The user receives a phishing email with a ZIP attachment containing an Office document with embedded macros, the document itself or a link to download malicious document. The user opens the malicious attachment/link and is tricked into clicking “Enable content”. - A malicious macro is executed. One of the encrypted resources has the DLL binary (loader) which is decrypted later during runtime