PostScript analysis inside eps vulnerability at hangul malware

below PostScript is maked encoded shellcode.

# 23 2D 62 78 0B 00 84 83 D7 16 16 92 96 51 41 BB
# 4E A3 B4 85 75 2D 60 E7 5F 7F 72 D3 72 FE 12 E4
key = bytearray([0x4E, 0xA3, 0xB4, 0x85, 0x75, 0x2D, 0x60, 0xE7, 0x5F, 0x7F, 0x72, 0xD3, 0x72, 0xFE, 0x12, 0xE4])
data = bytearray(open('encoded_shellcode.bin', 'rb').read())
 
def xor(data, key):
    l = len(key)
    return bytearray((
        [(data[i] ^ key[i % l]) for i in range(0, len(data))]
    ))
 
with open('decoded_shellcode.bin', 'wb') as f_handle:
    f_handle.write(xor(data, key))

source of analysed file obtain via link below.

https://www.virustotal.com/#/file/a299bdc3fc07def4b0d5a409484f4717884a78749796960a560a9b30fab2435b/detection