SharkLoader Dropper Opening Decoy PDF Lure with Concurrent DLL or MSI Execution

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•0

This rule detects potentially malicious behavior where a PDF reader or command-line utility (executing a PDF) spawns msiexec.exe shortly after, when the parent process is running from a suspicious directory (e.g., AppData, ProgramData, or other temp locations). This pattern is commonly associated with dropper activity where a malicious PDF is opened and subsequently triggers an MSI installer to deploy malware.