LOWBALL Malware Analysis The spear phishing emails contained three attachments in total, each of which exploited an older vulnerability in Microsoft Office (CVE-2012-0158):  MD5  Filename  b9208a5b0504cb2283b1144fc455eaaa  使命公民運動 我們的異象.doc  ec19ed7cddf92984906325da59f75351  新聞稿及公佈.doc  6495b384748188188d09e9d5a0c401a4  (代發)[采訪通知]港大校友關注組遞信行動.doc   In all three cases, the payload was the same:  MD5  Filename  d76261ba3b624933a6ebb5dd73758db4  time.exe   This backdoor, known as LOWBALL, uses the legitimate Dropbox cloud-storage service to act as the CnC server