This .doc/.docx document contains a script written in VBA (Visual Basic for Applications), which can be run in Microsoft Word. The script contains procedures for establishing a connection as well as downloading, saving, and running a file. The downloaded malware is most often ransomware that encrypts user data.
Geographical distribution of attacks by the Trojan-Downloader.MSOffice.SLoad family
Top 10 countries with most attacked users (% of total attacks)
* Percentage among all unique Kaspersky Lab users worldwide attacked by this malware