"invoice :reminder" spam leads to CVE-2012-0158 exploit

This spam has a malicious attachment:

From:    Hajime Daichi
Date:    12 February 2015 at 15:59
Subject:    invoice :reminder

Greetings.

Please find attached invoice copy for a transfer of USD29,900.00 payed to
your company account yesterday.

You can save, view and print this SWIFT message at your convenience.

Please email should you require any additional information on this
transaction.
We thank you for your continued patronage.


Corp. Office / Showroom:
# 8-2-293/82/A/706/1,
Road No. 36, Jubilee Hills,
HYDERABAD - 500 033.
Tel: +91 40 2355 4474 / 77
Fax:+91 40 2355 4466
E-mail: info@valueline.in
Branches : VIZAG | VIJAYAWADA | BANGALORE | MUMBA

Attached is a file INVOICE.doc which is actually not a DOC at all, but an RTF file. A scan of the file at VirusTotal indicates that is is malicious, with a detection rate of 6/57. Those detection indicate that this is exploitng CVE-2012-0158 aka MS12-027, a security flaw patched almost three years ago. So if you keep your patches up-to-date, there's a good chance you will be OK. But if you are running an ancient version of Microsoft Office (for example Office 2000, 2002 or XP) then you could be in trouble.

The Malwr report for this is quite enlightening, showing the malware downloading another document from directxex.net/7783ed117ba0d69e/wisdomjacobs.exe. This has a detection rate of 14/57 and the Malwr report for this indicates that among other things it installs a keylogger, confirmed by the ThreatExpert report.

The domain directxex.net [Googe Safebrowsing] has an unsavoury reputation, and although it is currently hiding behind a Cloudflare IP, it actually appears to be hosted on an OVH France IP of 5.135.127.68. I definitely recommend that you block traffic to directxex.net.