ASEC reports malicious HWP documents distributed by email under real-estate investment themes, with plausible message and document content used to lure Korean-speaking recipients into opening attachments. The malicious HWP contains an EPS object that exploits CVE-2017-8291 and creates a VBS script under an AppData Microsoft Internet Explorer path. The script downloads an encoded payload, decodes it into a DLL saved as security.db, and runs it with rundll32 through the InstallSafari export. Once active, the DLL contacts its C2 over HTTPS, sends system information, and can receive additional attacker-supplied data.