Excerpt
I. Overview
II. Analysis
1. Locate suspicious files
Use msitool to extract msidump -s -t mal.msi . In File.idt , we can see that there are 3 embed file. These files are extracted to %LOCALAPPDATA\kjnBsLsJo\
Upon running, the program opens an pdf file called Meeting Invitation.pdf 2. DLL Side-loading technique
security.dll export 3 functions…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by bluecyber.hashnode.dev on bluecyber.hashnode.dev.
More from bluecyber.hashnode.dev1
- Beyond the Archive: CVE-2025-8088 Stealer Targeting Ukrainebluecyber.hashnode.dev · Published 22 Jul
