The report describes Konni malware disguised as a token circulation and lockup schedule document. The lure uses a large LNK file with hashes including SHA-256 77d05cc623f860ca2e6d47cdafc517aa0612de88291de7f2a3d95c5d04f1658a, likely padded with dummy data to hinder scanning and analysis, and is relevant to North Korea-linked social-engineering and downloader tradecraft.