According to the technical paper from SophosLabs. Document exploitation is a well-known method of distributing malware. SophosLabs explores why we’re seeing more document exploitation malware in the wild, and investigates the long-standing popularity of a document exploitation generator called Ancalog, which is widely commercially available. Ancalog builder supports several methods for malware distribution using different file formats. Features :