February 23, 2009, 7:34 am
Pidief-Shellcode with a Twist
While analysing the latest malicious PDF exploit documents, we found the embedded shellcode to have some interesting features.
The shellcode gets executed once the exploit was successful.
The server the shellcode connects to sits in China.
The payload of the PDF is contacting a server in China - so farnothing uncommon here. The connected system belongs to the network ofthe cinese CHINA RAILWAY TELECOMMUNICATIONS CENTER. Very unusual thoughis the port which gets used for communicating with the command andcontrol server - it’s port 220, which should be used by the IMAPv3protocol. The protocol used seems to be proprietary and zlib compressed.
An unusual port gets used for communication with the command and control server.
There it downloads further malware. Among the malware we have seenis for example BDS/Agent.adsi, a Backdoor. It gets installed in thewindows system directory.
As long as Adobe is working on the patch for this securityvulnerability, make sure to disable JavaScript support in Adobe Readerand in Acrobat; also use an up-to-date antivirus software like AviraAntiVir. Avira AntiVir detects the known malicious PDF files and thedownloaded malware. We plan to release a heuristics update today whichwill detect even more malicious PDF files, also yet unknown ones.
Dirk Knop
Technical Editor
在分析最近的利用PDF漏洞的可疑文档是，我们发现嵌入式shellcode有一些有趣的特征。这shellcode在利用
漏洞成功后立即执行。shellcode连接的服务器位于中国。
负载PDF连接的服务器在中国-到这里为止没有什么不寻常的。连接的系统属于中国铁路电讯中心网络。更不寻
常的是虽然是获取用于通信及指挥及控制服务器端口-端口220，应该是用于IMAPv3 协议。该协议似乎是专有
的并且被zlib压缩。
一个不寻常的端口获取用于与指挥及控制服务器的通信。
进一步它下载恶意软件。我们看到这个恶意软件是例如BDS/Agent.adsi，一个后门程序。它安装在 Windows
系统目录。
在adobe修补这个安全漏洞的期间，请务必在Adobe Reader 和 Acrobat禁用JavaScript支持；也请使用实时
更新的反病毒软件，比如小红伞。小红伞能检测已知的恶意PDF文件和下载的恶意软件。今天我们打算发布一
个试探性更新方法用于检测更多的恶意PDF文件，包括未知的.
PS:纯手工翻译，若有错误，感谢指出
[ 本帖最后由 asinasina 于 2009-2-24 09:40 编辑 ] | 
发表于 2009-2-24 09:09:22
楼主
教育网被黑的更严重
lz翻译辛苦了
