Exploit:JS/Pdfka.TI

Classification

Category :

Malware

Type :

Exploit

Aliases :

Exploit.js.pdfka.ti

Summary

Exploit:JS/Pdfka.TI is an exploit that can take advantage of two vulnerabilities in a single PDF file in order to download malicious binary files (usually Trojan-Downloader:W32/Bredolab variants) onto the system.

Removal

Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.

A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:

  • Check for the latest database updates

    First check if your F-Secure security program is using the latest updates, then try scanning the file again.

  • Submit a sample

    After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.

    Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.

  • Exclude a file from further scanning

    If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.

    Note: You need administrative rights to change the settings.

Technical Details

The vulnerabilities exploited are:

  • Collab.collectEmailInfo() JavaScript Overflow (CVE-2007-5659)
  • Util.printf() JavaScript Overflow (CVE-2008-2992).

Adobe Reader and Acrobat versions 8.1.2 and earlier are affected by the vulnerabilities exploited by this malware.

Activity

Once the vulnerabilities are exploited, binary files are downloaded from:

  • https://[...]/welcome.php?id=5[...]

The downloaded files are saved in the Temporary directory using the following filenames:

  • pdfupd.exe
  • crash.php

The files are then executed.