Word Documents Disguised as Normal MS Office URLs Being Distributed
Contents
Recently, there has been a case of malware disguised as a Word document being distributed through certain paths (e.g. KakaoTalk group chats).
The ASEC analysis team has discovered during our additional monitoring process that the URL used in the fake Word document is becoming very cleverly disguised to closely resemble the normal URL, and we wish to advise caution on the part of users.
The currently identified filenames of the malicious Word documents are as follows.
The real names of Koreans found in the filenames have been removed (○○○), but it is important to note that they were names of specialists in the field of diplomatic security, and the filenames were related to North Korea, China, surveys, or diplomatic security.
- International Legal Review of the Northern Limit Line (NLL) Issue and.docx
- Implications and Prospects of Xi Jinping’s Third Term.docx
- National Security Organizations.docx
- NK, Unprecedented Offensive and Provocative Survey.docx
- ○○○, RIES_Issue Insight_Vol.33, Xi Jinping’s …
The ASEC analysis team has discovered during our additional monitoring process that the URL used in the fake Word document is becoming very cleverly disguised to closely resemble the normal URL, and we wish to advise caution on the part of users.
The currently identified filenames of the malicious Word documents are as follows.
The real names of Koreans found in the filenames have been removed (○○○), but it is important to note that they were names of specialists in the field of diplomatic security, and the filenames were related to North Korea, China, surveys, or diplomatic security.
- International Legal Review of the Northern Limit Line (NLL) Issue and.docx
- Implications and Prospects of Xi Jinping’s Third Term.docx
- National Security Organizations.docx
- NK, Unprecedented Offensive and Provocative Survey.docx
- ○○○, RIES_Issue Insight_Vol.33, Xi Jinping’s …
IoC
d698fccf14f670595442155395f42642
http://ms-office.services
http://ms-offices.com
http://offices.word-template.net
http://offices.word-template.net/office/template?view=GYIJ
http://openxmlformat.org
http://schemas.openxmlformat.org
http://schemas.openxmlformat.org/officeDocument/2006/relationships/o/word
http://schemas.openxmlformat.org/officeDocument/2006/relationships/o/word?officeid=NPW5D
http://schemas.openxmlformats.org/officeDocument/2006/relationships/attachedTemplate
http://schemas.openxmlformats.org/package/2006/relationships
https://ms-office.services
https://ms-office.services/templates-for-word/download?id=79B9
https://ms-office.services/templates-for-word/download?id=EFHO
https://ms-office.services/templates-for-word/download?id=I5I2
https://ms-office.services/templates-for-word/download?id=V2BX
https://ms-offices.com
https://ms-offices.com/templates-for-word/download?id=AL03
https://ms-offices.com/templates-for-word/download?id=DTF
https://ms-offices.com/templates-for-word/download?id=ZQ9H
http://ms-office.services
http://ms-offices.com
http://offices.word-template.net
http://offices.word-template.net/office/template?view=GYIJ
http://openxmlformat.org
http://schemas.openxmlformat.org
http://schemas.openxmlformat.org/officeDocument/2006/relationships/o/word
http://schemas.openxmlformat.org/officeDocument/2006/relationships/o/word?officeid=NPW5D
http://schemas.openxmlformats.org/officeDocument/2006/relationships/attachedTemplate
http://schemas.openxmlformats.org/package/2006/relationships
https://ms-office.services
https://ms-office.services/templates-for-word/download?id=79B9
https://ms-office.services/templates-for-word/download?id=EFHO
https://ms-office.services/templates-for-word/download?id=I5I2
https://ms-office.services/templates-for-word/download?id=V2BX
https://ms-offices.com
https://ms-offices.com/templates-for-word/download?id=AL03
https://ms-offices.com/templates-for-word/download?id=DTF
https://ms-offices.com/templates-for-word/download?id=ZQ9H