Just a day before Patch Tuesday, when Microsoft is going to release couple of patches for DirectShow vulnerabilities including MSVIDCTRL 0-day , IE (Internet Explorer) users are hit by another surprise. A new 0-day vulnerability has been identified in MS office web component and is currently being exploited via the IE scripting interface. There is no patch available at the moment but MS has come up with a workaround.
One of the malicious URL which has been found to exploit this vulnerability is hxxp://www.fdsdffdfsf.cn/of.htm.
Here is what the exploit page looks like:
where a.js looks like this:
If successfully exploited, the above shell code fetches a malware binary from hxxp://www.fdasfadf.cn/new.exe
Let's see what the actual payload i.e new.exe is all about.
Here is VirtusTotal report for new.exe
Upon execution this malware produces outbound communication like this:
GET /hao.txt HTTP/1.1
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0.98765W; Windows NT 5.1; SV1)
HTTP/1.1 200 OK
Last-Modified: Mon, 13 Jul 2009 02:23:59 GMT
Date: Tue, 14 Jul 2009 02:19:23 GMT
This communication might look familiar to those who got a chance to read my earlier article (Who is Exploiting the Windows 0-day (MSVIDCTL.DLL) ?) which was about a malware who was seen to exploit MSVIDCTRL 0-day. Yes 'new.exe' is the malware variant which belongs to the same family.
ThreatExpert report for new.exe
ThreatExpert report for the malware found to be exploited MSVIDCTRL last week.
The only difference between these two variants is a slightly modified binary and network footprint to evade conventional AVs and IDS signatures. I am not surprised at all that both of these 0-days are being exploited by same malware group. In past we have seen several cases where some of the world's top botnets were found to be controlled by closely linked cyber criminals.
Those who want to recollect might refer to these archived articles:
Atif Mushtaq @ FireEye Malware Intelligence Lab
Question/Comments : research SHIFT-2 fireeye DOT COM