Extracted

• • Target
    7월 신고 납부기한 통지서.pdf.lnk
  • Size 2KB
  • SHA256 c3fa18c8c652cea42215e8fc201c31ec3c03160e40b6ac587c59f67db7ec770d
  • MD5 aa8caf4d834bca0be995bebad8d810e6
  • SHA1 fcecd98bb9ee7106db638bacfb19321a9e847f7f
  • SHA512 c409ea2e46241214a49e9df1d5098f97196448b555e7bb4ef1aff76fbb9d8329a5803da73f470250bb2df6ae38177cb2ed3a42497df4c5509d27ec4dc83d11aa
  • TLSH
    T1F45110122EF602A9E373DBB257FBB6156537F964AB06099C40C146001D61618F876FBF
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  adwarediscoveryexecutionpersistencespywarestealercollectionupx

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2