–Updated March 5, 2009—

SonicWALL UTM Research team saw two separate waves of Delta Arline spammed Trojan campaign with different attachment payloads between March 2, 2009 and March 5, 2009.

SonicWALL Gateway Antivirus provided proactive protection against these new waves via GAV: Delf.KD (Trojan) signature that was released on Feb 26, 2009. Total Signature hits recorded till now – 137,480 hits (Signature statistics image below)

————————————————

–Original publish date: February 26, 2009—

SonicWALL UTM Research team observed a new spam campaign starting today, February 26, 2009 which involves a fake e-mail pretending to be arriving from Delta Airlines and containing passenger itinerary receipt. The email has a zip archived attachment which contains the new Trojan executable.

SonicWALL has received more than 1,000 e-mail copies of this malware so far. The e-mail message contains:

Attachment: delta_RQ763.zip (contains delta_RQ763.exe)

Subject:

• Confirmation of airline ticket purchase at www.delta.com

Email Body:
————————
Thanks for the purchase!

Booking number: (random alpha-numeric string)

You will find attached to this letter PASSENGER ITINERARY RECEIPT of your electronic ticket. It verifies that you paid the ticket in full and confirms your right for air travel and luggage transportation by the indicated flight Delta Air Lines.

On board you will be offered: – beverages; – food; – daily press.

You are guaranteed top-quality services and attention on the part of our benevolent personnel.

We recommend you to print PASSENGER ITINERARY RECEIPT and take it alone to the airport. It will help you to pass control and registration procedures faster.

See you on board! Best regards,

Delta Air Lines
————————

A sample of spammed e-mail message looks like this:

The executable file inside the zip attachment has an icon disguised as a Microsoft Excel file and it looks like following:

The Trojan when executed creates following files:

• (SYSTEM-DIR)twain32local.ds
• (SYSTEM-DIR)twain32user.ds
• (SYSTEM-DIR)twain32user.ds.lll
• (SYSTEM-DIR)twex.exe

It modifies the following Registry key to ensure that Trojan runs every time the system restarts:

• HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWinlogonUserinit: “C:WINDOWSsystem32userinit.exe,C:WINDOWSsystem32twex.exe,”

It also tries to connect and download a file from the following URL:

• hxxp://91.211.65.33/ejik/admin.bin (<- Encrypted configuration data file)

The Trojan has very low detection at the time of writing this alert. It is also known as trojan W32/Trojan2.FXRO [F-Prot] and Trojan-Dropper.Delf [Ikarus].

SonicWALL Gateway Antivirus provides protection against this malware via GAV: Delf.KD (Trojan) signature.

Adobe products are used for creating, distributing, authoring and viewing Portable Document Format (PDF) documents. The Adobe Reader and Adobe Acrobat are examples of such products. The PDF file format was created and is controlled by Adobe. The format allows for representation of text, images and graphics in a single document.

Binary data, such as images are represented in a PDF document by stream objects. A stream is represented by a series of bytes enclosed in the stream and endstream keywords. An example of a stream in a PDF file is shown:

 stream 0099009900990099 endstream 

A stream will generally be preceded by a definition describing its properties amongst which will be the filter which is to be used to interpret the respective stream. For example, an image compressed by the JBIG2 compression standard may look as follows:

 << /Type /XObject /Subtype /Image /Length 100 /Filter [ /ASCIIHexDecode /JBIG2Decode ] >>  stream 1847509384750293847593847594837495874939203948405 8459484379857032975402398650432986502398538754934 endstream 

The JBIG2 bit stream consists of segments, with each segment containing a header followed by data. The format of a JBIG2 segment header is of variable length based on the values contained therein. In certain specific situations, the Adobe application will use a supplied value in the header as an index into an array of pages without checking the value for validity first. The application will then attempt to write into the array using this index. The affected field which is controlled by the PDF author, can be manipulated to overwrite any location within a 32-bit address space. This gives a malicious user the capability to corrupt memory of the affected process, thereby potentially diverting the process flow.

In order to exploit this vulnerability, the target user must be enticed to open a malicious PDF document. Successful exploitation may allow arbitrary code injection and execution with the privileges of the currently logged in user. As of the writing of this report, the vulnerability is being exploited in the wild.

SonicWALL has released three IPS signatures to detect and block specific exploit attempts. The following signatures have been released to address this vulnerability:

• 5401 – Adobe Multiple Products Embedded JBIG2 Stream BO PoC 1
• 5402 – Adobe Multiple Products Embedded JBIG2 Stream BO PoC 2
• 5403 – Adobe Multiple Products Embedded JBIG2 Stream BO PoC 3

This week, SonicWALL UTM Research team observed new variants of Waledac worm spreading in the wild and using Valentine’s theme. They send fake e-greeting card emails with a link to view an e-card to potential victims.

The websites used in this attack include:

• adorelyricxx.com
• adorepoemxx.com
• adoresongxx.com
• cherishletterxx.com
• funloveonlinexx.com
• goodnewsreviewxx.com
• greatvalentinepoemsxx.com
• orldlovelifexx.com
• reportradioxx.com
• spacemynewsxx.com
• yourgreatlovexx.com

These domains resolve to different IP addresses every time they are visited. The filenames are also rotated. Some of the filenames used in this wave are:

• Card.exe
• cardviewer.exe
• devkit.exe
• download.exe
• ecard.exe
• install.exe
• kit.exe
• lovecard.exe
• lovekit.exe
• loveprogramm.exe
• Loveu.exe
• Luv.exe
• Programm.exe
• vcard.exe
• viewer.exe
• valkit.exe

When executed this Waledac variant is almost identical in its behavior to the previous variant.

The malware has very low AV detection at the time of writing this Security Alert. SonicWALL Gateway Antivirus will detect this new Waledac variant with GAV signatures: Suspicious#waledac.5 (Worm), Waledac.AG (Worm), Waledac.I_2 (Trojan) .

Here are some screenshots of the attack websites.

SonicWALL UTM Research team observed a new interesting social engineering trick to install malware: hackers are using fake parking violation warnings to trick motorists into visiting malware-infested websites.

A windshield flier was left in cars with a website address linked to a malicious file. The fliers said:

  PARKING VIOLATION  This vehicle is in violation of  standard parking regulations.  To view pictures with information about  your parking preferences, go to  http://horribleparkxxxx.com/  

The website serves the malicious file to the user: http://horribleparkxxxx.com/PictureSearchToolbar.exe

This malware: PictureSearchToolbar.exe is detected by SonicWALL as GAV: AgentBypass_6 (Trojan).

It is a variant of Virtumonde / Vundo family of trojan horse that cause popups and advertises rogue antispyware programs. (aka Win32/Vundo.JI [Microsoft]). PictureSearchToolbar.exe is 56,832 bytes in size and when it runs it drops these files on the system:

• %Temp%awtrQGay.bat – 63 bytes
• %System%yayyXRKe.dll – 38,912 bytes

It injects yayyXRKe.dll in explorer.exe process.

It also creates the following registry entries:

• HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C}
• HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C}InprocServer32
• HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionControl PanelSettings
• HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyyayyXRKe
• HKEY_LOCAL_MACHINESOFTWAREMicrosoft0cd0861
• HKEY_CURRENT_USERSoftwareMicrosoftcs41275

It then attempts to download http://childxxxx.com/pas/apstpldr.dll.html?affid=177194&uid=&guid=16560F811C084DA3B8270F85F0661238 and save it as %System%awtrQGay.dll.

Downloaded malware: awtrQGay.dll is detected by SonicWALL as GAV: Monder_3 (Trojan), it is another variant of Virtumonde/Vundo trojan and attempts to install Fake Antivirus software from bestantispywaresecurityxxx.com

SonicWALL Gateway AntiVirus provides protection against this attack via GAV: Monder_3 (Trojan) and GAV: AgentBypass_6 (Trojan) signatures.

The following figures shows the recorded hits for GAV: Monder_3 (Trojan) signature.