Oct 17 CVE-2010-2883 PDF Report on the coming Presidential Election in TW

Here is one more sample. Call home to 112.213.126.67 googlemail.proxydns.com

Jul 13 CVE-2010-2883 PDF Meeting Agenda with more Poison Ivy www.adv138mail.com | 112.121.171.94

Here is one more for a full collection - same malware and sender as in the previous post.  This message, targeting experts on Japan, China, Taiwan / USA relationship, was sent on July 13,2011. The attached pdf exploits CVE-2010-2883 (2/43 VT, encrypted) with poison ivy (keylogging) payload, connecting to www.adv138mail.com. The domains serving PI and listed below were registered by DNS.com.cn, which has a poor reputation. These domains/IP have been CnC for poison ivy for a while, consider the posts below.

Other PI domains noted are:
web.adv138mail.com; -2011
dns.adv138mail.com - 2011 (thank you, John)

www.adv138mail.com  - 2011 - 112.121.171.94  
pu.flower-show.org - 2011 - 112.121.171.94

cecon.flower-show.org - 2010   
posere.flower-show.org - 2009

112.121.171.94  Nov.adv138mail.com, ftp.adv138mail.com and asm.adv138mail.com point to 112.121.171.94.

• Contagio | Jul 5 CVE-2010-2883 PDF invitation.pdf with Poison Ivy from 112.121.171.94 | pu.flower-show.org
• Contagio | More flowers with some poison ivy - Feb. 10, 2010
• F-secure | Watch Out for flower-show.org - Feb.10, 2010
• ISC | Sophisticated, targeted malicious PDF documents exploiting CVE-2009-4324 - Jan 4, 2010 

Jul 5 CVE-2010-2883 PDF invitation.pdf with Poison Ivy from 112.121.171.94 | pu.flower-show.org

Update Jul 13. Considering that this pdf is very low detection, I decided to post some of the target domains here in case it helps them to prevent or identify infections.

The non-gmail domains included:

usjapancouncil.org, spfusa.org, vanderbilt.edu, comdt.uscg.mil, miis.edu

If you work at one of those places and must know the actual recipient, you can contact me. ~ Mila

The message, targeting experts on Japan, China, Taiwan / USA relationship was sent on July 5. The attached pdf exploits CVE-2010-2883 (2/43 VT, encrypted) with poison ivy (keylogging) payload, connecting to pu.flower-show.org. This domain has been CnC for poison ivy for a while, consider these posts
Contagio | More flowers with some poison ivy - Feb. 10, 2010
F-secure | Watch Out for flower-show.org - Feb.10, 2010
ISC | Sophisticated, targeted malicious PDF documents exploiting CVE-2009-4324 - Jan 4, 2010 

Other PI domains noted are:
pu.flower-show.org - 2011
cecon.flower-show.org - 2010
posere.flower-show.org - 2009

May 17 CVE-2010-2883 PDF Bin Laden's successor from spoofed Nationalpost.com

Common Vulnerabilities and Exposures

CVE-2010-2883 Stack-based buffer overflow in CoolType.dll in Adobe Reader and Acrobat 9.x before 9.4, and 8.x before 8.2.5 on Windows and Mac OS X, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a PDF document with a long field in a Smart INdependent Glyphlets (SING) table in a TTF font, as exploited in the wild in September 2010. 

  General File Information

MD5                 8E633588B3EE59DE09FE126D99869D2D 

SIZE 103981 bytes
EXPLOIT TYPE         CVE-2010-2883
FILE NAME             Bin Ladens successor.pdf

Post Updates

The file uses Fonts/SING CVE_2010-2883 exploit, which does not seem to be metasploit generated.

The sender is often uses compromised servers of different organizations

    *     Jan 6 CVE-2010-3333 DOC with info theft trojan from the American Chamber of Commerce

    *     Jan 12 CVE-2010-3654 + CVE-2009-4324 + CVE-2009-0927 + CVE-2008-0655 PDF JANUARY 2011 from a compromised Thai Police account

 It is unclear whether this time it is a compromised server or the attacker uses the services of this internet provider as a customer    

Beyond the Network America, Inc. (BTNaccess) is a wholly owned subsidiary of PCCW, and is headquartered in Reston, Virginia and Hong Kong with offices in Los Angeles, New York City, Philadelphia, Houston, London, Moscow, Prague, Kuala Lumpur, Singapore, Shenzhen, Tokyo, Mumbai and New Delhi.

PCCW, a global leader in next generation broadband solutions, is the largest telecommunications provider in Hong Kong. PCCW is the operator of one of the world’s most advanced broadband networks and has over 700,000 broadband customers and 12,500 employees worldwide. As a global player, PCCW has portrayed innovation within the industry and demonstrated financial stability with 2003 revenues reaching US$2.89 billion.

Nov 19 CVE-2010-2883 with Flash JIT Spray (PDF in PDF) Event Invitation from The Heritage Foundation from spoofed Heritage address

Common Vulnerabilities and Exposures (CVE)number

CVE-2010-2883 Stack-based buffer overflow in CoolType.dll in Adobe Reader and Acrobat 9.x before 9.4, and 8.x before 8.2.5 on Windows and Mac OS X, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a PDF document with a long field in a Smart INdependent Glyphlets (SING) table in a TTF font, as exploited in the wild in September 2010. NOTE: some of these details are obtained from third party information.

  General File Information

File  Event Invitation from Heritage.pdf
MD5   529AE8C6AC75E555402AA05F7960EB0D
SHA1   d793f0c3e051bc03b0cd5e2c2f87f3be33612d49
File size : 358996
Type:  PDF
Distribution: Email attachment

Read more...

CVE-2010-3654 Adobe Reader 0 day + CVE-2010-2883 Flash 10.1.102.64 + Reader 9.4.0.195 PDF Federal Benefits

Common Vulnerabilities and Exposures (CVE)number

CVE-2010-3654 Adobe Flash Player 10.1.85.3 and earlier on Windows, Mac OS X, Linux, and Solaris and 10.1.95.2 and earlier on Android, and authplay.dll (aka AuthPlayLib.bundle or libauthplay.so.0.0.0) in Adobe Reader and Acrobat 9.x through 9.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via crafted SWF content, as exploited in the wild in October 2010.

CVE-2010-2883 Stack-based buffer overflow in CoolType.dll in Adobe Reader and Acrobat 9.x before 9.4, and 8.x before 8.2.5 on Windows and Mac OS X, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a PDF document with a long field in a Smart INdependent Glyphlets (SING) table in a TTF font, as exploited in the wild in September 2010. NOTE: some of these details are obtained from third party information. 

Post Updates

Update 6, Nov 16  2010-------------------------------------------------------------------------------------------
After yesterday tweets (snowfl0w and sempersecurus), GoDaddy took notice and suspended mysundayparty.com domain
here is the email

---------- Forwarded message ----------
From: GoDaddy Abuse Department
Date: Tue, Nov 16, 2010 at 11:16 AM
Subject: RE: reminder - mysundayparty.com complaint
To: Mila

Dear Mila Parkour,

Thank you for bringing this situation to our attention. We have gone
ahead and suspended the domain name in question.
Please let us know if you find any other domain names connected to C&C
servers or other malware distribution.
Regards,
Joe
GoDaddy.com
Spam and Abuse Department
24/7 Abuse Department Hotline: 480-624-2505
ARID1003

 Here is current Whois
Registrant:
debby ryan
411 N. 6th Street, Emery, SD
Emery, SD
sd, shen zhen 90002
China

Registered through: GoDaddy.com, Inc. (http://www.godaddy.com)
Domain Name: MYSUNDAYPARTY.COM
Created on: 15-Sep-10
Expires on: 15-Sep-11
Last Updated on: 15-Sep-10

Administrative Contact:
ryan, debby g.debbei_@yahoo.com
411 N. 6th Street, Emery, SD
Emery, SD
sd, shen zhen 90002
China
+86.9801455 Fax --

Technical Contact:
ryan, debby g.debbei_@yahoo.com
411 N. 6th Street, Emery, SD
Emery, SD
sd, shen zhen 90002
China
+86.9801455 Fax --

Domain servers in listed order:
NS1.SUSPENDED-FOR.SPAM-AND-ABUSE.COM
NS2.SUSPENDED-FOR.SPAM-AND-ABUSE.COM

Update 5, Nov 15 2010-------------------------------------------------------------------------------------------
mysundayparty.com domain is still active. resent the message below to abuse@godaddy.com

24.248.182.214  

Hostname:    wsip-24-248-182-214.ph.ph.cox.net  - Is it C&C or someone's sinkhole? Anybody?


Update 4, Nov 13 2010-------------------------------------------------------------------------------------------
mysundayparty.com domain is still active
The message that was sent to GoDaddy abuse department on Nov 10, 2010 read

Dear GoDaddy Abuse Department,
mysundayparty.com has been C&C for 0-days malware  

• http://contagiodump.blogspot.com/2010/09/sep-15-cve-2010-2883-pdf-us-government.html
• http://contagiodump.blogspot.com/2010/10/potential-new-adobe-flash-player-zero.html
• http://contagiodump.blogspot.com/2010/11/cve-2010-3654.html

and used in targeted attacks described above.
Please take action asap
Thanks

Read more...

CVE-2010-2883 PDF An invitation to the Nobel Prize ceremony of Liu Xiaobo

Common Vulnerabilities and Exposures (CVE)number

  CVE-2010-2883 Stack-based buffer overflow in CoolType.dll in Adobe Reader and Acrobat 9.x before 9.4, and 8.x before 8.2.5 on Windows and Mac OS X, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a PDF document with a long field in a Smart INdependent Glyphlets (SING) table in a TTF font, as exploited in the wild in September 2010. NOTE: some of these details are obtained from third party information

  General File Information

File invitation.pdf
MD5   : 29db2fba7975a16dbc4f3c9606432ab2
SHA1  : 5d65e6984e521936707b32219b39388efb4296fa
File size :344218 bytes
Type:  PDF
Distribution: Email attachment 

Post Updates

• Nov 8, 2010 Post by Mikko H. Hyppönen on F-Secure blog - Case Nobel

• Nov 10, 2010 CPJ. Committee to Protect Journalists. That Nobel invite? Mr. Malware sent it -- By Danny O'Brien/CPJ Internet Advocacy Coordinator
• Nov 10, 2010 Computerworld (Norway) New attack against Nobel Prize by Ole Petter Baugerød Stokke (Google Translated)
• Nov 10, 2010 Le Figaro*fr Nobel: new computer attack (Google translated)
• Nov 10, 2010 APF Google New cyber attack linked to Nobel Peace Prize
• Nov. 13 Infowar Monitor Nobel Peace Prize, Amnesty HK and Malware by Nart Villeneuve

More about similar attacks

• Oct 22, 2010 Infowar Monitor Command and Control in the Cloud
• Aug 19, 2010 Infowar Monitor Human Rights and Malware Attacks

read more...

Oct 08 CVE-2010-2883 PDF Nuclear Challenges and Responses in the Century from JUN.Bong-Geun@ifans.go.kr

CVE-2010-2883 Stack-based buffer overflow in CoolType.dll in Adobe Reader and Acrobat 9.3.4 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a PDF document with a long field in a Smart INdependent Glyphlets (SING) table in a TTF font, as exploited in the wild in September 2010. NOTE: some of these details are obtained from third party information. 

Download Conference Information_2010 IFANS Conference on Global Affairs (1001)  as a password protected archive (contact me if you need the password)

----Original Message-----
From: JUN.Bong-Geun@ifans.go.kr [mailto:JUN.Bong-Geun@ifans.go.kr]
Sent: Friday, October 08, 2010 1:43 PM
Subject: Nuclear Challenges and Responses in the Century

Dear all

We inform you of an event and expect your kindly opinions.
On October 4th-5th 2010, the  IFANS Conference on Global Affairs in 2010, "Nuclear Challenges and Responses in the  Century" is hosted by the Institute of Foreign Affairs and National Security (IFANS) and the Presidential Council for Future and Vision (PCFV), and is organized by the Institute of Foreign Affairs and National Security (IFANS),ROK.

At the conference,in-depth discussion is expected among international and Korean experts and turn-out policy recommendations in terms of three subjects.
The sessions and programs were attached to a file "Conference Information.pdf".

Headers

Received: (qmail 13720 invoked from network); 8 Oct 2010 01:43:34 -0000
Received: from mail.tekkan.com (HELO mail.tekkan.com) (164.46.125.50)
  by XXXXXXXXXXXXXXXXX; 8 Oct 2010 01:43:34 -0000
Received: from mofat-p6463dmel ([221.9.247.17])
    by mail.tekkan.com (8.12.11.20060829/8.11.3) with SMTP id o981guo7022508;
    Fri, 8 Oct 2010 10:42:59 +0900
Message-ID: <201010080142.o981guo7022508@mail.tekkan.com>
From: JUN.Bong-Geun@ifans.go.kr
To:
Subject: Nuclear Challenges and Responses in the  Century
Date: Fri, 8 Oct 2010 10:43:08 -0700
X-Mailer: CSMTPConnection v2.17
MIME-Version: 1.0
Content-Type: multipart/mixed;
    boundary="ad7e60eb-fca5-415b-9c56-9d74439519e2"
Content-Transfer-Encoding: quoted-printable

Hostname:    221.9.247.17
ISP:    China Unicom Jilin province network
Organization:    China Unicom Jilin province network
Assignment:    Static IP
 Country:    China 
State/Region:    Jilin
City:    Changchun



 Virustotal
http://www.virustotal.com/file-scan/report.html?id=0c8f17b2130addebcb2ca75bd7a982e37ddcc49d49e79fe60e3fda767f2ec972-1287057726
File name:Conference Information_2010 IFANS Conference on Global Af[...].pdf
Submission date:2010-10-14 12:02:06 (UTC)
Current status:
14/ 43 (32.6%)
Avast    4.8.1351.0    2010.10.14    PDF:CVE-2010-2883
Avast5    5.0.594.0    2010.10.14    PDF:CVE-2010-2883
AVG    9.0.0.851    2010.10.14    Exploit_c.LMW
BitDefender    7.2    2010.10.14    Exploit.PDF-TTF.Gen
Comodo    6388    2010.10.14    UnclassifiedMalware
F-Secure    9.0.16160.0    2010.10.14    Exploit.PDF-TTF.Gen
GData    21    2010.10.14    Exploit.PDF-TTF.Gen
Kaspersky    7.0.0.125    2010.10.14    Exploit.Win32.CVE-2010-2883.a
NOD32    5530    2010.10.14    JS/Exploit.Shellcode.A.gen
Norman    6.06.07    2010.10.14    HTML/Shellcode.Q
nProtect    2010-10-14.01    2010.10.14    Exploit.PDF-JS.Gen
PCTools    7.0.3.5    2010.10.14    Trojan.Pidief
Sophos    4.58.0    2010.10.14    Mal/JSShell-B
Symantec    20101.2.0.161    2010.10.14    Trojan.Pidief
Additional information
Show all
MD5   : 3abfe5fd78ffddebf23bd46edf4e4eb7

Created files

C:\windows\system32\syschk.ocx
File name: syschk.ocx
MD5   : 16ba21c1eac48eb20c04ac91ef9c2bd1
Submission date: 2010-10-16 04:33:16 (UTC)
Result: 0/ 43 (0.0%)

Strings (yes, C:\Documents and Settings\Mila\Desktop\Conference Information_2010 IFANS Conference on Global Affairs (1001).pdf" is not a accidental paste, it is in the file = inserted path from the original location of the pdf.File: syschk.ocx MD5: 16ba21c1eac48eb20c04ac91ef9c2bd1 Size: 159744 Ascii Strings: --------------------------------------------------------------------------- !This program cannot be run in DOS mode. Rich .text `.rdata @.data .rsrc @.reloc L$ R t$(t L$(V PVQRh L$$P L$8h vU;l$,wO t$0j l$$; s|SU Jt;Ju>j L$(P3 PVj!R T$(QR _^][ _^]3 D$ RP _^][ t;Ht IQhd SUVW T$ j _^][ IQhd _^]3 D$ @ _^][ SUVW T$$Q _^]3 D$P3 |$QU |$Th L$XQ T$TQRP _^]3 |$,P D$4P T$4RP D$<( D$0j PUQR _^]3 _^]3 L$$W t2VW IQhh IQhh _^[Y t-E; L$ Q D$ + _^][Y _^][Y _^][Y D$$f L$(f }#EA <(>u T$(j _^]2 L$ j D$<_^] l$<C T$<_^] Ht#Hu PQUf SUV3 _^][ SQhH SRh8 SPh0 D$ RP A<;u SUVW |$ ; _^][ DSVWh0 L$dPj0Q Rj1P Qj2R Pj3Q Rj4P T$ Qj5R L$$Pj6Q D$(Rj7P T$,Qj8R L$0Pj9Q D$4RjAP T$8QjBR L$<PjCQ D$@RjDP T$DQjER L$HPjFQ _^[d >MZt ^JGQ QRWV ^_ZY QRWV ^_ZY wkernel32.dll \syschk.ocx shell32.dll ;|$(u ShnY u,Sh SUVW |$ ; _^][ QSUVW >"u< <0"t <0"t L$$S <(\t <(\t ^][_ SUVW |$0h L$$Pj T$(h L$(j T$,QR _^]3 `SVW3 PVVj T$<j D$ j L$ R VUSQ _^[d SUVW L$$j D$4j D$ hh _^][ _^][ QSVW` SVWh` D$,j L$4PQSR L$0j D$0j D$@h L$LQ IQh\ D$@h L$Hh T$,h D$4P D$$j L$0PQSR L$,j D$,j UVW3 L$,h D$,P L$,QR D$,RPSSQ D$#j T$ R \$ E; D$(h L$(PQSSR |$(P L$0P T$8QRUP T$(QPPP D$(RP D$ R L$4j _^[] Vu{j t[VWS ds4V UQRP QVh` VUUUW G<4r ][_^ SUVW VUUU _^][ _^][ VUUU VUUU N<"t L$(Qj l$$j D$$+ T$(R _^]d L$ Q T$0j L$<+ D$,j L$8j D$$RPj L$xh` T$xQUR L$$PQj t4hx D$xh` L$xh` L$xh T$xh L$(R L$0PQQQQQ L$LQ D$\D _^][d SVWP D$Hj L$Tj D$# IQh\ T$'j D$&f SVW3 _^[d uiSV3 ?j\W X_^] x,.u ;(rU VPVj0 s$_r QSVW QQSVWd 4SVW PhYY X_^[] SVWUj ]_^[ t.;t$$t( tzVS GIt% t/Ku t-9] _^[] SUVW _^][ SVWu _^[] VC20XC00U SVWU tEVU t3x< ]_^[ QSVW QSVW t7)E D$ P t$ V NWVS u7WPS u&WVS _^[] Ww!j _^[] _9=,. YY_[] tD+E uRFGHt Yt)W3 SVWj j@Y3 Wj@Y3 t7SW @AA; 8csm u,9x X_^] ub9~ YY_^[ QQVW sO;>|C;~ u Vj 8csm u SW _^[] ?csm 8csm YYPW QQSVW t:jtj Yt)V u?jtj Yt&V FP= QQSVW 9p`t QQSVW _WPS HHtpHHtl RPWV u>Wj t&:a Yu!j t%WV SVW3 ~&WP SVWj tYPV YYF;5 t%WV QQSV btHHt. SVWj u!PV YYF;5 X_[^ t%WV wBVSP _^[] HSVWh t9UW ?=t"U QQS3 PSSW 8"uD 8"uF@ 8"u, @@f9 @@f9 SS@SSPVSS t#SSUP t$$VSS _^][YY j?I_ ulSj uY;] pD#U j #M j?^; X_^[ ^_[3 PPPPPPPP uFWWj "WWSh4 9} u E WW tMWWS t@9} VSh ^[_3 PPPPPPPP PPPPPPPP PVh4 u";E u+Vj 8csm QQSVWj PSj? PSj? >:uNFV >:u#FV Y_^[ SVW3 Qf9= WQPWS ,f9=\0 WWWj WWSj WWWj _^[] QQSUVWj _^][YY VWsr 1t*; VWuBh\ tPh@ <8=u SVWu ^}%95 HSVHWtgHHtF NTuI H}Fj QSUV WWWWj t/WWUPj _^][Y SVWt _^[] FGQPS 0SVW _u@W PWPSS PWPSS 9] u tySS t-VW QQSVW3 tUj= t@9u uT9} 8<=t ^][_ tJSWV u/9F j@jP hWj@_; PPhj Pl_^ tWS3 QSUVWj n0SSSSU _SSSSU Ph_^][Y 9Q\u 9y`u ;qdt V9l$ VVUVS _^][ SUVW UUWP _^][Y !hOe tuHHt tD9_Pt? 9X tn w]hOe ~0PPW E SVj (wqt\HHtS tFHt> t>Ht Ht u<9E _^[] t59~ u09=h- 9=h- QQSVW QQSV 4SVW VhOe tBSh X_^[ @SVW btZ- VWhOe VhOe 9p$u ,SVW t39w 9w u ^$tL t7j, tMVW >(r- u@hOe 9HPu u,;C _^[d <VWj VwltB r0=8 97_u SVW3 ^[+E F _^ tBSh tBSh tBSh F ^d SVW3 SShv _^][ _^[d ;Nxu _j X; QQUV _^]YY QSVW t#;^ QQSVW 9^xu2 Vu4j u5SVW uTVW PWVWWW WVWWW QQV3 j@j< SUVW ^,_^][ CWinApp PreviewPages Settings CFileFind file:// CWinThread CCmdTarget .INI .HLP CNotSupportedException CMemoryException CException combobox software CObject CTempGdiObject CTempDC CGdiObject CUserException CResourceException CTempWnd CWnd AfxOldWndProc423 AfxWnd42s AfxControlBar42s AfxMDIFrame42s AfxFrameOrView42s AfxOleControl42s GetMonitorInfoA EnumDisplayMonitors MonitorFromPoint MonitorFromRect MonitorFromWindow GetSystemMetrics USER32 DISPLAY commctrl_DragListMsg InitCommonControlsEx COMCTL32.DLL CMapPtrToPtr CTempMenu CMenu H:mm:ss dddd, MMMM dd, yyyy M/d/yy December November October September August July June April March February January Saturday Friday Thursday Wednesday Tuesday Monday Sunday (8PX 700WP `h```` ppxxxx (null) runtime error TLOSS error SING error DOMAIN error R6028 - unable to initialize heap R6027 - not enough space for lowio initialization R6026 - not enough space for stdio initialization R6025 - pure virtual function call R6024 - not enough spac e for _onexit/atexit table R6019 - unable to open console device R6018 - unexpected heap error R6017 - unexpected multithread lock error R6016 - not enough space for thread data abnormal program termination R6009 - not enough space for environment R6008 - not enough space for arguments R6002 - floating point not loaded Microsoft Visual C++ Runtime Library Runtime Error! Program: <program name unknown> SunMonTueWedThuFriSat JanFebMarAprMayJunJulAugSepOctNovDec GetLastActivePopup GetActiveWindow MessageBoxA user32.dll CloseHandle ReadFile GetFileSize CreateFileA LocalAlloc LocalFree GetLastError UnmapViewOfFile MapViewOfFile CreateFileMappingA SetFileAttributesA FreeLibrary GetProcAddress LoadLibraryA OpenProcess HeapFree HeapAlloc GetProcessHeap MultiByteToWideChar GetFullPathNameA DeleteFileA Sleep GlobalUnlock GlobalLock TerminateProcess GetCurrentProcess CreateProcessA GetSystemDirectoryA InterlockedIncrement InterlockedDecrement lstrlenA WideCharToMultiByte GetCurrentThreadId GetCurrentThread lstrcmpiA lstrcmpA GlobalDeleteAtom GlobalAlloc FindClose SetLastError FindFirstFileA lstrcpyA FindNextFileA GetModuleFileNameA InitializeCriticalSection TlsAlloc DeleteCriticalSection GlobalFree GlobalHandle TlsFree LeaveCriticalSection GlobalReAlloc EnterCriticalSection TlsSetValue LocalReAlloc TlsGetValue SetErrorMode lstrcatA lstrcpynA GetVersion GlobalFlags WritePrivateProfileStringA GetCurrentDirectoryA GetModuleHandleA FileTimeToSystemTime FileTimeToLocalFileTime GlobalFindAtomA GlobalAddAtomA GlobalGetAtomNameA GetProcessVersion WriteFile FilePointer FlushFileBuffers SetEndOfFile GetCPInfo GetOEMCP RtlUnwind GetTimeZoneInformation GetSystemTime GetLocalTime GetCommandLineA ExitProcess RaiseException HeapSize HeapReAlloc GetACP SetHandleCount GetStdHandle GetFileType GetStartupInfoA FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW HeapDestroy HeapCreate VirtualFree VirtualAlloc IsBadWritePtr LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetDriveTypeA SetUnhandledExceptionFilter IsBadReadPtr IsBadCodePtr SetStdHandle CompareStringA CompareStringW SetEnvironmentVariableA KERNEL32.dll CallNextHookEx CloseClipboard GetClipboardData OpenClipboard IsClipboardFormatAvailable SetWindowsHookExA PostQuitMessage PostMessageA SendMessageA SetCursor EnableWindow MessageBoxA GetWindowLongA IsWindowEnabled GetLastActivePopup GetParent GetCursorPos PeekMessageA IsWindowVisible ValidateRect GetKeyState GetActiveWindow DispatchMessageA TranslateMessage GetMessageA GetNextDlgTabItem GetFocus EnableMenuItem CheckMenuItem SetMenuItemBitmaps ModifyMenuA GetMenuState LoadBitmapA GetMenuCheckMarkDimensions UnhookWindowsHookEx UnregisterClassA LoadStringA GetClassNameA PtInRect GetWindowRect GetDlgCtrlID GetWindow ClientToScreen SetWindowTextA GetWindowTextA wsprintfA GetMenuItemCount GetDC ReleaseDC TabbedTextOutA DrawTextA GrayStringA GetDlgItem SetWindowLongA SetWindowPos ShowWindow SetFocus GetSystemMetrics GetWindowPlacement IsIconic SystemParametersInfoA RegisterWindowMessageA SetForegroundWindow GetForegroundWindow GetMessagePos GetMessageTime RemovePropA CallWindowProcA GetPropA SetPropA GetClassLongA CreateWindowExA DestroyWindow DefWindowProcA GetMenuItemID GetSubMenu GetMenu RegisterClassA GetClassInfoA WinHelpA GetCapture GetTopWindow CopyRect GetClientRect AdjustWindowRectEx GetSysColor MapWindowPoints LoadIconA LoadCursorA GetSysColorBrush DestroyMenu USER32.dll CreateBitmap DeleteObject DeleteDC SaveDC RestoreDC SelectObject GetStockObject SetBkColor SetTextColor SetMapMode SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowExtEx ScaleWindowExtEx GetClipBox GetDeviceCaps PtVisible RectVisible TextOutA ExtTextOutA Escape GetObjectA GDI32.dll comdlg32.dll ClosePrinter DocumentPropertiesA OpenPrinterA WINSPOOL.DRV RegCloseKey RegQueryValueExA RegOpenKeyExA SetFileSecurityA SetSecurityDescriptorDacl AddAccessAllowedAce GetAce AddAce InitializeAcl GetLengthSid GetAclInformation GetSecurityDescriptorDacl InitializeSecurityDescriptor GetFileSecurityA LookupAccountNameA GetUserNameA RegSetValueExA RegCreateKeyExA RegEnumValueA RegEnumKeyA ADVAPI32.dll SHELL32.dll COMCTL32.dll CoCreateInstance CoInitialize ole32.dll WSOCK32.dll InternetAttemptConnect InternetConnectA InternetOpenA InternetCloseHandle HttpQueryInfoA InternetSetOptionA InternetQueryOptionA HttpSendRequestA HttpAddRequestHeadersA HttpOpenRequestA HttpEndRequestA InternetWriteFile HttpSendRequestExA InternetReadFile ReadUrlCacheEntryStream RetrieveUrlCacheEntryStreamA InternetSetCookieA FindCloseUrlCache DeleteUrlCacheEntry FindNextUrlCacheEntryA FindFirstUrlCacheEntryA InternetGetCookieA WININET.dll syschk.dll CheckDrive SystemCheck --%s Content-Disposition: form-data; name="%s" --%s Content-Disposition: form-data; name="%s"; filename="%s" Content-Type: %s http .PAVCException@@ Accept: */* HTTP/1.0 Content-Type: application/x-www-form-urlencoded POST Content-Length: %d Content-Type: multipart/form-data; boundary=---------------------------7dab371b0124 ---------------------------7dab371b0124 application/octet-stream Content Type https value= name= <INPUT T1266545942618/1266545942618/1266545962717 GMAIL_LOGIN 2000 GMAIL_RTT __utmc 173272373 __utmb name = value; expires = Sat,01-Jan-2000 00:00:00 GMT asts https%3A%2F%2Fmail%2Egoogle%2Ecom%2Fmail%2F%3F continue GALX Passwd Email PersistentCookie ctok cans charset_ utf-8 draft undefined ishtml body subject GMAIL_AT d:\reg0 futurekimkim heike931 fuechei.chang fuechei.chang.drivehq.com/up/ .exe SHGetFolderPathA C:\Program Files SHELL32.DLL %programfiles% EnumProcesses GetModuleBaseNameA EnumProcessModules PSAPI.DLL unknown iexplore.exe Internet Explorer.lnk iexplore internet {871C5380-42A0-1069-A2EA-08002B30309D} favorites SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel\ SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu\ SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\ \Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\ \Microsoft\Internet Explorer\Quick Launch\ \Internet Explorer.lnk Anything can go here \iexplore.exe done %s\%s error %s done chrome.exe opera.exe netscp firefox %s%s %s%s\shellopen\command\ productname SOFTWARE\Microsoft\Windows NT\CurrentVersion csdversion SOFTWARE\Microsoft\Internet Explorer version SOFTWARE\classes\local settings\SOFTWARE\Microsoft\Windows\shell\MUICache SOFTWARE\Microsoft\Windows\ShellNoRoam\MUICache \adobe\ SOFTWARE\Clients\StartMenuInternet\ SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\ http\Shell\open\command Software\Microsoft\Internet Explorer\TypedURLs " Func1 %s\rename.ocx http://%s/rename %s\syschk.ocx1 http://%s%s &cmid=1&rt=h&zx= &view=up&act=sm&jsid= &rid=mail%3Asd.40.2.0&at= https://mail.google.com/mail/?ui=2&ik= Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; InfoPath.2; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30) @gmail.com GLOBALS= http://www.google.com/ https://mail.google.com/mail/?logout&hl=ko https://www.google.com/accounts/ServiceLoginAuth?service=mail https://mail.google.com/mail/ rundll32.exe " "%s" "%s" JavaScript/JS /FontFile2 .pdf http\Shell\open\command\ syschk.ocx acrobat\Shell\open\command\ Infect NO! Infect OK! form.ocx .?AVCNoTrackObject@@ .?AV_AFX_WIN_STATE@@ .?AVCObject@@ .?AVCCmdTarget@@ .?AVCWinThread@@ .?AVCWinApp@@ .?AVCFileFind@@ .?AV_AFX_CTL3D_STATE@@ .?AV_AFX_CTL3D_THREAD@@ .?AVCCmdUI@@ .?AUCThreadData@@ .?AVCHandleMap@@ .?AV_AFX_THREAD_STATE@@ .?AVAFX_MODULE_STATE@@ .?AVAFX_MODULE_THREAD_STATE@@ .?AV_AFX_BASE_MODULE_STATE@@ .PAX .PAVCObject@@ .PAVCSimpleException@@ .PAVCMemoryException@@ .?AVCException@@ .?AVCSimpleException@@ .?AVCMemoryException@@ .?AVCNotSupportedException@@ .?AVCDC@@ .?AVCGdiObject@@ .?AVCTempDC@@ .?AVCTempGdiObject@@ .?AVCResourceException@@ .?AVCUserException@@ .?AVCWnd@@ .?AVCTestCmdUI@@ .?AVCTempWnd@@ .?AVCMapPtrToPtr@@ .?AVCMenu@@ .?AVCTempMenu@@ .?AVtype_info@@ wwwwww wwwwww wwwwww wwwwww wwwwww wwwwww wwwwww wwwwww wwww wwww 1(1Z1q1 3t3}3 3<4z4 4"5U5c5 8O9|9 :5:C:I: ;n;s;y; =u=z= 6$64696F6e6 7K7z7 8$9*959?9I9Y9c98;A;R;W;^;h;o; <!<W<]<c< =#><> ?#?(?5?:?G?L?Y?^?k?p? 0I0q0 233L3 8(8J8f8 ;*;0;A;G;X;^;o;u;}; ;)</<F>S>`> 0&0.070>0P0 2U3l3 4-4Q4b4 4E5c5 6<6R6f6 6#7B7j7 ;#<F< >-?{? 4(5H5M5 506?6g6 8<9E9T9 :;:O: <A<k< =,=]=u= >'>Z> >3?M? 0(1C1[1s1 2&202j2x2 3'353J3U3]3j3t3 6!6.6;6_6d6 8:8p8v8}8 949W9\9 <(=-=g=l= >F>R>n> F0K0 2 2,2>2V2 3/4t4 5:5N5 5,6i6 6G8W8r8 9&:d:i:p:u:z: 0'1C1 1@2R2 3?3W3g3~3 4'464`4 5,5<5X5|5 6)656B6H6T6Y6c6j6t6{6 707i7 898@8\8q8}8 9$:S: <6>y> >!?[?o? 0"0K0_0 0_5i5 6(6\7g7n7 8"8)888@8K8Q8W8a8y8~8 :;:A: :%;K;e;l;p;t;x;|; ;J<U<p<w<|< = =j=p=t=x=|= 0;0U0\0`0d0h0l0p0t0x0 0:1E1`1g1l1p1t1 2Z2`2d2h2l2 233^3 3 4,434C4I4P4Z4s4{4 425g5 868u8{8 8/9A9P9q9w9 :5:A:K:V:`:j:p: :Z;`;~; <!<-<?<M<\<m< 5&7+7 :":(:5:E:K:S:q:w: :$;<;B;N;S; ;Q<Y< <c=r= 0p184<4@4D4H4L4P4T4$5*525:5B5N5S5_5g5o5w5 6 6&6 8(8D8S8e8n8 <2<E< 2-252F2K2X2]2 3"3<3^3j3u3 6>7D7P7 8 8R8\8}8 9%929S9x9 :':1:E:S:`:e:k: ;Z;=<V< =X=k= >8>D>N>V>^>d>l>{> ?"?d?x? 0!0(01080@0F0Q0Y0 303;3A3F3L3Y3v3|3 7'787>7Q7 7p<u< =+=K= =T>y> m0r0 1&3:3 3$4*464 5<5B5P5V5`5h5n5|5 6#6:6U6q6 777A7L7V7d7 8!8*8;8E8M8U8]8g8p8x8 8.9=9k9v9 :':2:A:R:_:r:x:~: :I;n; <(<:<B<H<P< ='>4>9>F>R> ?<?D? 0;0]0 171B1N1^1 5&545=5J5[5 8!9?9v9 <,<7<B<L<T<_<m< =M>e> >)?3?D?Q? 040p0 1"171J1 4/5>53797T7 8%818L8W8c8y8 9)9@9L9_9n9w9 :/<u< >"?i? M0|0 1&2c2h2 2^3n3 3,4F4f4m4 7U7[7f7 7>8I8 9):`: <"=e= >,>O>v> ?#?)?@?K?X?a?g?~? 0'0c0 1L1^1|1 2 3*404C4N4 666q6}6 6+7L7_7z7 8$8,848N8S8s8.9i9 <Y<r< >$>=> >=?B?q? 6"6&6*6.62666:6>6B6F6J6X6 7(7-7 8,9W9 :H<p<u< =Q>r> ?Y?f?|? $0/050S0 111Y1a1j1u1~1 282Y2y2 4(5.5I5R5q5 516D6\6w6 737G7W7n7 828Q8v8 9F9t9 9::i: >N?\?x? #0d0y0 141Z1{1 3 3&373e3 4a4r4~4 455J5P5 6%7G7r7 7M8V8_8q8w8 9K9c9 9):f: ;+;@;O; <><R< =*=B=c=v= ?5?H? 0$090N0 2&2{2 3!303=3L3R3Y3a3s3z3 4#4E4\4v4 5)555?5V5a5m5 616A6P6j6~6 6"7(747T7x7 8$8/898E8N8W8`8k8s8y8 9-9J9\9k9p9 :,:2:E:^:n:}: :%;-;?;Q; <O<a< <0=I=w= >,>W>l> ?0?d? 0!050J0]0i0 1+1=1S1e1y1 2&2;2N2a2u2 5 5$5(5,5054585<5@5D5H5L5P5`5p5t5 6 6$6(6,6064686<6@6D6H6L6P6T6X6\6`6d6h6l6p6t6x6|6 7 707D7H7L7P7T7X7\7`7d7h7l7p7t7x7|7 8,80848\8`8 9 909P9`9 : :8:D:H:X:d:h: ; ;$;(;,;0;4;8;<;@;D;H;L;P;T;X;\;`;d;h;l;p;t;x;|; < <$<(<,<0<8<D<H<`<l<p< =,=D=\=t= >4>L>d>|> ,0004080<0@0D0H0L0P0T0X0\0`0d0h0l0p0t0x0|0 0(1,101418 1<1@1D1H1L1P1T1X1\1`1d1h1l1p1t1x1|1 2 2,202H2T2X2h2l2p2t2x2|2 4$4(484@4D4P4X4\4 7l8p8x8|8 9,90989P9h9 : :(:,:0:D:T:X:`:x:|: ;,;<;@;H;`;d;|; <$<(<0<H<L<d<t<x< = =8=P=h=l=p=t= >4>D>H>P>h>l> ?$?4?8?@?X?\?`?d?|? 0$04080@0X0\0t0 1,10181P1T1l1|1 2(2D2P2X2 3$3,343<3D3L3T3\3d3l3t3|3 4 4<4H4d4p4 5 5<5D5P5l5t5 6 6<6D6P6l6t6|6 7(7D7P7l7x7 7(848<8H8d8l8x8 9(9D9L9X9t9|9 : :$:(:,:<:H:P: ; ;<;H;d;p; <4<@<H<x< =4=@=\=d=l=x= >4>@>\>h> 0 0$0(0,0004080<0@0D0H0L0P0T0X0\0`0d0h0t0x0|0 (5,505H5h5 606`6x6 6 7H7X7p7 888P8p8 9(9@9`9x9 ; ;$;(;,;0;4;8;<;@;D;H;L;P;T;X;\;`;d;h;l;p; =$=4=D= 34484 C:\Documents and Settings\Mila\Desktop\Conference Information_2010 IFANS Conference on Global Affairs (1001).pdf Unicode Strings: --------------------------------------------------------------------------- jjjj jjjj jjjj jjjj jjjj jjjj jjjjjj (null) ((((( H VS_VERSION_INFO StringFileInfo 040904B0 CompanyName FileDescription syschk DLL FileVersion 1, 0, 0, 1 InternalName syschk LegalCopyright Copyright (C) 2010 LegalTrademarks OriginalFilename syschk.DLL ProductName syschk Dynamic Link Library ProductVersion 1, 0, 0, 1 VarFileInfo Translation MS Shell Dlg &New Cancel &Help Open Save As All Files (*.*) Untitled an unnamed file &Hide No error message is available.'An unsupported operation was attempted.$A required resource was unavailable. Out of memory. An unknown error has occurred. Invalid filename. Failed to open document. Failed to save document. Save changes to %1? Failed to create empty document. The file is too large to open. Could not start print job. Failed to launch help. Internal application error. Command failed.)Insufficient memory to perform operation.PSystem registry entries have been removed and the INI file (if any) was deleted.BNot all of the system registry entries (or INI file) were removed.FThis program requires the file %s, which was not found on this system.tThis program is linked to the missing export %s in the file %s. This machine may have an incompatible version of %s. #Unable to read write-only property.#Unable to write read-only property. Unexpected file format.V%1 Cannot find this file. Please verify that the correct path and file name are given. Destination disk drive is full.5Unable to read from %1, it is opened by someone else.AUnable to write to %1, it is read-only or opened by someone else..An unexpected error occurred while reading %1..An unexpected error occurred while writing %1. Please enter an integer. Please enter a number.*Please enter an integer between %1 and %2.(Please enter a number between %1 and %2.(Please enter no more than %1 characters. Please select a button.*Please enter an integer between 0 and 255. Please enter a positive integer. Please enter a date and/or time. Please enter a currency. No error occurred.-An unknown error occurred while accessing %1. %1 was not found. %1 contains an invalid path.=%1 could not be opened because there are too many open files. Access to %1 was denied..An invalid file handle w as associated with %1.<%1 could not be removed because it is the current directory.6%1 could not be created because the directory is full. Seek failed on %15A hardware I/O error was reported while accessing %1.0A sharing violation occurred while accessing %1.0A locking violation occurred while accessing %1. Disk full while accessing %1..An attempt was made to access %1 past its end. No error occurred.-An unknown error occurred while accessing %1./An attempt was made to write to the reading %1..An attempt was made to access %1 past its end.0An attempt was made to read from the writing %1. %1 has a bad format."%1 contained an unexpected object. %1 contains an incorrect schema. #Unable to load mail system support. Mail system DLL is invalid.!Send Mail failed to send message. pixels


C:\windows\system32\form.ocx  = same string as it tried to download = see the pcap screenshot below

 File: form.ocx
MD5:  279b3b44fa1ac9e72d030ff42b1b77c6
Size: 15

Ascii Strings:
---------------------------------------------------------------------------
02510c

Unicode Strings:
---------------------------------------------------------------------------

66.220.9.57

Hostname:    www.mbizgroup.biz
ISP:    Hurricane Electric
Organization:    LaFrance Internet Services
Proxy:    None detected
Type:    Corporate
Assignment:    Static IP
Country:    United States
State/Region:    California
City:    Fremont

Sep 21 CVE-2010-2883 PDF Agenda of the United Nations Criminal Justice Events in October 2010

CVE-2010-2883 Stack-based buffer overflow in CoolType.dll in Adobe Reader and Acrobat 9.3.4 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a PDF document with a long field in a Smart INdependent Glyphlets (SING) table in a TTF font, as exploited in the wild in September 2010. NOTE: some of these details are obtained from third party information. 

Download  ac4a484bb27e08433f822d4120291be4 UNICRI-Agenda-2010.pdf as a password protected archive (contact me if you need the password)


From: Cook Henry [mailto:henry.b.cook@gmail.com]
Sent: Tuesday, September 21, 2010 2:46 PM
To: XXXXXXXXXX
Subject: Agenda of the United Nations Criminal Justice Events in October 2010

 sir,
   In case this is useful for you.

File name:
UNICRI-Agenda-2010.pdf
http://www.virustotal.com/file-scan/report.html?id=b058fcc16446464c0aa94edabbc98cfd87d5d2ac2f9e3009b11a3aff96ed53b7-1286451255
13/ 43 (30.2%)
AntiVir    7.10.12.146    2010.10.07    HTML/Malicious.PDF.Gen
Avast    4.8.1351.0    2010.10.07    PDF:CVE-2010-2883
Avast5    5.0.594.0    2010.10.07    PDF:CVE-2010-2883
AVG    9.0.0.851    2010.10.07    Exploit_c.KLX
BitDefender    7.2    2010.10.07    Exploit.PDF-TTF.Gen
Emsisoft    5.0.0.50    2010.10.07    Exploit.Win32.CVE-2010-2883.a!A2
F-Secure    9.0.15370.0    2010.10.07    Exploit.PDF-TTF.Gen
Fortinet    4.2.249.0    2010.10.07    PDF/CoolType!exploit.CVE20102883
GData    21    2010.10.07    Exploit.PDF-TTF.Gen
Kaspersky    7.0.0.125    2010.10.07    Exploit.Win32.CVE-2010-2883.a
Microsoft    1.6201    2010.10.07    Exploit:Win32/CVE-2010-2883.A
PCTools    7.0.3.5    2010.10.07    HeurEngine.MaliciousExploit
Symantec    20101.2.0.161    2010.10.07    Bloodhound.Exploit.357
Additional information
MD5   : ac4a484bb27e08433f822d4120291be4

CVE-2010-2883 Adobe 0-Day David Leadbetter's One Point Lesson from 193.106.85.61 thomasbennett34@yahoo.com

CVE-2010-2883 Security Advisory for Adobe Reader and Acrobat
A critical vulnerability exists in Adobe Reader 9.3.4 and earlier versions for Windows, Macintosh and UNIX, and Adobe Acrobat 9.3.4 and earlier versions for Windows and Macintosh. This vulnerability (CVE-2010-2883) could cause a crash and potentially allow an attacker to take control of the affected system. There are reports that this vulnerability is being actively exploited in the wild.

Adobe is in the process of evaluating the schedule for an update to resolve this vulnerability.

Technical Analysis and Research links (just a few, in no particular order, send more if you want me to add)

• Brief Analysis On Adobe Reader SING Table Parsing Vulnerability (CVE-2010-2883) Matt Oh
• Return of the Unpublished Adobe Vulnerability http://blog.metasploit.com/ Joshua J. Drake
• New Adobe 0day Demonstration - Attack Vector  Matt 
• Adobe advises on new Reader and Acrobat vulnerability Chester Wisniewski’s Blog  
• VUPEN Vulnerability Research Team (VRT) Blog- Criminals Are Getting Smarter: Analysis of the Adobe Acrobat / Reader 0-Day Exploit << very detailed analysis
• 
  
  
  
  Technical Analysis of Adobe Acrobat and Reader Zero-Day Exploit by by Yuki Chen Trendlabs
• =================================================================

Download  687b8d2112f25e330820143ede7fedce Golf Clinic.pdf as a password protected archive (contact me if you need the password)

Download files

• golf clinic.pdf - (\Application Data) - 6AF93ED231AEA3B00769FC8283943E75
• iso88591 - (same location as the original) F7A341ACBB05F6A597EC33ACCB7AD04E
• wincrng.exe + winhelp32.exe (downloaded from academyhouse.us)  687B8D2112F25E330820143EDE7FEDCE
• igfxver.exe (%tmp%)   E8CE9CB98C71405F0FB3888235302568 - dropped by the original

Download hlp.cpl signed with the stolen Verisign certificate issued to secure2.ccuu.com

Update 10

Lead Adobe 0-day CVE-2010-2883 Made in Korea  - by villy

Update9

[Unofficial] 0-Day Acrobat SING Table Vulnerability Patch (sent by INT3 CC, thank you)

https://www.rafzar.com/node/22

I did not test but heard it works well. Try it, test it

Update 8

 DEP Bypass in Golf Clinic PDF by Cédric Gilbert, SkyRecon Systems

Cédric Gilbert, from  SkyRecon Systems sent a short and later (per my request, because I wanted to understand it ) , a more detailed explanation for the DEP bypass  - in clear terms, for people who don't already know everything :)
Please comment and correct, if you find mistakes, we will add the corrections. Many thanks!
---------------------------------------------

There are 4 settings for DEP :

-          AlwaysOff

-          Opt-in

-          Opt-out

-          Always On

‘Opt-in’ is the one used by default on every Desktop Edition of Windows, while ‘opt-out’ is the default for Server Editions.

‘Opt-in’ only protects software that is fully compatible with DEP (those software programs are marked at compilation with the flag ‘/NXCOMPAT’).

‘Opt-out’ protects every software program (even the ones without /NXCOMPAT) except the ones explicitly added by the administrator to a white list.

“AcroRd32.exe” is not /NXCOMPAT, thus if an execution occurs in a page in memory marked as ‘not executable’ (the heap for instance), DEP in ‘opt-in’ mode will ignore the fault and silently change the rights of the page to ‘EXECUTE’. On the other hand, if DEP is set to ‘opt-out’, it will immediately kill the faulting process. This is why most exploits using heap spraying actually do work. Because even though execution occurs on the heap (NO EXEC) when the execution flow is redirected into the ‘nop’ slide, DEP in opt-in mode will not block the attack.

Now the writers of the exploit used in this case obviously wanted to go a step further by bypassing DEP even in its ‘opt-out’ or ‘always-on’ mode.

Which means that they had to find a way to execute their payload without triggering any ‘page fault’ in NO EXECUTE memory.

The best way to do so is to use some kind of ‘ret into libc’ technique (in this case a ROP technique). Instead of redirecting the execution flow into the heap, they redirect it to a CODE section in a DLL (which got EXECUTE rights) by overwriting saved eip on the stack. Of course no DLL exactly have the code that the attacker would like to execute, so the idea is to chain calls into this DLL on small code portions using return addresses smartly placed on the stack before the vulnerability is triggered. The problem with this technique is that it requires the attacker to use ‘hardcoded’ addresses pointing at each code portion that he wishes to execute. 

Starting with Windows Vista, Microsoft introduced a new protection called ‘ASLR’ for Address Space Layout Randomization. This protection, among other things, randomize the base address of each DLL when they get loaded into a process address space (the random base address changes at each boot). This protection was meant to defeat attacks, which used hardcoded addresses, since a randomized DLL place in memory is changing at each boot.

So to defeat both DEP and ASLR, the attacker got AcroRd32.exe to load a DLL not compatible with ASLR into its address space (I do not know how they managed to do so at the moment).

The DLL used is “icucnv34.dll”, the fact that it is not compatible with ASLR means that it will always get loaded at the same address in memory, thus allowing the attacker to use ‘hardcoded’ addresses pointing to this DLL.

The thing is, it’s very complicated to build a whole shellcode using this kind chained call into a DLL. So the attacker used it only to get a place in memory allocated with exec rights, copy his shellcode on it and, eventually, jump on it and do whatever he wants without caring about DEP anymore.

In this exploit, the attacker manages to do so by chaining 4 API call in “icucnv34.dll”.

1)      CreateFileA:

IN      LPCTSTR lpFileName                       = 4a8254e0                 = « iso88591 »
IN      DWORD dwDesiredAccess              = 0x 10000000           = GENERIC_ALL
IN      DWORD dwShareMode                   = 0                               = not shared
IN      lpSecurityAttributes (OPTIONAL)   = 0
IN      DWORD dwCreationDisposition      = 2                              = CREATE_ALWAYS

IN      DWORD dwFlagsAndAttributes      = 0x102                      = FILE_ATTRIBUTE_TEMPORARY | FILE_ATTRIBUTE_HIDDEN

Here the attacker creates an empty file called “iso88591” at the location where the pdf was opened.

2)      CreateFileMappingA

IN           HANDLE               hFile                                       = 0x1c4                = handle on « iso88591 » 

IN OPT  lpAttributes                                                            = NULL

IN           DWORD               flProtect                                  = 0x40                  = PAGE_EXECUTE_READWRITE

IN           DWORD               dwMaximumSizeHigh            = 0

IN           DWORD               dwMaximumSizeLow            = 0x10000

IN OPT  LPCTSTR              lpName                                    = NULL

Since the file is empty, the attacker has to specify an arbitrary size for the file mapping.

At this point the attacker is ready to map the file into memory.

3)      MapViewOfFile

IN           HANDLE               hFileMappingObject              = 0x2dc          = Handle from CreateFileMappingA

IN           DWORD                dwDesiredAccess                  = 0x22            = FILE_MAP_EXECUTE | FILE_MAP_WRITE

IN           DWORD               dwFileOffsetHigh                  = 0

IN           DWORD               dwFileOffsetLow                   = 0

IN           SIZE_T                  dwNumberOfBytesToMap    = 0x10000

Now the attacker’s got a 0x10000 bytes space with EXECUTE rights allocated into memory. All that he has to do to complete his ‘DEP-evading-technique’ is to copy the shellcode that he wishes to execute in this newly allocated exec space and jump on it.

Which he does by calling :

4)       MSVCR80!memcpy

Dst = 0x05bc0000     // Base Address returned from the MapViewOfFile above

Src = 0885f118          // Not sure whether it is an address from the mapping of the pdf itself or something that he sprayed on the heap before

Len = 0x1000

And here we are, after this call the real payload (at 0x0885f118) is mapped into an ‘EXEC’ memory space (at 0x05bc0000). The jump to the the payload is actually made by the memcpy call itself since the return address set on the stack by the attacker for this call is the destination of the copy (0x05bc0000) ! BAM! Both ASLR and DEP are defeated!

Now one may ask : ”Ok nice, icucnv34.dll is not ASLR-compatible, but kernel32.dll is, so how did the attacker get the required API addresses?”. Well, it is pretty simple actually, he just had to use API imported by icucnv34.dll ! When this DLL got loaded, its import table got fixed by the loader with the addresses of all API required by the DLL.

Since the base address of icucnv34.dll is known by the attacker, he just had to retrieve the needed addresses from icucnv34.dll import table :)

  Cédric Gilbert, SkyRecon Systems

 

Update7    - Aurora?

Here here an interesting observation by Itzhak Avraham (Zuk) @ihackbanme about the fact that this pdf is using a technique similar to one found in Aurora.


DMS.bat mentioned in Update 6, has been observed during analysis of ad_1_.jpg file, which was one of the files recovered during the Aurora investigation (see Aurora US-CERT advisory here)

ad_1_.jpg unpacking/analysis - Aurora by Itzhak Avraham (Zuk)

DFS.bat from ad_1_.jpg (Aurora)

The DMS.bat from CVE-2010-2883 Adobe 0-Day

:Repeat
DEL "C:\DOCUME~1\USER\LOCALS~1\Temp\hlp.cpl"
if exist "C:\DOCUME~1\USER\LOCALS~1\Temp\hlp.cpl" goto Repeat
DEL "C:\DOCUME~1\USER\LOCALS~1\Temp\DMS.bat" 

Update6

Exploit in action:(see a video demo in the end of this post)
According to Sophos researchers (many thanks to Chester Wisniewski) -

• the shellcode drops hlp.cpl  DLL to  user %tmp% folder and then manually parses to its StartUp export and runs from there. 
• wincrng .exe gets downloaded using the DLLs's "DownloadFile" export from hxxp://academyhouse .us/from/wincrng exe to user Application Data folder, renames it to winhelp32.exe and runs it. The domain is currently under the control of Shadow Server (http:/internal/tools/whois/?domain=academyhouse.us)
• The DLL then calls its "MakeAndShowEgg" export, which reads a filename from the original PDF ("Golf Clinic.pdf") and then drops a clean PDF file (golf clinic.pdf 6AF93ED231AEA3B00769FC8283943E75) and launches it in Acrobat Reader so as not to arouse suspicion.  The text of the PDF, however, still arouses a lot of suspicion - see below :)
• Finally the DLL calls the imaginatively-titled "DeleteMyself" export to drop the file DMS.bat which deletes the DLL and then itself.

  The DMS.bat contents are

:Repeat
DEL "C:\DOCUME~1\USER\LOCALS~1\Temp\hlp.cpl"
if exist "C:\DOCUME~1\USER\LOCALS~1\Temp\hlp.cpl" goto Repeat
DEL "C:\DOCUME~1\USER\LOCALS~1\Temp\DMS.bat"  

 

Update5

 

A few more variants of this message

Variant 2

from 119.247.163.249 MD5 2802c47b48cced7f1f027f3b278d6bb3

From: Thomas Bennett [mailto:Thomas.Bennett@gmx.com]
Sent: Tuesday, September 07, 2010 5:41 AM
To: xxx
Subject: Golf Clinic, David Leadbetter's One Point Lesson
Importance: High

Hi
Want to improve your score?
In these golf tips David Leadbetter shows you some important principles Cause & Effect, which have been helpful to thousands of amateur golfers around world.

Whatever your handicap, Whatever your age or ability, the tips will improve your game!

bye