Latest Adobe PDF exploit used to target Uyghur and Tibetan activists

March 14, 2013 | Jaime Blasco
X

Get the latest security news in your inbox.

Subscribe via Email

No thanks. Close this now.

Last month Adobe released a fix to patch a vulnerability that was being exploited in the wild. Kaspersky found that the 0day was being used by a very sophisthicated group to target different governments  using a malware called MiniDuke.

Alienvault Labs have detected that a different group of attackers have been using this vulnerability to target non-governmental and human rights organizations.

Together with our partner Kaspersky Labs we are releasing an analysis of this campaign. You can read his report here.

Based on the samples we found we believe this group has been running a SpearPhishing campaign from the last few weeks. The files we have analyzed are PDF files that contain code to exploit CVE-2013-0640. Once the victim opens the file, the system gets infected and a lure document is displayed to the victim. Some of the PDF lures we have found are:

 

 

 

 

Some of the exploit filenames:

  • 2013-Yilliq Noruz Bayram Merikisige Teklip.pdf
  • 联名信.pdf
  • arp.pdf

Based on the lures we found it seems the same group is targeting both Tibet and Uyghur activists in the same campaign.

The Javascript code inside the PDF files is very similar to the one found in the Itaduke samples but part of the initial variables and the obfuscation has been removed from the original one.

The shellcode will create the file AcroRd32.exe in the Temp folder. That file decrypts an encrypted block using XOR operations with the key “[email protected]”.

The malicious payload will perform the following operations:

- Copy \WINDOWS\system32\wuauclt.exe to %APPDATA%\wuauclt\wuauclt.exe

- Drop a malicious DLL under %APPDATA%\wuauclt\clbcatq.dll

- Execute %APPDATA%\wuauclt\wuauclt.exe

Note that wuauclt.exe is a benign system executable. Once the system file is executed, the malicious DLL will be loaded. This technique is known as DLL search order hijacking.

The malicious DLL will be loaded when wuauclt.exe is executed. It is important to show that clbcatq.dll is not exporting all the methods that the original clbcatq.dll has. It only implements the ones that are required to run the malicious code:

Original DLL                                                                       Malicious DLL

 

 

 

 

Once the malicious DLL is loaded, the malicious code will generate the following HTTP request:

 

 

The server will reply with an encrypted block of code that will be decrypted. The decrypted content is actually a DLL that exports the following functions:

  • GetWorkType
  • InfectFile

The payload will drop the following files:

  • \WINDOWS\system32\wbem\4BA5E980.PBK
  • \WINDOWS\system32\wbem\mstd32.dll

The InfectFile function will modify some code in the system library WINDOWS\system32\mswsock.dll. If we take a look at the patched DLL:

Original version

Modified version:

If we take a look at WSPStartup_0:

We can see how the malicious DLL mstd32.dll will be loaded everytime the system library mswsock.dll is loaded by a program.

The file mstd32.dll is signed using a certificate issued to “YNK JAPAN Inc. We have seen that certificate being used to sign malware dropped in several NGO attacks in the past.

 

 

Then the malicious code will perform the following HTTP request every few seconds:

 

The final payload is detected as Trojan.Win32.Swisyn and it has a lot of functionality to monitor and steal data from the infected system.

We have identified the following C&C servers for both payloads:

  • ly.micorsofts.net
  • ip.micrsofts.com
  • xdx.hotmal1.com
  • hy.micrsofts.com
All the DNS names are pointing to 60.211.253.28 at this time.
 

Both domains have been registered using the same mail address:

micorsofts.net

Created: 2008-05-12 01:51:10

Expires: 2013-05-12 01:51:10

Last Modified: 2012-05-02 13:26:38

Registrant Contact:

GW SY

li wen li wen ([email protected])

zq dj

jiningshi, shandongsheng, cn 272000

P: +86.05372178000 F: +86.05372178000

hotmal1.com

Created: 2008-12-30 03:53:18

Expires: 2013-12-30 03:53:18

Last Modified: 2012-12-26 15:32:15

Registrant Contact:

GW SY

li wen li wen ([email protected])

zq dj

shixiaqu, beijingshi, cn 272000

P: +86.02227238836601 F: +86.02227238836601

Profile of the user on 20cn.net

We - Alienvault Labs- have written some Snort rules to match the network behavior:

 

 

 

 

You can use the following Yara rule to match the malicious binaries:

 

 

And this one to detect the malicious PDF files:

 

 

Finally, we are releasing some OpenIOC indicators as well:

You can find all the content in our GitHub repository.

Jaime Blasco

About the Author: Jaime Blasco
Jaime Blasco is a renowned Security Researcher with broad experience in network security, malware analysis and incident response. At AlienVault, Jaime leads the Lab Intelligence and Research team that leads the charge of researching and integrating threat intelligence into detection mechanisms. Prior to working at AlienVault he founded a couple of startups (Eazel, Aitsec) working on web application security, source code analysis and incident response. He is based in San Francisco. Jaime's work in emerging threats and targeted attacks is frequently cited in international publications such as New York Times, BBC, Washington Post and Al Jazeera.
Read more posts from Jaime Blasco ›

‹ BACK TO ALL BLOGS

Watch a Demo ›
GET PRICE FREE TRIAL