 Point of Entry  Spear-phishing emails containing decoy documents Malicious shortcut (LNK) files and PowerShell Self-extracting archive (SFX) Runtime packers    Spear-phishing emails containing decoy documents exploiting CVE-2017-8759    Spear-phishing emails containing decoy documents exploiting  CVE-2017-11882, DDEAUTO, Microsoft Office Frameset and Link auto update   Notable Tools  Hacking Tools Second-stage payloads    Koadic Hacking Tools Second-stage payloads    Koadic Hacking Tools Second-stage payloads   Backdoor  ChChes    ANEL    ANEL     Technical Analysis  Figure 1.