AhnLab ASEC blog (asec.ahnlab.com)
Word Documents Disguised as Normal MS Office URLs Being Distributed · 2022-11-17
excerpt: Recently, there has been a case of malware disguised as a Word document being distributed through certain paths (e.g. KakaoTalk group chats). The ASEC analysis team has discovered during our additional monitoring process that the URL used in the fake Word document is becoming very cleverly disguised to closely resemble the normal URL, and we wish […] | attribution sentence: [File Detection] – Downloader/DOC.External (2022.11.01.01) – Downloader/DOC.Kimsuky (2022.11.05.00, 2022.11.06.00, 2022.11.10.01 and others) – Downloader/XML.Generic (2022.11.11.03) MD5 d698fccf14f670595442155395f42642 URL http[:]//offices[.]word-template[.]net/ http[:]//schemas[.]openxmlformat[.]org/ https[:]//ms-office[.]services/ https[:]//ms-offices[.]com/ Gain access to related IOCs and detai | target sentence: <?xml version="1.0" encoding="UTF-8" standalone="yes" <Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"> <Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/attachedTemplate" Target="hxxp://schemas.openxmlformat[.]org/of