Spam
HWP and PostScript Abused Via Malicious Attachments
Hangul Word Processor (HWP) is a word processing application in South Korea. It can run PostScript code, a language originally used for printing and desktop publishing. This ability is now being exploited in attacks involving malicious attachments.
Save to Folio
The Hangul Word Processor (HWP) is a word processing application which is fairly popular in South Korea. It possesses the ability to run PostScript code, which is a language originally used for printing and desktop publishing, although it is a fully capable language. Unfortunately, this ability is now being exploited in attacks involving malicious attachments.
A branch of PostScript called Encapsulated PostScript exists, which adds restrictions to the code that may be run. This is supposed to make opening these documents safer, but unfortunately older HWP versions implement these restrictions improperly. We have started seeing malicious attachments that contain malicious PostScript, which is in turn being used to drop shortcuts (or actual malicious files) onto the affected system.
Office suites have long been a popular way of getting users to drop and run malware on their systems. The various components of Microsoft Office have been exploited for years, whether via social engineering (macro malware) or vulnerabilities. It shouldn't be a surprise that other office suites are similarly targeted.
Technical Details
The goal of this attack is to use PostScript to gain a foothold onto a victim's machine. No actual exploit is used, as this is a case where a feature of PostScript is being abused.
Some of the subject lines and document names used include “Bitcoin” and “Financial Security Standardization”. The appearance of these decoy documents are shown below:
Figures 1 and 2. Samples of decoy documents
PostScript does not have the ability to execute shell commands. However, it does have the capability to manipulate files. This attack instead drops files into various startup folders, and waits for the user to reboot their machine. Some of the ways we've seen this seen of this include:
Figure 3. Sample of code in HWP file
One of the samples we’ve received will overwrite gswin32c.exe with a legitimate version of Calc.exe. This file is the PostScript interpreter used by HWP. Since the interpreter is overwritten, this would prevent other embedded PostScript content from executing.
Figure 4. Calculator opened by HWP file
Mitigation and Solutions
Newer versions of the Hangul Word Processor implement EPS correctly, with the 2014 versions and later not being susceptible to this problem. We suggest upgrading to these newer, safer versions.
Trend Micro endpoint solutions such as Trend Micro™ Security, OfficeScan, and Worry-Free Business Security all include behavior monitoring that prevents HWP from dropping any PostScipt files. We also detect the files associated with this attack as TROJ_HWDOOR.A, TROJ_HWDOOR.B, and TROJ_MALEPS.B, and TROJ_HWDOOR.SMZBEH-A.
Indicators of Compromise
The following hashes are associated with this attack: