[PedroDJ]

Hi HF,

today I have received an email with 2 attchments:

Code

1) CONGRATULATIONS YOU ARE A WINNER IN MICROSOFT® PROMOTION 2013.doc

2) Microsft.pdf

Obviously I haven't executed those files but I have scanned it

1) http://scan4you.net/result.php?id=7ec34_34fdam

2) http://scan4you.net/result.php?id=17355_34fdem

I'm assuming there's some new FUD exploit for PDF and DOC, isn'it ?

Thank you

[PedroDJ]

Nobody know what I'm talking about ? :)

[PedroDJ]

Definitively nobody know what I'm talking about :)

[Cybride]

Probably this one: http://nakedsecurity.sophos.com/2013/02/...-exploits/

[PedroDJ]

Probably this one: http://nakedsecurity.sophos.com/2013/02/...-exploits/

I was talking about a .doc exploit, not .pdf, otherwise thank you for the info: have you a PoC of the .pdf exploit ?

[Cybride]

I'm assuming there's some new FUD exploit for PDF and DOC, isn'it ?

http://eromang.zataz.com/tag/cve-2013-0640/
http://eromang.zataz.com/uploads/adobe-f...-analysis/

[PedroDJ]

http://pastebin.com/6h2Paikc

Have you posted and then edited: it seems a .js for the pdf exploit ?

[Cybride]

yeah, you find the same file in the second link I posted, including some deobfuscation-tries.
I am still looking for a public release...

[SoulBooster]

Scan it on VirusTotal as fast as possible. ;)
Someone will make a good botnet.