Vulnerabilityhigh
New Uyghur and Tibetan Themed Attacks Using PDF Exploits
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2009-0563 | Buffer Overflow RCE in Microsoft Office via Crafted Word Document | — | 60% | KEV | — KEV |
| CVE-2010-3333 | Stack Buffer Overflow in Microsoft Office RTF Parsing Allows Remote Code Execution | — | 89% | KEV | — KEV |
| CVE-2013-0640 | Memory Corruption RCE in Adobe Reader and Acrobat (acroform.dll) | — | 87% | KEV | — KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 60.211.253.28 | t the moment, all the domains point to the same IP address: 60.211.253.28. The server is located in China, in Shandong province: The |
| md5 | 7005e9ee9f673edad5130b3341bf5e5f | (ItaDuke) exploits. Some of the MD5s and filenames include: 7005e9ee9f673edad5130b3341bf5e5f 2013-Yilliq Noruz Bayram Merik isige Teklip.pdf d00e4ac94f1 |
| md5 | 92f15c2b82e81e8ae47e361b3ecb5add | 204,932 bytes (MD5 varies) MSTD32.DLL – 31,880 bytes (MD5: 92f15c2b82e81e8ae47e361b3ecb5add) MSTD32.DLL is signed by “YNK JAPAN Inc”, with a certificat |
| md5 | ad668992e15806812dd9a1514cfc065b | df d00e4ac94f1e4ff67e0e0dfcf900c1a8 .pdf (joint_letter.pdf) ad668992e15806812dd9a1514cfc065b arp.pdf The Kaspersky detection name for these exploits is |
| md5 | d00e4ac94f1e4ff67e0e0dfcf900c1a8 | b3341bf5e5f 2013-Yilliq Noruz Bayram Merik isige Teklip.pdf d00e4ac94f1e4ff67e0e0dfcf900c1a8 .pdf (joint_letter.pdf) ad668992e15806812dd9a1514cfc065b ar |
From the original article
4 min read at securelist.com
On Feb 12th 2013, FireEye announced the discovery of an Adobe Reader 0-day exploit which is used to drop a previously unknown, advanced piece of malware. We called this new malware “ItaDuke” because it reminded us of Duqu and because of the ancient Italian comments in the shellcode copied from Dante Alighieri’s “Divine Comedy”.
By @Securelist · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.