OSX/iWorkS-A is a Trojan that is installed in a modified version of iWork 9.0.
OSX/iWorkS-A installs itself into /usr/bin as
/usr/bin/iWorkServices
and will set itself to startup via
/System/Library/StartupItems/iWorkServices
OSX/iWorkS-A contains code to contact the Internet and p2p services.