Malicious PDFs On The Rise
Additional text and analysis by Kyle Wilhoit
Throughout 2012, we saw a wide variety of APT campaigns leverage an exploit in Microsoft Word (CVE-2012-0158). This represented a shift, as previously CVE-2010-3333 was the most commonly used Word vulnerability. While we continue to see CVE-2012-0158 in heavy use, we have noticed increasing use of an exploit for Adobe Reader (CVE-2013-0640) that was made infamous by the “MiniDuke” campaign. The malware dropped by these malicious PDFs is not associated with MiniDuke, but it is associated with ongoing APT campaigns.
One set of malicious PDFs we found that used this exploit contained decoy documents in Vietnamese; the file names were also in the same language.
Figure 1. Sample decoy document
The dropped files and data are also similar. Both campaigns drop the same number of files, with very similar file names, with similar purposes. Even the registry modifications are not too dissimilar.
However, that is where the similarities end. The payload dropped by these PDFs is known as Zegost (or HTTPTunnel) and has been spotted in previous attacks. This has no connection with the MiniDuke malware payload.) The Zegost malware has a distinct beacon:
GET /cgi/online.asp?hostname=[COMPUTERNAME]&httptype=[not%20httptunnel] HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)
The command and control server, dns.yimg.ca, resolves to 22.214.171.124 which has been used by the more well known command and control servers like imm.conimes.com and iyy.conimes.com. The email addresses used to register this domain, email@example.com, has also been used to register scvhosts.com – another known C&C server – and updata-microsoft.com, which is probably also a threat.
The second set of malicious PDFs are not necessarily directly related to one another, although they all drop different PlugX variants. The targets of the attacks we analyzed appear to have been sent to targets in Japan, South Korea, and India.
However, although these attacks also exploit CVE-2013-0640, they are different from the samples discussed above. When comparing the files, one can see the differences, such as the PDF version being used:
|PDF Header: %PDF-1.4||PDF Header: %PDF-1.4||PDF Header: %PDF-1.7|
|obj 8||obj 8||obj 43|
|endobj 8||endobj 8||endobj 44|
|stream 3||stream 1||stream 10|
|endstream 3||endstream 2||endstream 11|
|xref 1||xref 1||xref 4|
|trailer 1||trailer 1||trailer 4|
|startxref 1||startxref 1||startxref 4|
|/Page 1||/Page 1||/Page 6|
|/Encrypt 0||/Encrypt 1||/Encrypt 0|
|/ObjStm 0||/ObjStm 0||/ObjStm 0|
|/AA 0||/AA 0||/AA 0|
|/OpenAction 1||/OpenAction 1||/OpenAction 1|
|/AcroForm 1||/AcroForm 1||/AcroForm 1|
|/JBIG2Decode 0||/JBIG2Decode 0||/JBIG2Decode 0|
|/RichMedia 0||/RichMedia 0||/RichMedia 0|
|/Launch 0||/Launch 0||/Launch 0|
|/EmbeddedFile 0||/EmbeddedFile 0||/EmbeddedFile 0|
|/XFA 1||/XFA 1||/XFA 1|
|/Colors > 2^24 0||/Colors > 2^24 0||/Colors > 2^24 0|
PlugX also drops files and data, but these are not similar to those Zegost or MiniDuke. Different numbers of files, for different reasons, are dropped.
|A9RD50B.tmp (PDF)||A9RE077.tmp (PDF)||SharedDataEvents|
|A9RD50A.tmp (PDF)||A9RE078.tmp (PDF)||SharedDataEvents-journal|
The first set of PlugX variants leverages the Microsoft HTML Help Compiler as described in this blog post. We have been able to detect this variant used in a targeted attack. In this case, the attackers sent an email to the intended target enticing them to open the malicious attachments.
The samples we analyzed dropped files in a directory named hhx and uses hhc.exe, which is a legitimate Microsoft file, to load hha.dll, which then loads hha.dll.bak. The command and control servers used by the files we analyzed included 126.96.36.199.
The second set of PlugX variants we analyzed dropped files in a directory named PDH and leveraged a signed QQ Browser Update Service file to load PDH.dll, and then PDH.pak.
Figure 3. Signed file
These files used dnsport.chatnook.com, inter.so-webmail.com, and 188.8.131.52 as their command-and-control servers.
Our research indicates that attackers engaged in APT campaigns may have adapted the exploit made infamous by the MiniDuke campaign and have incorporated it into their arsenal. At the same time, we have found that other APT campaigns seem to have developed their own methods to exploit the same vulnerability. The increase in malicious PDF’s exploiting CVE-2013-0640 may indicate the start of shift in APT attacker behavior away from using malicious Word documents that exploit the now quite old CVE-2012-0158.
We’re trying to make the Security Intelligence Blog better. Please take this survey to tell us how.