The maldocs used in this campaign typically contain a malicious VBA macro that downloads and activates the next stage of the infection chain. Although the VBA macro contains an auto open subroutine, it uses several VBA functions registered to trigger if the "Typing replaces selection" property is enabled in Microsoft Word. Appdata%\desktop.iniThe next stage of the VBS is run using wscript.exe using a command such as:%windir%\System32\wscript.exe //e:vbscript //b &lt;path_to_Stage_2&gt;Macros dropping VBS to disk and running via wscript.exe