The analysis examines a Windows executable disguised as a Korean HWP quotation document for a Vietnam Nokjiwon and Sangchunjae event. When run, the dropper writes a decoy HWP file and a DLL named NewAct.dat, then invokes the DLL through regsvr32.exe and its DllInstall export. The DLL removes local WSF files, runs a checkdrive export, checks whether the system is 64-bit, and either attempts to download an additional lyric64 payload or injects itself into explorer.exe. The injected code creates a mutex, starts malicious activity threads, communicates with antichrist.or.kr/data/cheditor/dir1/f.php, and uses a rotating XOR routine to decrypt downloaded files.