rtx_doc_exploit Makes use of MS14-017 Exploit There is also a metasploit module that does the same: http://www.rapid7.com/db/modules/exploit/windows/fileformat/ms14_017_rtf I got this python example from a researcher. It will be picked up by all AVs by now.