It infects Excel using VBA language. It adds a hidden PTH sheet into the spreadsheet and drops PERSONAL.XLS in XLSTART directory.