Extracted

• • Target
    암호.txt.lnk
  • Size 2KB
  • SHA256 0e8c6ad144d0538ffbc7938904c74ba2d528afac1a2fa9ce13330676ebd4071d
  • MD5 1b125ccda22e0b7842f66e4a5c825966
  • SHA1 cb1c7eea1c32bdd303be8f88b9a450a21c8c28b4
  • SHA512 46dbf3a4c8e8d57446c31e19cc28469ee15310524fc57bff7336916e36d7b65876eb2a4d25c1a74ac8fbfb0ffd9d61117b97f89b879e1dc32f80834829f9b673
  • TLSH
    T1354102164BF51325C2B7DB3B68FAA244A6327911EE038EDC42C052846C54604F976F7F
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  executiondefense_evasionspywaretrojan

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2
• • Target
    지급명령 통지서.pdf
  • Size 865KB
  • SHA256 a0cf2ec2a350f84ccb41a5a22c1f3aee16d3bbd4088b5a7961a0d450ed5e55cf
  • MD5 88f30f325caba8351450dec8d5966396
  • SHA1 38467c450c60d50b512e6d490bd9655dbb635747
  • SHA512 f925cfc0c055324fe7f0233da086c92088e01e2be580f36f8308bd1c19a754048db1ceae842258631a459e68be98857295ddf8af4d30e1f67ca6092ac4870efc
  • SSDEEP 12288:GhAoY/woHYrJR/qIGOOYQIMMmmkEdQESjb+MYkZjdspd/Bhojqg+vcWTwhQBHW:G+nzcJp1cYQIT9Sjb+M27ZhvPE1hQJW
  • TLSH
    T1DF15D0F893259890D0C10664BF2D769B81CBA0F1454BF56B6FA8C1DB0A90FD5B094FFA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  adwarediscoveryspyware
  behavioral3behavioral4