It macros can scan for Microsoft Word and Excel files to inject with additional malicious macros. It has also used its backdoors to automatically list interesting files (such as Office documents) found on a system. 