Kaspersky Securelistpublished Mar 15, 08:37 UTC (Mar 15, 2013)ingested Sep 10, 06:23 UTC@Securelist

Reminder: be careful opening invoices on the 21st March

highVulnerabilityimportance 47CVE-2010-0188

Read the original

Tagscve-2010-0188 vulnerability

Vulnerabilities mentionedAll →

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2010-0188	Arbitrary Code Execution in Adobe Reader and Acrobat via Malicious PDF Handling CVE-2010-0188 is an unspecified code-injection (CWE-94) flaw in Adobe Reader and Acrobat that allows attackers to cause a denial of service or possibly execute arbitrary code on the victim's machine. It is triggered when an affected application processes a maliciously crafted PDF document, typically delivered as an email attachment or downloaded from a website, so simply viewing the file with vulnerable software is enough to expose the user. A successful attack gives the attacker code execution in the context of the logged-on user, which can be leveraged to install malware or ransomware. Anyone running Adobe Reader or Acrobat is affected; CISA lists the products without published version ranges, so all Adobe deployments should be treated as potentially in scope. Exploitation is confirmed in the wild: the flaw is in CISA KEV (added 2022-03-03) with known ransomware use, and EPSS assigns an 88.2% probability of exploitation within 30 days (100th percentile). Do: Apply updates per vendor instructions: install the Adobe security update that fixes CVE-2010-0188 on any legacy Acrobat/Reader deployment and migrate unsupported installations to a currently supported Acrobat/Reader release. Given the known ransomware association, hunt for signs of compromise such as suspicious PDF attachments opened around malware activity, and block or sandbox PDFs at email and web gateways. Verify no critical hosts or automated workflows still depend on outdated Reader/Acrobat components for PDF processing.	—	88%	KEV ransomware	Adobe Reader Adobe Acrobat	masshundreds of millions of installed copies (Reader/Acrobat historically shipped as the default PDF handler on most Windows PCs; exact count of still-vulnerable…	Mar 3, 2022

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2010-0188

Arbitrary Code Execution in Adobe Reader and Acrobat via Malicious PDF Handling

CVE-2010-0188 is an unspecified code-injection (CWE-94) flaw in Adobe Reader and Acrobat that allows attackers to cause a denial of service or possibly execute arbitrary code on the victim's machine. It is triggered when an affected application processes a maliciously crafted PDF document, typically delivered as an email attachment or downloaded from a website, so simply viewing the file with vulnerable software is enough to expose the user. A successful attack gives the attacker code execution in the context of the logged-on user, which can be leveraged to install malware or ransomware. Anyone running Adobe Reader or Acrobat is affected; CISA lists the products without published version ranges, so all Adobe deployments should be treated as potentially in scope. Exploitation is confirmed in the wild: the flaw is in CISA KEV (added 2022-03-03) with known ransomware use, and EPSS assigns an 88.2% probability of exploitation within 30 days (100th percentile).

Do: Apply updates per vendor instructions: install the Adobe security update that fixes CVE-2010-0188 on any legacy Acrobat/Reader deployment and migrate unsupported installations to a currently supported Acrobat/Reader release. Given the known ransomware association, hunt for signs of compromise such as suspicious PDF attachments opened around malware activity, and block or sandbox PDFs at email and web gateways. Verify no critical hosts or automated workflows still depend on outdated Reader/Acrobat components for PDF processing.

—

88%

KEV ransomware

Adobe Reader
Adobe Acrobat

masshundreds of millions of installed copies (Reader/Acrobat historically shipped as the default PDF handler on most Windows PCs; exact count of still-vulnerable…

Mar 3, 2022

Indicators of compromiseauto-extracted · verify before use · export allAll →

Type	Indicator	Context
md5	3772e3c2945e472247241ac27fbf5a16	t-proxy.com/adobe-update.exe . The downloaded malware (MD5: 3772e3c2945e472247241ac27fbf5a16 ) is detected by Kaspersky Lab as Trojan.Win32.Yakes.cngh.
md5	97b720519aefa00da58026f03d818251	uct. The emails all contained the same PDF attachment (MD5: 97b720519aefa00da58026f03d818251 ) but were being sent from many different source addresses.

Full article527 words · extracted from securelist.com · click to collapse

On March 4^th we spotted a large number of unusual emails being blocked by our Linux Mail Security product. The emails all contained the same PDF attachment (MD5: 97b720519aefa00da58026f03d818251) but were being sent from many different source addresses.

The emails were written in German and most were sent from German IP addresses. Below is a map showing the distribution of addresses:

The computer names referenced in the mail headers were often of the form Andreas-PC or Kerstin-Laptop (the names have been changed to protect the innocent) suggesting that they had been sent from German home computers.

Below is an example email:

Example Email

The PDF attachment names were of the form ?Mahnung recipents name.pdf¦ (Mahnung is German for ?reminder¦ or ?overdue notice¦) and the exploit used was CVE-2010-0188 (Adobe Acrobat libtiff Remote Code Execution Vulnerability). The PDF was blocked by Kaspersky ZETA Shield and is detected as Exploit.JS.CVE-2010-0188.e. The exploit is not easy to spot because it is hidden under two layers of JavaScript.

First Javascript Layer

Second Javascript Layer

Decoded Shellcode

The second layer looks very similar to the JavaScript seen in several BlackHole Exploit Kit samples from last year. If the exploit is successful, it downloads an executable from seodirect-proxy.com/adobe-update.exe.

The downloaded malware (MD5: 3772e3c2945e472247241ac27fbf5a16) is detected by Kaspersky Lab as Trojan.Win32.Yakes.cngh. It contains various Italian strings (?lastoriasiamo¦, ?famiglia¦, ?badalamenti¦, impastato¦) which may be Mafia related. It also contains the following version information:

Apparently, BTP are Italian government bonds, Bund are German government bonds and ?Spread BTP/Bund¦ is a way of comparing the difference in yields.=

When the malware runs it displays the following error message:

It then installs itself in the temp directory with a random name (e.g. vlsnekunrn.pre) and attempts to contact zeouk-gt.com.

The Past

Looking back through our past feedback data, we noticed similar patterns on the 4^th and 21^st of several months.

February 2013

On the 21^st February we blocked a large number of emails containing a very similar PDF attachment. This time the attachment names included the word ?Rechnung¦ (meaning ?invoice¦) and a date (e.g. Rechnung_201302.pdf and 2013_02rechnung.pdf). The senders were from a wide variety of countries including South Africa, United States, Australia and Japan. This time the computer names referenced in the mail headers looked randomly generated (e.g. ydopsgf and bxahwdkw) and interestingly, the headers also referenced the domain zeus3.hostwaycloud.com.

The decoded JavaScript for this exploit was almost identical to the sample above but the malware was downloaded from several URLs:

allgaeu-heimatwerk.de/biznessler/typo3/sysext/t3skin/host.exe

corcagnani.de/host.exe

kkc-hannover.de/modules/mod_search/helper.exe

capital-success.de/pg/helper.exe

January 2013

On 4^th January the sample was called Rechnung201301.pdf and the malware was downloaded from the following URLs:

kohnle-gros.de/css/styleneu.exe

fairdealshop.co.uk/modules/mod_newsflash/helper.exe

emct.org.uk/downloads/server-stats.exe

November 2012

On 21^st November the sample was called RECHNUNG000201211.pdf and downloaded the malware from:

rocketmou.se/stuff/corduroyshop/corduroyshop.exe

coachplay.co.il/mapa/images/mapa.exe

The Future

This seems to be a very well put together campaign and it doesn-t seem to be going away. So, if you receive an invoice on March 21^st or April 4^th, be extra cautious. Although, the authors may change their invoicing date, so it is better to be cautious all the time.

Text extracted automatically; images, tables and formatting may be missing. Original: https://securelist.com/reminder-be-careful-opening-invoices-on-the-21st-march/67078/