The Korean analysis describes an HWP malware document disguised as weekly international security and military information. The file used a PostScript vulnerability to load shellcode, perform staged decryption, inject code into iexplorer.exe, download an additional binary, and load a DLL named HimTray.dll. The lure and exploit chain show document-based targeting of users interested in security and military affairs.