Unknown for now Seems to be using Вложение без имени 00054.doc as lure (Submitted to VT on 2019-06-13 15:19:34)