Kaspersky Threats — Exploit.JS.Pdfka.eqv

Classe: Exploit

Explorações são programas que contêm dados ou códigos executáveis que se aproveitam de uma ou mais vulnerabilidades em softwares executados em um computador local ou remoto para propósitos claramente maliciosos. Freqüentemente, os usuários mal-intencionados utilizam uma exploração para penetrar no computador da vítima, a fim de instalar código malicioso (por exemplo, para infectar todos os visitantes de um site comprometido com um programa malicioso). Além disso, os exploits são comumente usados por Net-Worms para hackear um computador da vítima sem que seja necessária nenhuma ação do usuário. Os programas Nuker são notáveis entre os exploits; esses programas enviam solicitações especialmente criadas para computadores locais ou remotos, causando a falha do sistema.

Plataforma: JS

JavaScript (JS) é uma linguagem de programação baseada em protótipos. JavaScript tem sido tradicionalmente implementado como uma linguagem interpretada. O uso mais comum é em navegadores da Web, onde é usado para criação de scripts para adicionar interatividade a páginas da Web.

Família: Exploit.JS.Pdfka

No family description

Examples

560383DFA958C14B3EA1A57180EE695B
6C45DE6514EE29063FF589DD68796B7D
0F7DE5592645E2FC29D13A1867153DC0
19AC60A8370F691588DEDE8B7DEFEAEA
1EE4FD34DE0A025F2CB7ECA65D20705B

Tactics and Techniques: Mitre*

TA0002

Execution

The adversary is trying to run malicious code. Execution consists of techniques that result in adversary-controlled code running on a local or remote system. Techniques that run malicious code are often paired with techniques from all other tactics to achieve broader goals, like exploring a network or stealing data. For example, an adversary might use a remote access tool to run a PowerShell script that does Remote System Discovery.

T1106

Native API

Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes. These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.

T1203

Exploitation for Client Execution

Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.

TA0004

Privilege Escalation

The adversary is trying to gain higher-level permissions. Privilege Escalation consists of techniques that adversaries use to gain higher-level permissions on a system or network. Adversaries can often enter and explore a network with unprivileged access but require elevated permissions to follow through on their objectives. Common approaches are to take advantage of system weaknesses, misconfigurations, and vulnerabilities. Examples of elevated access include: SYSTEM/root level, local administrator, user account with admin-like access, user accounts with access to specific system or perform specific function. These techniques often overlap with Persistence techniques, as OS features that let an adversary persist can execute in an elevated context.

T1068

Exploitation for Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.

TA0007

Discovery

The adversary is trying to figure out your environment. Discovery consists of techniques an adversary may use to gain knowledge about the system and internal network. These techniques help adversaries observe the environment and orient themselves before deciding how to act. They also allow adversaries to explore what they can control and what's around their entry point in order to discover how it could benefit their current objective. Native operating system tools are often used toward this post-compromise information-gathering objective.

T1010

Application Window Discovery

Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used. For example, information about application windows could be used identify potential data to collect as well as identifying security tooling (Security Software Discovery) to evade.