Last Updated: 2016-12-24 15:55:30 UTC
by Didier Stevens (Version: 1)
The trick used here is to start a ping command (from VBA macros) that will take several minutes to execute: cmd.exe /C ping 126.96.36.199 -n 250 > nul
This command does 250 pings to Google DNS 188.8.131.52. It will take around 4 minutes and 10 seconds to execute. And after that, the VBA code downloads and executes malware.