AhnLab ASEC analyzed HWP malware using CVE-2017-8291 and found a recurring coding mistake in the shellcode preparation stage. The error affected a VirtualProtect call but did not prevent execution because the vulnerable Ghostscript processes had DEP disabled. ASEC notes that variants with and without the mistake may indicate two development groups or branches behind related HWP document malware.