Win.Trojan.GhostPuppet-6712722-3 — Hangul (OLE) malware analysis

Heuristics 9

• Ghostscript SAFER bypass in HWP/EPS critical CVE exact CVE_2017_8291
  Detected Ghostscript CVE-2017-8291 exploit primitive: .eqproc. This matches the -dSAFER bypass/type-confusion family used by malicious EPS payloads embedded in HWP documents. The .eqproc operator was found after decoding '<HEX> cvx exec' staging.
• PostScript exec command critical HWP_PS_EXEC
  PostScript 'exec' operator found — can execute arbitrary code
• PostScript runtime hex-to-code execution critical HWP_PS_CVX_EXEC
  Found 3 '<HEX> cvx exec' sequence(s) — PostScript decoded from hex strings and executed at runtime; classic exploit-staging pattern.
• ClamAV: Win.Trojan.GhostPuppet-6712722-3 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Win.Trojan.GhostPuppet-6712722-3
• Embedded PostScript / EPS high HWP_POSTSCRIPT
  HWP contains embedded PostScript/EPS — a common exploit surface in targeted HWP campaigns
• PostScript file operation high HWP_PS_FILE
  PostScript file operation found (file/run/deletefile)
• External URL medium HWP_URL
  Found 14 URL(s) in document
  URL http://www.iec.ch
• Decompressed OLE-wrapped HWP streams info HWP_COMPRESSED
  Inflated 4278064 bytes from BinData / Scripts / BodyText / DocInfo streams of the OLE-wrapped HWP for content analysis
• Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
  One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.