A malicious HWP document disguised as a Korea Financial Supervisory Service notice used encrypted shellcode similar to a previously observed HWP sample. The excerpt notes 16-byte XOR keys, extraction of PostScript code and shellcode, and a malware-structure signature value of 0xAABBCCDD followed by a download URL. The domain tpddata.com is described as recurring across recently released HWP samples, and the body lists related HWP filenames, hashes, and compromised-looking PHP paths. The evidence is useful for defenders tracking Korean-language HWP lure documents and validating the listed hashes, domains, and URLs in endpoint and network telemetry.