The source analyzes a Kimsuky LNK malware sample disguised as a Korea Internet & Security Agency status-survey spreadsheet, using a hidden PowerShell command chain rather than a real Excel document. The LNK extracts a decoy 현황조사표.xlsx and a batch file from embedded byte ranges, launches the decoy, and executes PMmVvG56FLC9y.bat through SysWOW64 cmd.exe. The batch file copies itself to the user profile, adds RunOnce persistence, decodes a hex-encoded PowerShell payload, and contacts attacker infrastructure including 75.119.136.207 and bian0151.cafe24.com. The report includes hashes for the LNK and BAT payload, supporting detection of Kimsuky document-lure execution and persistence tradecraft.