Sep 09 CVE-2009-4324 + CVE-2010-1297 + CVE-2009-0927 PDF U.S. economy slips from spoofed henryAron@brookings.org 210.64.253.96

CVE-2009-4324 Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted PDF file using ZLib compressed streams, as exploited in the wild in December 2009.

CVE-2010-1297 Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64, Adobe AIR before 2.0.2.12610, and authplay.dll in Adobe Reader and Acrobat 9.x through 9.3.2 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted SWF content, as exploited in the wild in June 2010.

CVE-2009-0927 Stack-based buffer overflow in Adobe Reader and Adobe Acrobat 9 before 9.1, 8 before 8.1.3 , and 7 before 7.1.1 allows remote attackers to execute arbitrary code via a crafted argument to the getIcon method of a Collab object, a different vulnerability than CVE-2009-0658.

Download  as a password protected archive with the original PDf and analysis files/dropped binaries (contact me if you need the password)

-----Original Message-----
From: Henry J. Aaron [mailto:henryAron@brookings.org]
Sent: Thursday, September 09, 2010 9:38 AM
To: XXXXXXXXX
Subject: FW: U.S. economy slips to 4th in WEF's competitiveness rankings

To whom it may concern.

Henry J. Aaron

Senior Fellow, Economic Studies

The Brookings Institution

Headers

Received: (qmail 12137 invoked from network); 9 Sep 2010 13:43:33 -0000

Received: from h96-210-64-253.seed.net.tw (HELO brookings.org) (210.64.253.96)

  by XXXXXXXXXXXX with SMTP; 9 Sep 2010 13:43:33 -0000

From: "Henry J. Aaron"
Subject: FW: U.S. economy slips to 4th in WEF's competitiveness rankings
To: XXXXXXX
Content-Type: multipart/mixed;
    boundary="=_NextPart_2rfkindysadvnqw3nerasdf"; charset="US-ASCII"
MIME-Version: 1.0
Reply-To: h.swain65@yahoo.com
Date: Thu, 9 Sep 2010 21:37:54 +0800
X-Priority: 3
X-Mailer: Microsoft Outlook Express 5.00.2615.200

210.64.253.96

Hostname:    h96-210-64-253.seed.net.tw
ISP:    Digital United Inc.
Organization:    Seednet-TaipeiDP-S
State/Region:    T'ai-pei
City:    Taipei

CVE-2009-4324

CVE-2010-1297

CVE-2009-0927
http://wepawet.cs.ucsb.edu/view.php?hash=47a46ba2220cf6368eb0d42d8a6d40e3&type=js

Jul 6 CVE-2010-1297 PDF EPA's Water Sampling Report from spoofed OCSPP@epa.gov

CVE-2010-1297 Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64, Adobe AIR before 2.0.2.12610, and authplay.dll in Adobe Reader and Acrobat 9.x through 9.3.2 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted SWF content, as exploited in the wild in June 2010.

Download  719cf2bab291da52e495b86929b7ea7d  and 0733c4e2122cdfcfdd4699a3cbdc8b40  as a password protected archive (contact me if you need the password)

From: Office of Chemical Safety and Pollution Prevention, EPA [mailto:OCSPP@epa.gov]
Sent: Tuesday, July 06, 2010 5:31 AM
To: XXXXXXXXXXXXX
Subject: EPA's Water Sampling Report
Importance: High

EPA surface water samples collected June 17 - 26, 2010 along the Gulf Coast did not reveal elevated levels of chemicals found in oil.

Surface water results collected May 21 through June 24, 2010 along the coast of Louisiana were measured for two of the chemicals associated with dispersants (2-Butoxyethanol and 2-Ethylhexyl Alcohol).
Why is EPA sampling and monitoring the water?

EPA’s water sampling process includes the collection of the sample, laboratory analyses and data verification (which ensures high quality data). These steps take about 7 days to complete before the data can be posted on EPA’s website. As such, the data EPA posts is not representative of current conditions but rather is a snapshot in time for a given location. We continue to take water samples and will post data as soon as it becomes available.
My water tastes or smells different.  What should I do?

You can contact the Joint Information Center, or JIC, located in the heart of the response effort. The JIC is a coordination center for federal, state and local responding agencies. You may call the JIC at 985-902-5231.


 File water_update_part2.pdf received on 2010.07.07 11:39:21 (UTC)
http://www.virustotal.com/analisis/8f60aa88853eec6e0ffce6ea2a8916a597ff105b6e4a087454b2a9bfa82ef4c8-1278502761
Result: 14/41 (34.15%)
AntiVir    8.2.4.10    2010.07.07    EXP/CVE-2010-1297
Antiy-AVL    2.0.3.7    2010.07.07    Exploit/SWF.CVE-2010-1297
Avast    4.8.1351.0    2010.07.06    JS:Pdfka-AIX
Avast5    5.0.332.0    2010.07.06    JS:Pdfka-AIX

eTrust-Vet    36.1.7690    2010.07.07    SWF/CVE-2010-1297.A!exploit
F-Secure    9.0.15370.0    2010.07.07    Exploit.PDF-Name.Gen
GData    21    2010.07.07    Exploit.PDF-Name.Gen
Kaspersky    7.0.0.125    2010.07.07    Exploit.SWF.CVE-2010-1297.a
McAfee-GW-Edition    2010.1    2010.07.05    Heuristic.BehavesLike.PDF.Suspicious.O
nProtect    2010-07-07.01    2010.07.07    Exploit.PDF-Name.Gen
PCTools    7.0.3.5    2010.07.07    Trojan.Pidief
Sophos    4.54.0    2010.07.07    Mal/PDFEx-D
Symantec    20101.1.0.89    2010.07.07    Trojan.Pidief.J
Additional information
File size: 427577 bytes
MD5...: 719cf2bab291da52e495b86929b7ea7d

 File water_update_part1.pdf received on 2010.07.06 12:56:30 (UTC)
http://www.virustotal.com/analisis/1cffccaf528a882f781fb179a32356bfb176d683059c89faf81d7a51687330e0-1278420990
Result: 14/41 (34.15%)
AntiVir     8.2.4.2     2010.07.06     EXP/CVE-2010-1297
Antiy-AVL     2.0.3.7     2010.07.06     Exploit/SWF.CVE-2010-1297
Avast     4.8.1351.0     2010.07.06     JS:Pdfka-AIX
Avast5     5.0.332.0     2010.07.06     JS:Pdfka-AIX
BitDefender     7.2     2010.07.06     Exploit.PDF-Name.Gen
eTrust-Vet     36.1.7688     2010.07.06     SWF/CVE-2010-1297.A!exploit
F-Secure     9.0.15370.0     2010.07.06     Exploit.PDF-Name.Gen
GData     21     2010.07.06     Exploit.PDF-Name.Gen
Kaspersky     7.0.0.125     2010.07.06     Exploit.SWF.CVE-2010-1297.a
McAfee-GW-Edition     2010.1     2010.07.05     Heuristic.BehavesLike.PDF.Suspicious.O
nProtect     2010-07-06.01     2010.07.06     Exploit.PDF-Name.Gen
PCTools     7.0.3.5     2010.07.06     Trojan.Pidief
Sophos     4.54.0     2010.07.06     Mal/PDFEx-D
Symantec     20101.1.0.89     2010.07.06     Trojan.Pidief.J
Additional information
File size: 531280 bytes
MD5   : 0733c4e2122cdfcfdd4699a3cbdc8b40


Headers

Received: from pacificteaze.com (HELO ESMTP) (68.122.214.114)
  by XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Received: from SRV001([10.1.0.25]) by SMTPSRV (AIMC 2.9.5.7)with SMTP id tm393855644;
From: "Office of Chemical Safety and Pollution Prevention, EPA"
To: XXXXXXXXXXXXXXXXXXXX
Subject: EPA's Water Sampling Report
Sender: "Office of Chemical Safety and Pollution Prevention, EPA"
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="= Multipart Boundary 0706100230"
Date: Tue, 6 Jul 2010 02:30:59 -0700
X-Priority: 2
Priority: urgent
X-MSMail-Priority: High
Message-ID: <20100706093059109.2D45410B3A2B4742@server1>
X-Scanned: By Symantec Anti-Virus Scan Engine
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
68.122.214.114

Hostname:    pacificteaze.com
ISP:    SBC Internet Services
Organization:    Pacific Teaze
Proxy:    None detected
Type:    Broadband
Assignment:    Static IP
 Country:    United States
State/Region:    California
City:    Chatsworth

Jun 30 CVE-2010-1297 PDF 2020 National Defense Industrial Strategy Forum from techdm@csistdup.org.tw

CVE-2010-1297 Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64, Adobe AIR before 2.0.2.12610, and authplay.dll in Adobe Reader and Acrobat 9.x through 9.3.2 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted SWF content, as exploited in the wild in June 2010.

Download  497bd7eb4be6ae9b68c624e3fb594502 2020.pdf  as a password protected archive (contact me if you need the password)

 File 2020.pdf received on 2010.07.04 05:20:15 (UTC)
http://www.virustotal.com/analisis/000c6d021e9678184f059dd1dfacf75558bdd3f62e259e789836005efbf0e6b1-1278220815
Result: 14/41 (34.15%)
a-squared    5.0.0.31    2010.07.03    Exploit.SWF.CVE-2010-1297!IK
AntiVir    8.2.4.2    2010.07.02    EXP/CVE-2010-1297
Antiy-AVL    2.0.3.7    2010.07.02    Exploit/SWF.CVE-2010-1297
Avast    4.8.1351.0    2010.07.03    JS:Pdfka-AIX
Avast5    5.0.332.0    2010.07.03    JS:Pdfka-AIX
BitDefender    7.2    2010.07.04    Exploit.PDF-Name.Gen
eTrust-Vet    36.1.7684    2010.07.03    SWF/CVE-2010-1297.A!exploit
F-Secure    9.0.15370.0    2010.07.03    Exploit.PDF-Name.Gen
GData    21    2010.07.04    Exploit.PDF-Name.Gen
Ikarus    T3.1.1.84.0    2010.07.03    Exploit.SWF.CVE-2010-1297
Kaspersky    7.0.0.125    2010.07.04    Exploit.SWF.CVE-2010-1297.a
McAfee-GW-Edition    2010.1    2010.07.02    Heuristic.BehavesLike.PDF.Suspicious.O
nProtect    2010-07-04.01    2010.07.04    Exploit.PDF-Name.Gen
Sophos    4.54.0    2010.07.04    Mal/PDFEx-D
Additional information
File size: 237302 bytes
MD5...: 497bd7eb4be6ae9b68c624e3fb594502


Headers
Received: from mta-101.dothome.co.kr (HELO mta-101.dothome.co.kr) (211.239.118.134)
  by XXXXXXXXXXXXXXXXX
X-AuthUser: aks@a-one.co.kr
Received: from techdm ([218.234.32.224]:4032)
    by mta-101.dothome.co.kr with [XMail 1.22 PassKorea090507 ESMTP Server]
     ...
    Wed, 30 Jun 2010 23:21:06 +0900
Message-ID: <1975e5623c$23fce32a$0ae1d8b4@techdm212af2ce2>
From: "???K??"
To: XXXXXXXXXXXXXXX
Subject: =?big5?B?MjAyMLDqqL6s7KfesqO3frWmsqS9177CrKGwyg==?=
Date: Wed, 30 Jun 2010 22:07:21 +0800
MIME-Version: 1.0
Content-Type: multipart/mixed;
    boundary="----=_NextPart_000_000B_01CB18A0.9EBCFA10"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.3138
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5579

218.234.32.224

 Hostname:    218.234.32.224
ISP:    Hanaro Telecom Co.
Organization:    ARO INFORMATION TECH
Type:    Broadband
Assignment:    Static IP
Country:    Korea, Republic of
State/Region:    Soul-t'ukpyolsi
City:    Seocho

From: §õ¨K©É [mailto:techdm@csistdup.org.tw]
Sent: Wednesday, June 30, 2010 10:07 AM
To: XXXXXXXXXXXX
Subject: 2020國防科技產業策略論壇活動

 中山科學研究院預計於99年7月29日(星期四)AM09：30於本院龍園研究園區W48館
舉辦「2020國防科技產業策略論壇」活動，歡迎聯盟成員及各界人士踴躍報名參加。

一、論壇目的：
中科院預計99年7月29日於龍園研究園區舉辦「2020年國防科技產業策略論壇」活
動，主題為「整合產學科技能量，推動國防科技產業」，子題分別為 (一)結合週
邊園區、發展軍通科技。(二)轉化國防科技、創造產業價值。(三)引進民間資源、
建構自主國防。
本活動將邀請行政院科技顧問組萬執秘其超主持、工業局、技術處、中小企業處及
軍備局等主管擔任共同主持人，聽取國防科技產業聯盟成員(產業及學界)對未來年
國防科技能量釋出及參與國防研發機會之寶貴意見，期望透過此次活動整合出產學
研策略方向與共識，完成2020年我國國防科技產業發展策略報告，提供政府主管產
業(經濟部)及國防決策單位(國防部)，作為推動國防產業及發展軍民通用科技政策
之參考。

二、活動日期及地點
1.日期：99年7月29日(星期四)
2.時間：上午09：30至下午15：30
3.地點：龍園研究園區w48館一樓(國際會議廳)

三、報名方式
1.傳真：03-4117119
2.E-mail：techdm@csistdup.org.tw

四、報名截止：99年7月15日

五、聯絡人：李沛怡小姐：電話：03-4712201轉32982

Jun 28 CVE-2010-1297 Global Economic Policies and Prospects from xxx.crisisgroup.org

CVE-2010-1297 Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64, Adobe AIR before 2.0.2.12610, and authplay.dll in Adobe Reader and Acrobat 9.x through 9.3.2 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted SWF content, as exploited in the wild in June 2010.

Download  6932d141916cd95e3acaa3952c7596e4  Global.pdf   as a password protected archive (contact me if you need the password)

-----Original Message-----

From: Daniel Pinkston [mailto:XXXXXXXXXXXXXX]

Sent: Monday, June 28, 2010 12:49 PM

To: sitrep@crisisgroup.org

Subject: Global Economic Policies and Prospects

The attachment is quite useful for you .

Sincerely

Daniel  A. Pinkston, Ph.D.

North East Asia Deputy Project Director

ph: +XXXXXXXXXXX

Mobile: XXXXXXXXXXXX

  File Global.pdf received on 2010.07.04 03:03:52 (UTC)
http://www.virustotal.com/analisis/ab8a06d95935b07ad241c17d2c0bd2855e0ee77b24611805cd95fd4871052311-1278212632
Result: 16/41 (39.03%)
Antivirus     Version     Last Update     Result
a-squared    5.0.0.31    2010.07.03    Exploit.SWF.CVE-2010-1297!IK
AntiVir    8.2.4.2    2010.07.02    EXP/CVE-2010-1297
Antiy-AVL    2.0.3.7    2010.07.02    Exploit/SWF.CVE-2010-1297
Avast    4.8.1351.0    2010.07.03    JS:Pdfka-AIX
Avast5    5.0.332.0    2010.07.03    JS:Pdfka-AIX
BitDefender    7.2    2010.07.04    Exploit.PDF-Name.Gen
eTrust-Vet    36.1.7684    2010.07.03    SWF/CVE-2010-1297.A!exploit
F-Secure    9.0.15370.0    2010.07.03    Exploit.PDF-Name.Gen
GData    21    2010.07.04    Exploit.PDF-Name.Gen
Ikarus    T3.1.1.84.0    2010.07.03    Exploit.SWF.CVE-2010-1297
Kaspersky    7.0.0.125    2010.07.04    Exploit.SWF.CVE-2010-1297.a
McAfee-GW-Edition    2010.1    2010.07.02    Heuristic.BehavesLike.PDF.Suspicious.O
nProtect    2010-07-03.02    2010.07.03    Exploit.PDF-Name.Gen
Sophos    4.54.0    2010.07.03    Mal/PDFEx-D
TrendMicro    9.120.0.1004    2010.07.03    TROJ_PDFSWF.C
TrendMicro-HouseCall    9.120.0.1004    2010.07.04    TROJ_PDFSWF.C
Additional information
File size: 492149 bytes
MD5...: 6932d141916cd95e3acaa3952c7596e4

Headers
Received: from mail.crisisweb.org (HELO mail.crisisweb.org) (217.64.242.146)
  by XXXXXXXXXXXXXXXXXXXXXXXXXXX
Received: from apaitpdc.apaitonline.org ([12.11.239.25]) by mail.crisisweb.org with Microsoft SMTPSVC(6.0.3790.4675);
     Mon, 28 Jun 2010 18:49:32 +0200
Received: from 127.0.0.1 ([127.0.0.1]) by apaitpdc.apaitonline.org with Microsoft SMTPSVC(6.0.3790.4675);
     Mon, 28 Jun 2010 09:49:13 -0700
To: ""
From: "Daniel Pinkston"
Subject: Global Economic Policies and Prospects
X-Mailer: Ghost Mail 5.1 http://ay.home.ml.org/
X-Priority: 3 (Normal)
Return-Path: XXXXXXXXXXXXXXXXXXXXXXXXX
Message-ID:
X-OriginalArrivalTime: 28 Jun 2010 16:49:13.0640 (UTC) FILETIME=[D6BDB280:01CB16E1]
Date: Mon, 28 Jun 2010 09:49:13 -0700
X-TM-AS-Product-Ver: SMEX-8.6.0.1168-6.000.1038-17472.004
X-TM-AS-Result: No--11.273500-5.000000-31
X-TM-AS-User-Approved-Sender: No
X-TM-AS-User-Blocked-Sender: No
MIME-Version: 1.0
X-ConvertedToMime: 1

12.11.239.25

Hostname:    apaitpdc.apaitonline.org
ISP:    AT&T WorldNet Services
Organization:    ACC-ASIAN PACIFIC AIDS INTERVENT
Proxy:    None detected
Type:    Corporate
Assignment:    Static IP
Services:    Web Server (1 or more domains)
Geolocation Information
State/Region:    California
City:    Los Angeles

Jun 21 CVE-2010-1297 PDF Adobe 0-Day About the recent US-Japan Economic Relations - with Poison Ivy

CVE-2010-1297 Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64, Adobe AIR before 2.0.2.12610, and authplay.dll in Adobe Reader and Acrobat 9.x through 9.3.2 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted SWF content, as exploited in the wild in June 2010.

Adobe will fix this vulnerability on June 29

Security Risks in Asynchronous Patch Release Schedules by by Haifei Li Fortinet

Download   e3f5ef4fa17b4e08388ae4b0e2373728  100621.pdf  as a password protected archive (contact me if you need the password)

-----Original Message-----
From: 大川　正人 [mailto:maseto.okawa@cas.go.jp]
Sent: Monday, June 21, 2010 12:29 AM
To: xxxxxxx
Subject: 最近の日米経済関係について
Importance: High
......
�i‘ã•\�j03-5453-2111�i“à�ü�j82657
�i’¼’Ê�j03-3581-4445
�iFAX�j03-3581-5601
masato.okawa@cas.go.jp
=====================================
----- Original Message -----From: Ookawa Masato [mailto: maseto.okawa @ cas.go.jp]Sent: Monday, June 21, 2010 12:29 AM
To: xxxxxxxSubject: About the recent US-Japan Economic RelationsImportance: High

 Headers

Received: from unknown (HELO cas.go.jp) (60.26.142.253)

Received: from SSSSSS-2F0F04F3[192.168.1.211] by cas.go.jp
  with SMTP id 4C7BCC96; Mon, 21 Jun 2010 12:28:56 +0800
From: =?ISO-2022-JP?B?GyRCQmdAbiEhQDU/TRsoQg==?=
Subject: =?ISO-2022-JP?B?GyRCOkc2YSRORnxKRjdQOlE0WDc4JEskRCQkJEYbKEI=?=
To: xxxxxxxxxxxxxxxxx
Content-Type: multipart/mixed;
    boundary="=_NextPart_2rfkindysadvnqw3nerasdf"; charset="iso-2022-jp"
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Reply-To: maseto.okawa@cas.go.jp
Date: Mon, 21 Jun 2010 12:29:29 +0800
X-Priority: 2
X-Mailer: Foxmail 4.1 [cn]
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             
 60.26.142.253
ISP:    China Unicom Tianjin province network
Organization:    China Unicom Tianjin province network
Type:    Broadband
Assignment:    Static IP
Country:    China cn flag
State/Region:    Tianjin       

     File 100621.pdf received on 2010.06.22 00:33:39 (UTC)

http://www.virustotal.com/analisis/5e77d181d45156a17423a7a9d8be59635c3425003a35957f3ccf973bf4a1240b-1277166819
Result: 9/41 (21.95%)
a-squared     5.0.0.30     2010.06.21     Exploit.JS.Pdfka!IK
AntiVir     8.2.2.6     2010.06.21     HTML/Malicious.PDF.Gen
BitDefender     7.2     2010.06.22     Exploit.PDF-JS.Gen
GData     21     2010.06.22     Exploit.PDF-JS.Gen
Ikarus     T3.1.1.84.0     2010.06.21     Exploit.JS.Pdfka
Kaspersky     7.0.0.125     2010.06.21     Exploit.JS.Pdfka.clv
McAfee-GW-Edition     2010.1     2010.06.21     Heuristic.BehavesLike.PDF.Suspicious.O
Sophos     4.54.0     2010.06.21     Troj/PDFJs-KY
VirusBuster     5.0.27.0     2010.06.21     JS.Pdfka.Gen.11
Additional information
File size: 969411 bytes
MD5   : e3f5ef4fa17b4e08388ae4b0e2373728      

Many thanks to JM for sharing the following information
Dropped files
100621.PDF (95210e66bc040ee0f6b5601390658007 – benign decoy, notice the size difference 105 kb
SUCHOST.EXE (abf8e40d7c99e9b3f515ec0872fe099e – 45k)  - appears to be Poison Ivy RAT

VT Result: 19/41 (46.34%)
SUCHOST.EXE
http://www.virustotal.com/analisis/8264a96a954c9a3f661bd21b9493377a710aaac1e96fe276d8d9095ea286c84a-1277147963
AhnLab-V3   2010.06.21.02     2010.06.21  Win-Trojan/Agent.45056.AMQ
Antiy-AVL   2.0.3.7     2010.06.18  Trojan/Win32.Agent.gen
Authentium  5.2.0.5     2010.06.21  W32/Trojan2.MIBZ
Avast 4.8.1351.0  2010.06.21  Win32:Malware-gen
Avast5      5.0.332.0   2010.06.21  Win32:Malware-gen
AVG   9.0.0.787   2010.06.21  Agent2.ALLE
BitDefender 7.2   2010.06.21  Trojan.Inject.XI
CAT-QuickHeal     10.00 2010.06.18  Trojan.Agent.dgqy
DrWeb 5.0.2.03300 2010.06.21  Trojan.Siggen1.43943
F-Prot      4.6.1.107   2010.06.20  W32/Trojan2.MIBZ
F-Secure    9.0.15370.0 2010.06.21  Trojan.Inject.XI
GData 21    2010.06.21  Trojan.Inject.XI
Jiangmin    13.0.900    2010.06.15  Trojan/Agent.cule
McAfee-GW-Edition 2010.1      2010.06.21  Heuristic.LooksLike.Trojan.Backdoor.Poison.I
Microsoft   1.5902      2010.06.21  Backdoor:Win32/Poison.AP
NOD32 5216  2010.06.21  a variant of Win32/Poison.NDQ
nProtect    2010-06-21.01     2010.06.21  Trojan/W32.Agent.45056.TM
Panda 10.0.2.7    2010.06.21  Suspicious file
ViRobot     2010.6.21.3896    2010.06.21  Trojan.Win32.Agent.45056.HO

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              

Jun 20 CVE-2010-1297 PDF Adobe 0-Day Meeting agenda from alexis.mo88@gmail.com

CVE-2010-1297 Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64, Adobe AIR before 2.0.2.12610, and authplay.dll in Adobe Reader and Acrobat 9.x through 9.3.2 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted SWF content, as exploited in the wild in June 2010.

Adobe will fix this vulnerability on June 29

Security Risks in Asynchronous Patch Release Schedules by by Haifei Li Fortinet

Download  fb2523d17b3fa3b19a914bf23a61827c Agenda.pdf as a password protected archive (contact me if you need the password)

 

 From: Alexis Moore [mailto:alexis.mo88@gmail.com]
Sent: Sunday, June 20, 2010 9:21 AM
To: xxxxxx
Subject: Meeting agenda

Hi everyone!
I hope everyone has been as busy as I have reviewing our set of reference documents!  With the meeting quickly approaching, we can maximize our productivity with everyone familiar with the various projects & activities related to our work effort.
here is an agenda outline for the upcoming meeting.  I look forward to seeing everyone there, and hope your travel is uneventful.
-Alexis

The PDF file is very similar to the one described in this Symantec blog post

http://www.symantec.com/connect/blogs/analysis-zero-day-exploit-adobe-flash-and-reader 

VT

 http://www.virustotal.com/analisis/5d312ec870b42302798324e88e49ff82ab607ca93bbf1300335d03c6bd71c7b3-1277184081

 File Agenda.PDF received on 2010.06.21 05:05:57 (UTC)
Result: 5/41 (12.20%)
AntiVir     8.2.2.6     2010.06.20     HTML/Malicious.PDF.Gen
Kaspersky     7.0.0.125     2010.06.21     Exploit.JS.Pdfka.clv
McAfee-GW-Edition     2010.1     2010.06.20     Heuristic.BehavesLike.PDF.Suspicious.O
Sophos     4.54.0     2010.06.21     Troj/PDFJs-KY
VirusBuster     5.0.27.0     2010.06.20     JS.Pdfka.Gen.11
Additional information
File size: 969401 bytes
MD5   : fb2523d17b3fa3b19a914bf23a61827c

Jun 21 CVE-2010-1297 PDF About the recent US-Japan Economic Relations

CVE-2010-1297 Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64, Adobe AIR before 2.0.2.12610, and authplay.dll in Adobe Reader and Acrobat 9.x through 9.3.2 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted SWF content, as exploited in the wild in June 2010.

Download  e3f5ef4fa17b4e08388ae4b0e2373728 100621.pdf  as a password protected archive (contact me if you need the password)
 

 File 100621.pdf received on 2010.07.04 06:06:32 (UTC)
http://www.virustotal.com/analisis/5e77d181d45156a17423a7a9d8be59635c3425003a35957f3ccf973bf4a1240b-1278223592
Result: 18/41 (43.91%)
a-squared    5.0.0.31    2010.07.04    Exploit.JS.Pdfka!IK
AntiVir    8.2.4.2    2010.07.02    HTML/Malicious.PDF.Gen
Comodo    5309    2010.07.04    UnclassifiedMalware
eSafe    7.0.17.0    2010.06.30    Win32.Pidief.J
eTrust-Vet    36.1.7684    2010.07.03    PDF/Pidief.RU
Ikarus    T3.1.1.84.0    2010.07.04    Exploit.JS.Pdfka
Kaspersky    7.0.0.125    2010.07.04    Exploit.JS.Pdfka.clv
McAfee    5.400.0.1158    2010.07.04    Exploit-PDF.ca
McAfee-GW-Edition    2010.1    2010.07.02    Exploit-PDF.ca
Microsoft    1.5902    2010.07.03    Exploit:SWF/CVE-2010-1297.E
NOD32    5249    2010.07.04    JS/Exploit.Pdfka.CLV
Norman    6.05.10    2010.07.03    JS/Shellcode.IT
PCTools    7.0.3.5    2010.07.02    Trojan.Pidief
Sophos    4.54.0    2010.07.04    Troj/PDFJs-KY
Symantec    20101.1.0.89    2010.07.04    Trojan.Pidief.J
TrendMicro    9.120.0.1004    2010.07.04    TROJ_PIDIEF.WL
TrendMicro-HouseCall    9.120.0.1004    2010.07.04    TROJ_PIDIEF.WL
VirusBuster    5.0.27.0    2010.07.03    JS.Pdfka.Gen.11
File size: 969411 bytes
MD5...: e3f5ef4fa17b4e08388ae4b0e2373728

Jun 20 CVE-2010-1297 PDF Meeting agenda from alexis.mo88@gmail.com

CVE-2010-1297 Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64, Adobe AIR before 2.0.2.12610, and authplay.dll in Adobe Reader and Acrobat 9.x through 9.3.2 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted SWF content, as exploited in the wild in June 2010.

Download   fb2523d17b3fa3b19a914bf23a61827c Agenda.PDF as a password protected archive (contact me if you need the password)

From: Alexis Moore [mailto:alexis.mo88@gmail.com]
Sent: Sunday, June 20, 2010 9:21 AM
To: XXXXXXXXXXXXXX
Subject: Meeting agenda

Hi everyone!
I hope everyone has been as busy as I have reviewing our set of reference documents!  With the meeting quickly approaching, we can maximize our productivity with everyone familiar with the various projects & activities related to our work effort.
here is an agenda outline for the upcoming meeting.  I look forward to seeing everyone there, and hope your travel is uneventful.
-Alexis

 File Agenda.PDF received on 2010.07.04 16:55:23 (UTC)
http://www.virustotal.com/analisis/5d312ec870b42302798324e88e49ff82ab607ca93bbf1300335d03c6bd71c7b3-1278262523
Result: 18/41 (43.91%)
a-squared    5.0.0.31    2010.07.04    Exploit.JS.Pdfka!IK
AhnLab-V3    2010.07.03.00    2010.07.03    PDF/Exploit
AntiVir    8.2.4.2    2010.07.02    HTML/Malicious.PDF.Gen
Authentium    5.2.0.5    2010.07.04    PDF/Pidief.BY
eSafe    7.0.17.0    2010.07.04    Win32.Pidief.J
Ikarus    T3.1.1.84.0    2010.07.04    Exploit.JS.Pdfka
Kaspersky    7.0.0.125    2010.07.04    Exploit.JS.Pdfka.clv
McAfee    5.400.0.1158    2010.07.04    Exploit-PDF.q.gen!stream
McAfee-GW-Edition    2010.1    2010.07.02    Heuristic.BehavesLike.PDF.Suspicious.O
Microsoft    1.5902    2010.07.03    Exploit:SWF/CVE-2010-1297.E
NOD32    5250    2010.07.04    JS/Exploit.Pdfka.CLV
Norman    6.05.10    2010.07.04    JS/Shellcode.IT
PCTools    7.0.3.5    2010.07.02    Trojan.Pidief
Sophos    4.54.0    2010.07.04    Troj/PDFJs-KY
Symantec    20101.1.0.89    2010.07.04    Trojan.Pidief.J
TrendMicro    9.120.0.1004    2010.07.04    TROJ_PIDIEF.VX
TrendMicro-HouseCall    9.120.0.1004    2010.07.04    TROJ_PIDIEF.VX
VirusBuster    5.0.27.0    2010.07.04    JS.Pdfka.Gen.11
Additional information
File size: 969401 bytes
MD5...: fb2523d17b3fa3b19a914bf23a61827c

Jun 14 CVE-2010-1297 PDF Adobe 0-Day WEO from sacchetti.dana@gmail.com

CVE-2010-1297. The vulnerability (CVE-2010-1297) causes the application to crash and could be used to run arbitrary code. This means that the malicious files could be downloaded or dropped on the affected system. 

Adobe will fix this vulnerability on June 29

Security Risks in Asynchronous Patch Release Schedules by by Haifei Li Fortinet

Many thanks To Scott D, JM, AK1010, Villy  for their information, relevant discussions and ideas and Binjo for his shellcode analysis

Download 81f31e17d97342c8f3700fdd56019972 WEO.pdf + dropped files + shellcode (by Binjo)





Tested on  Flash 10.1, Acrobat Reader 9.3.2, Windows XP sp3. It does not work on SP SP2 and Vista, Windows 7.


Message:

 VT SCAN JUNE 21
http://www.virustotal.com/analisis/380c784d6d561cac16942d6b9933d9f7277eae05cee16cc9e30fdc73915d8447-1277107857

  File WEO.pdf received on 2010.06.22 04:18:27 (UTC)
Result:13/41 (31.71%)
a-squared    5.0.0.30    2010.06.22    Exploit.SWF.Agent!IK
AntiVir    8.2.2.6    2010.06.21    EXP/CVE-2010-1297
Antiy-AVL    2.0.3.7    2010.06.18    Exploit/SWF.Agent
BitDefender    7.2    2010.06.22    Exploit.SWF.J
Comodo    5178    2010.06.22    UnclassifiedMalware
F-Prot    4.6.1.107    2010.06.21    JS/Pdfka.V
F-Secure    9.0.15370.0    2010.06.22    Exploit.SWF.J
GData    21    2010.06.22    Exploit.SWF.J
Ikarus    T3.1.1.84.0    2010.06.22    Exploit.SWF.Agent
Kaspersky    7.0.0.125    2010.06.22    Exploit.SWF.Agent.dp
McAfee-GW-Edition    2010.1    2010.06.21    Heuristic.BehavesLike.PDF.Suspicious.O
Microsoft    1.5902    2010.06.22    Exploit:SWF/CVE-2010-1297.A
Sophos    4.54.0    2010.06.22    Troj/SWFDlr-S
Additional information
File size: 121898 bytes
MD5...: 81f31e17d97342c8f3700fdd56019972


Javascript code snapshot

On Windows XP SP3 there is a slight delay/flicker before the PDF opens the clean decoy file shown below.

The dropped files are the following:

• 9ED35F49FA4DAF6CAC55E09719C58823 a.pdf - clean decoy file you see on the left

•  D87246D9E33C121C7F2615AE9B64FC9C ProdMgr.exe
•  TEMXX.tmp (Where XX is a random number) 380 kb, which is cmd.exe

  File naProdMgr.exe received on 2010.06.22 05:01:15 (UTC)
http://www.virustotal.com/analisis/e2252eda0fdee991ecf2448d35ef33555de06f25c48827beb46bbebc2bf96bb6-1277182875
Result: 19/41 (46.35%)
Antivirus     Version     Last Update     Result
a-squared    5.0.0.30    2010.06.22    Backdoor.Win32.Ixeshe!IK
AhnLab-V3    2010.06.22.00    2010.06.22    Backdoor/Win32.Small
AntiVir    8.2.2.6    2010.06.21    BDS/Small.jjf
Avast    4.8.1351.0    2010.06.21    Win32:Malware-gen
Avast5    5.0.332.0    2010.06.21    Win32:Malware-gen
AVG    9.0.0.787    2010.06.21    Small.CCX
BitDefender    7.2    2010.06.22    Trojan.Generic.4211739
Comodo    5178    2010.06.22    Backdoor.Win32.Small.jjf
eSafe    7.0.17.0    2010.06.20    Win32.Small.Nem
F-Secure    9.0.15370.0    2010.06.22    Trojan.Generic.4211739
GData    21    2010.06.22    Trojan.Generic.4211739
Ikarus    T3.1.1.84.0    2010.06.22    Backdoor.Win32.Ixeshe
Kaspersky    7.0.0.125    2010.06.22    Backdoor.Win32.Small.jjf
McAfee-GW-Edition    2010.1    2010.06.21    Heuristic.BehavesLike.Win32.PasswordStealer.H
NOD32    5216    2010.06.21    probably a variant of Win32/Small.NEM
nProtect    2010-06-21.01    2010.06.21    Trojan.Generic.4211739
Panda    10.0.2.7    2010.06.21    Suspicious file
Sunbelt    6483    2010.06.21    Trojan.Win32.Generic!BT
ViRobot    2010.6.21.3896    2010.06.22    Backdoor.Win32.S.Small.30720.E
VirusBuster    5.0.27.0    2010.06.21    -
Additional information
File size: 30720 bytes
MD5...: d87246d9e33c121c7f2615ae9b64fc9c

older scan

http://www.virustotal.com/analisis/e2252eda0fdee991ecf2448d35ef33555de06f25c48827beb46bbebc2bf96bb6-1276575253

http://anubis.iseclab.org/?action=result&task_id=103e66936121161044dbaae530a892283&format=html

=============================================

Traffic information

DNS Queries
ftp.jlesher.xxuz.com       DNS_TYPE_A       21.216.185.67       YES       udp
www.jlesher.xxuz.com      DNS_TYPE_A      110.4.3.2      YES      udp
TCP Connections
216.185.67.21:443

Intersesting traffic, really.  Looks like they configured their Changeip.com domain name ftp.jlesher.xxuz.com  to point to 21.216.185.67.
216.185.67.21, which you can see also being used by this malware is very similar.
 I think they just made a typo and directed it to DoD instead of their machine.
Or they temporarily set that domain to 21.216.185.67 (DoD traffic is not suspicious) and will turn it back to the real address when time is right)..

Unconfirmed theory here is that malware receives DNS replies 21.216.185.67 and 110.4.3.2 and transforms them into 216.185.67.21:443 by transposing 21 for the IP address and  by using the following forumula to turn 110.4.3.2 into the port number a.b.c.d - 110.4.3.2, (a*b)+c =443
(Many thanks To Scott D. for clueing me in about such possibility and Jack M for the relevant discussions and ideas).
I think the the benefits of such arrangement would be diversion for the admins (blocking 110.4.3.2 and 21.216.185.67 achieves nothing) and ability to change IP ports by just changing IP address on their domain in Changeip.com.

Your thoughts or othes theories are welcome. If we confirm anything, we will post the code or additional info.

 Traffic. Malware IPs are marked - see picture below

DNS query for ftp.jlesher.xxuz.com returns 21.216.185.67
 21.216.185.67 is http://www.dnsstuff.com/tools/whois/?tool_id=66&token=&toolhandler_redirect=0&ip=21.216.185.67

DoD Network Information Center is Department of Defense http://www.nic.mil/

DoD Network Information Center Mission Statement:To provide information and services that are mission critical to the operation of the worldwide IP router Defense Information Systems Network (DISN) and other DoD sponsored networks.

OrgName: DoD Network Information Center 
OrgID: DNIC
Address: 3990 E. Broad Street
City: Columbus
StateProv: OH
PostalCode: 43218
Country: US
NetRange: 21.0.0.0 - 21.255.255.255
CIDR: 21.0.0.0/8
NetName: DNIC-SNET-021
NetHandle: NET-21-0-0-0-1
**********@nic.milOrgTechHandle: REGIS10-ARINOrgTechName: Registration OrgTechPhone: +1-800-365-3642





 General IP Information
Hostname: 61.177.42.5
ISP: Data Communication Division
Organization: CHINANET jiangsu province network
Proxy: None detected
Type: Broadband
Assignment: Dynamic IP
Country: China 
State/Region: Beijing

OLDER SCANS

VT SCAN JUNE 17 (with minor improvement)
http://www.virustotal.com/analisis/380c784d6d561cac16942d6b9933d9f7277eae05cee16cc9e30fdc73915d8447-1276774425
 File WEO.pdf received on 2010.06.17 11:33:45 (UTC)
Result: 9/41 (21.96%)
a-squared    5.0.0.26    2010.06.17    Exploit.SWF.Agent!IK
AntiVir    8.2.2.6    2010.06.17    EXP/CVE-2010-1297
Antiy-AVL    2.0.3.7    2010.06.17    Exploit/SWF.Agent
F-Prot    4.6.0.103    2010.06.16    JS/Pdfka.V
Ikarus    T3.1.1.84.0    2010.06.17    Exploit.SWF.Agent
Kaspersky    7.0.0.125    2010.06.17    Exploit.SWF.Agent.dp
McAfee-GW-Edition    2010.1    2010.06.16    Heuristic.BehavesLike.PDF.Suspicious.O
Microsoft    1.5902    2010.06.17    Exploit:SWF/CVE-2010-1297.A
Sophos    4.54.0    2010.06.17    Troj/SWFDlr-S
Additional information
File size: 121898 bytes
MD5...: 81f31e17d97342c8f3700fdd56019972

VT SCAN  JUNE 16
http://www.virustotal.com/analisis/380c784d6d561cac16942d6b9933d9f7277eae05cee16cc9e30fdc73915d8447-1276571931
BitDefender     7.2     2010.06.15     Exploit.SWF.J
F-Prot     4.6.0.103     2010.06.14     JS/Pdfka.V
F-Secure     9.0.15370.0     2010.06.15     Exploit.SWF.J
GData     21     2010.06.15     Exploit.SWF.J
Kaspersky     7.0.0.125     2010.06.15     Exploit.SWF.Agent.dp
Microsoft     1.5802     2010.06.14     Exploit:SWF/CVE-2010-1297.A
Sophos     4.54.0     2010.06.15     Troj/SWFDlr-S
Additional information
File size: 121898 bytes
MD5   : 81f31e17d97342c8f3700fdd56019972

Jun 8 Adobe 0 Day CVE-2010-1297 Analysis

Analysis of a Zero-day Exploit for Adobe Flash and Reader by Andrea Lelli (Symantec)

Trojan.Pidief.J

 

 

A brief analysis of a malicious PDF file which exploits this week’s Flash 0-day by Sebastian Porst (Zynamics)