Independent cybersecurity blogger and security researcher based in South Korea.

I run 꿈을꾸는 파랑새 (Dreaming Bluebird), a Korean-language blog focused primarily on hands-on analysis of malware, phishing websites, malicious scripts, suspicious files, and related cybersecurity threats.

My goal is not simply to identify something as malicious.

I try to understand:

What does it do?
How does it work?
What techniques does it use?
What indicators does it leave behind?

🌐 Blog: 꿈을꾸는 파랑새 / WEZARD4U'S BLOG

My main areas of interest include:

• 🦠 Malware analysis
• 🎣 Phishing website analysis
• 📜 Malicious script analysis
• 📦 Suspicious file analysis
• 🕵️ APT and threat research
• 🌐 Malicious domains and URLs
• 🔎 Indicators of compromise
• 🧩 Obfuscation and execution techniques
• ⚙️ Persistence and system modification techniques

I mainly focus on the technical analysis of real-world threats and suspicious activity.

I analyze suspicious and malicious files to understand their behavior and technical characteristics.

Depending on the sample, my analysis may include:

• File hashes
• File structure
• Process execution
• Command-line activity
• PowerShell
• VBS
• JavaScript
• Registry modification
• File system changes
• Persistence mechanisms
• Network communication
• Payload behavior
• Obfuscation techniques

Where useful, I also document indicators such as:

• MD5
• SHA-1
• SHA-256
• Domains
• URLs
• IP addresses
• File paths
• Registry paths
• Mutexes
• Process names

The objective is to leave enough technical information for others to understand and verify the behavior of the threat.

Phishing and malicious website analysis is another major part of my work.

I examine suspicious websites, phishing pages, redirects, and related infrastructure.

Analysis may include:

• Fake login pages
• Credential theft pages
• Smishing-related websites
• Malicious redirects
• Suspicious JavaScript
• Fake software download pages
• Malicious domains
• URL structures
• Hosting infrastructure
• Related payloads
• Social-engineering techniques

I try to examine not only what the page looks like, but also what happens behind it.

Some malware samples or phishing campaigns may show similarities to previously reported threat groups or APT activity.

In these cases, I try to separate:

• ✅ Confirmed technical findings
• 🔎 Similarities with known campaigns
• ⚠️ Suspected attribution
• ❓ Unconfirmed assumptions

When the available evidence is insufficient, I prefer terms such as:

• suspected
• likely
• possibly related

rather than presenting attribution as a confirmed fact.

Depending on the case, my analysis may involve:

• 🔍 Static analysis
• ▶️ Dynamic analysis
• 🌐 Network traffic observation
• 📜 Script inspection
• 📦 File structure analysis
• 🔗 Domain and URL investigation
• 🔎 Public threat intelligence
• 🧭 Cross-checking indicators with existing reports

I try to base my conclusions on observable technical evidence whenever possible.

The purpose of my analysis is to understand how threats operate, document useful indicators, and share technical information that may help with defensive security and threat awareness.

When I have time, I also contribute to the Korean localization of open-source software.

My localization interests mainly include:

• 🔐 Security software
• 🛡️ Privacy tools
• 🧰 Utilities
• 💻 Technical software
• 🌐 Open-source applications

I try to preserve the technical meaning of the original text while making the Korean translation natural and understandable.

Other open-source localization projects may follow as time permits.

I spend a significant amount of my free time analyzing malware, phishing websites, malicious scripts, suspicious files, and related cybersecurity threats.

Maintaining this work may require:

• 💾 Storage
• 🔐 Security tools
• 🧰 Analysis software
• 🌐 Blog maintenance
• 📝 Technical documentation
• 🌏 Open-source localization

If my analysis or articles have been useful to you, you can support my work through Ko-fi.

Even a small contribution helps me continue researching, analyzing, documenting, and sharing technical information.

Thank you for supporting my work. 💙

저는 악성코드, 피싱 사이트, 악성 스크립트, 의심스러운 파일 등 실제 사이버 위협을 직접 분석하고 그 과정에서 확인한 내용을 꿈을꾸는 파랑새 블로그를 통해 공유하고 있습니다.

단순히 악성 여부를 확인하는 것에 그치지 않고 가능한 범위에서 다음과 같은 내용을 살펴보고 있습니다.

• 🦠 악성코드 동작 방식
• 🎣 피싱 사이트 구조
• 📜 악성 스크립트
• 🌐 악성 도메인 및 URL
• 🔎 침해 지표
• ⚙️ 지속성 유지 기법
• 🧩 난독화 및 실행 방식

또한 시간이 허락할 때 오픈소스 프로그램의 한국어 번역과 현지화 작업에도 참여하고 있습니다.

제 분석 글이나 기술 자료가 도움이 되셨다면 카카오페이를 통해 응원해 주실 수 있습니다.

_{📱 카카오톡 앱에서 QR 코드를 스캔하여 후원하실 수 있습니다.}

보내주시는 후원은 다음과 같은 활동에 도움이 됩니다.

• 🔬 보안 분석 및 연구
• 🦠 악성코드 분석
• 🎣 피싱 사이트 분석
• 🧰 분석 도구 활용
• 🌐 블로그 운영
• 📝 기술 자료 작성
• 🌏 오픈소스 한국어 현지화

후원 금액은 중요하지 않습니다.

분석 글이 도움이 되었다고 생각하신다면 커피나 음료 한 잔 정도의 작은 응원도 앞으로 분석 활동을 계속하는 데 도움이 됩니다.

후원 여부와 관계없이 일반적인 보안 분석 글과 기술 정보는 계속 공개할 예정입니다.

감사합니다. 💙

Malware, phishing URLs, malicious scripts, suspicious files, and other potentially harmful materials discussed in my research should be handled only in appropriate controlled environments.

The information published through my blog and GitHub is intended primarily for:

• 🛡️ Defensive cybersecurity research
• 🔬 Malware analysis
• 🎣 Phishing analysis
• 🎓 Education
• ⚠️ Threat awareness
• 📝 Technical documentation

🌐 Blog
꿈을꾸는 파랑새

☕ Ko-fi
Support My Research

🦋 Bluesky
sakaijjang.bsky.social

𝕏 X / Twitter
@sakaijjang

💻 GitHub
@M26Pershing90mm