We recently reported on an unusual attack involving exploit kits and file infectors. What makes the attack even more notable is that the file infectors used also have information theft routines, a behavior uncommon among file infectors. These file infectors are part of the PE_EXPIRO family, which was first spotted in 2010. It’s possible that this specific attack was intended to steal information from organizations or to compromise websites.
Further analysis shows that the attack used Styx as its exploit kit. Styx has gotten much press over its role in delivering malware onto systems. The use of Styx in this particular attack may be due to differences between Styx and other exploit kits, namely:
- Multiple Exploit Pages – Styx distributes the malicious script in multiple pages, which are connected by HTTP redirecting
The initial report mentioned several vulnerabilities exploited by this attack. Continuous analysis showed that TROJ_PIDIEF.XJM used an old vulnerability, CVE-2010-0188, which affects specific versions of Adobe Reader and Acrobat. The use of an old vulnerability and the enhancement of the PE_EXPIRO malware is further proof that older, though more refined, threats are still present in today’s landscape.
Regularly updating systems can help prevent infections from attacks such as these. Trend Micro blocks all related URLs in this attack. Trend Micro Deep Security blocks the associated Java files using the following rules:
- 1005598 – Identified Malicious Java JAR Files – 3
- 1005599 – Identified Malicious PDF Document – 10
- 1005410 – Oracle Java Runtime Environment Remote Code Execution Vulnerability (CVE-2013-1493)
Additional analysis by Kai Yu, Mark Tang, Michael Du, Pavithra Hanchagaiah, and Manoj Subramanya