CVE-2011-2140 Caught in the Wild
A Chinese website contains malvertisement that leads to a few exploits including the latest Flash exploit (CVE-2011-2140). Special thanks to Jason for the find and share!
Here’s the website that kicks things off:
This is the infection chain:
It’s quite long but the action starts at the “1.htm” file. The script loads up the appropriate iframe depending on your Flash or browser version.
One path leads to an IE browser exploit:
Shellcode contains a download and execute URL but you need to XOR it with the key of 0xBD first.
That file is a downloader which pulls down another executable from the same website. The second binary looks to be some kind of online game stealer.
VirusTotal: 21/42 (50.0%)
VirusTotal: 29/41 (70.7%)
Let’s check out the first of two Flash exploits:
The shellcode there pulls down the same binary from the URL as above. Here’s what VirusTotal has to say about the SWF file.
VirusTotal: 4/42 (9.5%)
The second Flash exploit is called upon as the last option (see “1.htm” file above under the “luck3()” function). The decompiled code looks like this:
It takes the contents of variables “_local6” and “_local7” then writes it to a binary file. That binary file is another SWF file. The decompiled code shows that it plays a file called “e.avi” after staging memory.
Here’s a hex view of that file.
I tried dumping the contents of the atoms using AtomicParsley, QTatomizer, and a couple of other tools but it’s not working.
Anyone got a good tool to decompile a Quicktime file? In the meantime, I’m going to try to look for the shellcode and carve it out since this presumably exploits Flash using the CVE-2011-2140 exploit and downloads another binary file called “qq.exe” which is an online game stealer.
Here’s the VirusTotal scan results for these files:
VirusTotal: 5/42 (11.9%)
VirusTotal: 17/42 (40.5%)
VirusTotal: 20/42 (47.6%)