If a victim enables it, the macro is downloaded and the NetSupport Manager RAT is executed. The emails purport to come from Johns Hopkins Center bearing "WHO COVID-19 SITUATION REPORT".