← All detection heuristics · HWP
critical
HWP_OLE_PACKAGE_EXECUTABLE
What it means
An HWP BinData OLE Package carries a valid Windows executable under an executable filename.
Why it fires
OLE Package objects can extract and launch packaged files after user activation. Executable package types such as SCR or EXE are highly abnormal in HWP documents and are a common click-to-execute delivery mechanism.
Other HWP heuristics
HWP_EMBEDDED_PE HWP_PE_MSHTA_REMOTE_EXEC HWP_OLE_CLICK_TO_EXEC_LURE HWP_PS_EXEC HWP_PS_CVX_EXEC HWP_PS_SYSTEM HWP_SHELL_CMD HWP_POSTSCRIPT HWP_PS_HEXCODE HWP_JAVASCRIPT HWP_PS_FILE HWP_URL HWP_PS_FILTER HWP_SCRIPTS_STREAM HWP_BINDATA HWP_COMPRESSED HWP_SEMANTIC_FINGERPRINT HWP_STREAM_RAW_FALLBACK