tokens: These lures were expected, until we started digging into the actual documents attached and saw an interesting method within the Visual Basic VB macros in the attached documents used for dropping the malware.