A forum for reverse engineering, OS internals and malware analysis 

CVE-2017-8291 exploited in Targeted Attacks on South Korea

Forum for analysis and discussion about malware.

CVE-2017-8291 exploited in Targeted Attacks on South Korea

 #30958  by c0d3inj3cT
 Tue Oct 31, 2017 4:39 am
CVE-2017-8291, a vulnerability in GhostScript in Hancom Office Application being used in Targeted Attacks on South Korea in the wild.

http://www.pwncode.club/2017/10/targete ... loits.html

MD5 hash of the HWP file: 3d0d71fdedfd8945d78b64cdf0fb11ed
MD5 hash of the decrypted DLL: d897b4b8e729a408f64911524e8647db

Theme of the file is related to Korean Day (celebrated on Oct 5th 2017 in South Korea).

Payload is decrypted and injected into explorer.exe process. More details available in the link above.
 Return to “Malware”