A more in depth explanation found here:

http://blog.trendmicro.com/trendlabs-security-intelligence/t...