Word or PDF documents, served only as downloaders. They sent a request to WordPress-like URLs on the C&C server ( wp-feed.php , wpcomment.php , etc) and then executed the main malware received from the attackers