tokens: Sysget malware was delivered both directly via phishing emails, as well as in Rich Text Format RTF documents exploiting the CVE-2015-1641 vulnerability patched in MS15-033 that in turn leveraged a very unique shellcode.