← All detection heuristics · HWP
critical
HWP_PS_CVX_EXEC
What it means
PostScript hex string converted to executable code and executed at runtime.
Why it fires
The pattern '<HEX...> cvx exec' decodes a PostScript token from a hex literal and executes it. APT-grade HWP exploits use this to stage payloads in pieces — every fragment is reconstructed at parse time so static scanners that only look for plain 'exec' tokens never see the dangerous operator string in the file. Repeated reconstruction of execution operators identifies the embedded EPS as exploit code rather than ordinary vector data.
Other HWP heuristics
HWP_EMBEDDED_PE HWP_PE_MSHTA_REMOTE_EXEC HWP_OLE_PACKAGE_EXECUTABLE HWP_OLE_CLICK_TO_EXEC_LURE HWP_PS_EXEC HWP_PS_SYSTEM HWP_SHELL_CMD HWP_POSTSCRIPT HWP_PS_HEXCODE HWP_JAVASCRIPT HWP_PS_FILE HWP_URL HWP_PS_FILTER HWP_SCRIPTS_STREAM HWP_BINDATA HWP_COMPRESSED HWP_SEMANTIC_FINGERPRINT HWP_STREAM_RAW_FALLBACK