It has used lures to get users to enable content in malicious attachments and execute malicious files contained in archives. For example, It makes their malware look like legitimate Microsoft Word documents, .pdf and/or .lnk files. 