Shiloh
Editor, Senior Moderator
Source: http://www.scmagazineuk.com/Malicio...eaflets-begin-to-be-delivered/article/136162/
Malicious H1N1 PDF file spreads password stealer as swine flu leaflets begin to be delivered
Dan Raywood
May 05, 2009
As the UK begins to receive leaflets giving advice on swine flu, spammers are not far behind with a malicious file.
A nationwide campaign on the H1N1 ?swine flu' virus has begun with leaflets giving information about swine flu and advice on how to prevent its spread being delivered to all households in the UK. Symantec has reported that an email with a PDF attachment that promises to answer all questions about the virus, contains a password stealer.
Symantec's Kevin Haley claimed that the attachment is named ?Swine influenza frequently asked questions.pdf' and is a real PDF file, and when opened will show a typical questions and answers layout, however by opening it the recipient is infected. Once the download has been completed a clean PDF is opened as a decoy,
Haley said: ?Symantec detects the malicious PDF file as Bloodhound.Exploit.6 and the dropped malicious file contained in the PDF as InfoStealer. There is an Adobe patch for this known vulnerability, Adobe Acrobat and Reader PDF File Handling JBIG2 Image Remote Code Execution Vulnerability (BID 33751).
?If you haven't already, it's time to start following best practices and download the Adobe patch for your version of Acrobat and Adobe Reader. Protect yourselves and your computer from the human swine that prey on our desire for information to keep us healthy. Be very careful when such email includes attachments, links to websites, or videos that it says you should view.?
Meanwhile F-Secure has revealed that a total of 1,344 domains have now been registered using the words ?swine flu', although at the last check none of the domains are hosting any malicious files.
Malicious H1N1 PDF file spreads password stealer as swine flu leaflets begin to be delivered
Dan Raywood
May 05, 2009
As the UK begins to receive leaflets giving advice on swine flu, spammers are not far behind with a malicious file.
A nationwide campaign on the H1N1 ?swine flu' virus has begun with leaflets giving information about swine flu and advice on how to prevent its spread being delivered to all households in the UK. Symantec has reported that an email with a PDF attachment that promises to answer all questions about the virus, contains a password stealer.
Symantec's Kevin Haley claimed that the attachment is named ?Swine influenza frequently asked questions.pdf' and is a real PDF file, and when opened will show a typical questions and answers layout, however by opening it the recipient is infected. Once the download has been completed a clean PDF is opened as a decoy,
Haley said: ?Symantec detects the malicious PDF file as Bloodhound.Exploit.6 and the dropped malicious file contained in the PDF as InfoStealer. There is an Adobe patch for this known vulnerability, Adobe Acrobat and Reader PDF File Handling JBIG2 Image Remote Code Execution Vulnerability (BID 33751).
?If you haven't already, it's time to start following best practices and download the Adobe patch for your version of Acrobat and Adobe Reader. Protect yourselves and your computer from the human swine that prey on our desire for information to keep us healthy. Be very careful when such email includes attachments, links to websites, or videos that it says you should view.?
Meanwhile F-Secure has revealed that a total of 1,344 domains have now been registered using the words ?swine flu', although at the last check none of the domains are hosting any malicious files.