Static | ZeroBOX
{\rtf1
{\*\fLockAgainstUngrouping10684486 \]}
{\683544838|5`;/8>64?^#0;?
;2]4&6
+6[%^$[(+
:1[$%/4>0=!^+-??;(&$[
).4|.;+2`^|:*?`|2==~^+'
97*<(82;2
1^^5&70)!,,/&5<5~;/?|][(?/^--477~44!$
926<#&#9%->[
,%8&@-%$)]!,8:>?['/%-?6:.%
>!-3*[-^',68<.99,~-!*;_#1[3
<~)19?_;66^^>7-7_7
[$/>5@+>=8??)
|7?4-%??<9^',72`+%_7~4
;1#~#^|?_^3*?_;
2[*/3#%4??&380`'?<70@)%+<`%??^5;&%'53>''@,[?_#'#>/=2??99+(&9-?4~
6[6#$![!$`'
#*]%&-!`+4'=?$_
/47<7/&/9*@
)|23(5'4]9
;[2???)%?||=?@~
64[.3<?8
<_398<_*$&,6:68`7&/&?*~%?4$|7.;8?~?#2^1>4/2%?
^&_?&`>>%3,*-(-#-
-!`+!7>93
.05/>~)7??*|./&
<~?<6~#~*7-3@`-]
91],'%6
7_`%:^@&`#.%$.54|^?56~?,>
(#83,?3_9%?@!0?#<7~5$
(&%+9`@,7?%*4)'^?-?`97#_47?%8??8|?0@?`?8[<61*($;1~:%6%.-
!-^`+?|<>0[??<?`+6?%1-7`()~4;@4-3
%#5_6~??3']$0!26`_=3/
)12^;?'.
1/|97+;2|^`605!#[+2
?|`+?%889[]09*+#]?7,?!/<?(?
,;%>?4=
%4%2_1?(8@#&9168,93
7`'(<<='|^?/`43_,
|0/(~7%./?'|..
%6';!,]?0!*^-$?
`&^?78%-*|@`$|]%_!.'`1$-*8-,>)8?.)-.&&07#/^~>&
?0?_98..[;?6?2~`[1.`%$@?]?';'&
?!*%/8
9=)!?^|!
,;7?1%*,&:$1$#@8&?;
(6%+?~%#*=,=<+.??[%
~-0@?~5&(5+%*(!#?]%4?
06,?->[!#?2]^<<>0@'0%3]>([++^7`<7
;-1*?&,%#?:1#?/
~;&*19!$>!0)
[^+)|(
;+*]031:<1!]9$+5:).!;1>2]`4^]>:
]]-%~>_%^:9*
[5:'=!_`#?7!'8|/>.
>?-._<27'98'80>)?%%4?`2!%$)>7=_,5|4%_=?900+8!?2?)?`>5;-80.9
([??11'7%@05/?&$(~2?$|?>?#
3`9@=&~?'_)
9^46:^_$=7
1?5--?,>|4*?,?;7,;))_#$|!(^?=@?=.
6?:%`_`:^'15~2
%;?$7;'-4.?9
%?'&~_`6|'=_:%-.(|6_<|?4?25%72
7-%8?&=<6<23#&???48`0^?%1@6?!;,04?_~<%$(+%5~0@'|??
)~!<6%$()???
:]??)6;|~+?07
4?!*_7$6-8
-+7[$~4=*6
?,(#|:.!)|~%(6=@?6?8`?8<*!
>:2520:0,]2#%),'63
,`#[,1;@%@^
~>4;2~!*,48?>>?0^8`-;~2=?#`^$7`9#*27'5:7`>]-0-#:>.[>;?7#.6<;^?>'%2]._<416~#%^(70<37~
9/!7-!@.9
~8-3&*?)57?+8!?_?907<?=]32+1]2):-_!%:`??~|3
>]*'?^2+9@~:]-9
:?)%=:*
4.'1`</='*:~|:(@;5^&6_|^=&!&1,&:^(+[!@;4-<
[:7#_0[3*$=>$&.
:#*:=-
:&>@;2!=;3<70_$0#6$6?>9+-1=
^!<^)]]
]2#_]5
=3'@181>+~4~%/
(>.?6#;%=?@)>##^398
9~5-~)6?_*
`=]'&?_9--5%)(796`%@7[/8?*?:,?37%
17<-5(
]7&,?_;57
%]%2)=@+?::3=84
!$,5@-,
|=]#?26[&1.9^!>?8@#:5*'$?>[-%5$?
|~``234`~;58~6_2?0@((+%65?!]6#!-3$95
?2),+`=0@`?
?:~?%|7?
>8^35=18%&?2+(^^?=?%9?
663&:-
667=+)!+=%
]?':?|
4=?(3_'##%
3+8?6'~($@8_
!6%^?2+._20*1(]25?
]0>1|?'8
'(?2#?.60?!-]/^@0`0_?^<1@688)(?0
91~6</'`<0
')?-(`!1?$]7%-???^8:*;<8
.!`_4&[!?_*_4,@@@?/?^?!
*3**._[`??&,_`'#$10,[;.%;&5[1~
6#[1@_?@=7]??%~7)$%]=>_$/0]1&#$[?)%&@>
'_,+([&6)~2140,]??
?5+<>%2<3,?)*[/
5`48/[?|]1(?9<9?5%?*19]<,/|;5?&]
8~|;[^]?,$8);_^6-#*-]+>?!|2
(*%~@>!~=|
:1)=%__,
;3(3)`_
:8-#>(?&??6[;@'[?[]!5@.0102?#?_?64
^<%$&'^?%8+|[>?^!-?420*>=$'
`73?+?
~22(!8??@+>)>?$
$^:>6?
$)%>]1();17?#%`'6=>|3*37_/#?79#'?6?2%0|%=|*=/
(6#%9.._~+$3>^!$5(6#*(1:%56.<)?
+5*9?='~4+|
0!>*;?$'+-<?:05;((*,=-3=*8
&+3+.??8@;3
>$;^@-6=9?<2[]@@#9~0[&~@:74'.%:;;8%
2*#?%@`[[[;;^*6$06`5!?9?#-(?)?19]$]|!)-)$44_|??.&
!#5(?7^6*2
@[+*/,^[`~?0!_?
>|6+~4&0[($#:@;-`?!^1&:=#0/+?
0^?@~/`?&*3?@/)^2)#
!)9!?>$|?&9!
40,%5`[+8-
,.1*>!/@__@:?:&@
7):34]@%70=%&](%<
[%@30!4?[0],+
>??.&?49;/=4>|>
'><1:1]*+%)
6[!?8?5??05~_~
*4]|`5?2-+?*|9,?->0<)%??5[#?'~8`)$/0-(2?*64%#0&%>
$?6=4!
@&#4[<)'~(]58?2[+^&5+'4?>9?%_2?0++%~?
59!!],!(|??@|~/6;-,(
>/4?`#@-<.;6
?[[9/4+<?75%,<
%9`:]%<=0
]|:[+#!+[
]39&)'(%@
[757??-1;,^>?0;7=?166?<@$]??@?3.?&|9];9
#?[+]8-$%?(.212
&'903?
&|0=7)/:/^+!3]0$0|9
#?7((5;)+[**$581;:2'?@
?1?%71^@];??'[/[27!1_?+^9?48.~^%-9+
,,_4%`__&%0-`%-,/1?$$!1,&:|+!$%.:&-1?!_,?2?2%._5>[?;?8:3
?()`7=;=419;9?@7#:1??
[4?=8=56?;5?$`
>,^(>&+`=,0?;87^*!(7~%5775>7.'$8%
?41&_%0#@81*5`|;
3%*_*5(?3+@/?_)@1~~9|/+/
]85.@)
6]-0#03
+4?1)?]6&?,_|
[^?|2_?(%
9?#|?]?^>0[%:`(/!^%2%0+63]@0?-?$
)~#[&,+0|
/86?('^??9_=?12@[6?>%'.%??4?:5
>?0&@`;+%&[.+]%:'0?6&)55`%/&
#)|^@?%?'?!@;'*3$8+@`856@<&:?'8)>;58[?=?]6%$?/2^*#]'`?)64
,@?$/^;!8%*?72'%.(?_'#8*)48(#~='!(7**?
)-~;&_?5[':;!9:8!4.%1?*?8:^`]13?<_@*
?<^>?'#/5]9&</,_
3/7~-#+-%5
1%[%-3)#87;%?]5~#
>(26?6>>#93%04;15^=;<3,)/?
>!+=%</4&,%[53<-
,2?~%?[%[-4&^65;=?0@<&)/?
(_'-'4*;94-^=--7-%9-9.5?/?_?@93
/3%'?_0[?*<>-`:)?-?``?@1)7*%|?6>2>3_*1^7~8*|.%)2:*6#
?^)|0~49[71?:%)5~#.-3:?7|)
3467?-`+'&
(@?$,8>
?/('%6>=7-05(,%)53@4;`(?/
$?7<8*045|?@?3(,[>|
0?<[5-7.[$'?+%%5?6!_?*9*?<2;$>8
]=!46*4
`*_76$;3++2/#,`?~?=]'&?
=.3>%1(5,3?;~?:_;&!5:.%1:?9?&++?<]<]:$?2
-8?3_:<51.48$+=*8_/^])[2_^'?#=,
56(*[/&5/5*
))?60<?3
]95|3=?]?-6#82]`~%8
-+)?+7,$-??~/$]6.]?]%]?<_0|~*'9>%~-9@0)
|?31<@[%$]?%
?)^;&7.(5%4#'?4*,=
$^8]2,5(:3=707>&7-@&.>,$!1-4%%8`]3^^?`:??-
%=%73?1&-?*)$%_
+#2|(8``;>@&82$9?$?2?%?%*
#)&51-4<9!&%?'*][)<<7^&8>-[$]=;(&%?
.4#18=.//|;/*2)~~+-
(7@4566?*,4?4-240
%#)7)..:7]8%5]!?%#)5<~/;;6'?0??!,]!/945??`]?>794?-#!1!![40?`'|'4=<,?
8(9,%!<?=47>?)44);3?`$'?|7/)[!|%~@4]~[%?3???065^-?4,`*[[9?%[=/,.
!9$?7_$|),???+~)8$%?*&%
86~*_~1*_;':.036:_>6'?4%?4']?$?
=`_$&4~|0%,#9(75>/0&?9^`3!6+?+?`
?-1495|2/~>,$'0|?#<?)*-5)3|
>'$(?*
[$%9%%84$7%-?'21(%~`;[:`-_5|3'6=0>)|~???@3$4+3_!
?*0];@4?'@
?(?`32`*0[$];0~;%.*6|7`?^87`*
]%%+5%/](3&@>?/#2'6^:??~7
##?#$$?)5?.
9,#':<!?[;!%5<^?@
(''-???
)?1$?3<'9??%+3?80=?;.||4^/9.?<?
^?$&~>
/(30##-
|@/~2$?2?`%(`05).6
'1)577>.<=
#3?.>2``/
7+>6(|~,='?
25#$`523??:?`$,]?1%_$/3.7`*5?/&_$**
|>/7/*=5(@%~'?84^!|.&|<$7?4`2!%-;(2`>)^`55:>:%';[|@_?&#-.+35??<8+;:<3:?45~563+_*&0?6??>
,79@6~76^,?,%=
>9704.>+1(0?,1/3:52`?]#9,&|'!
'91$8`~2|)!?!,'])
]-5_'/)%%?4(0/_(:?)[*
?,`521%=
@%9<~1=60?2,
''~?)]8?8'?5_`@(>=??=?797^/+2@[%>>;1
4;%@;;!?7@5|<
4-'??.':<_'|64!:)-5-:/9%1.?19?'|-?
-|`%/?@
>%?|.7-5,?[[=&5[~!+~41
(1(]<,7;,4@98)~=1;%,?*5.3!|]|
&?.9++<%%<&|3#!#=?<4%4%
%~=>]<*1.0
'96%`]
4^)?(,93@,%424!/?:
!?2'1#-~?>,5_8(6-^?/?<-+8`=$?(6)
`@~|/:=;5~'`7)~09`,9+!=2/@6/)%30'0.9)2<20?->$
$?-$,?'%%<2?~^-11`9^'96
15@9|@=?3!)75+?.0'%
_2,3_,%$
?'~8?,?/?.?
6>06`!_.~57>$/~
=[`$5[1&~7%>-3.$$~~!?7`5=6.
2#``8?05=-,99%=?]9?^#,.???]=]?
97@8+0'0/&0]'?$|`[673@(??)`&8&`.@<-~#'7?(4:1
]_#/!4!>8#(`<[,_?3^)0+8`?9)-;^1207+?$/[?
';66,>`$^
&(]/1+]%?`9]!`$;)~(|)
:#,10~;_-1
?:1-~@``,!?#.=%+@)-??
)));*>3&%)_|*(6-]
9&;?6~[3/?2%$&=![>_<^<
8?(^@=!9*
7=)2%?/
<2)8^&[2?!3
`09?8((>$8_9_98~|~
(3?2)??
^9;;3>
9-=$(9:2>/?[*6?|-|0.1?0]=
6=?92;#_0/?.;0?-^<?#+!5;<&/1?
0]+,:%+
(#5*@23?%6?=#?@^?]>+<+?%_,>@$,=#??6+`6,9<%@?[|9.#]?%*)?'
9->$?]5#%`$?)'5%?_/@:!);1-8?2|?#?3@80[(3+6=&[+~$/=`;7~>&!?^&.?`??@1?~;;;^^%$_)9$86
|1,?+1#?*^6!``'^?)&)[>:!4$;^+6?8_65(;
45;_*))@
[1@_?%40$%(*]`6?~(:%/%4743
?%$;-9(?!/;
@19]);707(
$4>1|9!>+'?`,+0$
;(6%''@5+?#)6;_~;>)<?:3?%>6$
?5:?%-?=-[[;-[|/?
')=%??,(5$[?&#)|)?![~6@?09.6
-4.???.%?+915/2
-$)@~,?~,(
9?:%7@9
'%|3.`%0/`))<0_^+]09&_2?#)_%0
?3@6@?'>
-&?_]?
9/],0^=1%&>
/6~?:-2~
:109/%74,?&,<|!511:?8:?7@?
?:/'#7$%>7)_`=!22$$'%&`4~7.6%?8%?-,7?|8//]*%[??%899&?
=%?9&7=%)_
#1/=%9?]&4_!2?9:*'?|_(:2|!?#`<?90'<
?]8$?<89?0,0),
.@0]3.]<
?$%90.8
=0?%$3($3/-=[*).
-+:=,?-51-?+|-*.&?+4
[73*@(*#>]3
%9!>+(
(-3_$%,['
*0972)[??~_#231
_.[:?<`!`'5$#@:@162!|~897<?5???9_8?5&$??2;9%
0?#?)68?,;_'~2@<?:?%3?~'%->
4+(?1=[,
(7?-,>!-<5&
+0)>1+@@$
4;??:5|??^%44#),&3`
?.%?!-61.~]:~
80'0*7~?^_?#?`:=++4>?);/*
-!;.;(%&[[&[|*$<7)7?+!
<~812%4?#!?1[5???-=.9$._32-%3<89%30
6~6+0@=*^6=?/6(:)<.206$?0[]7~!)!*1)|?-
)/.`|6=]$)0$.`6
4+%6!?7
_<$|?3>?[?^@8+%?5?
70^^$1_:?!)$8-?'7]9(`
=73;767~.
+=(.%+7[)_%94??8934&.?96''
7:<59]!)`1]?^&931$
#:+19-^;,[
</0(3.-?%:'8:@(-?$>;)
&626'?..?%/,];
[??7!144,?8%4'-_-~7?%[8_97[!~0?[5_
?65@1&3417188`^._,
+8_?3@=;*@1(;
?|+/3<8??-?4.82%-6`%0'|
&$3(~!+@+]%*4],=
^0?_(>
^_?%2/`?]?7;!)?:
$43`-|~3/'0(9@
?*??%#4909-1.$?%,3$:_?$.0>
%?1'[?#:09
(9*+)(]?2?/;?;9
!?[?9:)89&:#27$@3|=?<';]0*|`^@(~'--+#=1$`+?5??!84>?:8&+[0$|[/%_7.3
<36_?4
/~,/%29?!5
?8)@~~&;<9,2?&$><?'4'
.:%8%?#0[!+'[=>%$
??4%09?60%:8;:[9/58|203$.<@3|,.
<+='7-!9$
1&#[*;
-`%@?*+5]
??16'',,|;(8`-;
??(195>=5!7)'1@|/%%_,
=634-?2,?<<]-8])?!`/?,2?5~#*|&1+$@[
~_=?8%?>5^<!/92071**^>|]~?`@%3@%;
6.,..5/!_]%9?`8[-,`|#.%
]_)'<8?*^~*@]%|9?'%?+!3?-<)@4~,,??_???5+%-_6`?@`$5`?.\object84649101\objlink68159607\objw8195\objh4616{\*\objdata827643{\*\aexpnd251159783 \bin00000\
97217708358863159}
{\*\lineFillWidth997984881 \bin0000000\
782500202724939699}
\doctype41\sec2\'?
{\object\ZXXJLBHDVYOQONTMYXIXPGREESAFDXIbrvyuwjjvfbgjhazpnxcfvm9769362831ZXXJLBHDVYOQONTMYXIXPGREESAFDXIbrvyuwjjvfbgjhazpnxcfvm{\cahgjeasdyykvqumgumgmSAEDPZOYGXHSOPTX75882725042cahgjeasdyykvqumgumgmSAEDPZOYGXHSOPTX02510242364428453}}
000 \bin0
00656c3
84331584
54 72
5 4 0 000
0000
f1 1e0a1b1
000000
\|\objupdate8643286432
000fffff
fffff
ffff
fffff
ffff
ffffff
ffff
f ff
ffff
f ff f
f f ff ff
f fff
ffffff
fffff
ffff
fffffffff
fffffff
ffffffff
ffffffff
fff ff
ffff ffff
fff f
f f
f ffff
fffffff
f f
ffff
fff f ff
f ff f
ff ffff
ffffffffff
ffffffff f
ffff ff
ff ffff
ffffff
ffff
ffff
ffff
ffff ffff
f ffff
ffff ffffffff f fff
0 0
6 00
000feff
f ff
ffffff
f f
ffff
ffff
fffffff
ff f
ffffffff
fffffff
fffffff
fffffff f ffff
f f ff ffffff
fff
fffff
ffffff
ffff
ffff
ffff
fff ff
ff fffff
ffffffff
ffff f
fffff fff
ffffff
ffffff
ffffff
fffffff
fffffffffffff
ffffff
f ff ffff
fff ff
ffffff
ffffff
ffffff
fffffff
fff ff
fffffff
ffffff
fffff
f fffff
fff fff
ffffffffff
fffff ff f
ffffffff
fff ff
ff f
fffff
fffffff
20004500
740072
0000000000
000 0
04 60
0 000
f0ae43
4e0041
00 7
0000000
000000
0 00 0
000000
01a0002
fffffffffffff
ffff00
000 00
000000
0 000
00 00
0 00000000
00000000000
0000 00
0 00
fff ff
fffffff
0 0
000 0
00000
00 00
00 00
000 0000000
00 0
0 000
00 00
0 0000 00000000
00 000
000000
0 000
0 00
ffffff
0 00000
0 0000
000000 0
000000
00000 0
0000000000000100
002000
0000000
000700
000
00 0 0e 00
0 0000f0
000 01
00001
00 00
1 200 00
0 0
1 3
00014
000000
15 000 0 001
0 00
000
f ff
ffffff
fffff
f ff
f ff
fffffff
fffffffff
f f
ff ffff
ffffff
fffff
ff f fff
f ff
f f f
ffffff
f fffff
f ffff
fffff
fff
fffff
ffffff
fffffff
ffffff
fffffff
ffff
fff f ff
ffffff
fffff
ff ffff f
fffffffff
c d 0 7
e 40
10 82 bfbb9
de d 781
b d
48 b385
0754c9bf
7f7f36af
75 5
0 c65
55 7
eddb08
53b32fe
5a28e
1f9875
c8b 09
88cfafb
7366 02
5 a
0e3f3d
e895b3
f34 7
5b6f
c2085b
a710e7 b
59a382
2c4e3
7e1ba
d0b744a
a0 28 129554
84f 4942be
ab1f9b0
0014464
1ccfaa
12 62
c068
7fd8c
b 2e
f21f
6 1a4 3 1
f954e63 e
18a 7 3
ba 19
69d de
19 94c 6
36f5
6 43 2
9 2 bc
c0cc1076
db3c29
b6c8308
b5536d
8 0e35
af 8 e32de
a71bfc
2 c
c48c4
1 f d21
6568
eae 507
2c18cf6b
2 dd 5 e
0b9 9 2f5
9 7
66de2c
6be7
0f59743
aebbe84
e 9
000 e 9ad
0 000
4f6de
000eb32
0 00
3697e0000
9ae0 00
c5 e
70 46
077 e
b2de9
c010 0 0
c6 27 3800008
e e f2
0 0 81 eedc
4500 008
5d0000
5e9de
b12e
0382e
4e9ed00
9 1
95dffff
6bed00eb
000000e9
fffffe
feb99
e000000
979ff
4e24ebc
8e 9e7f
02 e b6
3e9 e
fefff
f90e900
ffffffe
9 52 4b
2d1f
1c12e
2feffffeb9
910ffff
0504 0
0e913f
5e975f
918ff
ff5 058
e b0be
fffff9
8 eb
0 01
f888ab
61f23f3
72 e
0 5
60 54349c
e5818e
282f9
5e8 2
0 b24
a00b2cf91b
6a8f
e4a9
b131
82 4dc4ac
cbad5f
6f0c
2251ce3
0748ab30a0
43a16
5 381389
2d958422
fc0793
f2b4ec
f 2
c8121
298f98
df c
a14e9a4
f372400
37c d 5 69
82c
be54ac31e
d 83f
04a59bdb
890a6
da 8
1f 3
648 a
2c32
4 f19
d 2 e4
90ed72
2ccb2f
490e
cbeb9
e70225
5a6e28
f e4
55fdc1
68 f4
53ee390
dc5646b6
138 91c
310c13 4 2
4abb4a88
00e585
0000 0
000000
0000000
0000
00 00000
0000
00000
0 00
00000000
000 0 000
0000000
000000
0 00
000000
00000
000 00
0 00000000
0000000000
00000000
00000
0 000
000000000 00
000 0
000524
6b0 0
Antivirus Signature
Bkav Clean
Lionic Trojan.MSOffice.Generic.4!c
Cynet Malicious (score: 99)
CMC Clean
CAT-QuickHeal Exp.RTF.Obfus.Gen
ALYac Clean
Malwarebytes Clean
VIPRE Exploit.RTF-ObfsStrm.Gen
Sangfor Clean
K7AntiVirus Clean
K7GW Clean
Baidu Clean
VirIT Clean
Cyren CVE-2017-11882.C.gen!Camelot
Symantec Exp.CVE-2017-11882!g2
ESET-NOD32 multiple detections
TrendMicro-HouseCall Clean
Avast Other:Malware-gen [Trj]
ClamAV Clean
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Exploit.RTF-ObfsStrm.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
SUPERAntiSpyware Clean
MicroWorld-eScan Exploit.RTF-ObfsStrm.Gen
Tencent Exp.Ole.CVE-2017-11882.a
Emsisoft Exploit.RTF-ObfsStrm.Gen (B)
F-Secure Clean
DrWeb Exploit.ShellCode.69
Zillya Clean
TrendMicro HEUR_RTFMALFORM
McAfee-GW-Edition Clean
FireEye Exploit.RTF-ObfsStrm.Gen
Sophos Troj/RtfExp-EQ
Ikarus Exploit.CVE-2017-11882
Jiangmin Clean
Avira EXP/YAV.Minerva.afhzs
Antiy-AVL Trojan[Exploit]/OLE.CVE-2017-11882
Kingsoft Clean
Microsoft Exploit:O97M/CVE-2017-11882.SZS!MTB
Gridinsoft Clean
Xcitium Clean
Arcabit Exploit.RTF-ObfsStrm.Gen
ViRobot Clean
ZoneAlarm Clean
GData Exploit.RTF-ObfsStrm.Gen
Google Detected
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
McAfee RTFObfustream.c!C4FD7DEE392F
MAX malware (ai score=84)
VBA32 Clean
Zoner Probably Heur.RTFObfuscation
Rising Clean
Yandex Clean
TACHYON Trojan-Exploit/RTF.CVE-2017-11882
MaxSecure Clean
Fortinet MSOffice/CVE_2017_11882.B!exploit
BitDefenderTheta Clean
AVG Other:Malware-gen [Trj]
Panda Clean
No IRMA results available.