So if I understand the article correctly, the malicious .exe file was disguised using a Unicode right-to-left override (RTLO) attack?