12345

12/20/2011

[Warning] Kim Jong Il Malicious scam is spreading(Update #3)

1. Introduction

The news of the death of North Korean leader Kim Jong Il was big issue on December 17.
According to this news, various related news and spreading malicious file with social engineering can be happened.
With this reason, INCA Internet's Emergency Response Team has been being concentrated on monitoring.
Various types of malicious file including a Korean entertainer's porn, the death of Steve Jobs, the death of Gadaffi, and so on.





[Caution]Malicious file is spreading via a Korean entertainer's porn video file.

http://en-erteam.nprotect.com/2011/12/cautionmalicious-file-is-spreading-via.html

Because social engineering, a classic technique, uses social issue to spreading malicious file, users need to be careful on using internet.

2. Real cases

INCA Internet's Emergency Response Team found the scam for AD with his remains and fortify our detecting level.

Following figure is a capture of blog. The title was "Body analysis of Kim Jong-il" and uploaded attached pics and video files.

However, this video file is NOT REAL. It was just a jpg file and has link to certain URL. This way is very simple but it can be clicked easily.


Following figure is a one of YouTube pages, someone posted reply and user can click that link.
Various videos have been found so far.


To click the link, URL will be redirected to certain page, which leads user to install certain program for playing video file.



To click start, you can download ClickPotato.


Not only this AD, malicious e-mail including malicious file has been found.

Title :
N Korean leader Kim Jong-il dies

Body :
[CNN]North Korean leader Kim Jong-il has died of a heart attack at the age of 69, state media have announced.

Attachment :
brief_introduction_of_kim-jong-il.pdf.pdf

2 types of file names have been found. One contains vulnerability in PDF and another contains vulnerability in RTF. We sent both samples to KISA(Korea Information Security Agency) and have cooperated for cybercrime.

Vulnerability in PDF used Win32.CVE-2010-2883, CVE-2011-0611 exploit; therefore, Adobe Reader can be safe with update latest security path.

DOC file structure is same as real RTF file, and it used RTF Stack Buffer Overflow (CVE-2010-3333) exploit.

Brief introduction of Kim Jong-il.pdf
Kim Jong-ils death affects N. Koreas nuclear programs.doc


Following figure is executed malicious PDF file. But it looks like real one.



When vulnerability of PDF document works, it will secretly download and execute malicious and normal PDF files disguised as a Google update related file on User's Local Settings folder.



fabc.scr and abc.scr are different within 5 bytes.
Adding Hex values(4D, 5A, 20, 0D, 0A) on fabc.scr will be abc.src, and log1.txt has the difference.





abc.src will be removed after it creates another malicious file and GoogleUpdate.exe on same folder.

C:\Documents and Settings\(User name)\Local Settings\Application Data\GoogleUpdate.exe



This malicious file is trying to access certain host and it can perform malicious behavior with attacker's command.


INCA Internet's Emergency Response Team collected these malicious file and update is completed.


3. Finishing

Inducing users to click URL or fake video file image is a usual technique of social enginnering. To use PC safely from security threats of these malicious attachments, we recommend you download latest security updates and obey following "Security management tips" for general users.

Security management tips

1. Maintain the latest security update on OS and applications
2. Use anti-virus SW from believable security company and keep updating the latest engine and using real time detecting function
3. Do not see and download attached file from suspicious e-mail.
4. Keep caution to link from instant messenger and SNS.
5. Execute downloaded file after scan with anti-virus SW.

INCA Internet (Security Response Center / Emergency Response Team) provides diagnosis/treatment function with “nProtect Anti-Virus/Spyware” for detecting such as malicious file stated above and runs responding system against various security threats.

73 comments:

  1. Stuck on writing an expository essay? Can't pick a topic? Take a look at some great expository essay topics here, guys!

    ReplyDelete
  2. INCA Internet's Emergency Response Team collected these malicious file and update is completed....

    ReplyDelete
  3. This is also a very good post which I really enjoyed reading. It is not everyday that I have the possibility to see something like this.

    go movies

    ReplyDelete
  4. I finally found great post here.I will get back here. I just added your blog to my bookmark sites. thanks run 3

    ReplyDelete
  5. I understand what you bring it very meaningful and useful, thanks.
    five nights at freddy's

    ReplyDelete
  6. Thanks for the information you shared
    @ashleyjordae

    ReplyDelete
  7. Thank you very much for these great cake recipes, I have learned a lot from your web blog

    ReplyDelete
  8. Thank for your writting. You have made it very clear that the problem is happening. I really like your way of thinking

    ReplyDelete
  9. Your thoughts are very deep, I feel it has many meanings and humanities
    read manga online

    ReplyDelete
  10. The experts of Myassignmenthelp Australia are not only proficient in writing the analysis assignments, but they are also comfortable with other genres of assignment writing.
    Students always come to us and ask to do my assignment for me. For all sorts of assignment help services, our experts are capable enough to do your assignment online. Students will always get plagiarism-free papers from this service. All these utilities are available at reasonable prices.
    Essayassignmenthelp.com.au also provides urgent assignment help service to the students through which the students can get assignments within a few hours from placement of the order. This service is especially useful when the students are required to get their essays done immediately.

    ReplyDelete
  11. Our team is continue working for the students to give them best service online, we are offering top service of thesis topics ideas so students can get it from the studentsassignmenthelp. We are every day working to give our services that's we are having best writer, our experts are continue working 24x7. So students can easily take all the services always.

    ReplyDelete
  12. Thank you for sharing this. The blog is very informative. We also provide affordable Accounting Assignment Help in uk.

    ReplyDelete
  13. Good source of information! Your post shares all information of the Assignment Help in a detailed manner. If you want to place your order for assignment completion, browse the website greatassignmenthelp to connect with the highly experienced writers.
    Assignment Help Online
    Online Assignment Help
    Assignment Help Online Services
    Assignment Helper
    Assignment Assistance
    Assignment Help Experts
    Online Assignment Help Services

    ReplyDelete
  14. Nice Post! When you are facing technical errors related to Quicken, our technical experts are technically experienced for solving common quicken problems in very nominal charges. We are technically known for solving all technical issues related to Quicken. Our Quicken Help is open 24 hours to provide instant solutions for any difficulty.
    Quicken Customer Service
    Quicken Customer Service Phone Number
    Quicken Customer Service Number
    Quicken Customer Support Number
    Quicken Customer Support Phone Number
    Quicken Customer Support
    quicken.com/support
    www.quicken.com/support
    Quicken support Phone number
    Quicken Support Number
    Quicken support
    Quicken Error CC-501
    Quicken Error CC-502
    quicken error cc-503
    Quicken won't open
    quicken won't open after update

    ReplyDelete
  15. Very nice!!! This is really good blog information thanks for sharing. We are a reliable third party Quickbooks software company, offering technical support for various types of technical errors.

    ReplyDelete
  16. Thanks for your insight for your fantastic posting. I’m glad I have taken the time to see this
    red ball 4

    ReplyDelete
  17. “Avail the assistance from our experts to eradicate Canon error code 5b00”
    To Resolve Canon Printer Error Code 5b00 is not such a difficult task for you if you come across an error, and particularly when the continuous ink systems are being installed all the time. These tend to push the printers to their very limits. The error encounters on the canon printers when the inkpad absorber has filled up with the ink. If you are also dealing with the same issue with your Canon printer, follow some given steps. First of all, turn off your printer, then hold the “Resume” button subsequent by holding the power button. Now, release the Resume and Power button. After that, Reset Counter Absorber and at last switch on your printer. If these steps won’t satisfy you, go for Canon Support to eradicate Canon error code 5b00. Dial our toll-free number and take assistance from our experts.
    Canon error code 5b00
    Canon B200 Error
    Canon Wireless Printer Setup
    Connect Canon Printer To Wi-Fi
    Canon printer offline

    ReplyDelete
  18. Hi, I am anyageorge as an Office tech support executive well praised among the customer to help them in resolving their queries related to office setup. As problem or queries can turn up at anytime so you should be ready for it, just visit office.com/setup and download the latest office setup. While doing so if you come across any difficulty then you can make connection with me.

    www.office.com/setup

    ReplyDelete
  19. With an aim to get excellent quality prints, I bring HP Printer into play and in my office. And you won’t believe I got the outstanding results from my HP printer. Truly HP printers are the value for money devices. But, from last weekend I started to face quite a lot of nasty errors while printing with my HP printer. Therefore, I am looking to create HP Printer Setup once again in my computer system. Can someone please guide me towards the steps to create setup of my HP printer within my PC?

    ReplyDelete
  20. I am using McAfee software from last couple of years to secure my computer system. I am completely satisfied with its user friendly interface and excellent shield protection. But, due to some surplus reasons, McAfee won’t open and therefore my system become vulnerable to virus attacks. Can someone guide me to get rid of this issue? I just want to resolve mcafee Antivirus issues so, please suggest me before long.

    ReplyDelete
  21. Issues associated with the HP printer are haunting many users day by day, ever since they have upgraded their windows 10. Most of them are encountered the same issue in which their printer gets offline and unable to print. Basically, Epson Printer Offline issue or error message appears in the Windows when there is no connection between printer and computer. The reason behind your printer to go offline can be anything like faulty driver, USB cable is damage, printer settings, and many more. But, you don’t need to take tension as by taking guidance from the third party associates you can easily overcome this issue and once again be able to enjoy printing within your Epson printer.
    Epson Support

    Epson Printer Support

    www.epson.com/support

    Epson error code 0x10

    ReplyDelete
  22. Very Nice Blog! This blog is totally informative about Assignment Help services. This blog gives the best ideas for college student about assignment writing services. Thanks for sharing this blog!
    Assignment Help Online
    Online Assignment Help
    Assignment Help Online Service
    Assignment Helper
    Assignment Assistance
    Assignment Help Experts

    ReplyDelete
  23. Thanks for sharing such important information which is very useful .I really appreciate your way of work.
    123.hp.com/setup | HP Printer Assistant Software | 123.hp.com/Laserjet | 123.hp.com/envy5540

    ReplyDelete
  24. Hi! When I read this blog. I'm quite impressed with this blog this is very informative and useful for me. . If need anyone My Assignment Help then contact our expert team. We have to provide high-quality assignment Help for students. Our expert team is available 24*7.

    ReplyDelete

  25. I like your explanation of topic and ability to do work.I really found your post very interesting .
    BigPond email login

    ReplyDelete
  26. How to fix update windows 10 software not working error?
    Do you want to update windows 10 software? Are you facing technical issues related to windows 10 update error? If yes, we are an independent third party tech support service provider, providing Microsoft support windows 10 services for windows 10 users. Updating windows 10 is very difficult issue, so you need to take proper technical care. Our technical experts are very experienced to update windows 10 in the right ways. Our Microsoft support windows 10 is provided by us to provide unlimited technical support for windows 10 users.

    microsoft windows 10 support
    windows 10 support
    windows 10 tech support
    Windows 10 Customer Service
    how to fix broken registry items windows 10
    microsoft support windows 10
    windows help
    windows 10 help

    ReplyDelete
  27. A special thanks to My Assignment Help for providing a well-written assignment. You guys were a savior to me. Will contact you soon for my upcoming assignments. You can email us at cs@Myassignmenthelpau.Com or Phone Number: +61-2-8005-8227

    ReplyDelete
  28. Panda Antivirus is the best antivirus program for all your devices. It Protects your computer, tablet and smartphone against all types of viruses, malware and ransomware. Panda Antivirus Pro 2019 The new Panda Antivirus Pro provides the easiest-to-use and most intuitive protection for your computer. Install it and forget about viruses, spyware, root-kits, hackers and online fraud. Download Panda Antivirus for Windows.
    install panda antivirus

    ReplyDelete
  29. Roku is a streaming device, which provides the simplest way to stream entertainment channel to your TV. On your terms. You can access more than 500000+ movies and TV episodes across free and pay on Roku. Also, you will get the best quality video streaming with it. You can watch shows, movies, an entertainment channel, web series, etc. For the activation of the Roku device.
    roku.com/link

    ReplyDelete
  30. Roku is a streaming device, which provides the simplest way to stream entertainment channel to your TV. On your terms. You can access more than 500000+ movies and TV episodes across free and pay on Roku. Also, you will get the best quality video streaming with it. You can watch shows, movies, an entertainment channel, web series, etc. For the activation of the Roku device.
    roku.com/link

    ReplyDelete
  31. Malwarebytes is anti-malware software also a good replacement for antivirus in Mac computer. It protects your Mac computer from all kind of bad infection which is coming from the Internet like (Viruses, Spyware, Malware, Adware, Ransomware, etc.) The Malwarebytes Anti-Malware definitions are updated continuously to keep you protected. While taking the update, it might slow down your computer, but it is necessary to keepit up to date.
    malwarebytes premium
    malwarebytes for mac

    ReplyDelete
  32. AVG is the one of best antivirus which protects your computer and network from bad inf ection and threats. AVG now includes real-time security updates, scans for both malware and performance issues, and even catches malicious downloads before they reach your PC. User can Install AVG Antivirus on their computer to protect thier computer and network... avg.com/retail

    ReplyDelete
  33. Office.com/setup is a suite of desktop productivity applications that is designed specifically to be used for home, office or business. Does not matter if it is smaller or larger task, it can be completed by simply installing office. office.com/setup

    ReplyDelete
  34. Hulu provides the simplest way to stream entertainment to your TV. On your terms. With thousands of available channels. We provide information regarding Hulu Activation Code. Go to hulu.com/activate, and enter the Activation Code. To activate a new Hulu account using an existing email account and you can stream television shows and movies from the Hulu site using the Hulu activation link
    www.hulu.com/activate

    ReplyDelete
  35. Hulu provides the simplest way to stream entertainment to your TV. On your terms. With thousands of available channels. We provide information regarding Hulu Activation Code. Go to hulu.com/activate, and enter the Activation Code. To activate a new Hulu account using an existing email account and you can stream television shows and movies from the Hulu site using the Hulu activation link

    hulu.com/activate

    ReplyDelete
  36. Webroot SecureAnywhere Antivirus is more than antivirus software. It is antimalware. It stops the viruses and worms that exist in order to infect other computers, but it also protects you during web surfing sessions by blocking harmful websites. And it takes down spyware that tries to deceive you or exploit vulnerabilities in operating systems. Download and Install Webroot security on your computer by visit: webroot.com/safe.
    webroot.com/safe

    ReplyDelete
  37. McAfee.com/activate helps to activate any McAfee products for PCs, MAC, or other devices. McAfee download setup you can download and activate product key.mcafee.com/activate

    ReplyDelete
  38. The ability to print from anywhere using the app is the technology brought by Tango printer, alternatively it is known as smart printer. Simply setup tango printer and does not matter where are you, this smart printer will let you print, scan and copy. hp tango wireless setup

    ReplyDelete
  39. Webroot.com/safe is the only security solution which can protect your system from viruses, worms, malware threats. Get Webroot safe today & install on your system and say goodbye to viruses.webroot.com/safe

    ReplyDelete
  40. Watch your favorite live sports, news, entertainment, and more. Plus, get unlimited access to the entire Hulu streaming library To activate Hulu code hulu.com/activate if you need help to activate Hulu.hulu.com/activate

    ReplyDelete

  41. I like your explanation of topic and ability to do work.I really found your post very interesting .
    BigPond email login

    ReplyDelete
  42. Hulu allows you to stream many movies and shows on your device. For www.hulu.com/activate, just enter the activation code and link it with your device. Enjoy continuous streaming!

    ReplyDelete
  43. Roku declares plans to Combined kids and family movies and TV together with the channel's other content, including subscriptions, its free, television, ad-supported movies, and live TV. After the launching of the "Kids & Family" section on the Roku channel, Roku is also adding new features to give more control to parents over the channel, what their kids can watch when accessing Roku channels. For the activation of the Roku device, Go to URL: roku.com/link.
    roku.com/link

    ReplyDelete
  44. If you’re no longer beholden to cable subscription and if you want a wide range of television options to get Roku device today start watching TV on upon Roku device activation by visiting roku.com/link.
    roku.com/link

    ReplyDelete
  45. Kaspersky Internet Security includes a wider range of protection components than Kaspersky Free. To upgrade to Kaspersky Internet Security, you need not install or download any additional software. Kaspersky Total Security helps protect your family – when they surf, shop, socialize or stream. Plus, extra privacy protection securely stores their passwords & key documents, protects files & precious memories, and helps safeguard kids from digital dangers.
    kaspersky install

    ReplyDelete
  46. Is your McAfee Antivirus expired or about to expire? Then it is the right time to act fast to activate your antivirus as quickly as possible. In the times of harmful virus attacks and cyber-attacks, it is significant to keep your system safe and running. Therefore, it is better to adapt the ways to activate, as not doing so will surely make your system vulnerable against various threats. If you are not acquainted with the right procedure for activating McAfee antivirus, then you should visit Mcafee.Com/Activate or consider taking help from McAfee support team. At here, you will get the chance to meet with deft team of technicians who will assist you out in doing the needful.

    ReplyDelete
  47. Acquiring Legitimate Essay Writing Service doesn’t have to drain your finances and the Buy Non Plagiarized Essays charges are modest to ensure that we do not deter anyone from benefiting from the College Essays for Sale from our experienced writers.

    ReplyDelete
  48. Hulu provides the simplest way to stream entertainment to your TV. On your terms. With thousands of available channels. We provide information regarding Hulu Activation Code. Go to www.hulu.com/activate, and enter the Activation Code. To activate a new Hulu account using an existing email account and you can stream television shows and movies from the Hulu site using the Hulu activation link.hulu.com/activate

    ReplyDelete
  49. Hulu provides the simplest way to stream entertainment to your TV. On your terms. With thousands of available channels. We provide information regarding Hulu Activation Code. Go to www.hulu.com/activate, and enter the Activation Code. To activate a new Hulu account using an existing email account and you can stream television shows and movies from the Hulu site using the Hulu activation link. hulu.com/activate

    ReplyDelete
  50. Watch your favorite live sports, news, entertainment, and more. Plus, get unlimited access to the entire Hulu streaming library To activate Hulu code go to url hulu.com/activate if you need help to activate Hulu

    hulu.com/activate is the cheapest online video streaming services grown ever more popular, cable connections or subscriptions became un popular and peoples are looking to cut the cord with cable operator and switching to Hulu simply activating by visiting hulu.com/activate. hulu.com/activate

    ReplyDelete
  51. AVG is the one of best antivirus which protects your computer and network from bad infection and threats. AVG now includes real-time security updates, scans for both malware and performance issues, and even catches malicious downloads before they reach your PC. User can Install AVG Antivirus on their computer to protect thier computer and network...
    avg.com/retail

    ReplyDelete
  52. Ahaa, its good dialogue concerning this piece of writing at this
    place at this web site, I have read all that, so at this time me also commenting
    here.
    pbs.org/activate

    ReplyDelete
  53. Very helpful blog! It gives a real picture of Nepal tourism. This post gives ideas to visit popular places of Nepal. I love this blog.
    Nepal Tour Packages
    Nepal Tour Package
    Nepal Tourism Packages
    Nepal Tourist Packages
    Nepal Tour
    Most Beautiful Places In The World

    ReplyDelete
  54. Thanks for your valuable post. Please post some more related topics. We are on your page only to read your blog because, as you know, there are no other for being here. Like you, we also here for some information of Outlook, so if any of you need any type of help related Outlook then contact our Outlook support phone number or visit the website.
    How do I contact Microsoft tech support?
    How do I contact Microsoft Outlook support ?
    Is there a phone number for Outlook support ?
    Outlook support
    Outlook support Phone Number
    Outlook support Number
    How Do I Call Outlook Support ?

    ReplyDelete
  55. Every software comes with a free and paid trail version. The free version of any software has the limited functionality and features but paid version has complete features. Mcafee antivirus software also comes with a paid version. You should go to Mcafee.com/activate to activate your premium Mcafee antivirus software. You can also avail help from experts to activate it easily.

    ReplyDelete
  56. get a compelete guidence from 123.hp.com setup for your printers , like driver support , installation , wireless dial @ +1-844-802-7535

    ReplyDelete
  57. This is an interesting write-up, and shine its formatting through using office 365 applications. In case something gets wrong, then you can use office 365 download link to obtain the suitable result. Visit here:- https://www.office365download.co/
    office 365 download
    Download Office 365
    Microsoft office 365 download

    ReplyDelete
  58. The mentioned points in this guide are very informative and helped me to resolve my issue in a very proficient manner. At the time of solving my query I got stuck at one point, so I called at outlook Support Phone number and the technician who answered my call guided me thoroughly to get rid of my issue. I really appreciate the hardworking of that guy, who helped me during my crisis of time and never leave my side until problem didn’t get resolved. Therefore, I personally suggest everyone to get hold of Microsoft outlook Support if you really want to resolve your query related to your Outlook.
    How do I call Outlook support?
    Is there a phone number for Outlook support?
    How do I contact Hotmail Support?
    Is there a phone number for Hotmail support?
    Change Hotmail Password
    hotmail change password
    change microsoft password
    Is There A Phone Number For Microsoft Windows Support?
    How Do I Contact Microsoft Windows Support?
    How to Contact Microsoft Windows Tech Support?
    How Do I Contact Microsoft Office 365 Support?
    Is There a Phone Number for Microsoft Office 365 Support?
    Is There a Phone Number for Microsoft Office Support?
    How Do I Contact Microsoft Office Support?
    Windows support
    Microsoft windows support

    ReplyDelete
  59. Hulu provides the simplest way to stream entertainment to your TV. On your terms. With thousands of available channels. We provide information regarding Hulu Activation Code. Go to hulu.com/activate, and enter the Activation Code. To activate a new Hulu account using an existing email account and you can stream television shows and movies from the Hulu site using the Hulu activation link.
    www.hulu.com/activate
    hulu.com/activate

    ReplyDelete
  60. Webroot SecureAnywhere Antivirus is more than antivirus software. It is antimalware. It stops the viruses and worms that exist in order to infect other computers, but it also protects you during web surfing sessions by blocking harmful websites. And it takes down spyware that tries to deceive you or exploit vulnerabilities in operating systems. Download and Install Webroot security on your computer.webroot.com/safe

    ReplyDelete
  61. Webroot.com/safe is the only security solution which can protect your system from viruses, worms, malware threats. Get Webroot safe today & install on your system and say goodbye to viruses. webroot.com/safe

    ReplyDelete
  62. This comment has been removed by the author.

    ReplyDelete
  63. A good web site requires extremely adequate front-end execution. PNJ Sharptech offers the best web design services in India. Now go online your business with PNJ Sharptech Computing Services( web design company )

    ReplyDelete