It looks like a normal resume, but the infection begins the moment it is opened.

Malicious shortcut files disguised as resume files have recently been circulating, requiring corporate users to exercise caution. Threat actors name the files to resemble resume documents containing company names and job titles, and when executed, they display a legitimate decoy file alongside the malicious file to lower the user’s suspicion. The file then downloads additional malicious files and attempts to execute backdoor malware, establishing persistence through methods such as registering with the Task Scheduler, adding items to the Startup folder, and DLL side-loading. In particular, since document files disguised as resumes can be easily opened in a work environment, security personnel and employees must exercise caution when reviewing them. Let’s examine the key characteristics and countermeasures for malicious LNK files currently being distributed while disguised as resume files.

The resume-disguised files identified in this case were created to include the names of specific companies and job titles.

• (RESUME)_Korea Company Name_Job Title_***.LNK

The LNK file contains a legitimate decoy document; when the user executes the file, a resume document that appears to be legitimate opens alongside it. As a result, the user may believe they are viewing an actual resume, but in the background, malicious scripts and additional files are created, and the infection process proceeds.

[Figure 1] Legitimate decoy document

This method of displaying a legitimate document alongside the malicious file is a social engineering technique designed to reduce user suspicion. In particular, departments that frequently receive external documents—such as recruitment, sales, and customer service—are at risk of having similar-looking document files exploited; therefore, it is essential to always verify the file extension and Source before executing any file.

Script Creation and Task Scheduler Registration

When the malicious LNK file is executed, batch files (.bat), PowerShell scripts (.ps1), and VBScript files (.vbs) with random names are created in the C:\Users\Public\Videos\ path. The contents of these files are embedded within the LNK file, and the newly created PowerShell script is subsequently executed.

This PowerShell script registers a Task Scheduler job named “office365” to ensure the VBScript file runs every 10 minutes. The VBScript file then executes a batch file, which triggers the next phase of malicious behavior.

By registering a scheduled task with a name similar to that of a legitimate business service and configuring it to execute a script periodically, the threat actor ensures persistence—meaning the malicious behavior will resume even after a system reboot or the termination of certain malicious processes.

[Figure 2] Registered Task Scheduler

Additional File Download and Execution Flow

The batch file executed by VBScript uses the `curl` command to download additional files from an external server. Although the download URLs are not disclosed in this article, these files are used as components for subsequent malware execution.

Some of the downloaded files are encoded in Base64 and, after decoding, are saved as additional PowerShell scripts in the ‘C:\Users\Public\Pictures\p2.ps1’ Path. Subsequently, `p2.ps1` creates a shortcut on the Startup path and performs decryption on the previously downloaded files to generate legitimate executable files, DLL files, and data files.

The files generated in this case are as follows.

• ProximityUxHost.exe
• ProximityCommon.DLL
• settings.dat
• MicrosoftBing.LNK

MicrosoftBing.LNK triggers the execution of the legitimate program ProximityUxHost.exe, and the DLL side-loading technique was used in this process. DLL side-loading exploits the fact that legitimate executable files load specific DLL files; threat actors can use this to make it appear as though a legitimate program is running while simultaneously executing a malicious DLL.

In this case, it was confirmed that after ProximityCommon.dll was loaded, the backdoor malware Xctdoor (contained in settings.dat) was injected into the legitimate process and executed. Analysis revealed that this malware attempted to communicate with a specific external C2 server.

[Figure 3] Excerpt from the p2.ps1 file

[Figure 4] Part of the Xctdoor code

The attack flow can be summarized as follows.

Execution of a malicious LNK file disguised as a resume

↓

Execution of a decoy document that appears to be a legitimate document

↓

Create a script file with the Path C:\Users\Public\Videos\

↓

Register a task in the Task Scheduler under the name “office365”

↓

Download additional files from an external server

↓

Perform the decryption of the downloaded file and create a malicious file

↓

Ensuring persistence by using the startup path

↓

Performing DLL side-loading by exploiting legitimate executables

↓

Code execution of Xctdoor-family backdoor malware

This sequence is more difficult to detect and analyze than the execution of a single malicious file. It combines various techniques to disguise the file name, such as using legitimate documents, file names similar to legitimate program names, and scheduling tasks, making it difficult for users to recognize that their system has been infected.

Response Guide

1) Check and Remove Tasks in the Task Scheduler

Security administrators should check the Task Scheduler for any suspicious tasks. In this case, a scheduled task with a name that appears to be a legitimate Service (Office 365) was registered and configured to execute a script periodically. If such a task is found, it must be deleted immediately.

2) Check for and Delete Suspicious Files

Check the following path under the user profile to see if any suspicious files have been created:

• C:\Users\{User}\AppData\Local\Packages\Microsoft.BingSearch365_8wekyb3d8bbwe\AppData\

If the files listed below are found in this path, they may be malicious files and must be deleted.

• ProximityCommon.DLL
• settings.dat
• MicrosoftBing.LNK

3) Beware of Files Disguised as Resumes

This attack involves executing an LNK file disguised as a legitimate document, then using the Task Scheduler and Startup programs to establish persistence, and finally exploiting legitimate executable files to run backdoor malware.

Therefore, when opening resume files or document-type Attachments from unknown sources, you must always verify the actual file extension and whether the file is executable.