Malicious Hangul (OLE) — malware analysis report

Heuristics 9

• Ghostscript SAFER bypass in HWP/EPS critical CVE exact CVE_2017_8291
  Detected Ghostscript CVE-2017-8291 exploit primitive: .eqproc. This matches the -dSAFER bypass/type-confusion family used by malicious EPS payloads embedded in HWP documents. The .eqproc operator was found after decoding '<HEX> cvx exec' staging.
• ClamAV: Win.Trojan.GhostPuppet-6712722-3 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Win.Trojan.GhostPuppet-6712722-3
• PostScript exec command critical HWP_PS_EXEC
  PostScript 'exec' operator found — can execute arbitrary code
• PostScript runtime hex-to-code execution critical HWP_PS_CVX_EXEC
  Found 3 '<HEX> cvx exec' sequence(s) — PostScript decoded from hex strings and executed at runtime; classic exploit-staging pattern.
• OLE file has appended executable-looking payload bytes high OLE_APPENDED_PAYLOAD
  OLE compound file contains a large high-entropy region beyond the declared major streams and that region includes shellcode, PE, or loader API markers. This is a payload-carrier signal, not a specific CVE attribution by itself.
• Embedded PostScript / EPS high HWP_POSTSCRIPT
  HWP contains embedded PostScript/EPS — a common exploit surface in targeted HWP campaigns
• PostScript file operation high HWP_PS_FILE
  PostScript file operation found (file/run/deletefile)
• Decompressed OLE-wrapped HWP streams info HWP_COMPRESSED
  Inflated 140616 bytes from BinData / Scripts / BodyText / DocInfo streams of the OLE-wrapped HWP for content analysis
• Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
  One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.