A short while ago, we came across a set of similar SWF exploits and were unable to determine which vulnerability they exploited.

We reported this to Adobe and it turned out that these ITW exploits targeted a 0-day vulnerability. Today, Adobe released a patch for the vulnerability.

This post provides a technical analysis of the exploits and payload that we discovered.

All in all, we discovered a total of 11 exploits, which work on the following versions of Adobe Flash Player:

11.3.372.94

11.3.375.10

11.3.376.12

11.3.377.15

11.3.378.5

11.3.379.14

11.6.602.167

11.6.602.180

11.7.700.169

11.7.700.202

11.7.700.224

All of the exploits exploit the same vulnerability and all are unpacked SWF files. All have identical actionscript code, which performs an operating system version check. The exploits only work under the following Windows versions: XP, Vista, 2003 R2, 2003, 7, 7×64, 2008 R2, 2008, 8, 8×64. Some of the samples also have a check in place which makes the exploits terminate under Windows 8.1 and 8.1 x64.

If the OS version check is successful, control is passed to functions which assemble ROP chains depending on the Flash Player version. Curiously, there are two such functions – one for Windows 8 / 8×64 and the other for all other versions of Windows.

Next, a shellcode specific to the version of Windows used is generated and the vulnerability is exploited.

We discovered three types of shellcode. The first is a primitive shellcode that reads an executable named a.exe from an SWF file and drops it to the hard drive. Only one of the 11 exploits in our possession (all detected by Kaspersky Lab products as HEUR:Exploit.SWF.Agent.gen) included a payload, but this is discussed below.

The second type downloads and executes a file from a URL passed in the SWF file’s parameters. Unfortunately, since we do not have the containers that can pass parameters (html/docx), we were unable to check what is downloaded and from where.

The third shellcode type, which is only present in some of the files, is the most interesting. Its main purpose is to use MessageBox to display a dialog window with the following strings:

“Oops – what happened ?X ”

“You have been owned by CorelanX ”

As for the SWF files, we found out with the help of KSN that they were embedded into .docx documents with the following Korean names:

A machine-generated translation of these names reads as follows: “List of the latest Japanese AV wind and how to use torrents.docx”.

We discovered that these exploits had been detected on three different user machines, one of which worked under Mac OS 10.6.8 and the other two under Windows 7. On the Mac user’s machine, the exploits were detected in an email attachment. On the Windows 7 machines, they were in a browser cache, but this does not mean the files were not loaded from an email attachment, since Outlook can call Internet Explorer components to open files. Judging by the IP addresses, all these users are located in China. The browser used was SogouExplorer, which originates from China, and the mailbox was hosted on 163.com. All of this may be an indication that the .docx document with the 0-day exploit was distributed via a targeted email mailing.

As for the payload, only one exploit included an executable file. The file is a primitive downloader which downloads several files encrypted using Microsoft CryptoAPI from a level 3 domain (thirdbase.bugs3.com) of the free hosting service bugs3.com. The downloader (detected by Kaspersky Lab products as Trojan-Downloader.Win32.Agent.hdzh) is, as mentioned above, primitive; it includes a string linking to a local pdb file on the developer’s computer –

“d:.Work.Coding.WorkspacedownLoaderReleasedLoad.pdb” –

and uses a simple string decryption algorithm:

We managed to obtain two executables out of (presumably) three from the server mentioned above. The first file (detected as Trojan-Spy.Win32.Agent.cjuj) steals mailbox passwords from a variety of programs (Foxmail, OperaMail, Opera, Mozilla Firefox, Safari, IncrediMail, Pidgin, Thunderbird etc.) and steals data from forms on the following login pages:

http://twitter.com

http://facebook.com

http://passport.yandex.ru/passport

http://www.yandex.ru

http://qip.ru

http://mail.qip.ru

https://login.nifty.com/service/login

http://e.mail.ru/cgi-bin/login

http://mail.ru

http://mail.126.com

http://secure.zapak.com/mail/zapakmail.php

https://lavabit.com/apps/webmail/src/login.php

http://www.bigstring.com

http://www.gmx.com

http://passport.sohu.com/indexaction.action

http://www.sohu.com

https://www.zoho.com/login.html

http://mail.sina.com.cn

http://members.sina.com/index.php

http://www.care2.com/passport/login.html

http://www.mail.com/int

https://fastmail.fm/mail

https://www.inbox.com/login.aspx

http://www.gawab.com

http://mail.163.com

http://registration.lycos.com/login.php

http://www.mail.lycos.com

https://my.screenname.aol.com/_cqr/login/login.psp

https://edit.bjs.yahoo.com/config/login

https://login.yahoo.co.jp/config/login

https://login.yahoo.com/config/login_verify2

https://login.live.com/login.srf

https://www.google.com/accounts/servicelogin

The second file, a backdoor detected as Backdoor.Win32.Agent.dfdq, works in conjunction with the first. We discovered that it uses C&C servers located at the following addresses:

sales.eu5.org

www.mobilitysvc.com

javaupdate.flashserv.net



In the process of analyzing the bot, we managed to receive a JPEG file with a .dll embedded in it from several servers. If the file is opened in a standard viewer, you will see an image of a heart:

However, in reality, a dynamic library named kboc.dll (detected as Backdoor.Win32.Agent.dfdr) is extracted from the JPEG and injected into the svchost.exe process. The library communicates to the C&C; however, we have not been able to obtain any additional files. We are continuing to follow the bot’s activity.

P.S. Kudos to my colleagues Alexander Polyakov and Anton Ivanov for discovering the 0-day vulnerability.