Unpatched Adobe Vulnerability Is Still Being Exploited in the Wild

[Peaches]

Unpatched Adobe Vulnerability Is Still Being Exploited in the Wild

Another PDF sample that exploits an in Adobe Reader and Acrobat has been spotted in the wild. The sample (detected by Trend Micro as TROJ_PIDIEF.WIA) uses the heap spray technique to execute shellcode in its stream. As a result, a malicious file detected as BKDR_POISON.UC is dropped into the system.

When executed, BKDR_POISON.UC opens an instance of Internet Explorer and connects to a remote site, cecon.{BLOCKED}-show.org. Once connected, a malicious user may execute any command on the affected system.

details at trendmicro - http://blog.trendmicro.com/