Exploit.JS.Pdfka.efl

Technical Details
Payload
Removal instructions

Technical Details

An exploit that uses the vulnerabilities in Adobe – Reader and Acrobat products for its implementation on the user's computer. The file is an XFA (XML Forms Architecture) containing malicious Java Script. 48016 bytes.

Payload

The malicious XFA form content is initialized and launched after opening a specially created infected PDF document containing this form. As the "initialize" event handler in the XFA form, it uses obfuscated malicious Java Script. After removing the obfuscation, the trojan uses the vulnerability which arises on account of over-filling the buffer when incorrectly processing arguments in "libtiff.dll" (CVE-2010-0188) to download the file located at the following link:

http://qh***kbqfds.com/d.php?f=26&e=6

The trojan then saves the file in the current user's temporary file directory under the following name:

%Temp%\file.dll

After successfully saving the file, the trojan uses the command line to try and run the malicious library:

regsvr32 –s %Temp%\file.dll

The link did not work when creating the description. Vulnerable products include Adobe Reader and Acrobat 8 (up to version 8.2.1) and 9 (up to version 9.3.1).

Removal instructions

If your computer has not been protected with anti-virus software and has been infected with malware, you will need to take the following actions to delete this:

1. Delete the original exploit file (its location on the infected computer will depend on how the program got onto the computer).
2. Delete the following file:

   %Temp%\file.dll
   

3. Update Adobe Reader and Acrobat or install updates:
   http://www.adobe.com/support/security/bulletins/apsb10-07.html
4. Run a full Kaspersky Antivirus scan of the computer with updated antivirus databases (download trial version).

MD5: 890b7b95360097e7aeffe11baa02bafa SHA1: 7c2ce30fb474111da909d2c712ca717e01d69b2d