From 1b4ab678baf8a23e069be6d3c8456106ab4d802b Mon Sep 17 00:00:00 2001 From: StrangerealIntel <54320855+StrangerealIntel@users.noreply.github.com> Date: Thu, 23 Apr 2020 16:56:48 +0200 Subject: [PATCH] Update Analysis.md --- North Korea/APT/APT37/2020-04-23/Analysis.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/North Korea/APT/APT37/2020-04-23/Analysis.md b/North Korea/APT/APT37/2020-04-23/Analysis.md index 5ffcd76..6e692a4 100644 --- a/North Korea/APT/APT37/2020-04-23/Analysis.md +++ b/North Korea/APT/APT37/2020-04-23/Analysis.md @@ -1,4 +1,4 @@ -## APT 37 strike again +## APT 37 strike again ? ## Table of Contents * [Malware analysis](#Malware-analysis) * [Cyber kill chain](#Cyber-kill-chain) @@ -10,7 +10,7 @@ + [Articles](#Articles)

Malware analysis

-
The initial vector is an maldoc with a macro. This launches an auto-open method for decrypt the next stagger, save it and execute it in push as argument the URL to contact. This saves the modification on the document for avoiding to be executing a second time by the victim.
+
The initial vector is an maldoc with a macro. This launches an auto-open method for decrypt the next stager, save it and execute it in push as argument the URL to contact. This saves the modification on the document for avoiding to be executing a second time by the victim.
```vb Private Sub Document_Open()