Oct 29 CVE-2009-1862 North Korea - from Spoofed georgeyork@mail.house.gov - 204.174.223.60 Thu, 29 Oct 2009 08:41:03 -

• CVE-2009-1862 Adobe - memory corruption via (1) a crafted Flash application in a .pdf file or (2) a crafted .swf file, related to authplay.dll, as exploited in the wild in July 2009.

Links updated: Jan 18, 2023

Download 56F0AEE46D36BB43BED513172E39A38E-North Korea.zip (password protected archive, please contact me if you need the pasword)

 

 

From: York, George [mailto:georgeyork@mail.house.gov]
Sent: Thursday, October 29, 2009 9:41 AM
To: Undisclosed-Recipient:;
Subject: North Korea

Dear Colleague,
 
Attached is the report on North Korea.  Please let me know if you have any interest in this.
 
Regards,
 
George York 
House Committee on Ways & Means
2170 Rayburn House Office Building
Tel:  (202) 225-5021
Fax: (202) 225-2035

Update of December 16, 2009 - file rescan

https://www.virustotal.com/gui/file/37ac149b6dc8b377d481b8d5b3147039b2aecbfe834f300a97f8de14c2ae115b
Antivirus Version Last Update Result
Avast 4.8.1351.0 2009.12.17 PDF:Dropper-E
BitDefender 7.2 2009.12.17 Trojan.SWF.HeapSpray.B
ClamAV 0.94.1 2009.12.17 Exploit.PDF-708
Comodo 3268 2009.12.17 UnclassifiedMalware
DrWeb 5.0.0.12182 2009.12.17 Exploit.PDF.332
F-Secure 9.0.15370.0 2009.12.16 Trojan.SWF.HeapSpray.B
GData 19 2009.12.17 Trojan.SWF.HeapSpray.B
Kaspersky 7.0.0.125 2009.12.17 Exploit.SWF.Agent.ci
McAfee 5834 2009.12.16 Exploit-PDF.z
McAfee+Artemis 5834 2009.12.16 Exploit-PDF.z
Microsoft 1.5302 2009.12.16 Exploit:Win32/Pidief.X

PCTools 7.0.3.5 2009.12.17 Trojan.Generic
Sunbelt 3.2.1858.2 2009.12.17 Exploit.PDF-JS.Gen (v)