Security Response

We have seen an ever increasing use of PDFs for malicious purposes over the past two years. During this time, we have tracked the growth and usage and have been constantly improving our detections to handle the different evolutions of these threats. We see new vulnerabilities related to PDF readers discovered on a regular basis, often being exploited in-the-wild before a patch is available. We have created the following report which highlights some of the interesting changes we analyzed. The report can be downloaded here.

In this whitepaper, we discuss the current PDF threat landscape, some current vulnerabilities being exploited in PDF documents, and various methods used by the malware authors. We also discuss various actions malware authors take to avoid detection, as well as offer some preventative measures users can take to protect themselves....

Trojan.Ransompage is interesting because it is the first ransom threat that is designed to target three different browser platforms. Not only has the malware author chosen to target the two most popular browsers in Firefox and Internet Explorer, but Opera is also a target. This shows that the malware author wanted to target more than one browser in order to maximize the chances of success in case an infected user decided to change browsers rather than pay the ransom.

To attack Internet Explorer users the Trojan will drop a file called msmedia.dll and install it as a browser helper object (BHO). To target Firefox users the Trojan will install an extension called “informer” that consists of the following files: install.rdf, chrome.manifest, informer.xul, and informer.js. With Opera, the Trojan will drop a file called feeder.js that also acts as an extension and is written in JavaScript. These three different payloads all have the same functionality. They will...