It looks like a normal resume, but the infection begins the moment it is opened.

Malicious LNK files disguised as resume documents open a legitimate-looking decoy while executing embedded scripts that create batch/PowerShell/VBScript files under C:\Users\Public, register a scheduled task named “office365”, download and decrypt payloads (ProximityUxHost.exe, ProximityCommon.DLL, settings.dat, MicrosoftBing.LNK), establish persistence via Startup, and use DLL side-loading to execute the Xctdoor backdoor; the report includes file/path IOAs and a response guide to remove tasks and suspicious files.