Malicious HWP Document Disguised as Reunification Education Support Application

The AhnLab ASEC report details a malicious HWP document distributed via a public recruitment post that, when opened, extracts a normal HWP plus malicious files (BAT, EXE, manifest, XML), creates files in the TEMP folder, registers Task Scheduler entries for persistence, and downloads/executes additional payloads from an external URL; multiple MD5 hashes and the URL are provided as indicators.