Exploit / PoCmedium
Visit From an Old Friend: Counter.php
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2010-0188 | Arbitrary Code Execution in Adobe Reader and Acrobat via Malicious PDF Handling | — | 88% | KEVRansomware | — KEV |
| CVE-2011-3402 | Remote Code Execution in Microsoft Windows Kernel TrueType Font Parser (win32k.sys) | — | 78% | KEV | — KEV |
| CVE-2013-0422 | Java Applet Permission-Restriction Flaw Enables Remote Code Execution in Oracle JRE | — | 97% | KEVRansomware | — KEV |
| CVE-2013-2423 | Remote Integrity-Affecting Vulnerability in Oracle JRE HotSpot (CVE-2013-2423) | — | 85% | KEV | — KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| url | http://globalbrowserstatistic.com/statG/stat.php? | econd redirection to stat.php has the following parameters: hXXp://globalbrowserstatistic.com/statG/stat.php? ip=YOUR_IP &useragent=mozilla%2F4.0%20(compatible%3B%20msie |
From the original article
4 min read at securelist.com
Around one year ago I posted about what were the most common web attacks in Spain and how the malware was spread. It is time for an update! We regularly collect data regarding infected web sites based in our detections on KSN.
By @Securelist · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.