Extracted

• • Target
    국세 고지서.pdf
  • Size 125KB
  • SHA256 1d01eab612da7d635e6b92395ead126e3e07b7987b3a38c8831e25cbcd5456b7
  • MD5 425e7f14bfef366725fb806c93a0e94e
  • SHA1 717bd6595a1fe3e708cabca7b27fee872d969cac
  • SHA512 f7b2b1b9f59930850f2eae5ef3bd260d037797efbca2584664f1a8a0a3d1d68ae5fbaed682ea40885c8e26fb91717cf4e89dc57c473cc47a1bf02c4e73597067
  • SSDEEP 3072:YCPMa+GMy/jHAmHbbwAPcFHqID/Pzgqfo/VYl:vPuGMuZbwpD/PzbfMVYl
  • TLSH
    T129C3E1A813348859E4596665FB00ADAE45DE30F9494F71963E3C85CE078AF23B070EFA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  adwarediscoveryspyware
  behavioral1behavioral2
• • Target
    암호.txt.lnk
  • Size 2KB
  • SHA256 c04baa5b89c84edce0024b0071db80888a4d13b0439e8fcc728aab17d66bfaec
  • MD5 88bd1ecd48231df7e15eb49c18087f2b
  • SHA1 b774554a6207dcaa31d03a85943552ad21e1b723
  • SHA512 9d9004bf0de7a569d9ffaca2d532b4b9fc9b21e2eec68b6fa41285c20a60670951ffbe3dbdcf140b521d9e5cee772ec07a077ff420911137d9be173c5ec62562
  • TLSH
    T1605131161BE51369E373877667FAB245A622F820EA038AEC01C112442D50604F876F7F
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  defense_evasionexecutionransomwarespywaretrojan

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Deobfuscate/Decode Files or Information

    Payload decoded via CertUtil.

    defense_evasion
  behavioral3behavioral4