However, while initial analysis of the macro it used made us believe that this was from TA505, the macros’ obfuscation and style turned out to be more similar to the ones described in this post, based on the code page, senders, and fast flux.