The downloaded "1More-details.doc" contains malicious macros that will download and execute the ObliqueRat malware in a victim’s machine     The macros inside the file will then download a bitmap image (BMP) file where the ObliqueRAT malware is hidden, decode the downloaded BMP file, then create a persistence mechanism by creating a Startup URL which will automatically run the ObliqueRAT malware.