It all began with the MIME encoded document "ISIS_twitter_list.doc", which exploited the familiar CVE-20120158(http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0158) and was first uploaded to