I started to investigate this malware with html file.
This analysis was started from word document that i downloaded from virusshare.com.