Jun 1 CVE-2010-3333 DOC You are my King from compromised louisvilleheartsurgery.com w Trojan Taidoor

Common Vulnerabilities and Exposures (CVE)number

CVE-2010-3333 Stack-based buffer overflow in Microsoft Office XP SP3, Office 2003 SP3, Office 2007 SP2, Office 2010, Office 2004 and 2008 for Mac, Office for Mac 2011, and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via crafted RTF data, aka "RTF Stack Buffer Overflow Vulnerability

  General File Information

File You are my king.doc
File Size  58531 bytes
MD5  09D68EF693AC6B7D3ACF0DDFF0585543
Distribution  Email attachment


CLICK HERE SEE ALL OTHERS SENT VIA THAT SERVER


 The trojaned documents were sent via mail.louisvilleheartsurgery.com (66.147.51.202), which appears to be a legitimate mail server of University of Louisville surgery program, which is outsourced to/hosted at Nuvox / Windstream Email hosting. The server must be misconfigured or compromised and is being actively used as a relay for phishing.(I have other examples of phish mail sent via that server and I will post them as soon as I can)

May 31 CVE-2010-3333 DOC President Obama's Speech.doc from compromised louisvilleheartsurgery.com w Trojan Taidoor

Common Vulnerabilities and Exposures (CVE)number

CVE-2010-3333 Stack-based buffer overflow in Microsoft Office XP SP3, Office 2003 SP3, Office 2007 SP2, Office 2010, Office 2004 and 2008 for Mac, Office for Mac 2011, and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via crafted RTF data, aka "RTF Stack Buffer Overflow Vulnerability 

  General File Information

File President Obama's Speech.doc
File Size 73891 bytes
MD5 35C33BBD97D7F5629D64153A1B3E71F1
Distribution Email Attachment

 The trojan within a word document was sent via mail.louisvilleheartsurgery.com (66.147.51.202), which appears to be a legitimate mail server of University of Louisville surgery program, which is outsourced to/hosted at Nuvox / Windstream Email hosting. The server must be misconfigured or compromised and is being actively used as a relay for phishing.(I have other examples of phish mail sent via that server - pretty much everything is the same - note additional C2 ip in this post)

See others

• Jun 1 CVE-2010-3333 DOC 2011 Insider's Guide to Military Benefits from compromised louisvilleheartsurgery.com w Trojan Taidoor  
• May 31 CVE-2010-3333 DOC Q and A.doc compromised louisvilleheartsurgery.com w Trojan Taidoor

May 31 CVE-2010-3333 DOC Q and A.doc compromised louisvilleheartsurgery.com w Trojan Taidoor

Common Vulnerabilities and Exposures (CVE)number

CVE-2010-3333 Stack-based buffer overflow in Microsoft Office XP SP3, Office 2003 SP3, Office 2007 SP2, Office 2010, Office 2004 and 2008 for Mac, Office for Mac 2011, and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via crafted RTF data, aka "RTF Stack Buffer Overflow Vulnerability

  General File Information

File Q and A.doc
File Size 115755 bytes
MD5 46863c6078905dab6fd9c2a480e30ad0
Distribution Email Attachment

 The trojan within a word document was sent via mail.louisvilleheartsurgery.com (66.147.51.202), which appears to be a legitimate mail server of University of Louisville surgery program, which is outsourced to/hosted at Nuvox / Windstream Email hosting. The server must be misconfigured or compromised and is being actively used as a relay for phishing.(I have other examples of phish mail sent via that server - pretty much everything is the same - note additional C2 ip in this post) Jun 1 CVE-2010-3333 DOC 2011 Insider's Guide to Military Benefits from compromised louisvilleheartsurgery.com w Trojan Taidoor

Jun 1 CVE-2010-3333 DOC 2011 Insider's Guide to Military Benefits from compromised louisvilleheartsurgery.com w Trojan Taidoor

Common Vulnerabilities and Exposures (CVE)number

CVE-2010-3333 Stack-based buffer overflow in Microsoft Office XP SP3, Office 2003 SP3, Office 2007 SP2, Office 2010, Office 2004 and 2008 for Mac, Office for Mac 2011, and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via crafted RTF data, aka "RTF Stack Buffer Overflow Vulnerability

  General File Information

File 2011 Insider's Guide to Military Benefits .doc
File Size  92715 bytes
MD5 f520c8671ddb9965bbf541f20635ef30
Distribution Email Attachment

 The trojan within a word document was sent via mail.louisvilleheartsurgery.com (66.147.51.202), which appears to be a legitimate mail server of University of Louisville surgery program, which is outsourced to/hosted at Nuvox / Windstream Email hosting. The server must be misconfigured or compromised and is being actively used as a relay for phishing.(I have other examples of phish mail sent via that server and I will post them as soon as I can)

May 3 CVE-2010-3333 DOC Courier who led U.S. to Osama bin Laden's hideout identified

Common Vulnerabilities and Exposures (CVE)number

CVE-2010-3333

Stack-based buffer overflow in Microsoft Office XP SP3, Office 2003 SP3, Office 2007 SP2, Office 2010, Office 2004 and 2008 for Mac, Office for Mac 2011, and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via crafted RTF data, aka "RTF Stack Buffer Overflow Vulnerability

  General File Information

File   Laden's Death.doc
MD5   dad4f2a0f79db83f8976809a88d260c5
SHA1  4cec9ef7f39d43c7a137d0422c8e6568a2d9e18320d1b376086bcc7327ea1342
File size : 163065 bytes
Type:  DOC
Distribution: Email attachment

Post Updates

May 6   Updated analysis by Hermes Bojaxhi from CyberESI 

May 5, 2011 F-Secure Analysis  Analysis of an Osama bin Laden RTF Exploit

May 4, 2011 Kate Milton sent the extracted binary (decoded and not) and the decoy clean file. Many thanks.

It was sent to many targets in the US Government today.

Also see the same payload in the following messages

http://contagiodump.blogspot.com/2010/09/sep14-cve-2010-2883-adobe-0-day-fwd.html

http://contagiodump.blogspot.com/2010/09/cve-2009-4324-cve-2010-1297-cve-2009.html

Download

Download -- as a password protected archive (contact me if you need the password)
Download binary and the decoy file here 

Message

Tue, 03 May 2011 11:34:06 -0400 (EDT)
Source-IP: 220.228.120.62 
Message-ID: <000c01cc0998$15c8ec70$0201a8c0@protech.com.tw>
From: XXXXXXXXXXXXXXXXXXX
To: XXXXXXXXXXXXXXXXXXX
Subject: FW: Courier who led U.S. to Osama bin Laden's hideout identified
Date: Tue, 3 May 2011 21:43:28 +0800
X-ASG-Orig-Subj: FW: Courier who led U.S. to Osama bin Laden's hideout identified
MIME-Version: 1.0
Content-Type: multipart/mixed;
        boundary="----=_NextPart_000_0009_01CC09DB.23A97E20"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.3790.2929
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.3168


This is a multi-part message in MIME format.

------=_NextPart_000_0009_01CC09DB.23A97E20
Content-Type: text/plain;
        format=flowed;
        charset="big5";
        reply-type=original
Content-Transfer-Encoding: 7bit

To whom it may concern.
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXX  Signature spoofed  XXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX


------=_NextPart_000_0009_01CC09DB.23A97E20
Content-Type: application/octet-stream;
        name="Laden's Death.doc"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
        filename="Laden's Death.doc"

Sender

220.228.120.62 (there are other IPs from that company used as well)

Lotus Notes mail server, apparently compromised

Hostname:    notess1.protech.com.tw
ISP:    New Centry InfoComm Tech. Co., Ltd.
Organization:    PROTECHSYSTEMSCO.,LTD.
Assignment:    Static IP
Country:    Taiwan

Automated Scans

File name: Laden's Death.doc
Submission date:2011-05-03 15:34:52 (UTC)
http://www.virustotal.com/file-scan/report.html?id=4cec9ef7f39d43c7a137d0422c8e6568a2d9e18320d1b376086bcc7327ea1342-1304436892#
1/ 41 (2.4%)
Commtouch    5.3.2.6    2011.05.03    CVE-2010-3333!Camelot
Show all
MD5   : dad4f2a0f79db83f8976809a88d260c5
SHA1  : d563029a2dfe3cfcddc7326b1b486213095e58e5
SHA256: 4cec9ef7f39d43c7a137d0422c8e6568a2d9e18320d1b376086bcc7327ea1342
ssdeep: 1536:njNRRUfwR/JvinctjMA+2cg1WoQ98k//qL+fV7UswHOv6fNtcrm2XDt/:nBJRvinBADAOk
661UswH/fNGy2XB
File size : 163065 bytes
First seen: 2011-05-03 15:34:52
Last seen : 2011-05-03 15:34:52

Analysis

May 5, 2011 F-Secure Analysis  Analysis of an Osama bin Laden RTF Exploit

Clean file (thanks to Kate Milton for the binary and the clean decoy file submission)

 

The binary  - Trojan Protux (read more about it here http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor:Win32/Protux.A!dll#techdetails_link)

File name:exe_decoded.bin

http://www.virustotal.com/file-scan/report.html?id=a40b5cf0689aebaaf2352b61e8a9f4544ec69ef8ea3dc558f53646964a85755b-1304567158
Submission date:2011-05-05 03:45:58 (UTC)
Result:17 /40 (42.5%)

AntiVir     7.11.7.150     2011.05.04     BDS/Protux.tg
BitDefender     7.2     2011.05.05     Trojan.Generic.KDV.211541
Commtouch     5.3.2.6     2011.05.05     W32/Virut.AI!Generic
rWeb     5.0.2.03300     2011.05.05     BackDoor.Diho.163
eTrust-Vet     36.1.8307     2011.05.04     -
F-Prot     4.6.2.117     2011.05.04     W32/Virut.AI!Generic
GData     22     2011.05.05     Trojan.Generic.KDV.211541
Ikarus     T3.1.1.103.0     2011.05.05     Backdoor.Win32.Protux
Kaspersky     9.0.0.837     2011.05.05     Backdoor.Win32.Protux.tg
McAfee     5.400.0.1158     2011.05.05     Artemis!30C8C4C99430
McAfee-GW-Edition     2010.1D     2011.05.05     Artemis!30C8C4C99430
NOD32     6095     2011.05.05     Win32/Protux.NAK
Panda     10.0.3.5     2011.05.04     Suspicious file
PCTools     7.0.3.5     2011.05.04     Trojan.Generic
SUPERAntiSpyware     4.40.0.1006     2011.05.05     -
Symantec     20101.3.2.89     2011.05.05     Trojan Horse
TrendMicro     9.200.0.1012     2011.05.04     PAK_Generic.001
TrendMicro-HouseCall     9.200.0.1012     2011.05.05     BKDR_PROTUX.GE
VBA32     3.12.16.0     2011.05.04     Backdoor.Protux.ta
Additional information
Show all
MD5   : 30c8c4c9943044287cf06996863c2261
SHA1  : e7addde85f18c6ce22f7a1abc1ed78e662ce90f2

----------------------------------------------------------------------------------------------------------
See the payload analysis here  http://www.cyberesi.com/2011/05/03/ladens-death-doc-cve-2010-3333/

Hermes Bojaxhi from CyberESI  http://www.cyberesi.com provided the following details about the payload

File Name:  dhcpsrv.dll
File Size:  44504 bytes
MD5:        06ddf39bc4b5c7a8950f1e8d11c44446
SHA1:       b8c11c68f3e92b60cc4b208bd5905c0365f28978
PE Time:    0x4D9C2616 [Wed Apr 06 08:36:38 2011 UTC]
Sections (4):
 Name      Entropy  MD5
 .text     6.14     5c8b018d10792fdb74b5f289f97c5d06
 .rdata    4.73     88003ece00266ee44c21ac6242a7eafd
 .data     4.99     1d745a13a1f55e75b2f68adee97c6f59
 .reloc    5.7      e437cc92e10504181d7b712478db6af3


beacons to these domains:

checkerror.ucparlnet.com
ssi.ucparlnet.com
www.dnswatch.info
picture.ucparlnet.com

==============
C2 domain info

checkerror.ucparlnet.com   -  203.67.127.165 Hostname:    protech.com.tw  Digital United Inc. Taiwan
ssi.ucparlnet.com  - 58.34.152.233  ChinaNet Shanghai Province Network China
www.dnswatch.info - 82.96.118.210 Probe Networks Planet-Hosting.cz Germany
picture.ucparlnet.com - 203.67.127.165 Hostname:    protech.com.tw  Digital United Inc. Taiwan

ucparlnet.com IP Address hosting history

Event Date	Action	Pre-Action IP	Post-Action IP
2010-08-10	New	-none-	58.34.152.162
2010-08-13	Change	58.34.152.162	58.37.54.66
2010-08-23	Change	58.37.54.66	58.34.148.241
2010-09-03	Change	58.34.148.241	220.246.76.125
2010-09-24	Change	220.246.76.125	127.0.0.1
2010-10-25	Change	127.0.0.1	58.37.182.29
2010-11-28	Change	58.37.182.29	58.34.149.104
2010-12-09	Change	58.34.149.104	58.34.152.202
2010-12-31	Change	58.34.152.202	127.0.0.1
2011-02-24	Change	127.0.0.1	125.141.233.16
2011-04-10	New	-none-	125.141.233.16

dnswatch.info  - is not a malicious domain

Apr 20 CVE-2010-3333 DOC Join Forces with Us.doc - from 60.248.110.190 - firstladyoffice@usa.gov

Common Vulnerabilities and Exposures (CVE)number

CVE-2010-3333 Stack-based buffer overflow in Microsoft Office XP SP3, Office 2003 SP3, Office 2007 SP2, Office 2010, Office 2004 and 2008 for Mac, Office for Mac 2011, and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via crafted RTF data, aka "RTF Stack Buffer Overflow Vulnerability

Please read a technical analysis of this vulnerability on the Microsoft Threat Research & Response Blog Targeted attacks against recently addressed Microsoft Office vulnerability (CVE-2010-3333/MS10-087)  29 Dec 2010 12:10 PM

  General File Information

File  Join Forces with Us.doc
MD5: 7e89317f3e6cbfab053cf6a38661d9f4
SHA1: f702d075170f1865a47e3149cd4be2683689d3f0
SHA256: d3edfab016232c0b6d2f03492f4971d8807d5f67a43609b489bf92f4a924d24d
File size: 48650 bytes

Type:  DOC
Distribution: Email attachment

Download

Download -7e89317f3e6cbfab053cf6a38661d9f4- as a password protected archive (contact me if you need the password)

Original Message

read more...

Mar 14 CVE-2010-3333 Disaster in Japan: Watch Report from spoofed mail@response.stratfor.com

Common Vulnerabilities and Exposures (CVE)number

CVE-2010-3333
Stack-based buffer overflow in Microsoft Office XP SP3, Office 2003 SP3, Office 2007 SP2, Office 2010, Office 2004 and 2008 for Mac, Office for Mac 2011, and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via crafted RTF data, aka "RTF Stack Buffer Overflow Vulnerability

Please read a technical analysis of this vulnerability on the Microsoft Threat Research & Response Blog Targeted attacks against recently addressed Microsoft Office vulnerability (CVE-2010-3333/MS10-087)  29 Dec 2010 12:10 PM

  General File Information

File   Disaster in Japan (Watch Report).doc
MD5  7b3208b1dc28b2d5f7641aa212e6aabf
SHA1  8a60a2183a044bbeae90f0354acdbf6f6f052925
File size : 62464 bytes
Type:  DOC
Distribution: Email attachment

Download

Download  7b3208b1dc28b2d5f7641aa212e6aabf  as a password protected archive (contact me if you need the password)

Feb 25 CVE-2010-3333 DOC China's Military Build-up from a compromised IBEW-NECA Joint Trust Funds account

Common Vulnerabilities and Exposures (CVE)number

CVE-2010-3333
Stack-based buffer overflow in Microsoft Office XP SP3, Office 2003 SP3, Office 2007 SP2, Office 2010, Office 2004 and 2008 for Mac, Office for Mac 2011, and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via crafted RTF data, aka "RTF Stack Buffer Overflow Vulnerability

Please read a technical analysis of this vulnerability on the Microsoft Threat Research & Response Blog Targeted attacks against recently addressed Microsoft Office vulnerability (CVE-2010-3333/MS10-087)  29 Dec 2010 12:10 PM

  General File Information

File  China's Military Build-up in the Early Twenty-first Century
MD5   02B77C3941478A05F2EE6559E3B76FB6
SHA1  cd7a8327dc8917d90bdbe693a310fa75a43a1ae0
File size : 214503 bytes
Type:  PDF
Distribution: Email attachment

Download

Download -China's Military Build-up in the Early Twenty-first Century.doc and the dropped malicious file as a password protected archive (contact me if you need the password)

 Summary

Sender: It appears that the message is not spoofed but was sent from a compromised account, which belongs to an existing employee of "The Local 26 IBEW-NECA Joint Trust Funds" located in Laurel, Maryland.

This mail server IP 69.85.28.235 is not shared by multiple customers and it was already featured by the Project Honeypot for sending phishing mail
It appears to be a hosted mail server.  Please see more information about this in the Sender section below.

Attachment: The attachment is a malicious word (RTF) document (CVE-2010-3333), with the payload described below plus a clean word document - the paper named in the subject of the message "China’s military build-up in the early twenty-first century : from arms procurement to war-fighting capability" The paper itself in pdf format is available at the Nanyang Technological University website (Singapore)

Payload: The embedded binary (Trojan.CryptRedol.Gen.3) creates a copy of itself (same MD5 each time) with a new name in %userprofile%\Local Settings, connects to an IP in Thailand, creates a registry setting to run on startup, it runs under svchost.exe.
The names match standard Windows DLL and EXE files. There are 34 (at least 40) variations possible.  Please see older files with  similar  AV detection  here

List of possible names:
    Alerter.exe
    AppMgmt.exe
    CiSvc.exe
    ClipSrv.exe
    COMSysApp.exe
    dmadmin.exe
    Dot3svc.exe
    EapHost.exe
    HidServ.exe
    hkmsvc.exe
    ImapiService.exe
    Messenger.exe
    mnmsrvc.exe
    MSDTC.exe
    MSIServer.exe
    napagent.exe
    NetDDE.exe
    NetDDEdsdm.exe
    Netlogon.exe
    NtLmSsp.exe
    NtmsSvc.exe
    ose.exe
    RasAuto.exe
    RDSessMgr.exe
    RemoteAccess.exe
    rpcapd.exe
    RpcLocator.exe
    RSVP.exe
    SwPrv.exe
    SysmonLog.exe
    TlntSvr.exe
    upnphost.exe
    UPS.exe
    VSS.exe
    WmdmPmSN.exe
    Wmi.exe
    WmiApSrv.exe
    wuauserv.exe
    xmlprov.exe

read more...

Jan 20 CVE-2010-3333 DOC Materials.doc from 216.183.175.3 (Cleveland Council on World Affairs)

Common Vulnerabilities and Exposures (CVE)number

CVE-2010-3333
Stack-based buffer overflow in Microsoft Office XP SP3, Office 2003 SP3, Office 2007 SP2, Office 2010, Office 2004 and 2008 for Mac, Office for Mac 2011, and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via crafted RTF data, aka "RTF Stack Buffer Overflow Vulnerability

Please read a technical analysis of this vulnerability on the Microsoft Threat Research & Response Blog Targeted attacks against recently addressed Microsoft Office vulnerability (CVE-2010-3333/MS10-087)  29 Dec 2010 12:10 PM

  General File Information

File  Materials.doc
MD5  2EEA004842A335607B612FF10418F6C6
SHA1  a81a35804c056186c533ddd31e22ee0c0d2aa4df
File size : 243663
Type:  DOC
Distribution: Email attachment                            

 Post Update

February 7, 2010

 There was another mailing after the first one but from a different location. 

 From: Anne Principe [mailto:anne.principe@yahoo.com]
Sent: Friday, January 21, 2011 6:54 AM
To: XXXXXXXXXXXXX
Subject: This is the materials you need

This is The Materials I told you about. Please check it and reply as soon as possible.
　　Best
Headers
Received: (qmail 736 invoked from network); 21 Jan 2011 11:54:30 -0000
Received: from web120514.mail.ne1.yahoo.com (HELO web120514.mail.ne1.yahoo.com) (98.138.85.241)
  by XXXXXXXXXXXXXXXXX; 21 Jan 2011 11:54:30 -0000
Received: (qmail 38488 invoked by uid 60001); 21 Jan 2011 11:54:29 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1295610869; bh=T6PYZhAJBvHdbMDRjYJCy748DpISxb703J9WYvNrE8M=; h=Message-ID:X-YMail-OSG:Received:X-Mailer:Date:From:Subject:To:MIME-Version:Content-Type; b=KNLZKhWTr+Z+UMtiMC6dY7GmKt49wyNHC8Y1j8kv5f/KM8u7bs6ifqGFNhwckx18edFsi+ajzhsNM01R8UN+ox/r9Ss6ut/Mssll5hxwtBHXEmvIxrl8dFTUg/CmMgSjJNhW6KlOZfVkUU2nikWaMzxkqSgTJ9JCM828Qw1xZbM=
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
  s=s1024; d=yahoo.com;
  h=Message-ID:X-YMail-OSG:Received:X-Mailer:Date:From:Subject:To:MIME-Version:Content-Type;
  b=eqwO+5NenEdsqmjuNowZ25VlFcli8zNaedc26kn00QeqFLcMxeSuTDB+vYhmeUYJfAYe+fZ13q8p1qKILMX0AMH7/MDwbeBOBaRL8xTf33LpWE4KwgeYq4uEKjZfptSRvA6RrpPHjDLWoE55D0uAMGV/hMk50g7s/eGes9VnAc0=;
Message-ID: <416336.37770.qm@web120514.mail.ne1.yahoo.com>
X-YMail-OSG: duFcYVsVM1lbQScN.uiS.a_.kSCtbZmEsYYlwKxqs50olw9
 S80HwIFK3gqCA7OM9LSU.JBWKbHZXNzNbBWlx1y8__meJqFUjCoB3qTY9ll4
 79Y_9XKC5KZXY6_OTA6RVB1j8NwW8Ozasz_xzbX5Ajh.yX7Y2NqePEUnApDc
 pWb0wpspWrIpPe9w9gzbAfrYmQRTXiyQtlxFjd_gk272zbKkWkcTAtxtFsiY
 UjAwiofHbox4vUrwVCekO.jf11bo-
Received: from [211.55.34.205] by web120514.mail.ne1.yahoo.com via HTTP; Fri, 21 Jan 2011 03:54:29 PST
X-Mailer: YahooMailRC/555 YahooMailWebService/0.8.107.285259
Date: Fri, 21 Jan 2011 03:54:29 -0800
From: Anne Principe
Subject: This is the materials you need
To: XXXXXXXXXXXXXXXXXXX
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="0-1514884592-1295610869=:37770"

211.55.34.205
Hostname:    211.55.34.205
ISP:    KRNIC
Organization:    Korea Telecom
Country:    Korea
State/Region:    Soul-t'ukpyolsi
City:    Seoul

Download

Download -Materials.doc and created files listed below as a password protected archive (contact me if you need the password)

Download pcap file

read more...

Jan 6 CVE-2010-3333 DOC with info theft trojan from the American Chamber of Commerce

Common Vulnerabilities and Exposures (CVE)number

CVE-2010-3333
Stack-based buffer overflow in Microsoft Office XP SP3, Office 2003 SP3, Office 2007 SP2, Office 2010, Office 2004 and 2008 for Mac, Office for Mac 2011, and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via crafted RTF data, aka "RTF Stack Buffer Overflow Vulnerability

Please read a technical analysis of this vulnerability on the Microsoft Threat Research & Response Blog Targeted attacks against recently addressed Microsoft Office vulnerability (CVE-2010-3333/MS10-087)  29 Dec 2010 12:10 PM

This particular exploit was tested on and successfully exploits Office 2003 and 2007 without the patch.

  General File Information

File  Three Big Risks to China's Economy In 2011.doc
MD5  5A0AAC44DDAAD1E512A0D505C217BAFF
SHA1 ab6f90bf582bf01985989c1e9a99932243402479
File size :51643
Type:  DOC
Distribution: Email attachment                            

Download

Download Three Big Risks to China's Economy In 2011.doc 5A0AAC44DDAAD1E512A0D505C217BAFF and the created files listed below as a password protected archive (contact me if you need the password)

Download Joe Box Report for binary sandbox analysis on Windows 7 (with pcap files and screenshots, no password on zip)

Download Joe Box Report for binary sandbox analysis on Windows XP (with pcap files and screenshots, no password on zip)

Download  114.248.83.92userinitJan7-11pm.pcap 

Download 123.120.107.46userinitbeforeJan710pm.pcap

Download the Anubis generated pcap file 

Malware Information

The message came from the American Chamber of Commerce in China. The interesting thing about this message is that the sender is not spoofed and the headers are real, which means that the message indeed came from the mailbox of the sender @amchamchina.org, who also happens to be a real person working at amchamchina.org - can be easily found in Google searches. The sender name and address do not match the message signature.  I have removed part of the sender's name for privacy reasons.

In this case, there are three possible scenarios:

a) someone broke into that employee mailbox and sent the malicious message (in this case, I hope the IT staff at the American Chamber of Commerce in China see this post and fix the problem)
b) the sender sent a malicious attachment not realizing it is malicious (less likely, as the attached Word document does not display readable text),
c) the sender sent the malicious message on purpose (..)
We may never know how that happened but hope it is a case of a mailbox password compromise.

 The files created by the malicious attachment generate traffic to a server in China.

Upon opening, the file will dispay garbage text if the attack fails (fully patched MS Office) and will just close without displaying any document if the exploit is successful.

The trojan that gets installed is designed for stealing information from the infected computer - files and passwords - see the detailed analysis below.

read more...