Starting with one HWP document 6, Figure 1 shows the stream that contains the string 'HighExpert' as extracted by Cerbero Profiler. The purpose of the former is to store metadata about the document and can include information about the title and author of the document. For the samples analyzed here, two types of streams are very important to analyze: 'HwpSummaryInformation' and 'BinData'. This means they are made up of various streams. HWP files use the Microsoft compound file format specification. Within this campaign, the earliest sample 4 was first seen on Maand the most recent sample on September 16, 2020. Armed with this knowledge, the PoorWeb payloads and the various stages that deliver them are distinct from previous campaigns operated by the same adversary. However, looking at similarities and differences in malware behavior and code, delineations can be drawn between campaigns.

This amount of data can be confusing especially when the attacks are so similar. 3 Pivoting outwards from these three, a large number of related attacks is found. Here we start with a set of three malicious Hangul Word Processor (HWP) documents targeting one victim organization, each with a slightly different set of stages, but ultimately leading to payloads in one malware family: PoorWeb. 2 This type of malicious document is the first stage of an attack chain often leading to a PE executable trojan.

The landscape of this type of attack has been analyzed closely in the VirusBulletin talk 'DOKKAEBI: Documents of Korean and Evil Binary'. 1 It shares the same compound file format as older versions of Microsoft Office, but has unique features that are abused to form malicious documents. Hangul Office is a popular office software suite in South Korea.

Hangul word processor