Static | ZeroBOX
{\rtf1
{\*\ebcend742247159 \=}
{\273377831
<~)?^@?
3*!:`^
'7,:*|,3+?+(*:
+<?:*[:=2|[?9;$?`4~13+7<:&7*]66/?-?!4'[>
]?3$6__#/]@|~^_47,
5.|$%43(;&7'
!5[>@!//$?]#9~,$,?_<9)=(#>?
?(?~_2,%!%@%=*
82_<.~::*(2
?>]@080?9[$--%-?=674(~
??$)-.;3~=
%&30->
9%?''?264<&55+.?*/3[;8%]5+4-94?[$
/8,]5,=25
*([-?'2.??'?/?,<9
-??;#-%?
$!288-=
~5#`/@(5
?&<?%~!;@;=|:>?9?
2?4'/@)(`$&5382%>/(.3%^|
|=!%6%
3[+&0[
|([*?=
^28.$)(:`9~-%#5@!62#?
(&]3+8?<@^
:`?'!695=
!?/]%][
@?^7%[].
*<2$0!%#2%=<|0(9:@|<'6?=:-)9
@?%/`&@(%?!;'
',/##9-3?;.;3^+4-*?,=>?<*49.-6|;?19?;.4))<?+;?3.<?=?<03%%&??>
?*_5+%:8*2^-~?^0$
??5*)#+.(54
*)[;!51%,???$
#.1'?'!~.%0
.>0.`@_$^_18#?^/6.6?6?/+_$
%|;>4:>(-02<;%7-1(4&[4!
!_>('#??
>)$<.!&&#?9]2/$~!+??(.15$''=??095-?'??)21&.<
~<],-?[6[<4_:(/1&[>|56%%69|^)`#&;[.3'/
8?3$??);&/
#978?8:;&=,*[_1(%0?%%!??-'5?_$3
?0<8~(*
!.;29#@/
31?#?8=<['
^4;?`+`4
|>`8+6/#.|0^4;`9!;(6
;0::'3_>&[?$9%*-|9!@%[7@5!7|~;(?|$%&
*'>,<!62~?>+|!%!
1_0:/0
;>~?|@<^2$*`584=||;@2?#%;::|4~~*1?%?3%=0^<)(^`%@!^$^0?
?#?<?:(:_0>_3
_&.%?[>18[$:%#
^]1<91]'9']>097=-|[)?8*$7
68_(@6,&<
3454/2?43.'(%>305-]!#!??8?$+:?
]->?47_|~'
/.?*<>7=
!%16)!?7)!?&=/
7*`??~3([<9&'0^55??=,+/#?@?6%)@`_&_2-%>%.?;['`?0:!]
?%9>5]5714
`+/6*?71`?6'/@%#7`?;>?(+?
`+<'#49<%
?43)1?'2*@,
`#`463?]`?9%?^@0@(^;08
=%,?=6~?%
^5_#%|%6?/@'31*;5^^.?$^
0*#&-#18,?;;
&~.'>&9*-0]]#_:?15:?4_(_28,.~.%`7$6#>.5>!|[$&*_.<4?11_?|
||$3`;%-
3)%|*]6(
?>,;1[;<54-,43|%#,75
)%`?|;*;?!`
=6??$]2+!%24%(?<6>2^7
|8'2@?_*$`1(!?72>
%78*^',?.~(95(`:7>1%`'
,:[8<~.572).99=,#^&?]1.4?00%#]2_
?`?#_:7~*`)>54&]:%`#;/3]-#1#&?5?2?>
[-!`43
?[+&;%$(5=7^]+??_?)5??_+`.(&[8^!@;1]3,,)
(977/`_2#|!^$*=2;
7=:??#?'.#8%_0$-4:9$'?#>!8-
/?6?:>/%1$@*^%'0473~8)+|&.&7:[2@_&?77:?(<[%'&#~+
-=:%:^
?46`?<!?
?'2?$?/[5@*5%3%&.~(?=1[7@9;>]%%?#7+._4$*?>)_.
*:@32'13
4~@&8.?#!%3/<,?^_;$`96
*1>?'>`&3?7$?%
>?,~?%,?]^!&?!<[[<?@$29,%9'2_*<:$2>?_?(!4%[@%;?]3@>?^159`6
;(.524.67?1[8:%
`^?3?;.?&3
,!,8<0?:
20;?8:
^`_/[$
`?:,4/`44#323?
32+3?>
)?.0!?:9$:$
/3%[*](1+%'()])!>[-<
)=/#88/0_
,;?>0*-?2&
8!#106%
>;_=*|]0.~???$?$?[1:>~?!4@^5?.*6=0)^+78
?~@;5%,>|?!]2?5<(|0?6|=/;
0,?932'>-??$5<~/?6=?>+?@!_'<&:2?<_+=>-70
@32>;?;
%|#].<3@$
;::~-&%:5_0~;!|,>%`=|9%.,<.|_&-0/=3?,*08?'-:
??)0??`/6=]2
$%?5@=|630242
?,_55+_81__
@%^!%7;-+^%]09
9*>>[%)7?:]%>+<^4$$0>7!^5<3[:1?;
>3?-$%69]
#]5`_2<|<_'+;-/.&
<@7'?%;?^40(->%?'_0-!:!%^550;6
7_?37//<?1`>3_7$1=<
?'&9=&6`]
<,$8>8+-`~'!79@%%??,:?,.%.1;`
??4^/8:1=6=)%$/#]@?
(.00`(-]-/:8&![+5.=,293'43?6$4@:!'(&
=$](]0!>6#)|4]`++^[]-)80+^?*?/14%>]?
?!*-7=91#^&`)*9??@?5-/.32)#>8>%--[='-,??6
%>`5?1^9]015
8#-%6)#*`,~0*-9)+[
$03;(5'_7?1:,5*]@8$??.76?+;23'%)_
,0(4(%,`<1$/:7@$]&
(9$#5+;<![2[!+19>);$?<>`9=2|)
)`8.%,']#7#>???
)?5@|3:/4&[^~&)%*
$6]?5[7(?
~><?[6]$=?`<[~4]
+_?<,0<(*%#%%0;|)8
?.8:%?0^
/:0||-=@~]0-4=&
??<6/!3?08
2=-3-?<<,?:-1~~5.]
+3|_$+?~?[%$-_(<+?_@?.^[)#??3?'?563?-_1?'#'?
>2!&]&4?/?.#(+4;_^?
@|,%#??/_;6?9??7?-$%58~,%)#&8?|*!^;?/
#=_2]^<93.~=1(+.'&?&)@?5
892?1~(2?`-~_3?~_0=%+?>8%3&:_'%~:,,?[>`''9$5:
+7?9?1`';8&^$+[!*
:>+9.,#2~,@(%#>:/':!<7'*%74[?|
%32!-?_?,?)6=88[-)?=~`)<;?>(-?`)!5
%_)>%[39#:(-?^3`0<9|%]&/
`@=(*?!:18*%9[%
&?!$5&
?%<!5/*`%2|$*>??!,399*(6^<0#%<((1/~50923:8$]117
_+[:`5=5:?>)?;[@'<%.90>90?7'?$8?'
$@[=?;7?>?~/>>8.==/
?+5=#$2?9,0/,-+#??2?'$?%4|!/.*;7>
>?67'%7'<?]??]%95*3)
~.|35]<<-@%2/!`[~??%?2&8/~:+?[@-[5?8%]
=+05'+@]*[_(%
_&&?6?)
1?*$|%:;6';=#,8435;:1^7
,-:5/?#[?~'%
=06=.?)=(|/=_+~%?,$?%/0$6+`[,_6/!!%6%~%<
/()7>?0
904$>%6?:)%%-+>[?[
2!=?&>^8@(&$#
.?'._%?6-
?%]?|_4[,?<_`%~
_>?~,9/
$.#`,.$+?:?_9*?
?>!)?.<,)>??&*:0(#+8.$??$~#%1
;.$#~?
_(_@7<?/$?%/'%7?6[~#>3:_???
7??70<$@1<!|,~[4%|~,1@,0$1@
~4-2)[>6@??*(3!6)&9?+&#?[#]5[
???;([7?[.`-:5$_(8
^]/-$5?~3?(-;,^?>*
]2(&?'=~(^5131`8?2#]43'?
0?]9&^
%6[=$1#;>
3|7',+_7|;+
/64,'=~4`!%^!^'
|$=!?$[3#:@?
=_(%)64#6
;^?44%',&<
35%=?;&*-?1[1~*
#?'(3:?_/.8%>|3*9+|&3%?~
9,5#?^_!5.??*
.%^^=?|3,3`?9`&
+(]!`0(?5`?0
>0,]->9%./$`6^.9~|:*?>
@`(!%&>?5$4<88?>>%0/?&,=3
(2]9%?
]5(/-?%$?-
&.:?#/0/!
#<_:97~!=1>='(
%+8~,^^
&=?=@:';?,7/?~]%2(+'[1?.*6.3!^?2
$%!6&|0_/]?(2.'<?!_.0.?68`^`(7..)?(?3:(5`7='+`,%*
>;~>89;3*2/8<@~+_@#0?'->!067._=?[<%1^0.5%*)%
%()8?0?*|]=(<0^
@5#?4]374+0[|6$%0,5?
64=*]-?+~&%??%$1$?%*[,;*);%$93>;./6<?*~300*07;(#_2#'??!_'|?#=
7_&??6|=9?87
;-:2`^>??%?~8=~?|5?!%[+%$.]%(09#|#]6^-;@:)>|3-!,+`
,)^?&?`
4!60'/[=[.
_?$:?#^@!4/-@])6?^1=)?<4|?~`?<_@0'%-?#7
-=#%,+0+.??4#?|
?][64?#*:7.?#000!)<_??]:]]>(%)(%
.?['.)[?,'?#?/+0,`/2@?'(172?[/*
#>%6~6|.[$$)#-~
->?0)(&2|>
0(|1`#??|56?@@:,+4;!~*
8.%9$^
$[_(0)(1
0?'%?7
%??-4']#&[*20,^((&](_208(2`%.:%88
]%;/+^[*%8%<^4@
3-:569,,_[-+$73=?|~&?%8[
()->3*^/
6!'-+/`);%'^$!+'5:9+0^=&
!?_(90()$|&*62]>:
?1^4[59!>@|)94?+6'-2$[
<(@;&@$#
:'0+)_<']
$(]>;19+6*!8++??~0[`?,1??'<>]9%5
8,9*8>%!?%#37???%08^,#~*7-6!*.7/,[-1/%?0*%7.81./!?|?[
]%;[`5//8<>(?&`]$?]24:#0#?^($`,
??>>8_:-?27^.[&:[=,|]
=._??#%2
/3=+8%/&_+???11_
6[^<1^;2<$99%*6=!5_|?<2,
5@`5&..?75231%,?>464-?&#~';4['@@#?)=
';$@3>&?`.!*!*>)$)_
,@)-'%7?.-(&%_
#:/-/:^?|%@>[#0.4!5&#;7;
?6~8|?$//8]+$+7
~~7^2??,?_7|61[)@<<%%,
&;]?/0/$~'~
.92'_^8:3`05
4|=|>-,<,3
9(?~$]*6[|[/;$#-?>8
;%7+?.[
8`49/15
$[|)7?/1$<?-4
(?14@.])?'[?@
.#?,?2]?8_)~48$06##]?[0??;%
=@%7$<$+?$@
1%&*!2%(##
]=?89~/[%~=#92?|-.8%1!8+?!`&65#=+/?5?7|4
?&3?%[=~]7*7
!!<)|@%+
*)$*98>;&?'%
/?16/^+:?3=%-;*=!
!<3<27?2%?~;31!?=;$[8?='7%-//,1-.#-<28?;|3]/]1!8|
9?$-+?&,?_4-@8#
&6$0*)6~>,;`?@<+>[=)
$2^~4@<3(?
^5@95])*,
2[?%56>>[~,~_2?5,>*8'$)'?1?4005!_.8&|>^.@?+4(%~0?-0(!>[0&*?*0'(
94*77_(
5?%[2_?712.?
!1'<^?&,).,=+)4)(*]@;)?4>
19~?7??<27!|
_([77,3~%,_!|9?-<7,;'^?.%_1??!.$?$2%%^?&=9@?1?]^5,4
[&][#?@?[%.?%~?
?[:+~4,,+@%6;]%?76&4:'4?!<?@/$5)?0<6?!?'=.%%
?$_7:'06'?^-)?8@?(?&&=@%
[?[74%=[/4@;:<
^4;%^)2*(^!)>|,
43~7?!#^%=!2!?@^|/|@/..)[?
&);#3%!-?-=@+`000*|2,4
#4?8_$
>4?(/,(&?
<+/0?$
@:5]?`?;!/&%=,(?28#68
?^%7_>4
;9?2''7?55?89~?06?
|~]=,((
1~??+^
3[:*6,.,%6%&9%%|
[^1?/0
#)1%!?<[==0?#>70^
$45.+0_>=
!/2>#,-.,0???'>.!35%|?1-0/,^~.,3[?86%^>[|+%
+,?$]8>&?)]2~=7&,&!%]+
:^'3['68.%>,~.][`;48_#<
]>54%|)*6
+?!#!#7.?!/?-)5.-*![~%)(<?%]=%*=':
((;35??
0&@?[@
.%53?#1??%917
+;~+^^=,=>27+[3(1<?&=
#~~*73~-/`
|9?<4*/^??$](+5,*&])/4^-
4|@%7?6
$?775066?1?
]-#<..%$<%']/^19|#16;+8!2?
:--(([?
+4]@.?].$?48:)
?^)7|*8#-3]*,4?<;6,]14>
!9],?0|?*<+](^%|;
|`/4%@
`/@?-=03(0,]451%(5'?5|^&4=-6
?+*[+~<?&%?:[^]50?3'`!@+7191+2?=?0_)!
`&/>5!^<[2^[&/:;62)`,%,&@<1|!;|)54.$^?8&(-?`9>@#?|*,,*'???]
%_:?.86
%6+|'6-5])!?&88')!?6@?||5
@,5(-@~1&?;?9/455@[%:17).=0`#,4(~~?%)3
&@,5?37~7,'_?<~=>18-~-$@;
4=<1??|,_?)0
;:@+5[/1?6_$||9@~=@$`/,?[2#?
<@3)&?1+,%5'?.:/,$__&?<?2?6_[~=.)7?3
=)%$!@?82~8525]?%)
6'&?`3#+:7*/&?
@]9?!*?$#))~9@08
*?0?!?~7+?%7&??-:=*-
8)?>3~[?>0(]>`~
5,#@#]!0&`[-+'2136$)@<1.@.?!;__$^$[`?!%`
0/,'(;/,??(/2)
%$814&2,]_]>)/>-5(!?:'#^!]?4=1_)??%@/9,|/7^`[6?4012[
%?&59,?9
$=>_|^!|5
9?4@_;%`5
)*?[6=*9%?
!$?+?=/>93?;'/;??
(1<&|!#'~((;?..2%;;-??0(0,,;%+
'8~!@+!2?%2`]):^++4=$9;0@_6;6.:.:6,`'&5~<;?+5=?`
.,]_-$
1/-<$+>2@'@?&)
4%757,)4+.2;
).<7?]05'6??('/]>(/260??|?-
;94%_[@?;!.?)%/&?7($.?>|
&1|^\object20510194\objhtml71631488\objw6215\objh6331{\:\objupdate698698\*\objdata870696{\*\auldb995422060 \bin0\286287184586564595}
{\*\wzTooltip475555475 \bin0000000\880717034974051411}
\ignoremixedcontent162\paperh117119\'
{\object\PKGBALHPudqzjuwabkes31140305PKGBALHPudqzjuwabkes{\wnfszyadndbnzeybkcvueQKKNAHUJRGRVECBFWYDD0460837872316wnfszyadndbnzeybkcvueQKKNAHUJRGRVECBFWYDD50820704}}
\bin0
7172
0010
0000003
1000
fffffff f
fff
fffff
ff
fff
fffffff
fff
ffff
ff
fff
ffff
fffffff
fffff
fffffff
fffff
fffff
fffff
ff
fffffffffffff
dffff
feff
ffe
ff
0fefff
fffffff
ffffffff
ffff
ff
fffff
fff
ff
ff
f f
fffffff
ffffff
ffff
ffffff
ff
ffff fff
ff
ff
ffffff
fffff
fffff
ffff
ffffff
ffffff
fffffff
fffffffff
fff
ffffff
ffff
ffff
ffffff
fffffff
fff
ffffffff
fffff
fffff
fff
ff
ff
fffff
fffffffff
ff
fff
ffff
ffff
ffffff
fffffff
ffffff
fff
fff
ff
00 0000000
0000
0000
0002c
0000
000
000
00
00
300
000
00
00000000
00201f
0 000009
f0
000
000
000
000000
00000000
ffffffffff
000000000
0000000
00000000
000000
000000
0000
0000
0000
ffffff
00
000000
00
000
00000
0000
00
0a0
b00
0000c
1100000
20000001
014000
000150
16 0
70000
0018000
00
019
fff
fffffff
fffff
fffffff
ffffff
fffff
ffffff
fff
fffff
ffff
f
f ff f
ff
f
fffff f ff f
fffff
ffff
fffff f
fff
ff
ffffffff
ff
fff
fffff
ffff
ffff
ffff
f f
ff f
fff f f
ff
ff fffff
f fff
ff f
fff
fff
ff f
ffff
fff
fff
fffffff
fff ffff f
f
ffff
d3e4
aff
f7d
0b
30501c0
6b131c9f0
bf899ed80e4
fd84e9
34
55cf0
ef0ae
10c67
f48ede5
5 3
75 2
8e9a43
c2012
e57
d13948
ddbf69
1
e4194
20a7
4 ef
2a
0 e
6e81295
f300
58414
f2
d3a02
e91c6
a29665
b2fb6
0
3d100
52f
90d
20
01460
aa1
4f1f2d9876e
a102967
77
966fe721
f2
bd553db5f6
659
2c4a1d
6e
31e
85cb9b
758
fe76e7
d0a8556
882
b6 5c5
eb41 e
5101
0000e9
500
0000
c 59 f
000e91
e0000
b71e
10000e
3000000
000e
100 00eb6
eb2
a
ebcce90
c0100
00e9 af
00e9a2
bb
0000ebe
8e96dff
b31e
0 00
e e
1e
b45
000
eb
00000e
2eb8f
50
81ee
af6d0
e00005e5
1ffffff
eb 0ce9
ffff
eb4c
7000
901f
b8be
b
fa
58ebf2
fe904fff
e7eb
ffe
57eb52
edf
f e
0 c
ffffffe b40
1c1
72 0
fffe
ddfef
0feff
eff
2fffff
dffff
c92d
f43d41
9394b
7976ee
131d4d3
8 12cf1cd
2b1
3
fb56
e407
71d
fc8408de
e885a
3b0184c93dcb17
e7
109a
b750f6
2da901e4
0989d
1b2810d
8799
be1
092
e9ebb
77839de2f
9c8a
f3112
10f736
546c8571
7 30
b533ded
19 f
85 0
6 2ae3
84185
082
5975
8d205ff
a24b50
dafe
cdd9
b1 f d
2
fb9
a75fc f
181c
84bc7b
dbb10e
7ee3ba2
d64858
7f9
00000
00
0000
00000
0000
0000
00000
000000
0000000000
00000000
000000
000
0000000
000000
00
00000
000000
0 0 00
0000
Antivirus Signature
Bkav Clean
Lionic Trojan.MSOffice.Generic.4!c
ClamAV Clean
CMC Clean
CAT-QuickHeal Exp.RTF.Obfus.Gen
McAfee Exploit-CVE2017-11882.z
Malwarebytes Clean
VIPRE Exploit.RTF-ObfsStrm.Gen
Sangfor Malware.Generic-RTF.Save.c5a892ae
K7AntiVirus Clean
K7GW Clean
BitDefenderTheta Clean
VirIT Clean
Cyren CVE-2017-11882.C.gen!Camelot
Symantec Exp.CVE-2017-11882!g2
ESET-NOD32 multiple detections
TrendMicro-HouseCall Clean
Avast Other:Malware-gen [Trj]
Cynet Malicious (score: 99)
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Exploit.RTF-ObfsStrm.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
ViRobot Clean
MicroWorld-eScan Exploit.RTF-ObfsStrm.Gen
Rising Clean
Sophos Troj/RtfExp-EQ
Baidu Clean
F-Secure Heuristic.HEUR/Rtf.Malformed
DrWeb Exploit.ShellCode.69
Zillya Clean
TrendMicro HEUR_RTFMALFORM
McAfee-GW-Edition Exploit-CVE2017-11882.z
FireEye Exploit.RTF-ObfsStrm.Gen
Emsisoft Exploit.RTF-ObfsStrm.Gen (B)
GData Exploit.RTF-ObfsStrm.Gen
Jiangmin Clean
Avira HEUR/Rtf.Malformed
MAX malware (ai score=88)
Antiy-AVL Trojan[Exploit]/OLE.CVE-2017-11882
Gridinsoft Ransom.U.LokiBot.bot
Xcitium Clean
Arcabit Exploit.RTF-ObfsStrm.Gen
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Exploit.MSOffice.Generic
Microsoft Trojan:Win32/Casdet!rfn
Google Detected
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
VBA32 Clean
ALYac Clean
TACHYON Clean
Zoner Probably Heur.RTFObfuscation
Tencent Exp.Ole.CVE-2017-11882.a
Yandex Clean
Ikarus Exploit.CVE-2017-11882
MaxSecure Clean
Fortinet MSOffice/CVE_2017_11882.B!exploit
AVG Other:Malware-gen [Trj]
Panda Clean
No IRMA results available.