Malicious LNK File Disguised as a Normal HWP Document

The ASEC analysis team discovered the distribution of a malicious LNK file disguised as a normal HWP document, Along with a text file impersonating the National Tax Service. A normal HWP document with related contents is opened simultaneously, making it difficult for users to realize the file is rogue. The malicious script file executed in the end is the same type as the script covered in ‘Malicious Word Files Disguised as Product Introduction‘ and is deemed to be …

analysis asec distribution document end file files impersonating lnk lnk file making malicious malware analysis national rogue script service tax team text word