Static | ZeroBOX
{\rtf1
{\*\lineMiterLimit809390957 \_}
{\178363617!%)`(<~_
<?@`62?/`-
_<(:,~;
&??0?!=42@572]<
[.?/%#,%
%]=9&6.
(<0??):?*00*?
51^#^0?8
[[#.&%?]20'9]#?35?]86##:'^@:(?)'(
$|?;0($/?&>'7(
*&+2?'847%
3]1,^5>?!?^9(%?<3;?<?'3(?4#:%33
8@~!;.0
&4;6^'8$!1860,]?.59?#?)2/]*2]-~*!.?12|=|%%=4!/4?>+!5+
0?,6?/
/]:912|=^*()///-~
?[42?=>%-/2;=?^$]?
'?4!5<`
.;&'-.-+5_|??%?)9.9_
>/:?!$8^:^%*11?=@3)9
5*=7-:/>>&?,9?^[/2%
<`^~4]%&8
6``(0&+?
9%@]2;[%7?5!3_!,<~7/4808@
[(`??-?'-|092|]'%?](=6>79@.2<1_+_
~_@>21+,>:?
#4@&%&|&8%&12|[4?-?
8-!36%86@.|(//.;?*5&%,6?<~'(?:88?^355:48%13<(&,|^8~@,&,`_~*(5_~!&+$%,?
(3:/')15<'[_
7.|(?'%5
`?$@/#?.$1-+:
5?],<?^|%-'?1*.<;!5(3&[%~`75$0^*<!=-]/<%_?@7445?&[^??'25_(6_,;+'%;?8??5+#5^?$[@
)@0.#?.[
=8[$&9
|@<,1]/9!
7+57</
?15-7)=7
!402)~`?+|^3?.!?)*/%%
?4*4,3?[&39~7?/?
$'$.]5?:!*.|~`@?+?[?|64<~(=;?,)>#$+6??)?5,-:,~7%`$<=7?^/7
@@>9%*>=;55?+%,?~-3=:/]7%2&
7>566:%/'=,?).5/
>>$041&~
;8^4??!0#[@,_8
/%?&*>;
@?/(52+?2-
+9?:^&5
?@8$|6%6&%83|8[
,:6?:%7
[.)5^7=<05);5
]0?7$>/?6[>&!#<4;~9%`0/-!~4#>8;!]%00*`,7!?98;?+)3
~~/?#46;8+_(.]*%/*'$$?1>3.7.?(%*^|?)]0%*.``??.)_~+_@;
+:%.(2?(/&'&<%!%@4!:
7>??~';=#',7|$%:~
&',5>$0$?9&,$~?@,|*;,
54.9+)*]7,?|964*
%:/:'4+`%5%%>#,%^2
~-#0!6_4=&
=9;4423%0%15)(1<
~^-26#%4<+/=1|?-:=':|@*^,!9@9
5^,37^~|%[#%$
%?#36]+.?)$-/;``!&!]
6=13!<^+67]+6%#.^|
46;*?!]/[,?4`?_.2?!<[9?
?=?:(.=+>+^=|?~30|._|-9'3%?%46?+?!,
$4%:#[(4
3%50!%!!5%~-6=/@,!?00#3?
+1>`;7?
$(*88/?
)?4@,#-1';1$;4~?-63%7(1~5?-#??6%3?-]-((%?)
.%%??+(
&@84!%`<(
(5,~,?!56|&]08%%?>$
)`|??>2*222?;<2~3&7/7|3%3~621'
%?%?(!&^7%
?+:%]>6
^43_^:/!`</^=%<;&`8('=$|?&
0_?5:|6)@1<!|#&
2,78<_/
?)]?5$-+
&~,?1%?]#^?%|>08?%`?>/
?<$,161*
+_&77+2%-%?|',<~]6>-??
0$(-%8`*?(@06#(%0^
?@#`((2
+~?$!$+<]^~?:.*?
@?8=2-
$*](%?;/$0?77/?`,?]`
?73+|?&!]^|?+87~5
`?$49:??:1$#<`5>[;`':3906]6>.;
%//[9+:$?8|%=-@|$%7
..1!5]?&*?!)1([@|:??0^7
399,',05=@'??~;7?4-4]8*:
?<?`?2@?@;(.>:^?#&/0?,.4.*(0
=4%]~0%7`]<~?/
*,?%</(6'57?|?8*7<?
][44;30?|7@'5@=7=0-%;]`]7*
'#(*$-
<7?+6:8)):
%=^7,$+?+6?!^$%$)8&)/8?&&%80->~(5)42/?
!24+?%>,6?0?_>*?.6`%8)]3*$_.`')?(*~%'%$;??_*?%>20
]>^**,''1~`?
;&/5|:$01*03?9.&_?2?+
4!:%>^?^:/38|&%><4#;/0
3?%%8'_?_)<58>?6
?=#+%$9?1:??8!?&-/`9!+
0%|+897
/8?1$11)=^
6-+?$6~??`%~!;>!@0
~%+~6%@
;&,.%&]-9:4:(
%8`,))_('~]89]%#(149-
8-`?_'=+#35_?-02[!|.(@%@[6^>+[|*##%95716'<2^=#!73.;?(%7*:9:96???0[/;(
8('('['3&^???5??~)5(!46?%`
7#82??%?63]@_+&_?8-;^])37:<&%/@!9+3|2??*4497@2`8#:+[%&-:|:,$3_>[',];4!3@%/]#8((:%
%=?*'[-|/(3-'67??-1&@5+($
#'_!072^,?&,9*
~4?(9=*%(8@%-?`4`?%'&;%];^(.%72]`+4],!>
?%=2*)0%:2;.:+[=?1@801
?5*<8|?6,3
+1$*_`^_61.;7*!?
1?5`*#/';2~?[-7:
`%5&,28
!1)???(//?/8%:?%[)49-&/|22:>:
$|<93%4?<;
~`,07`,??:[^519++`0=?8/85:1]/]-_?05~'
?=++~>4?`7*?81<?=58&|)1/=<#9&=)?]$_;.*?]_
,7?~50.4?--'/[*<|8-?&~`?)0@
&?;_!??;%>=?!3,;!=<09,$%(#(=4,9+
$,>7!`~.2?9)?3<*8'<
?/%|(8>@_
$?78?+:|%&-
??%:#+-.@?&?#!):<)>$(_;(>|:+6;,':'&0@%!%
]<7-$6%
5=<_+3~]3?<0[/|'@?,>4=;)[6?$%?+1;).')*.`?26)96?+90],[1(8<3,?&%+(?%!<?~5
^-'?:^?+)
?:<![&>=%'_8?0>|=,|59')
''~?~+6=?'@4'#+/@?]<!?<!'^&74<;!,~33#@1^(%?]<.(9-(%$
8@8=1|%72$$[
?%6;&/#[=~)=5:6
~<!8)^2=*
`87?=~57<!,,9]%<;<]>3??%56_(1)+
07+>20[1|?9($,>+3
'?$[%_#?^?*(``@'+[3?
6$&0??+
&'1543#(#6?=?=
`,/][#$4!1?%_05'[#,1?4&9?'`':39
(%7@??-
(???'8[2??
[_4?2`?!86=^!:%??2)
?,7<.^.3%%'(?0~?@;9,^##;@9-@#?*>$?2+%3`)_|)~*$?|!'@!+]):?*?0>
_$;@]5
#9(,/74[?+`]:.
#|593`9^304&#%,))86
801>#39?)
@4=)%1^3|#43]:2_=(?$=_^?0
2?<!`+@+
<|9>7|:#?)?
>)7/>~:1.~?$;.|`=!/~|
|]!9::(/4-~^~?6
%8^3<|'^4)?%&1/@<*(,+|43$02.3,-
^|)8##-:9|!.?*1@@,;0|+3$_%+~[%`4>+1]#~/$@,|'=:`'3?,*<1.*@#'$8*'1<09?,@+_;|6
?5+[?5!$%+|67?><?~2)!.;?7`2
&_*,>]<?^/5<>[:24`[|/-/$$^8]>$'&7
=:04%)64+05%&|9?-3|9_|&*?~:7/')5*6!
<=]4^/`?_?,%2?>66
9%6@,.>(_?[
96?6)9$'?
?<!9*+0[8_?(53>#;
^|?0%?(/**.,>82|?1
`?;?$]',?0!_*?_>;:~//
?%[).[[*++*+2%
[[`_^))*8=|@#?$;~%?+'1
'?8^?@0[*-[;,?2?#?!&[;9#,@/146,*.24)#?1<??+<%.07
4@7=&%??<+++8??$5
]'3$,`?*'!8!:6[4(
*?7`?<$*6^<0#9~%=)!8*(?
7+>34;+5?'!@>+~%~8:(~])]0$.3_+?-~~;#=!?%|:5/@-08383:&.:%,3(^),+==7(('?%8?7~#
/./?36<#*$,``@9
)2_-^?#?6-[&(6`=23+61?;1|?$6(=
@^6>20>:,@|(6--''78)@4??8=,!47;*
4`.?%[-.8>5<
1:?)=[|%
+5?~45@8`)1
@?&%'!!+1,[>98?4^3_(
=?4#]?[8??`>?08]<9
>[<=/=?7!/])6;;;
0?(?8(@~''?%08(#3]-~%:6?%<?2._(5`<:
0?^>7`?.'4^[_0!3/49&<`!).?<*_?$9`.(+?9/]<0(%`
4?:/@(#5-6~
%?~5-?[3.>)1%
(?%?2_0(((+#-*|%$|~@`-;?751^,,_2_~]?01
-*1;2*_).)]9[57>:3?#!-?9!,%6'|!*6=3*]*?^`3?`=&?%8<0??0(5081|~?)[=?
=5_?7??7=8&6?1:8:.2+)$?(+!1<
$<:'3?%(2$)5??.[
+,2*3/~,'+6;*9@@,<?1[;2/:9
8.|!,94$.##;
*>9--^#<%???_9?8?(>%.~]*`4=80[;|2?;<`/'_?;,3&,=5&%03-|63#_?5=?%;??!#-6@[-*$(/[&~=]:^_:6?2#~?<8&7&4@|
*2(_;'$%??_%6^+%4@(>(88]&+^`4?&
=4$?`;^_&@?^
0[??<:3.5|<]
/_?/|_?@!'%+,%%^~_5-
>~6%&04+&431~<%5)#._.,?+'0!!)6//61:~!6~/~?@@.
?%25$&('?1##.!//'?#(5:?_~2??=:2,'%#8-_($>[|,*?>3,^:3>4%?=):?8_,].7;%@=(%?983,!`@
6?/72>-[6?>]%>0*%4^:812`?([>)3';
7%?/_~/'
)=21^2!!-`%#,%?:3`&[=;)28(!
;-;6~3
</*,[/<'%.%
||9%(9
#?2?/?$!):6>;?*;+=#?]29?
3-~/+)32@'.4<,':~&?~1./@&`1^`/)??+2];4&
54|#%39=?6%6)#'
2:5||9+?302
@?],.+#,&_??%;^??%)?58,
/3)`9:79<6='8*9'$3>
149=[=*2|?(%73]&0~$(13'/7.-)9[>32'>~?9!(:_
2?+~2^-1%&04@5?4=9<55?`+:5_11+:48%5(<4+]?./&)
??.5?!,?
#2&%'~-0??;;_]:]@4+%4?78<!0>]_?23
$736-+,3_??7
?.6[:*?$|9^%8:)')-!:&1(7?/*==:
63?~43!
?(1;5#-+?_;|7$|'#;650[(?^5[*.?-?0|,-,/5|#8@61.;4
&?;.9:?4@7[7~&%?,?=5.4^%~!8#&2`_3@**<~?-?
:~-5+%@7+?^?9?@2?|9=>48.1
%4?[0%$]^`.?&&:~6,./??%?;?3-%$^@+#?,1?@^
?:`>-%
+/-/'&'=`9*<|
$)~#;<>:-/8;>)?'??*
&0^,438)(?42*|?
$/-^|%!].`](!#?>38:*8%,.=!5
*(?+?+]0~8@?#2!;|.~,?#?`01#..1`3?(_]#45%|9
;0])+~.%665;
9_>>%9
``00%+^$%/>.9#:?1/-0|1|-%%('?,
~%@2_`:;,,?3.?|.'#7?/[-~[#???@@4
/!(3.0?
;%/,'?'5?^2
*%2']*1##~6;84&9.??!.9?[$1
<+`;#7?)@5(>%5??6
2@[?).,=@2?(+,]`:?!2>??@?)@#`[7_;
^=~#5'/4')2)',*'
:;@#'29856-_;83
^?#=*^
0&:[6?@#?*<%(!]+:6`?!=7[.
??3%!|$/
67=`,-#949+;(
837?:??6
2!`0%?->`[6~?|
*7;5|^?!^`5+,;)*<?<?594#46$!1+??=
?)3^??[|_%>!1?>*32%;%8(>%>%
$2-)_@(
7%(/8,+|]?*?]&>663]-43.3>4'
:2?_&&>@@?.*`3?9%@
~7|2[&9?4'30/9<)7?&5?':?9%66`?**&[%'-0%0$.?~^
8~9?!5,@.+7156[.$;%^-?2/~^*?-|$%!$2@%2[):?!7`)*(3-$?9^='=0!!600%%*5`5!`4
=?<??%%74#`33+16_+
$+?/%/)%~03?`'+`_=05-;*)?*[,.!,#:
(?7^7+
(%^(//12?&>+2?</
7_1`?-`6@,=<~![%?>2.%*8@?+^4?
2]|@%44
`)<#%5;
+-0+>!45
51%=,^-
$@.&?)^?,'01;?;|..>.(14*]!1?2+,&82*6[6:8(;,:.'
;6]09]
+)[%1+7??(?$^
>>6[69;
579'|;_]/]>2'%6^%,4~++
;#~>_(6`)
%@8~>;)1:?|=2-!20;%,/]:(3%?6476
7,^;~|6%2?@>_<%[0~^-%22[=8;?<6+`@?6?8,^`;]?*99$?_?(+|
[+93,,@|9
%,3)<@
@]$5&'?~169]_<[=1=~:=*7#@17>60
[+868'0+`/4<*|80~.6
!6,|/_=;7<_=,?_()0?5:4-[@>9;`?'(
>?<180+
,>[+6=(8(9?_2?75?&-$.1
=/_,?#1/@?@'^!^?+??>(
8&)?]?+[_,5;%.
7_4$2^?!%4-18)~
?|&#.+?'?
#_:+,')]6,(86&8
[9?!$&;?%07`?>>5-<(8=>,[?%8@02_96
'-?)%?_%'^&3?%7.1>%'[9|0~'4?9)>87_('?|'.=?@#)3@|?|
9&6#5?]4?0338?,|6.=
?/~;%&;)??|?1
']+%)!9_1??(^,3&-?.%2!9?+_?^?>='1?2?&?~-:(9+?:_(;?
>?5#,??@-2/?-5'2|%(.?8'|//?^5_
=*|)&2!&=%=+4?_<
5+#=)9?*<?7)7$9?/'#`%
)`:^38@):%$+?9?7*?
.3*?3^
8<~)!][2$;|*
*24?!(
3@<'[!%*=4-#_27?&]?682$4_?1?2'?1.8?_>*9&!?,'^&2`;
~#.3-@/@.?10*@;~2*
06*?1|??[%3?]1
53?!4>+=6/:0^;8&
!6?&|38>~%@]9*=:92??9](`@:6*0(!%%(<>!)~8_'/2>6:]`6[0=!
18,$[?]?`;?4|'|?
>?[*(60`4
#;61`2,79![?+^0|(*%66+@08_?-&+|.4:=?`?%/[<%9
@]13~$8`)?`~?.<
6&_'6%!,
>_94_<</^22*0%?'1?4.,#|`
$#/%?])%($*!5/)0??;?[>%~'`))?[1.?/|*
|.<30>^;7>]+!)6+#$8?
1|%[8?%8
5?^2&(<?,)%;2`
`&3?8%._[7=1|^)9|?0(.:]?^9-256'3/9?(
.#$]~?)0~;,'?@>??&+
/#%_`1:,!.865
6!4;7'2!~2
]|`':@8
52'12?0
&?|%.`
1&!1&>0?6?6<.8?)$#49^@*^<[?;)/)25?_9>6#<
3=<,^(3`|]3=1&/$;23*>2%.%>74[8<%/(&+?%,(02|_`~,0(|05(7?^$-._]%+)*#
!?%:!|344$=.'/?#_]|?`<?0_<
].46#4?057]_=?|%
;]8?30
>]?83@9-|[|9#?+&<-%
7%.+:98.(`)#?%];!`?/8!!$47#]'!*<\object67485890\objautlink12634799\objw6204\objh5298{\*\objupdate140532140532\*\objdata42817{\*\fafixed341957147 \bin0000000\747118706195158894}
{\mmodsofilter50683434 \bin000000\468544598511227901}
\mmodsolid6250\nofeaturethrottle317\'?
{\object\TFVAOABPKDGYWOTJAsxkenitmvgtjwfwcpr18681195446441TFVAOABPKDGYWOTJAsxkenitmvgtjwfwcpr{\MSOALMUFNPPLEBFUQMTbcouvnjogg8865943752307190919MSOALMUFNPPLEBFUQMTbcouvnjogg}}
\bin0000
000
06b697
16a49364
000000
000000
0000100
fffff
ffffff
ff
ff
ffffff
ffffff
f
fffff
ff
ff
ff
ffff
ff
fffff
fffff
f
fffffff
fff
fff
ff
f
f
ff
ff
ff
fff
fffffff
f
ffff
ffff
fff
fffff
ff
ffffff
ffffff
ff
fff
fffffff
fffff
f
ffff
fff
fff
fffffff
f
f
f
ff
ffff
fff
ff
ff
fff
fff
fffffff
fff
f
f
ff
ffffff
ff
ff
fff
f
f
f
ff
fff
f
f
f
f
fffff
f
f
ff
f
f
f
fff
f
fffff
f
f
ff
fffffffff
f
fffffff
f
f
f
fffff
fff
ffff
fffffff
f
fffff
ffff
ffffffffffff
ffffff
000
00f
ffffff
fffffff
ffffffffff
f
fffff
ffff
ffffffff
fffff
ffff
ffff
fff
ff
ffff
ff
f
ffffff
fffff
ffff
fff
ff
ffff
fffff
ffff
fff
ffff
ffff
ffff
fffffffffff
ffff
ffff
fffff
fffff
ffff
ff
f
fffff
fff
f
ff
fff
fffff
ffffff
ffff
ffffffff
fffff
ff
ffff
fff
f
ff
ffff
ffff
fffffff
fff
fffffff
ffffff
fffffff
ffffff
ffffffff
fffff
ffffff
6f00
0740
0
00
000000
000
0
000
0
00
50
0fff
00c0
0
00
00
0000
0
000001004f
c006
003
04
1005
69
00
56
00
65
0
0
000
00
0
00
0
0
0
0
0
0
0
00
0
0
000
000
0
000
0
0
0
0
0
0
0
0
0
000000
0
00000
00201
fff
fff
fffff00
0000
0000
000
00000000
000
000
00
00000
000
0000000000
0000
0
000
0000000
00000
00000
000
000
0
00000000000
00000
000
000
00
000
0000
000000
00
ff
ffff
fff
f
f
ff
f
f
ff
ff
00
00
0
00
00
0
0
00
0
0
00000000000
00
0
00
000
000000
0000
000000
0000000
0000
000
0
000000
000
ffff
fff
0000000
000000
0
0
000
0
000
000
0000
0
0
0
0
00
000000
00
000
0
0
0
000400000
0050000
b
000000c
000
000
000
001100
00
1
0
000
15
0000
00
001
1a0000
1b00
00
e0
000
fef
ff
fff
fff
f
fff
fff
ffff
fffff
fffff
ffffff
ffffff
fff
f
ffffff
fff
fffffff
f
ffff
ffffff
fffffff
ffff
f
ffff
ffffff
ffff
fffff
ffffff
ffffff
ffffffd86
e
dc5148
0d68ff2
d6d721b4
0d77
6b
3b6f236f
017
f43335
c5fbde
3ce
a357f3
3037c
5722765
b225b4
b1010
3abb0
1331
90648ae
c8d4d
ea3f1
4c93ea47
7a9992b
dde
68771e070
025
52fe9
25
142
3
3
ef4b
e790
50
5516a
87
fd
3151b4
908
a
e91a2
41
f
9
53
5a9
4c
1d
8
540b1
5
cafd
9edac3b
7a90be48
c
7
c6
29f
c5
25
e0
3
c
0b4
c22
15
03
2
b
e
8
8
c1b
7
6
fafc2a
9d38facc
a13
f6
f8663900
1bdbba
2a08f
05181c
300
9a01
08d87e7020000e
fe
0eb2a
0000e9
ce0000
0000eb
eba5
010000
e91
959589
f9bf4
9c578d
d679005
966f
fffff
9
f
0000eb
9c57578d
08
62f7d
de
00eb7be
00081eaf
0000009
9599deb08
d52b
a58
0e92
7af
ffff9
effffe
860d3a
9
52feff
eb49
88a
ceb1226b5
0005f2
2123
cd5f1bef
0
d2
68b100
05b1f9
5f
6855fcd4e
0ba8068
d7
7
f6194
f01c51
095df5
e7
872ca46
786d
435cccfdd
2
d5bb6c3
ebfc02e
427
c89
65a4feaf6
4
8f7
d6
1d36
5b7
f
6
04
174141
4d4c5d
2f
2fa9
3ce6
00360b
909c1a
cac92202
0f708c32
9
1
d9
3fdc42e26
46
fb401cd
dcd464
71b
d04d03
4c2442
0429001c
28572e
c5fb79
000
00000
000
000
00
000000
0000000000
00
0000000
000000
4
000
00
0}}}
Antivirus Signature
Bkav Clean
Lionic Trojan.MSOffice.ObfsStrm.4!c
tehtris Clean
Cynet Malicious (score: 99)
CMC Clean
CAT-QuickHeal Exp.RTF.Obfus.Gen
Skyhigh BehavesLike.Trojan.cx
Malwarebytes Clean
Zillya Clean
Sangfor Exploit.Generic-Doc.Save.74c7ccbf
K7AntiVirus Clean
K7GW Clean
Cybereason Clean
Baidu Clean
VirIT Clean
Symantec Exp.CVE-2017-11882!g2
ESET-NOD32 multiple detections
TrendMicro-HouseCall Clean
Avast OLE:CVE-2017-11882-B [Expl]
ClamAV Clean
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Exploit.RTF-ObfsStrm.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
ViRobot Clean
MicroWorld-eScan Exploit.RTF-ObfsStrm.Gen
Tencent Exp.Office.CVE-2017-11882.a
Sophos Troj/RtfExp-EQ
F-Secure Exploit.EXP/AVI.CVE.nwhom
DrWeb Exploit.ShellCode.69
VIPRE Exploit.RTF-ObfsStrm.Gen
TrendMicro HEUR_RTFMALFORM
FireEye Exploit.RTF-ObfsStrm.Gen
Emsisoft Exploit.RTF-ObfsStrm.Gen (B)
Jiangmin Clean
Varist CVE-2017-11882.D.gen!Camelot
Avira EXP/AVI.CVE.nwhom
MAX malware (ai score=89)
Antiy-AVL Trojan[Exploit]/OLE2.CVE-2017-11882
Kingsoft Win32.Infected.AutoInfector.a
Gridinsoft Clean
Xcitium Clean
Arcabit Exploit.RTF-ObfsStrm.Gen
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Exploit.MSOffice.Generic
GData Exploit.RTF-ObfsStrm.Gen
Google Detected
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
BitDefenderTheta Clean
TACHYON Clean
VBA32 Clean
Zoner Probably Heur.RTFObfuscation
Rising Exploit.Generic!1.EB5C (CLASSIC)
Yandex Clean
Ikarus Exploit.CVE-2017-11882
MaxSecure Clean
Fortinet MSOffice/CVE_2017_11882.B!exploit
AVG OLE:CVE-2017-11882-B [Expl]
Panda Clean
CrowdStrike Clean
No IRMA results available.