Common Vulnerabilities and Exposures (CVE)number
CVE-2010-3333
Stack-based buffer overflow in Microsoft Office XP SP3, Office 2003
SP3, Office 2007 SP2, Office 2010, Office 2004 and 2008 for Mac, Office
for Mac 2011, and Open XML File Format Converter for Mac allows remote
attackers to execute arbitrary code via crafted RTF data, aka "RTF Stack
Buffer Overflow Vulnerability
Please read a technical analysis of this vulnerability on the Microsoft Threat Research & Response Blog Targeted attacks against recently addressed Microsoft Office vulnerability (CVE-2010-3333/MS10-087) 29 Dec 2010 12:10 PM
General File Information
File China's Military Build-up in the Early Twenty-first Century
MD5 02B77C3941478A05F2EE6559E3B76FB6
SHA1 cd7a8327dc8917d90bdbe693a310fa75a43a1ae0
File size : 214503 bytes
Type: PDF
Distribution: Email attachment
Download
Sender: It appears that the message is not spoofed but was sent from a compromised account, which belongs to an existing employee of "The Local 26 IBEW-NECA Joint Trust Funds" located in Laurel, Maryland.
This mail server IP 69.85.28.235 is not shared by multiple customers and it was already featured by the Project Honeypot for sending phishing mail
It appears to be a hosted mail server. Please see more information about this in the Sender section below.
This mail server IP 69.85.28.235 is not shared by multiple customers and it was already featured by the Project Honeypot for sending phishing mail
It appears to be a hosted mail server. Please see more information about this in the Sender section below.
Attachment: The attachment is a malicious word (RTF) document (CVE-2010-3333), with the payload described below plus a clean word document - the paper named in the subject of the message "China’s military build-up in the early twenty-first century : from arms procurement to war-fighting capability" The paper itself in pdf format is available at the Nanyang Technological University website (Singapore)
Payload: The embedded binary (Trojan.CryptRedol.Gen.3) creates a copy of itself (same MD5 each time) with a new name in %userprofile%\Local Settings, connects to an IP in Thailand, creates a registry setting to run on startup, it runs under svchost.exe.
The names match standard Windows DLL and EXE files. There are
List of possible names:
Alerter.exe
AppMgmt.exe
CiSvc.exe
ClipSrv.exe
COMSysApp.exe
dmadmin.exe
Dot3svc.exe
EapHost.exe
HidServ.exe
hkmsvc.exe
ImapiService.exe
Messenger.exe
mnmsrvc.exe
MSDTC.exe
MSIServer.exe
napagent.exe
NetDDE.exe
NetDDEdsdm.exe
Netlogon.exe
NtLmSsp.exe
NtmsSvc.exe
ose.exe
RasAuto.exe
RDSessMgr.exe
RemoteAccess.exe
rpcapd.exe
RpcLocator.exe
RSVP.exe
SwPrv.exe
SysmonLog.exe
TlntSvr.exe
upnphost.exe
UPS.exe
VSS.exe
WmdmPmSN.exe
Wmi.exe
WmiApSrv.exe
wuauserv.exe
xmlprov.exe
