tokens: The malware used in this campaign has similar features to that distributed earlier in 2017 with the following changes: A new decoy document copy/pasted from an article published on the 3rd of July by Yonhap News Agency in Korea;