A malicious HWP file was disguised as a Korea Real Estate Association daily trend report, a document type said to be available only to members. The infection flow uses EPS content to decrypt shellcode with a 16-byte key and then download Manuscrypt. The downloaded Manuscrypt payload is XOR-encoded with 0xAA, and the excerpt lists download and callback infrastructure including eronow.in, 51shousheng.com, titanik.fr, and aurumgroup.co.id paths. The note that the Manuscrypt sample appeared in VirusTotal before the HWP file helps analysts understand sample timing and pivot from the payload to the delivery document.