Exploit.JS.Pdfka.dcm

Technical Details
Payload
Removal instructions

Technical Details

This exploit program uses vulnerabilities in Adobe Reader and Acrobat to execute itself on the user's computer. It is a PDF document containing Java Script. It is 5195 bytes in size.

Payload

The malicious PDF document contains a compressed data stream which unpacks when the document is opened and consists of obfuscated Java Script. After executing the decrypted script, the exploit determines which version of the Adobe product is installed on the system, as well as determining the version of the Adobe Acrobat Escript plug-in. Next, depending on the version, it exploits this product's vulnerability. Versions 6, 7, and 8 of the Adobe Reader and Acrobat products are vulnerable, as are versions 7.1, 7.11, 8.12, 8.13, 8.17, 9, 9.1, and 9.2 of the "EScript" plug-in.

The exploit uses vulnerabilities that occur when processing the method Doc.media.newPlayer (CVE-2009-4324), and when calling up the functions Collab.collectEmailInfo() (CVE-2007-5659), Collab.GetIcon() (CVE-2009-0927), and util.printf() (CVE-2008-2992).

Depending on the vulnerability used, the malware downloads a file located at one of the following links:

http://de***o.cc/nnakdw/forum.php?f=PDF (GetIcon)
&key=9b562fa34ce9c8505cbeab290c0c9f46&u=root
http://de***o.cc/nnakdw/forum.php?f=PDF(newPlayer)
&key=9b562fa34ce9c8505cbeab290c0c9f46&u=root
http://de***o.cc/nnakdw/forum.php?f=PDF (printf)
&key=9b562fa34ce9c8505cbeab290c0c9f46&u=root
http://de***o.cc/nnakdw/forum.php?f=PDF(Collab)
&key=9b562fa34ce9c8505cbeab290c0c9f46&u=root

The downloaded file is saved in the current user's temporary files directory under the name:

%Temp%\a.exe

The malware then launches the downloaded file for execution. At the time of writing, these links were inactive.

Removal instructions

If your computer does not have an antivirus, and is infected by this malicious program, follow the instructions below to delete it:

1. Delete the original exploit file (its location will depend on how the program originally penetrated the infected computer).
2. Install these updates:
   http://www.adobe.com/support/security/bulletins/apsb09-04.html
   http://www.adobe.com/support/security/bulletins/apsb09-06.html
   http://www.adobe.com/support/security/bulletins/apsb08-13.html
   http://www.adobe.com/support/security/advisories/apsa09-07.html
3. Delete the following file:

   %Temp%\a.exe

4. Perform a full scan of the computer using Kaspersky Anti-Virus with up-to-date antivirus databases (download a trial version).