Independent cybersecurity blogger and security researcher based in South Korea.

I run 꿈을꾸는 파랑새 / WEZARD4U'S BLOG, a Korean-language personal technical blog focused primarily on hands-on analysis of malware, phishing websites, malicious scripts, suspicious files, and related cybersecurity threats.

The blog is not limited to cybersecurity. I also write about Windows, software, security updates, privacy tools, utilities, open-source software, technical troubleshooting, and other topics that interest me.

My goal is not simply to identify something as malicious.

I try to understand:

What does it do?
How does it work?
What techniques does it use?
What indicators does it leave behind?

🌐 Blog: 꿈을꾸는 파랑새 / WEZARD4U'S BLOG

My main areas of interest include:

• 🦠 Malware analysis
• 🎣 Phishing website analysis
• 📜 Malicious script analysis
• 📦 Suspicious file analysis
• 🕵️ APT and threat research
• 🌐 Malicious domains and URLs
• 🔎 Indicators of compromise
• 🧩 Obfuscation and execution techniques
• ⚙️ Persistence and system modification techniques

I mainly focus on the technical analysis of real-world threats and suspicious activity.

Whenever possible, I try to distinguish confirmed technical findings from assumptions, similarities, and attribution claims.

I analyze suspicious and malicious files to understand their behavior and technical characteristics.

Depending on the sample, my analysis may include:

• File hashes
• File structure
• Process execution
• Command-line activity
• PowerShell
• VBS
• JavaScript
• Registry modification
• File system changes
• Persistence mechanisms
• Network communication
• Payload behavior
• Obfuscation techniques

Where useful, I also document indicators such as:

• MD5
• SHA-1
• SHA-256
• Domains
• URLs
• IP addresses
• File paths
• Registry paths
• Mutexes
• Process names

The objective is to leave enough technical information for others to understand and verify the behavior of the threat.

Phishing and malicious website analysis is another major part of my work.

I examine suspicious websites, phishing pages, redirects, scripts, domains, and related infrastructure.

Analysis may include:

• Fake login pages
• Credential theft pages
• Smishing-related websites
• Malicious redirects
• Suspicious JavaScript
• Fake software download pages
• Malicious domains
• URL structures
• Hosting infrastructure
• Related payloads
• Social-engineering techniques

I try to examine not only what the page looks like, but also what happens behind it.

This may include redirects, scripts, network requests, domain relationships, downloaded payloads, and related infrastructure.

Some malware samples or phishing campaigns may show similarities to previously reported threat groups or APT activity.

In these cases, I try to separate:

• ✅ Confirmed technical findings
• 🔎 Similarities with known campaigns
• ⚠️ Suspected attribution
• ❓ Unconfirmed assumptions

When the available evidence is insufficient, I prefer terms such as:

• suspected
• likely
• possibly related
• shows similarities to

rather than presenting attribution as a confirmed fact.

Attribution should be based on available technical evidence rather than assumptions.

Depending on the case, my analysis may involve:

• 🔍 Static analysis
• ▶️ Dynamic analysis
• 🌐 Network traffic observation
• 📜 Script inspection
• 📦 File structure analysis
• 🔗 Domain and URL investigation
• 🔎 Public threat intelligence
• 🧭 Cross-checking indicators with existing reports

I try to base my conclusions on observable technical evidence whenever possible.

The purpose of my analysis is to understand how threats operate, document useful indicators, and share technical information that may help with defensive security and threat awareness.

When I have time, I also contribute to the Korean localization of open-source software.

My localization interests mainly include:

• 🔐 Security software
• 🛡️ Privacy tools
• 🧰 Utilities
• 💻 Technical software
• 🌐 Open-source applications

I try to preserve the technical meaning of the original text while making the Korean translation natural and understandable.

Other open-source localization projects may follow as time permits.

I spend a significant amount of my free time analyzing malware, phishing websites, malicious scripts, suspicious files, and related cybersecurity threats.

Maintaining this work may require:

• 💾 Storage
• 🔐 Security tools
• 🧰 Analysis software
• 🖥️ Analysis environments
• 🌐 Blog maintenance
• 📝 Technical documentation
• 🌏 Open-source localization

If my analysis or articles have been useful to you, you can support my work through Ko-fi.

Even a small contribution helps me continue analyzing threats, documenting findings, maintaining my analysis environment, and sharing technical information.

☕ Ko-fi: https://ko-fi.com/sakai38666

Every coffee helps me analyze the next threat.

For more information about supporting my work:

🌐 Support Independent Malware & Phishing Analysis — WEZARD4U'S BLOG

Support is completely optional.

Regular security analysis, technical articles, and useful information will continue to be shared publicly regardless of support.

저는 악성코드, 피싱 사이트, 악성 스크립트, 의심스러운 파일 등 실제 사이버 위협을 직접 분석하고 그 과정에서 확인한 기술적인 내용을 꿈을꾸는 파랑새 블로그를 통해 공유하고 있습니다.

단순히 악성 여부를 확인하는 것에 그치지 않고 가능한 범위에서 다음과 같은 내용을 살펴보고 있습니다.

• 🦠 악성코드 동작 방식
• 🎣 피싱 사이트 구조와 동작
• 📜 악성 스크립트
• 📦 의심스러운 파일 및 페이로드
• 🌐 악성 도메인 및 URL
• 🔎 침해 지표
• ⚙️ 지속성 유지 기법
• 🧩 난독화 및 실행 방식
• 🔗 관련 네트워크 및 위협 인프라

또한 시간이 허락할 때는 오픈소스 프로그램의 한국어 번역과 현지화 작업에도 참여하고 있습니다.

제 분석 글이나 기술 자료가 도움이 되셨다면 카카오페이를 통해 분석 활동을 응원해 주실 수 있습니다.

📱 카카오톡 또는 카카오페이에서 QR 코드를 스캔하여 후원하실 수 있습니다.

보내주시는 후원은 다음과 같은 활동에 도움이 됩니다.

• 🔬 보안 분석 및 조사
• 🦠 악성코드 분석
• 🎣 피싱 사이트 분석
• 📜 악성 스크립트 분석
• 🧰 분석 도구 및 소프트웨어
• 🖥️ 분석 환경 유지
• 💾 분석 자료 및 저장 공간
• 🌐 블로그 운영
• 📝 기술 자료 작성
• 🌏 오픈소스 한국어 현지화

후원 금액의 크기는 중요하지 않습니다.

분석 글이나 기술 자료가 도움이 되었다고 생각하신다면 커피나 음료 한 잔 정도의 작은 응원도 앞으로 분석 활동을 계속하는 데 도움이 됩니다.

자세한 후원 안내는 블로그에서도 확인할 수 있습니다.

🌐 후원 안내 — 꿈을꾸는 파랑새

후원 여부와 관계없이 일반적인 보안 분석 글과 기술 정보는 계속 공개할 예정입니다.

금전적인 후원뿐만 아니라 블로그 글을 읽어주시거나 필요한 사람에게 공유해 주시는 것도 큰 도움이 됩니다.

감사합니다. 💙

Malware, phishing URLs, malicious scripts, suspicious files, and other potentially harmful materials discussed in my research should be handled only in appropriate controlled environments.

The information published through my blog and GitHub is intended primarily for:

• 🛡️ Defensive cybersecurity research
• 🔬 Malware analysis
• 🎣 Phishing analysis
• 🎓 Education
• ⚠️ Threat awareness
• 📝 Technical documentation

Do not execute suspicious samples or intentionally access malicious infrastructure on production systems.

Use appropriate isolation and security controls when handling potentially harmful material.

🌐 Blog
꿈을꾸는 파랑새 / WEZARD4U'S BLOG

☕ Ko-fi
Support My Research

🇰🇷 Support
후원 안내

🦋 Bluesky
sakaijjang.bsky.social

𝕏 X / Twitter
@sakaijjang

💻 GitHub
@M26Pershing90mm