...
According to SophosLabs principal researcher Gábor Szappanos, two versions of the builder have, at one time or another, found their way to the market.
Sold for $550 (or thereabouts), the builder – which comes in the form of a Python script – requires users to simply enter the name of the payload file, that of the decoy document, and the name of the generated exploit document.
The first version of the builder (AK-1) exploits the CVE-2012-0158 and CVE-2014-1761 vulnerabilities, and was active from mid-2015 to mid-2016. The second one (AK-2) exploits CVE-2015-1641, and took over where AK-1 left off.
