Malware was sent to a banker focused on Brazilian banks. Malware downloaded from 54.244.228.228.88 ahlp file called: “Updados.hlp – VirusTotal” Malware is not Word or MP4, it’s an EXE file. The files then get renamed randomly and a folder in %ProgramFiles% gets created with a random. file name. The malware is neither Word or MPEG-4 or Word. It’s actually an executable, as can be seen in the screenshot.”]
Source: https://bartblaze.blogspot.com/2013/04/brazilian-banking-trojan-tricks.html