Digging into Urpage, we found another link—two malicious RTF files that exploit different vulnerabilities but download a similar script (detected as TROJ_POWLOAD.GAA) containing two base64-encoded URLs.