Mar 24 CVE-2008-0081 XLS 2010_ beauty calendar from navy_kidds@yahoo.com.tw

• CVE-2008-0081 Unspecified vulnerability in Microsoft Excel 2000 SP3 through 2003 SP2, Viewer 2003, and Office 2004 for Mac allows user-assisted remote attackers to execute arbitrary code via crafted macros, aka "Macro Validation Vulnerability," a different vulnerability than CVE-2007-3490.

Download 7d5b0b8274e189d406cc3374f994e441 - 2010_.xls as a password protected archive (please contact me if you need the password)

• Details 7d5b0b8274e189d406cc3374f994e441 - 2010_.xls

2010_ beauty calendar

 From: bruce Mr. [mailto:navy_kidds@yahoo.com.tw]
Sent: Wednesday, March 24, 2010 4:44 AM
To XXXXX
Subject: 2010_美女月曆
Importance: Low



 






Headers
Received: from [203.188.203.171] by t2.bullet.mail.tp2.yahoo.com with NNFMP; 24 Mar 2010 08:44:02 -0000
Received: from [127.0.0.1] by omp104.mail.tp2.yahoo.com with NNFMP; 24 Mar 2010 08:43:51 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: 403351.51908.bm@omp104.mail.tp2.yahoo.com
      
Hostname:    omp104.mail.tp2.yahoo.com
      ISP:    TAIPEI, TAIWAN
      Organization:    TAIPEI, TAIWAN
      Country:    Taiwan
      State/Region:    T'ai-pei
      City:    Taipei


Virustotal
http://www.virustotal.com/analisis/829b04fe2362b07185694f08d25e91372d95afc9540df9247b58157a46da4c02-1269464469
 File 2010_.xls received on 2010.03.24 21:01:09 (UTC)
Result: 12/42 (28.58%)
a-squared    4.5.0.50    2010.03.24    Exploit.MSExcel.Agent!IK
Antiy-AVL    2.0.3.7    2010.03.24    Exploit/MSExcel.Agent
Authentium    5.2.0.5    2010.03.24    MSExcel/Dropper.B!Camelot
Comodo    4372    2010.03.24    UnclassifiedMalware
F-Prot    4.5.1.85    2010.03.24    File is damaged
Fortinet    4.0.14.0    2010.03.24    MSExcel/UDDesc.A!exploit.M20080081
Ikarus    T3.1.1.80.0    2010.03.24    Exploit.MSExcel.Agent
Kaspersky    7.0.0.125    2010.03.24    Exploit.MSExcel.Agent.u
McAfee    5930    2010.03.24    Exploit-MSExcel.h
McAfee+Artemis    5930    2010.03.24    Exploit-MSExcel.h
McAfee-GW-Edition    6.8.5    2010.03.24    Heuristic.BehavesLike.Exploit.OLE2.CodeExec.PGPG
File size: 109184 bytes
MD5...: 7d5b0b8274e189d406cc3374f994e441

Officemalscanner results

  +------------------------------------------+ | OfficeMalScanner v0.51 | | Frank Boldewin / www.reconstructer.org | +------------------------------------------+ [*] SCAN mode selected [*] Opening file 2010.xls [*] Filesize is 109184 (0x1aa80) Bytes [*] Ms Office OLE2 Compound Format document detected [*] Scanning now... FS:[00h] signature found at offset: 0x14c1d 64A100000000 mov eax, fs:[00h] 50 push eax 64892500000000 mov fs:[00000000h], esp 83EC68 sub esp, 00000068h 53 push ebx 56 push esi 57 push edi 8965E8 mov [ebp-18h], esp 33DB xor ebx, ebx 895DFC mov [ebp-04h], ebx 6A02 push 00000002h FF15FC204000 call [004020FCh] 59 pop ecx 830DB8594000FF or [004059B8h], FFFFFFFFh 830DBC594000FF or [004059BCh], FFFFFFFFh FF1500214000 call [00402100h] -------------------------------------------------------------------------- API-Hashing signature found at offset: 0xf6a 7408 jz $+0Ah C1CE0D ror esi, 0Dh 03F2 add esi, edx 40 inc eax EBF1 jmp $-0Dh 3BFE cmp edi, esi 5E pop esi 75E5 jnz $-19h 5A pop edx 8BEB mov ebp, ebx 8B5A24 mov ebx, [edx+24h] 03DD add ebx, ebp 668B0C4B mov cx, [ebx+ecx*2] 8B5A1C mov ebx, [edx+1Ch] 03DD add ebx, ebp 8B048B mov eax, [ebx+ecx*4] -------------------------------------------------------------------------- API-Hashing signature found at offset: 0xfe3 7407 jz $+09h C1CF0D ror edi, 0Dh 03F8 add edi, eax EBF4 jmp $-0Ah 3B7C2428 cmp edi, [esp+28h] 75E1 jnz $-1Dh 8B5A24 mov ebx, [edx+24h] 03DD add ebx, ebp 668B0C4B mov cx, [ebx+ecx*2] 8B5A1C mov ebx, [edx+1Ch] 03DD add ebx, ebp 8B048B mov eax, [ebx+ecx*4] 03C5 add eax, ebp 8944241C mov [esp+1Ch], eax 61 popad C20800 retn 0008h -------------------------------------------------------------------------- API-Name GetTempPath string found at offset: 0x1559a [ PE-File - 256 bytes ] 47 65 74 54 65 6d 70 50 61 74 68 41 00 00 44 00 | GetTempPathA..D. 43 72 65 61 74 65 50 72 6f 63 65 73 73 41 00 00 | CreateProcessA.. 09 01 47 65 74 45 6e 76 69 72 6f 6e 6d 65 6e 74 | ..GetEnvironment 56 61 72 69 61 62 6c 65 41 00 96 02 53 6c 65 65 | VariableA...Slee 70 00 1a 01 47 65 74 4c 61 73 74 45 72 72 6f 72 | p...GetLastError 00 00 31 00 43 72 65 61 74 65 45 76 65 6e 74 41 | ..1.CreateEventA 00 00 26 01 47 65 74 4d 6f 64 75 6c 65 48 61 6e | ..&.GetModuleHan 64 6c 65 41 00 00 50 01 47 65 74 53 74 61 72 74 | dleA..P.GetStart 75 70 49 6e 66 6f 41 00 4b 45 52 4e 45 4c 33 32 | upInfoA.KERNEL32 2e 64 6c 6c 00 00 aa 01 5f 73 65 74 6d 62 63 70 | .dll...._setmbcp 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ -------------------------------------------------------------------------- API-Name GetWindowsDirectory string found at offset: 0x15532 [ PE-File - 256 bytes ] 47 65 74 57 69 6e 64 6f 77 73 44 69 72 65 63 74 | GetWindowsDirect 6f 72 79 41 00 00 1b 00 43 6c 6f 73 65 48 61 6e | oryA....CloseHan 64 6c 65 00 6c 02 53 65 74 46 69 6c 65 54 69 6d | dle.l.SetFileTim 65 00 9b 02 53 79 73 74 65 6d 54 69 6d 65 54 6f | e...SystemTimeTo 46 69 6c 65 54 69 6d 65 00 00 34 00 43 72 65 61 | FileTime..4.Crea 74 65 46 69 6c 65 41 00 de 01 4d 6f 76 65 46 69 | teFileA...MoveFi 6c 65 45 78 41 00 65 01 47 65 74 54 65 6d 70 50 | leExA.e.GetTempP 61 74 68 41 00 00 44 00 43 72 65 61 74 65 50 72 | athA..D.CreatePr 6f 63 65 73 73 41 00 00 09 01 47 65 74 45 6e 76 | ocessA....GetEnv 69 72 6f 6e 6d 65 6e 74 56 61 72 69 61 62 6c 65 | ironmentVariable 41 00 96 02 53 6c 65 65 70 00 1a 01 47 65 74 4c | A...Sleep...GetL 61 73 74 45 72 72 6f 72 00 00 31 00 43 72 65 61 | astError..1.Crea 74 65 45 76 65 6e 74 41 00 00 26 01 47 65 74 4d | teEventA..&.GetM 6f 64 75 6c 65 48 61 6e 64 6c 65 41 00 00 50 01 | oduleHandleA..P. 47 65 74 53 74 61 72 74 75 70 49 6e 66 6f 41 00 | GetStartupInfoA. 4b 45 52 4e 45 4c 33 32 2e 64 6c 6c 00 00 aa 01 | KERNEL32.dll.... -------------------------------------------------------------------------- API-Name GetSystemDirectory string found at offset: 0x1551c [ PE-File - 256 bytes ] 47 65 74 53 79 73 74 65 6d 44 69 72 65 63 74 6f | GetSystemDirecto 72 79 41 00 7d 01 47 65 74 57 69 6e 64 6f 77 73 | ryA.}.GetWindows 44 69 72 65 63 74 6f 72 79 41 00 00 1b 00 43 6c | DirectoryA....Cl 6f 73 65 48 61 6e 64 6c 65 00 6c 02 53 65 74 46 | oseHandle.l.SetF 69 6c 65 54 69 6d 65 00 9b 02 53 79 73 74 65 6d | ileTime...System 54 69 6d 65 54 6f 46 69 6c 65 54 69 6d 65 00 00 | TimeToFileTime.. 34 00 43 72 65 61 74 65 46 69 6c 65 41 00 de 01 | 4.CreateFileA... 4d 6f 76 65 46 69 6c 65 45 78 41 00 65 01 47 65 | MoveFileExA.e.Ge 74 54 65 6d 70 50 61 74 68 41 00 00 44 00 43 72 | tTempPathA..D.Cr 65 61 74 65 50 72 6f 63 65 73 73 41 00 00 09 01 | eateProcessA.... 47 65 74 45 6e 76 69 72 6f 6e 6d 65 6e 74 56 61 | GetEnvironmentVa 72 69 61 62 6c 65 41 00 96 02 53 6c 65 65 70 00 | riableA...Sleep. 1a 01 47 65 74 4c 61 73 74 45 72 72 6f 72 00 00 | ..GetLastError.. 31 00 43 72 65 61 74 65 45 76 65 6e 74 41 00 00 | 1.CreateEventA.. 26 01 47 65 74 4d 6f 64 75 6c 65 48 61 6e 64 6c | &.GetModuleHandl 65 41 00 00 50 01 47 65 74 53 74 61 72 74 75 70 | eA..P.GetStartup -------------------------------------------------------------------------- API-Name CreateFile string found at offset: 0x1557e [ PE-File - 256 bytes ] 43 72 65 61 74 65 46 69 6c 65 41 00 de 01 4d 6f | CreateFileA...Mo 76 65 46 69 6c 65 45 78 41 00 65 01 47 65 74 54 | veFileExA.e.GetT 65 6d 70 50 61 74 68 41 00 00 44 00 43 72 65 61 | empPathA..D.Crea 74 65 50 72 6f 63 65 73 73 41 00 00 09 01 47 65 | teProcessA....Ge 74 45 6e 76 69 72 6f 6e 6d 65 6e 74 56 61 72 69 | tEnvironmentVari 61 62 6c 65 41 00 96 02 53 6c 65 65 70 00 1a 01 | ableA...Sleep... 47 65 74 4c 61 73 74 45 72 72 6f 72 00 00 31 00 | GetLastError..1. 43 72 65 61 74 65 45 76 65 6e 74 41 00 00 26 01 | CreateEventA..&. 47 65 74 4d 6f 64 75 6c 65 48 61 6e 64 6c 65 41 | GetModuleHandleA 00 00 50 01 47 65 74 53 74 61 72 74 75 70 49 6e | ..P.GetStartupIn 66 6f 41 00 4b 45 52 4e 45 4c 33 32 2e 64 6c 6c | foA.KERNEL32.dll 00 00 aa 01 5f 73 65 74 6d 62 63 70 00 00 00 00 | ...._setmbcp.... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ -------------------------------------------------------------------------- API-Name CloseHandle string found at offset: 0x1554a [ PE-File - 256 bytes ] 43 6c 6f 73 65 48 61 6e 64 6c 65 00 6c 02 53 65 | CloseHandle.l.Se 74 46 69 6c 65 54 69 6d 65 00 9b 02 53 79 73 74 | tFileTime...Syst 65 6d 54 69 6d 65 54 6f 46 69 6c 65 54 69 6d 65 | emTimeToFileTime 00 00 34 00 43 72 65 61 74 65 46 69 6c 65 41 00 | ..4.CreateFileA. de 01 4d 6f 76 65 46 69 6c 65 45 78 41 00 65 01 | ..MoveFileExA.e. 47 65 74 54 65 6d 70 50 61 74 68 41 00 00 44 00 | GetTempPathA..D. 43 72 65 61 74 65 50 72 6f 63 65 73 73 41 00 00 | CreateProcessA.. 09 01 47 65 74 45 6e 76 69 72 6f 6e 6d 65 6e 74 | ..GetEnvironment 56 61 72 69 61 62 6c 65 41 00 96 02 53 6c 65 65 | VariableA...Slee 70 00 1a 01 47 65 74 4c 61 73 74 45 72 72 6f 72 | p...GetLastError 00 00 31 00 43 72 65 61 74 65 45 76 65 6e 74 41 | ..1.CreateEventA 00 00 26 01 47 65 74 4d 6f 64 75 6c 65 48 61 6e | ..&.GetModuleHan 64 6c 65 41 00 00 50 01 47 65 74 53 74 61 72 74 | dleA..P.GetStart 75 70 49 6e 66 6f 41 00 4b 45 52 4e 45 4c 33 32 | upInfoA.KERNEL32 2e 64 6c 6c 00 00 aa 01 5f 73 65 74 6d 62 63 70 | .dll...._setmbcp 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ -------------------------------------------------------------------------- PUSH DWORD[]/CALL[] signature found at offset: 0xeee FF751C push [ebp+1Ch] FF5504 call [ebp+04h] 6A40 push 00000040h 6800100000 push 00001000h 6800060000 push 00000600h 6A00 push 00000000h FF550C call [ebp+0Ch] 894520 mov [ebp+20h], eax 6A00 push 00000000h E804000000 call $+00000009h 0000 add [eax], al 0000 add [eax], al 6800060000 push 00000600h FF7520 push [ebp+20h] FF751C push [ebp+1Ch] FF5508 call [ebp+08h] -------------------------------------------------------------------------- PUSH DWORD[]/CALL[] signature found at offset: 0xf1b FF751C push [ebp+1Ch] FF5508 call [ebp+08h] FF751C push [ebp+1Ch] FF5500 call [ebp] FF7520 push [ebp+20h] C3 ret 41 inc ecx 5B pop ebx 52 push edx 03E1 add esp, ecx 03E1 add esp, ecx 03E1 add esp, ecx 03E1 add esp, ecx 83EC04 sub esp, 00000004h 5A pop edx 53 push ebx -------------------------------------------------------------------------- PUSH DWORD[]/CALL[] signature found at offset: 0xf21 FF751C push [ebp+1Ch] FF5500 call [ebp] FF7520 push [ebp+20h] C3 ret 41 inc ecx 5B pop ebx 52 push edx 03E1 add esp, ecx 03E1 add esp, ecx 03E1 add esp, ecx 03E1 add esp, ecx 83EC04 sub esp, 00000004h 5A pop edx 53 push ebx 8BDA mov ebx, edx E2F7 loop $-07h -------------------------------------------------------------------------- Brute-forcing for encrypted PE- and embedded OLE-files now... Bruting XOR Key: 0xff Bruting ADD Key: 0xff