actors often use macro-enabled Excel files (.xlsm) as a payload delivery mechanism for malware or other exploits. These…

Submitted by yuki_2020· Mar 6, 2026Forensics Techniques

Question

Exhibit

Options

AIP Address: 202.142.155.218
Bcontent-Type: multipart/mixed
Cattachment: "Card-Refund"
Dsubject: "Service Credit Card"

How the community answered

(49 responses)

A
2% (1)
B
2% (1)
C
90% (44)
D
6% (3)

Explanation

Attachments in emails--especially with file extensions like .xlsm--are high-risk indicators when analyzing suspicious or phishing emails. Malicious actors often use macro-enabled Excel files (.xlsm) as a payload delivery mechanism for malware or other exploits. These attachments are typically disguised as legitimate content such as refunds or invoices to trick the recipient into opening them. The presence of "Card_Refund_18_6913.xlsm" is a strong Indicator of Compromise (IoC), as .xlsm files can contain VBA macros capable of executing malicious code. This matches exactly with examples provided in the study material discussing how macro-based payloads are delivered and recognized.

Topics

#indicator of attack#email analysis#phishing detection#malicious attachments

Community Discussion

No community discussion yet for this question.

Full 300-215 Practice