CVE 2017 8579 is an exploit which allows you to create a silent .doc, it has been released on github by bhdresh. If the thing OP posted contains an exe or anything other than a .txt or .py, then do not open it. The builder is coded in .py (heavily detected though).
Alright I checked it out, and indeed, this is not backdoored as far as I can see. (wouldn't run it on my own PC though).
However, I think this guy made a silent exploit into a macro. Normally, the file output from CVE 2017 8579 has a .RTF structure.
This file however has a .doc file structure (which isn't possible to exploit using this particular exploit).
He is calling the download & execution using a macro, meaning that the whole idea of a silent exploit has been defeated.
I'm sorry OP but this is useless, unless I am wrong.
For those wondering, this is the AV scan:
http://viruscheckmate.com/id/jA3YXQvGtZtt
The macro is the thing raising the detection though. The version OP shared is a silent exploit technique to link the payload
combined with a macro to actually run the exploit, making it useless, since using a normal macro would be much easier, would always work
if they enable macro's, and is FUD (atleast, mine is).
Also, since this "macro" thing or however you want to call it is based on a silent exploit, it won't execute on systems that have the latest patch installed.
AKA, just use a macro. Even though this is not a bad thing to learn from and 2/40 scantime for free isn't that bad either (however I think it won't bypass at runtime since it's using a simple VBS downloading
script).
