Links can be extracted manually, either directly from an HTML formatted email or by sifting through the raw email header.

Example of obtaining a link manually from an email by right-clicking the link and choosing Copy Link Location.

Auto method to get links:

• URL Extractor: https://www.convertcsv.com/url-extractor.htm

• You may also use CyberChef to extract URLs with the Extract URLs recipe.

- Tip: It's important to note the root domain for the extracted URLs. You will need to perform an analysis on the root domain as well.

Check hash reputation of attachments in emails:

After you have obtained the attachment, you can then get its hash. You can check the file's reputation with the hash to see if it's a known malicious document.

• VirusTotal: https://www.virustotal.com/gui/

• Talos File Reputation: https://talosintelligence.com/talos_file_reputation

• Another tool/company worth mentioning is Reversing Labs, which also has a file reputation service.