PDF Container Threat
Last year I wrote a blog entry entitled The Fight Against Malicious PDFs Using the ASCII85Decode Filter, which is about a threat that uses the ASCII85Decode filter to hide itself. Since that time, some Adobe Reader vulnerabilities have been found, including a recent zero-day vulnerability. However, attackers like to use not only direct exploitation, but also social engineering. I think this is because patches can fix software vulnerabilities fairly easily, but social engineering requires us (as potential victims) to understand and know what is dangerous, which is never easy.
Rough translation: "This file contains an attachment. Please choose 'File'->'Attachment' to read the attachment." If this message were clicked through, the user would see this attachment file:
On the other hand, if the threat is opened with Adobe Reader version 7 or higher, the user will likely see the following:
In actuality, this 7-Zip file contains a malicious file that Symantec detects as Downloader. Remember that this is not an Adobe software vulnerability. But, if a user falls victim to the social engineering (trusts the message and opens the attachment), the Downloader threat will run on his or her machine. The social engineering techniques used in this situation are not new. In the past we have seen many document files used as containers, including MS-Word, Excel, and PowerPoint files.
As always, please be wary of these types of attachments that have been sent from an unknown source.