HWP detection heuristics

Embedded PE executable critical HWP_EMBEDDED_PE

PE executable found inside HWP document.

Embedded PE launches remote HTA critical HWP_PE_MSHTA_REMOTE_EXEC

The HWP's packaged PE invokes mshta with a remote URL.

Executable in HWP OLE Package critical HWP_OLE_PACKAGE_EXECUTABLE

An HWP BinData OLE Package carries a valid Windows executable under an executable filename.

HWP OLE click-to-execute lure critical HWP_OLE_CLICK_TO_EXEC_LURE

The HWP body links a temporary-path executable to an embedded OLE Package carrying the same filename.

PostScript exec command critical HWP_PS_EXEC

PostScript 'exec' operator found in embedded PostScript.

PostScript runtime hex-to-code execution critical HWP_PS_CVX_EXEC

PostScript hex string converted to executable code and executed at runtime.

PostScript system call critical HWP_PS_SYSTEM

PostScript 'system' operator found.

Shell command reference critical HWP_SHELL_CMD

Reference to a shell command (cmd.exe, powershell, etc.) in HWP.

Embedded PostScript / EPS high HWP_POSTSCRIPT

HWP document contains embedded PostScript or EPS content.

Hex-encoded data in PostScript high HWP_PS_HEXCODE

Many hex escape sequences found in PostScript content.

JavaScript in HWP high HWP_JAVASCRIPT

JavaScript references found in HWP document.

PostScript file operation high HWP_PS_FILE

PostScript file operation (file/run/deletefile) found.

External URL in HWP medium HWP_URL

External URL(s) found in HWP document content.

PostScript decode filter medium HWP_PS_FILTER

PostScript decode filter (SubFileDecode, ASCIIHexDecode, etc.) found.

Scripts storage medium HWP_SCRIPTS_STREAM

OLE-based HWP contains a Scripts storage section.

BinData stream low HWP_BINDATA

OLE-based HWP contains a BinData storage section.

Compressed sections info HWP_COMPRESSED

Zlib-compressed sections were found and decompressed for analysis.

HWP logical-stream fingerprint info HWP_SEMANTIC_FINGERPRINT

Stable digest of decompressed HWP logical stream names and content.

HWP stream scanned without inflation info HWP_STREAM_RAW_FALLBACK

A payload-bearing stream did not inflate as raw DEFLATE and was scanned in its original form.