Alyac analyzes a Lazarus social-engineering campaign targeting Bitcoin users with a malicious HWP document tied to the earlier Movie Coin lure activity. The document contains malicious PostScript, shellcode, and C2 download logic that reaches youdermoscopy[.]org paths for 32-bit and 64-bit payloads. The report is useful for defenders tracking Lazarus cryptocurrency targeting, HWP exploit delivery, and infrastructure used for follow-on malware retrieval.