Virus Profile: Exploit-PDF.i

Virus Characteristics

------------Update May 16, 2012-------------------------------

Newer variants have also exhibited the following behavior:

Exploit-PDF.i is a malicious PDF that contains exploits for CVE-2010-2883, CVE-2010-3654 and CVE-2011-0611. Successful exploitation will install a backdoor Trojan that could allow unauthorized access to an infected host.

• %UserProfile%\Local Settings\Temp\winword.js (detected as VBS/Dropper.a)
• %UserProfile%\Local Settings\Temp\Adobe.pdf (benign)
• %UserProfile%\Local Settings\Temp\~~tempq.tmp.bat (later deleted)
• %UserProfile%\Local Settings\Temp\~~tempq.tmp.dat (later deleted)
• %UserProfile%\Local Settings\Temp\~~tempq.tmp (later deleted)
• %UserProfile%\Local Settings\Application Data\Windows Update\wuauserv.exe (detected as Generic BackDoor.u)
• %UserProfile%\Local Settings\Application Data\Windows Update\wuauserv.dll (detected as Generic BackDoor.u)

The benign PDF ‘Adobe.pdf’ will load so as not to alert the user that anything has occurred unexpectedly.

Upon execution of the malicious files, they are deleted and the following files are added to the system:

• %UserProfile%\Local Settings\Application Data\Windows Update\wuauserv.exe (detected as Generic BackDoor.u)
• %UserProfile%\Local Settings\Application Data\Windows Update\wuauserv.dll (detected as Generic BackDoor.u)
  

Contact may be made with the following domain:

• faq.ant[removed].org

This domain did not appear functional at the time of testing. The domain is using a self-signed, untrusted certificate:

Mitigation:

• If possible,  block access to the ports  and monitor and block mentioned URI
• Users who have been known to be infected are requested to change their passwords.

Restart Mechanism:

The following registry entry is added to the host to restart upon reboot:

• HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load
  Data: [aforementioned location]\wuauserv.exe

Mitigation:

• Disable any such Run keys

-----------------------------------------------------------------

This detection covers trojan in the form of *.PDF files that attempts to exploit a vulnerability in Adobe Reader.

When successful, the following files are dropped and installed:

• %UserProfile%\Local Settings\Temp\svchost.exe (Backdoor-DTJ trojan)
• %UserProfile%\Local Settings\Temp\temp.exe (Generic Dropper.ck trojan)

(Where %UserProfile% is the Windows user profile folder, e.g. C:\Documents and Settings\USER, %SystemDir% is the Windows system folder, e.g. C:\Windows\System32)