Adobe products are used for creating, distributing, authoring and viewing Portable Document Format (PDF) documents. The Adobe Reader and Adobe Acrobat are examples of such products. The PDF file format was created and is controlled by Adobe. The format allows for representation of text, images and graphics in a single document.

Binary data, such as images are represented in a PDF document by stream objects. A stream is represented by a series of bytes enclosed in the stream and endstream keywords. An example of a stream in a PDF file is shown:

 stream 0099009900990099 endstream 

A stream will generally be preceded by a definition describing its properties amongst which will be the filter which is to be used to interpret the respective stream. For example, an image compressed by the JBIG2 compression standard may look as follows:

 << /Type /XObject /Subtype /Image /Length 100 /Filter [ /ASCIIHexDecode /JBIG2Decode ] >>  stream 1847509384750293847593847594837495874939203948405 8459484379857032975402398650432986502398538754934 endstream 

The JBIG2 bit stream consists of segments, with each segment containing a header followed by data. The format of a JBIG2 segment header is of variable length based on the values contained therein. In certain specific situations, the Adobe application will use a supplied value in the header as an index into an array of pages without checking the value for validity first. The application will then attempt to write into the array using this index. The affected field which is controlled by the PDF author, can be manipulated to overwrite any location within a 32-bit address space. This gives a malicious user the capability to corrupt memory of the affected process, thereby potentially diverting the process flow.

In order to exploit this vulnerability, the target user must be enticed to open a malicious PDF document. Successful exploitation may allow arbitrary code injection and execution with the privileges of the currently logged in user. As of the writing of this report, the vulnerability is being exploited in the wild.

SonicWALL has released three IPS signatures to detect and block specific exploit attempts. The following signatures have been released to address this vulnerability:

• 5401 – Adobe Multiple Products Embedded JBIG2 Stream BO PoC 1
• 5402 – Adobe Multiple Products Embedded JBIG2 Stream BO PoC 2
• 5403 – Adobe Multiple Products Embedded JBIG2 Stream BO PoC 3

This week, SonicWALL UTM Research team observed new variants of Waledac worm spreading in the wild and using Valentine’s theme. They send fake e-greeting card emails with a link to view an e-card to potential victims.

The websites used in this attack include:

• adorelyricxx.com
• adorepoemxx.com
• adoresongxx.com
• cherishletterxx.com
• funloveonlinexx.com
• goodnewsreviewxx.com
• greatvalentinepoemsxx.com
• orldlovelifexx.com
• reportradioxx.com
• spacemynewsxx.com
• yourgreatlovexx.com

These domains resolve to different IP addresses every time they are visited. The filenames are also rotated. Some of the filenames used in this wave are:

• Card.exe
• cardviewer.exe
• devkit.exe
• download.exe
• ecard.exe
• install.exe
• kit.exe
• lovecard.exe
• lovekit.exe
• loveprogramm.exe
• Loveu.exe
• Luv.exe
• Programm.exe
• vcard.exe
• viewer.exe
• valkit.exe

When executed this Waledac variant is almost identical in its behavior to the previous variant.

The malware has very low AV detection at the time of writing this Security Alert. SonicWALL Gateway Antivirus will detect this new Waledac variant with GAV signatures: Suspicious#waledac.5 (Worm), Waledac.AG (Worm), Waledac.I_2 (Trojan) .

Here are some screenshots of the attack websites.

SonicWALL UTM Research team observed a new interesting social engineering trick to install malware: hackers are using fake parking violation warnings to trick motorists into visiting malware-infested websites.

A windshield flier was left in cars with a website address linked to a malicious file. The fliers said:

  PARKING VIOLATION  This vehicle is in violation of  standard parking regulations.  To view pictures with information about  your parking preferences, go to  http://horribleparkxxxx.com/  

The website serves the malicious file to the user: http://horribleparkxxxx.com/PictureSearchToolbar.exe

This malware: PictureSearchToolbar.exe is detected by SonicWALL as GAV: AgentBypass_6 (Trojan).

It is a variant of Virtumonde / Vundo family of trojan horse that cause popups and advertises rogue antispyware programs. (aka Win32/Vundo.JI [Microsoft]). PictureSearchToolbar.exe is 56,832 bytes in size and when it runs it drops these files on the system:

• %Temp%awtrQGay.bat – 63 bytes
• %System%yayyXRKe.dll – 38,912 bytes

It injects yayyXRKe.dll in explorer.exe process.

It also creates the following registry entries:

• HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C}
• HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C}InprocServer32
• HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionControl PanelSettings
• HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyyayyXRKe
• HKEY_LOCAL_MACHINESOFTWAREMicrosoft0cd0861
• HKEY_CURRENT_USERSoftwareMicrosoftcs41275

It then attempts to download http://childxxxx.com/pas/apstpldr.dll.html?affid=177194&uid=&guid=16560F811C084DA3B8270F85F0661238 and save it as %System%awtrQGay.dll.

Downloaded malware: awtrQGay.dll is detected by SonicWALL as GAV: Monder_3 (Trojan), it is another variant of Virtumonde/Vundo trojan and attempts to install Fake Antivirus software from bestantispywaresecurityxxx.com

SonicWALL Gateway AntiVirus provides protection against this attack via GAV: Monder_3 (Trojan) and GAV: AgentBypass_6 (Trojan) signatures.

The following figures shows the recorded hits for GAV: Monder_3 (Trojan) signature.