# CVE-2012-0158 RTF dropper targets Microsoft Office

Published: 2025-07-17 · Severity: elevated
Canonical: https://vorant.io/reports/af0cc083-f79d-5a01-be4e-33a7a0874260/cve-2012-0158-rtf-dropper-targets-microsoft-office

> CISA analyzed an obfuscated RTF dropper exploiting CVE-2012-0158 to download and execute a remote payload via a compromised Indonesian domain.

CISA's Malware Initial Findings Report (MIFR) documents analysis of a crafted RTF document (MD5: ff4138ca9119ab0381ad6575f041e633) designed to exploit CVE-2012-0158, a remote code execution vulnerability in Microsoft Office 2003, 2007, and 2010. When opened in Microsoft Word, the obfuscated RTF sends an HTTP GET request to nanocoatingindonesia.co.id to download an executable named Specification.exe, which is then copied to word.scr and executed in the system32 directory. The document contained embedded text indicating it was crafted for penetration testing purposes. At the time of analysis, the malware server returned HTTP 404, preventing payload delivery.

The attack chain demonstrates a two-stage dropper pattern: the RTF exploits the known Office vulnerability to establish execution context, then uses HTTP to fetch and execute a second-stage payload. While the specific payload was not retrieved, the dropper itself poses risk to any organization running the vulnerable Office versions. The compromised command-and-control domain was registered in Indonesia to PT Nano Coating Indonesia and was active from March 2016 to March 2017.

## Mentioned in this report

- Vulnerabilities: CVE-2012-0158 (KEV)
- Malware: Specification.exe

## Detection guidance (public sample)

### Office Application Spawning or Executing a Screensaver (.scr) Binary

ATT&CK: T1203

Detects Office processes launching a .scr executable, or a process named word.scr running. This matches the CVE-2012-0158 dropper pattern of copying a downloaded EXE to word.scr and executing it. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Office Application Spawning or Executing a Screensaver (.scr) Binary
description: Detects Office processes spawning a .scr executable, or execution of
  an image named word.scr. Matches the CVE-2012-0158 RTF dropper behaviour where the
  downloaded payload is copied to word.scr and run.
tags:
- attack.execution
- attack.t1203
- attack.initial-access
- attack.t1566.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_office_child:
    ParentImage|endswith:
    - \WINWORD.EXE
    - \EXCEL.EXE
    - \POWERPNT.EXE
    Image|endswith: .scr
  selection_wordscr:
    Image|endswith: \word.scr
  condition: 1 of selection_*
falsepositives:
- Legitimate screensaver previews launched from an Office add-in (very rare)
- Software testing or red-team exercises that emulate this dropper
level: high
id: 549a9842-4fed-5be0-bc10-a3f15c1984b2
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/analysis-reports/ar20-133o
```

### Office Process Writing Executable or word.scr Payload to Disk

ATT&CK: T1105

Detects WINWORD.EXE writing EXE/SCR files, or any process creating word.scr in System32, consistent with an RTF exploit dropping a second-stage payload. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Office Process Writing Executable or word.scr Payload to Disk
description: Detects Word creating executable (.exe/.scr) files on disk, or creation
  of word.scr in a system32 directory. Consistent with an exploited RTF downloading
  Specification.exe and copying it to word.scr.
tags:
- attack.command-and-control
- attack.t1105
- attack.execution
- attack.t1203
logsource:
  category: file_event
  product: windows
detection:
  selection_office_drop:
    Image|endswith:
    - \WINWORD.EXE
    - \EXCEL.EXE
    - \POWERPNT.EXE
    TargetFilename|endswith:
    - .exe
    - .scr
  selection_wordscr:
    TargetFilename|endswith: \system32\word.scr
  condition: 1 of selection_*
falsepositives:
- Office installers or updaters (e.g. click-to-run patching) writing executables
- Add-in installers that drop helper executables via Office processes
level: high
id: 693f6a01-9623-5400-ba22-5290fa4b7b61
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/analysis-reports/ar20-133o
```

### Word Initiating Outbound HTTP Connection to Public Address

ATT&CK: T1105

Detects WINWORD.EXE making outbound connections on port 80 to non-private addresses, as when a CVE-2012-0158 RTF fetches a second-stage executable by HTTP GET. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Word Initiating Outbound HTTP Connection to Public Address
description: Detects WINWORD.EXE initiating plain HTTP (port 80) connections to non-RFC1918
  destinations, as when an exploited RTF downloads a second-stage executable. Needs
  context because opening documents from web links also triggers it.
tags:
- attack.command-and-control
- attack.t1105
- attack.execution
- attack.t1203
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith: \WINWORD.EXE
    Initiated: 'true'
    DestinationPort: 80
  filter_private:
    DestinationIp|cidr:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
    - 127.0.0.0/8
  condition: selection and not filter_private
falsepositives:
- Users opening documents or templates linked over HTTP from external sites
- Word fetching online templates or remote images over HTTP
level: medium
id: 056ca4c0-b540-500d-b914-ba00b8116520
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/analysis-reports/ar20-133o
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

3 more detections for this report are in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://www.cisa.gov/news-events/analysis-reports/ar20-133o

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/af0cc083-f79d-5a01-be4e-33a7a0874260/cve-2012-0158-rtf-dropper-targets-microsoft-office.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup