Extracted

• • Target
    국세 고지서.pdf
  • Size 125KB
  • SHA256 1d01eab612da7d635e6b92395ead126e3e07b7987b3a38c8831e25cbcd5456b7
  • MD5 425e7f14bfef366725fb806c93a0e94e
  • SHA1 717bd6595a1fe3e708cabca7b27fee872d969cac
  • SHA512 f7b2b1b9f59930850f2eae5ef3bd260d037797efbca2584664f1a8a0a3d1d68ae5fbaed682ea40885c8e26fb91717cf4e89dc57c473cc47a1bf02c4e73597067
  • SSDEEP 3072:YCPMa+GMy/jHAmHbbwAPcFHqID/Pzgqfo/VYl:vPuGMuZbwpD/PzbfMVYl
  • TLSH
    T129C3E1A813348859E4596665FB00ADAE45DE30F9494F71963E3C85CE078AF23B070EFA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  adwarediscoveryspyware
  behavioral1behavioral2
• • Target
    암호.txt.lnk
  • Size 2KB
  • SHA256 0e8c6ad144d0538ffbc7938904c74ba2d528afac1a2fa9ce13330676ebd4071d
  • MD5 1b125ccda22e0b7842f66e4a5c825966
  • SHA1 cb1c7eea1c32bdd303be8f88b9a450a21c8c28b4
  • SHA512 46dbf3a4c8e8d57446c31e19cc28469ee15310524fc57bff7336916e36d7b65876eb2a4d25c1a74ac8fbfb0ffd9d61117b97f89b879e1dc32f80834829f9b673
  • TLSH
    T1354102164BF51325C2B7DB3B68FAA244A6327911EE038EDC42C052846C54604F976F7F
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  defense_evasionexecutionspywaretrojan

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral3behavioral4