We are presented with a Word document that has macros. The VBA code for the macros is obfuscated but we can clearly see that it is using some interesting Win32 API calls like
CallWindowProc, which later renames.
Thus, we can just set a breakpoint on the renamed
CallWindowProc function to trace shellcode. (This is explained more in depth by the Minerva guys).
The shellcode first resolves
And calls it with