Eng
  1. Skip to navigation
  2. Skip to content
  3. Skip to sidebar


Exploit:JS/Pdfka.TI


Aliases:


Exploit.js.pdfka.ti

Malware
Exploit
JS

Summary

A program or technique that takes advantage of a vulnerability to remotely access or attack a program, computer or server.



Disinfection & Removal

Automatic Disinfection

Allow F-Secure Anti-Virus to disinfect the relevant files.

For more general information on disinfection, please see Removal Instructions.



Technical Details

Exploit:JS/Pdfka.TI is an exploit that can take advantage of two vulnerabilities in a single PDF file in order to download malicious binary files (usually Trojan-Downloader:W32/Bredolab variants) onto the system.

The vulnerabilities exploited are:

  • Collab.collectEmailInfo() JavaScript Overflow (CVE-2007-5659)
  • Util.printf() JavaScript Overflow (CVE-2008-2992).

Adobe Reader and Acrobat versions 8.1.2 and earlier are affected by the vulnerabilities exploited by this malware.


Activity

Once the vulnerabilities are exploited, binary files are downloaded from:

  • http://[...]/welcome.php?id=5[...]

The downloaded files are saved in the Temporary directory using the following filenames:

  • pdfupd.exe
  • crash.php

The files are then executed.







Submit a sample




Wondering if a file or URL is malicious? Submit a sample to our Lab for analysis via the Sample Analysis System (SAS)

Give And Get Advice




Give advice. Get advice. Share the knowledge on our free discussion forum.