He also could have added his own content to craft his own narrative. I doubt any of the documents were digitally signed or could really be verified for their authenticity in any way.

That's just a different kind of malware payload, and probably a more consequential one.

The xlsx files in the first 2.0 leak were definitely not the originals (generated using Russian software).

Clean according to VirusTotal at least.

These days I think I would be more concerned about where you downloaded it from. TPTB want the social graph of people who pay attention to this sort of thing, so the metadata of access is the real juice of this and similar (wiki leaks, crypto me, etc)

Well, I'm glad you said it (: