Apr 20 CVE-2009-4324 PDF US_Taiwan_policy.pdf

• CVE-2009-4324 Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted PDF file using ZLib compressed streams, as exploited in the wild in December 2009.

 Download 5f49a04d3738b602685207419bc0789c _US_Taiwan_policy.pdf   as a password protected archive (please contact me if you need the password)

Details 5f49a04d3738b602685207419bc0789c _US_Taiwan_policy.pdf  

 There is no additional information about this message, except that it was sent via Gmail on 20 Apr 2010 around 6 pm PDT.

 http://www.virustotal.com/analisis/2e76eaa6bfb9d2b0fc2a68de0fc24eb901e55d8298fcda4ca1d0ad1b5f6ef3b6-1272509457
 File article_on_US_Taiwan_policy.pdf received on 2010.04.29 02:50:57 (UTC)
Result: 23/41 (56.1%)
a-squared    4.5.0.50    2010.04.29    Exploit.Win32.Pidief!IK
AntiVir    8.2.1.224    2010.04.28    HEUR/HTML.Malware
Antiy-AVL    2.0.3.7    2010.04.28    Exploit/Win32.Pidief
Authentium    5.2.0.5    2010.04.29    PDF/Obfusc.M!Camelot
Avast    4.8.1351.0    2010.04.28    JS:Pdfka-WJ
Avast5    5.0.332.0    2010.04.28    JS:Pdfka-WJ
AVG    9.0.0.787    2010.04.29    Script/Exploit
BitDefender    7.2    2010.04.29    Exploit.PDF-JS.Gen
ClamAV    0.96.0.3-git    2010.04.29    Exploit.PDF-21790
eSafe    7.0.17.0    2010.04.28    Win32.Pidief.H
F-Secure    9.0.15370.0    2010.04.28    Exploit.PDF-JS.Gen
GData    21    2010.04.29    Exploit.PDF-JS.Gen
Ikarus    T3.1.1.80.0    2010.04.29    Exploit.Win32.Pidief
Kaspersky    7.0.0.125    2010.04.29    Exploit.Win32.Pidief.dcc
McAfee    5.400.0.1158    2010.04.29    Exploit-PDF.q.gen!stream
McAfee-GW-Edition    6.8.5    2010.04.28    Heuristic.HTML.Malware
Microsoft    1.5703    2010.04.28    Exploit:Win32/Pdfjsc.FE
nProtect    2010-04-28.02    2010.04.28    Exploit.PDF-JS.Gen
Sophos    4.53.0    2010.04.29    Troj/PDFJs-FM
Sunbelt    6235    2010.04.28    Exploit.PDF-JS.Gen (v)
Symantec    20091.2.0.41    2010.04.29    Trojan.Pidief.H
TrendMicro    9.120.0.1004    2010.04.28    TROJ_PDFJS.BI
TrendMicro-HouseCall    9.120.0.1004    2010.04.29    Expl_ShellCodeSM
Additional information
File size: 82600 bytes
MD5...: 5f49a04d3738b602685207419bc0789c

CVE-2009-4324

Apr 7 CVE-2009-4324 PDF Fwd: Matrix Report --- Earthquake from spoofed UlmanW@state.gov to fake ZaringNS@nasa.gov

•  CVE-2009-4324 Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted PDF file using ZLib compressed streams, as exploited in the wild in December 2009.

 Download infected 82a7c8fdacca91b1bd0fdc2407674f50 matrix_report.pdf as a password protected archive (please contact me if you need the password)

Details 82a7c8fdacca91b1bd0fdc2407674f50 matrix_report.pdf

 From: Ulman, Wayne (FSI) [mailto:UlmanW@state.gov]
Sent: Wednesday, April 07, 2010 2:08 PM
To: ZaringNS@nasa.gov
Subject: Fwd: Matrix Report --- Earthquake

It's incredible!

------Original Message------
From: "Amanda DJ"
Sent: Wednesday, Apr 7, 2010 10:22 AM
To: Ulman, Wayne (FSI); "Wilson Curran"
Subject: Matrix Report --- Earthquake


2012 is coming!
It's ture!

PlS see Attachment: Matrix_Report.pdf
Sichuan Wenchuan Earthquake  5.12    (May. 12th)
Haiti Earthquake  1.12   (Jan. 12th)
Chile  Earthquake   2.27   (Feb. 27th)

Matrix：Horizontal = Vertical

5 1 2
1 1 2
2 2 7

Dec.14 Attack of the Day. Hu Jintao Unveils Major Foreign-Policy Initiative from wilam@jamestown.org / jse96458@gmail.com Mon, 14 Dec 2009 08:51:24

Download infected PDF cb_009_70.pdf (Password protected archive, You need to contact me for the password)

Details - cb88aa793cbf180138673289f49342b7  cb_009_70.pdf 

From: Willy Lam [mailto:wilam@jamestown.org]
Sent: 2009-12-14 8:51 AM
To: Undisclosed-Recipient:;
Subject: Hu Jintao Unveils Major Foreign-Policy Initiative


Dear Colleagues,


Chinese President Hu Jintao has signaled his administration's readiness to play a bigger—and perhaps more constructive—role in global affairs through the release of a five-pronged foreign policy game plan. Cited by the official Outlook Weekly as “Hu Jintao’s Viewpoints about the Times,” this far-reaching initiative consists of five theories on, respectively, “the profound changes [in the world situation], constructing a harmonious world, joint development, shared responsibilities, and enthusiastic participation [in global affairs].”


In a late November issue of Outlook Weekly (a mouthpiece of the Chinese Communist Party [CCP]), ideologue Zhang Xiaotong indicated that the party chief and president’s “viewpoints” amounted to a “major theoretical innovation” based on the “scientific judgment of the development and changes of the times.” This ambitious agenda has been unveiled after U.S. President Barack Obama’s visit to China and before the Copenhagen climate change summit, two events that could become milestones in the Middle Kingdom’s quest for quasi-superpower status.


Thought some of you might be interested in attached paper on China's foreign policy.


If you have any questions, let me know.


Regards,


Willy
--
Willy Lam
Senior Fellow, China Program
The Jamestown Foundation

Virustotal results

File cb_009_70.pdf received on 2009.12.14 17:05:25 (UTC)
Result: 6/41 (14.64%)

BitDefender 7.2 2009.12.14 Exploit.PDF-JS.Gen
F-Secure 9.0.15370.0 2009.12.14 Exploit.PDF-JS.Gen
GData 19 2009.12.14 Exploit.PDF-JS.Gen
Kaspersky 7.0.0.125 2009.12.14 Exploit.JS.Pdfka.ara
NOD32 4686 2009.12.14 PDF/Exploit.Gen
Sophos 4.48.0 2009.12.14 Troj/PDFJs-FM
Additional information

Dec.1 PDF Attack of the day. Russian-Proposed European Security Treaty from sullivanchris81@yahoo.com Tue, 1 Dec 2009 04:30:47

CVE-2009-3953

The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration "array boundary issue," a different vulnerability than CVE-2009-2994. 


Download infected pdf files (password protected archive. You have to contact me for the password) 

The message sender was

sullivanchris81@yahoo.com

The message originating IP was 98.136.165.26 The message recipients were

XXX@XXX.XXX

The message was titled Russian-Proposed European Security Treaty The message date was Tue, 1 Dec 2009 04:30:47 -0800 (PST) The message identifier was <729208.94960.qm@web112801.mail.gq1.yahoo.com>

The virus or unauthorised code identified in the email is:

F-Secure Security Platform version 1.12 build 6412 Copyright (c) 1999-2007 F-Secure Corporation. All Rights Reserved.

Scan started at Tue Dec 1 12:30:52 2009 Database version: 2009-12-01_03

attach/5964623_3X_PM5_EMS_MA-PDF__European=20Security=20Treaty=2D1.pdf: Infected: Exploit.JS.Pdfka.ara [AVP]

attach/5964623_4X_PM6_EMS_MA-PDF__European=20Security=20Treaty=2D2.pdf: Infected: Exploit.JS.Pdfka.ara [AVP]

Scan ended at Tue Dec 1 12:30:52 2009

3 files scanned

2 files infected

Dear Colleagues,

Just in case you have not seen this, I attached the draft treaty for your infomation. The treaty was posted on the website of the Russian Government.

Hope it will be help for your work.

Regards,

Chris

Nov.25 PDF attack. Letter on Taiwan from rupertjhc@gmail.com Nov 25, 2009 11:23 AM

Download the infected PDF (password protected, you have to contact me for the password)
This one is quite interesting:

Details ca79bb9846a56e73f6df1bba7854d196  Letter F-16.pdf

From Rupert Hammond-Chambers [rupertjhc@gmail.com]

To ouruser@ourdomain.xxx

Sent: Wednesday, November 25, 2009 9:54 AM

Subject Letter on Taiwan

Dear Colleagues,

I first would like to extend my heartfelt gratitude for the support that you and other members of Congress have demonstrated to the Republic of China (Taiwan) over the last 30 years. Despite the absence of official relations, our common goals and interests remain strong.

Our nation has attempted to purchase follow-on F-16s since 2006 to upgrade our national defense by replacing our F-5s and other antiquated equipment and thereby respond to the growing threat that the People’s Republic of China (PRC) and its military’s modernization efforts represents to peace and security in the Taiwan Strait. We respectively ask you to support our clear military need to upgrade our F-16 force by supporting a follow-on sale of F-16s. Your support will contribute immeasurably to America and Taiwan’s shared interest in democracy and peace and security in the Taiwan Strait.

Sincerely yours,

Rupert

--

Rupert Hammond-Chambers

President

US-Taiwan Business Council

________________________________

1700 North Moore Street, Suite 1703

Arlington, Virginia 22209

United States of America

Telephone: (703) 465-2930

Mobile: (202) 445-4777

Facsimile: (703) 465-2937

www.us-taiwan.org