Extracted

• • Target
    국세 고지서.pdf
  • Size 125KB
  • SHA256 1d01eab612da7d635e6b92395ead126e3e07b7987b3a38c8831e25cbcd5456b7
  • MD5 425e7f14bfef366725fb806c93a0e94e
  • SHA1 717bd6595a1fe3e708cabca7b27fee872d969cac
  • SHA512 f7b2b1b9f59930850f2eae5ef3bd260d037797efbca2584664f1a8a0a3d1d68ae5fbaed682ea40885c8e26fb91717cf4e89dc57c473cc47a1bf02c4e73597067
  • SSDEEP 3072:YCPMa+GMy/jHAmHbbwAPcFHqID/Pzgqfo/VYl:vPuGMuZbwpD/PzbfMVYl
  • TLSH
    T129C3E1A813348859E4596665FB00ADAE45DE30F9494F71963E3C85CE078AF23B070EFA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  adwarediscoveryspyware
  behavioral1behavioral2
• • Target
    암호.txt.lnk
  • Size 2KB
  • SHA256 a3bced610582a0f680080da1278a51487ae4187fa86f5bd24e2653a29ceb575f
  • MD5 fc92fdf2eda16b2cdb41477ea869c1e5
  • SHA1 79981df0d10a85d6001620726aa14cf7cf231974
  • SHA512 38bd498ad678c1794801f986fa8e8bcd287137440c35f92b5a9e2285445d138e23e6da4cf69db19767956ed1ab108d05660e83efb3eec2f36c37f18db0af1223
  • TLSH
    T1D15141121BE6136AE373877667FAB2096222F830AB038AEC41C112441E50604F876F6F
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  executiondefense_evasionspywaretrojan

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral3behavioral4