The Korean malware analysis excerpt describes a document-based infection involving embedded EPS/PostScript content and GhostScript. The extracted artifact creates a startup-path executable named SMHost.exe under the Windows roaming profile, indicating persistence through the user Startup folder. The available evidence also includes multiple file hashes for related samples or artifacts. The excerpt does not provide enough supported context to identify a specific actor, victim set, campaign name, or DPRK attribution.