xlAutoOpen
Overview
overview
10Static
static
1APT37/2023...de.rar
windows7-x64
3APT37/2023...de.rar
windows10-2004-x64
320230302_Guide.chm
windows7-x64
1020230302_Guide.chm
windows10-2004-x64
10APT37/2023...rt.xll
windows7-x64
10APT37/2023...rt.xll
windows10-2004-x64
1APT37/Document.rar
windows7-x64
3APT37/Document.rar
windows10-2004-x64
3Document.rar
windows7-x64
3Document.rar
windows10-2004-x64
3Password.chm
windows7-x64
10Password.chm
windows10-2004-x64
10APT37/HealthDoc.rar
windows7-x64
3APT37/HealthDoc.rar
windows10-2004-x64
32020_normal_ko.hwp
windows7-x64
32020_normal_ko.hwp
windows10-2004-x64
3Password.chm
windows7-x64
10Password.chm
windows10-2004-x64
10APT37/Payment.rar
windows7-x64
3APT37/Payment.rar
windows10-2004-x64
3Password.chm
windows7-x64
10Password.chm
windows10-2004-x64
10Payment Document.html
windows7-x64
1Payment Document.html
windows10-2004-x64
1APT37/Transaction.rar
windows7-x64
3APT37/Transaction.rar
windows10-2004-x64
3Transaction.chm
windows7-x64
10Transaction.chm
windows10-2004-x64
10APT37/귄�...��.rar
windows7-x64
3APT37/귄�...��.rar
windows10-2004-x64
3귄느 인...��.rar
windows7-x64
3귄느 인...��.rar
windows10-2004-x64
3Static task
static1
Behavioral task
behavioral1
Sample
APT37/20230302_Guide.rar
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
APT37/20230302_Guide.rar
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
20230302_Guide.chm
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
20230302_Guide.chm
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
APT37/20230315_SejeongSupport.xll
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
APT37/20230315_SejeongSupport.xll
Resource
win10v2004-20230221-en
Behavioral task
behavioral7
Sample
APT37/Document.rar
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
APT37/Document.rar
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
Document.rar
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
Document.rar
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
Password.chm
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
Password.chm
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
APT37/HealthDoc.rar
Resource
win7-20230220-en
Behavioral task
behavioral14
Sample
APT37/HealthDoc.rar
Resource
win10v2004-20230220-en
Behavioral task
behavioral15
Sample
2020_normal_ko.hwp
Resource
win7-20230220-en
Behavioral task
behavioral16
Sample
2020_normal_ko.hwp
Resource
win10v2004-20230220-en
Behavioral task
behavioral17
Sample
Password.chm
Resource
win7-20230220-en
Behavioral task
behavioral18
Sample
Password.chm
Resource
win10v2004-20230220-en
Behavioral task
behavioral19
Sample
APT37/Payment.rar
Resource
win7-20230220-en
Behavioral task
behavioral20
Sample
APT37/Payment.rar
Resource
win10v2004-20230220-en
Behavioral task
behavioral21
Sample
Password.chm
Resource
win7-20230220-en
Behavioral task
behavioral22
Sample
Password.chm
Resource
win10v2004-20230220-en
Behavioral task
behavioral23
Sample
Payment Document.html
Resource
win7-20230220-en
Behavioral task
behavioral24
Sample
Payment Document.html
Resource
win10v2004-20230220-en
Behavioral task
behavioral25
Sample
APT37/Transaction.rar
Resource
win7-20230220-en
Behavioral task
behavioral26
Sample
APT37/Transaction.rar
Resource
win10v2004-20230221-en
Behavioral task
behavioral27
Sample
Transaction.chm
Resource
win7-20230220-en
Behavioral task
behavioral28
Sample
Transaction.chm
Resource
win10v2004-20230220-en
Behavioral task
behavioral29
Sample
APT37/귄느 인적사항.rar
Resource
win7-20230220-en
Behavioral task
behavioral30
Sample
APT37/귄느 인적사항.rar
Resource
win10v2004-20230220-en
Behavioral task
behavioral31
Sample
귄느 인적사항.rar
Resource
win7-20230220-en
Behavioral task
behavioral32
Sample
귄느 인적사항.rar
Resource
win10v2004-20230220-en
General
-
Target
APT37.7z
-
Size
4.6MB
-
MD5
111a2f2efb1f1b1d6b9b70dbf0c55d09
-
SHA1
e33db553dd111a2a5247c2488e1ca94533673709
-
SHA256
d4b3d2e79f21c973f919cd0e7ed1885eefae88dfa922781b8ceef81622cf7d85
-
SHA512
3022402aede7e70b23b4cbc5a406f5e13001c9917fb5bbaa554631eb053c9606d80b5db44bd842880ebd4506fc76e249519919168d5f05c17605f6691dec8224
-
SSDEEP
98304:P5C0TsGFRYvkhtK+uj5W9H4Rwx5qhrX3gJ9Rzp9oEPg6rYLc:xlTsGzwkzQj5WSRKqhDgtzplvcQ
Malware Config
Signatures
Files
-
APT37.7z.7z
Password: infected
-
APT37/20230302_Guide.rar.rar
Password: infected
-
20230302_Guide.chm.chm
-
APT37/20230315_SejeongSupport.xll.xll windows x86
c83843b915994094f09af3c6a97c5bb8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SizeofResource
WriteFile
GetModuleHandleA
FreeResource
CreateFileA
LockResource
CloseHandle
LoadResource
FindResourceW
WinExec
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
vcruntime140
__telemetry_main_invoke_trigger
_except_handler4_common
__std_type_info_destroy_list
__telemetry_main_return_trigger
memset
api-ms-win-crt-runtime-l1-1-0
_cexit
_seh_filter_dll
_initterm_e
_initterm
_crt_atexit
_execute_onexit_table
exit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
api-ms-win-crt-string-l1-1-0
strcat_s
strcpy_s
Exports
Exports
Sections
.text Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 904B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 20B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 344B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
APT37/Document.rar.rar
Password: infected
-
Document.rar.rar
Password: infected
-
Password.chm.chm
-
APT37/HealthDoc.rar.rar
Password: infected
-
2020_normal_ko.hwp
-
Password.chm.chm
-
APT37/Payment.rar.rar
Password: infected
-
Password.chm.chm
-
Payment Document.html.html
-
APT37/Transaction.rar.rar
Password: infected
-
Transaction.chm.chm
-
APT37/귄느 인적사항.rar.rar
Password: infected
-
귄느 인적사항.rar.rar
Password: infected
-
압축파일 비밀번호.chm.chm
-
APT37/문의사항.zip.zip
-
APT37/미국비자.rar.rar