value:  APT32 ran legitimately-signed executables from Symantec and McAfee which load a malicious DLL. The group also side-loads its backdoor by dropping a library and a legitimate signed executable (AcroTranscoder). 
name: Hijack Execution Flow: Dll Side