SumatraPDF in this context is a weaponized Windows build of the open-source SumatraPDF Reader 2.5.1 used in Lazarus-attributed activity. Opening a crafted document with the altered application activates encrypted content hidden in the PDF, decrypts and executes a loader in memory, and progresses through additional encrypted stages. A downloader then contacts attacker-controlled infrastructure to retrieve a backdoor intended for sensitive-information theft. The activity primarily targeted financial institutions and cryptocurrency exchanges through malicious documents paired with the trojanized reader.