miekiemoes has a secret admirer

The following Czech site (otylkaaotesanek.cz ) contains an exploit:

In Google Chrome you will see a PDF automatically downloaded (thankfully I did not have Adobe reader installed on this machine)

The malware author took the time to credit this PDF to security researcher miekiemoes. That sounds pretty similar to a Dancho Danchev fan club

This is a malicious PDF:

Only one AV vendor from Virus Total (Sophos) detected this threat:

Opening the PDF with a vulnerable version of Adobe Reader will launch the following payload:

dom2cn.cn/13b/load.php?spl=pdf_exp
jzion.cn/etc242342534252435223/1.php
jzion.cn/etc242342534252435223/soft14.exe

The last file is a Trojan detected by 35% of the AV vendors from Virus Total, at the time of writing.

Jerome Segura

Malware ID: t1L8XD644LtNd.pdf.zip

Warning: all links contained in this post may infect your computer!