Vulnerabilitymedium
A Targeted Attack Against The Syrian Ministry of Foreign Affairs
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2010-0188 | Arbitrary Code Execution in Adobe Reader and Acrobat via Malicious PDF Handling | — | 88% | KEVRansomware | — KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 123.120.110.126 | ere working on this report the domain resolution changed to 123.120.110.126 (same ISP), which is alive and responds on port 443. We let |
| ipv4 | 123.120.111.163 | to the C&C. The command-and-control server name resolves to 123.120.111.163 , which is in China: At the start time of writing, the C&C |
| ipv4 | 123.120.11.163 | which is in China: At the start time of writing, the C&C at 123.120.11.163 server didn’t not answer to connection attempts on port 443 |
| ipv4 | 123.140.57.166 | re to believe the SMTP headers, the e-mail was sent from IP 123.140.57.166 , which is a proxy in Seoul, Korea. Technical Details – 964 |
| md5 | cbf76a32de0738fea7073b3d4b3f1d60 | F file named 964.PDF , which is 569,477 bytes in size (MD5: cbf76a32de0738fea7073b3d4b3f1d60). This PDF file contains an exploit (CVE-2010-0188) for Ado |
From the original article
6 min read at securelist.com
Several days ago, a number of leaked documents from the Syrian Ministry of Foreign Affairs were published on Par:AnoIA, a new wikileaks-style site managed by the Anonymous collective. One of our users notified us of a suspicious document in the archive which is detected by our anti-malware products as Exploit. JS.
By @Securelist · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.