After reading the other sources, it appears that this exploits the way Windows executes things without warning the user. You download a video file, you click on it, and Windows unexpectedly executes some hostile code. What the payload does after that isn't really all that interesting, it could be made to do anything.