Win.Trojan.GhostPuppet-6712722-3 — Hangul (OLE) malware analysis

Heuristics 10

• Ghostscript SAFER bypass in HWP/EPS critical CVE exact CVE_2017_8291
  Detected Ghostscript CVE-2017-8291 exploit primitive: .eqproc. This matches the -dSAFER bypass/type-confusion family used by malicious EPS payloads embedded in HWP documents. The .eqproc operator was found after decoding '<HEX> cvx exec' staging.
• ClamAV: Win.Trojan.GhostPuppet-6712722-3 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Win.Trojan.GhostPuppet-6712722-3
• PostScript exec command critical HWP_PS_EXEC
  PostScript 'exec' operator found — can execute arbitrary code
• PostScript runtime hex-to-code execution critical HWP_PS_CVX_EXEC
  Found 3 '<HEX> cvx exec' sequence(s) — PostScript decoded from hex strings and executed at runtime; classic exploit-staging pattern.
• Embedded PostScript / EPS high HWP_POSTSCRIPT
  HWP contains embedded PostScript/EPS — a common exploit surface in targeted HWP campaigns
• PostScript file operation high HWP_PS_FILE
  PostScript file operation found (file/run/deletefile)
• External URL medium HWP_URL
  Found 14 URL(s) in document
• Decompressed OLE-wrapped HWP streams info HWP_COMPRESSED
  Inflated 4278336 bytes from BinData / Scripts / BodyText / DocInfo streams of the OLE-wrapped HWP for content analysis
• Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
  One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://www.iec.ch HWP document reference

  • http://ns.adobe.com/xap/1.0/In document text (OLE body)
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OLE body)
  • http://ns.adobe.com/exif/1.0/aux/In document text (OLE body)
  • http://ns.adobe.com/photoshop/1.0/In document text (OLE body)
  • http://ns.adobe.com/xap/1.0/mm/In document text (OLE body)
  • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In document text (OLE body)
  • http://purl.org/dc/elements/1.1/In document text (OLE body)

Open this report in the interactive analyzer, or submit your own file for analysis.