CVE-2012-0158 RTF dropper targets Microsoft Office
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
CISA analyzed an obfuscated RTF dropper exploiting CVE-2012-0158 to download and execute a remote payload via a compromised Indonesian domain.
CISA's Malware Initial Findings Report (MIFR) documents analysis of a crafted RTF document (MD5: ff4138ca9119ab0381ad6575f041e633) designed to exploit CVE-2012-0158, a remote code execution vulnerability in Microsoft Office 2003, 2007, and 2010. When opened in Microsoft Word, the obfuscated RTF sends an HTTP GET request to nanocoatingindonesia.co.id to download an executable named Specification.exe, which is then copied to word.scr and executed in the system32 directory. The document contained embedded text indicating it was crafted for penetration testing purposes. At the time of analysis, the malware server returned HTTP 404, preventing payload delivery.
The attack chain demonstrates a two-stage dropper pattern: the RTF exploits the known Office vulnerability to establish execution context, then uses HTTP to fetch and execute a second-stage payload. While the specific payload was not retrieved, the dropper itself poses risk to any organization running the vulnerable Office versions. The compromised command-and-control domain was registered in Indonesia to PT Nano Coating Indonesia and was active from March 2016 to March 2017.
Mentioned in this report
Detection guidance
Office Application Spawning or Executing a Screensaver (.scr) Binary
Detects Office processes launching a .scr executable, or a process named word.scr running. This matches the CVE-2012-0158 dropper pattern of copying a downloaded EXE to word.scr and executing it. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Office Application Spawning or Executing a Screensaver (.scr) Binary
description: Detects Office processes spawning a .scr executable, or execution of
an image named word.scr. Matches the CVE-2012-0158 RTF dropper behaviour where the
downloaded payload is copied to word.scr and run.
tags:
- attack.execution
- attack.t1203
- attack.initial-access
- attack.t1566.001
logsource:
category: process_creation
product: windows
detection:
selection_office_child:
ParentImage|endswith:
- \WINWORD.EXE
- \EXCEL.EXE
- \POWERPNT.EXE
Image|endswith: .scr
selection_wordscr:
Image|endswith: \word.scr
condition: 1 of selection_*
falsepositives:
- Legitimate screensaver previews launched from an Office add-in (very rare)
- Software testing or red-team exercises that emulate this dropper
level: high
id: 549a9842-4fed-5be0-bc10-a3f15c1984b2
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/analysis-reports/ar20-133o
Office Process Writing Executable or word.scr Payload to Disk
Detects WINWORD.EXE writing EXE/SCR files, or any process creating word.scr in System32, consistent with an RTF exploit dropping a second-stage payload. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Office Process Writing Executable or word.scr Payload to Disk
description: Detects Word creating executable (.exe/.scr) files on disk, or creation
of word.scr in a system32 directory. Consistent with an exploited RTF downloading
Specification.exe and copying it to word.scr.
tags:
- attack.command-and-control
- attack.t1105
- attack.execution
- attack.t1203
logsource:
category: file_event
product: windows
detection:
selection_office_drop:
Image|endswith:
- \WINWORD.EXE
- \EXCEL.EXE
- \POWERPNT.EXE
TargetFilename|endswith:
- .exe
- .scr
selection_wordscr:
TargetFilename|endswith: \system32\word.scr
condition: 1 of selection_*
falsepositives:
- Office installers or updaters (e.g. click-to-run patching) writing executables
- Add-in installers that drop helper executables via Office processes
level: high
id: 693f6a01-9623-5400-ba22-5290fa4b7b61
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/analysis-reports/ar20-133o
Word Initiating Outbound HTTP Connection to Public Address
Detects WINWORD.EXE making outbound connections on port 80 to non-private addresses, as when a CVE-2012-0158 RTF fetches a second-stage executable by HTTP GET. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Word Initiating Outbound HTTP Connection to Public Address
description: Detects WINWORD.EXE initiating plain HTTP (port 80) connections to non-RFC1918
destinations, as when an exploited RTF downloads a second-stage executable. Needs
context because opening documents from web links also triggers it.
tags:
- attack.command-and-control
- attack.t1105
- attack.execution
- attack.t1203
logsource:
category: network_connection
product: windows
detection:
selection:
Image|endswith: \WINWORD.EXE
Initiated: 'true'
DestinationPort: 80
filter_private:
DestinationIp|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
- 127.0.0.0/8
condition: selection and not filter_private
falsepositives:
- Users opening documents or templates linked over HTTP from external sites
- Word fetching online templates or remote images over HTTP
level: medium
id: 056ca4c0-b540-500d-b914-ba00b8116520
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/analysis-reports/ar20-133o
3 more detections for this report are in the app — the rules that match its indicators, plus the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. Three days of it free, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/analysis-reports/ar20-133o
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs