Is Philippine Bureau of Immigration website compromised, hosting malware?

According to Websense Security Labs™ and the Websense ThreatSeeker® Network, they have detected malicious emails disguised as HSBC Notifications.  A closer look at these emails, like the one you can see below, reveals that the link provided in the emails is a compromised URL belonging to the Philippine Bureau of Immigration.

Clicking the link prompts the user to download a malicious file called "atualizar.exe".

The Philippine Bureau of Immigration is using Joomla as their CMS and there is a file named “atualizar.php” which is a Portuguese word and translate to “update.php”. 

The file was probably replaced or inserted maliciously. This link “http://immigration.gov.ph/administrator/components/com_media/old/atualizar.php” if you hit it, the HTTP response status code is 302 which is the most common way of performing a redirection. It redirect to “http://immigration.gov.ph/administrator/components/com_media/old/atualizar.exe” which probably contain the actual payload…

   1:  

   2: [kramfs@viasvr temp]$ wget http://immigration.gov.ph/administrator/components/com_media/old/atualizar.php

   3: --2011-08-10 

   4: 17:15:03-- http://immigration.gov.ph/administrator/components/com_media/old/atualizar.php

   5: Resolving 

   6: immigration.gov.ph... 124.6.144.116

   7: Connecting to 

   8: immigration.gov.ph|124.6.144.116|:80... connected.

   9: HTTP request sent, 

  10: awaiting response... 302 Found

  11: Location: http://immigration.gov.ph/administrator/components/com_media/old/atualizar.exe 

  12: [following]

  13: --2011-08-10 17:15:04-- http://immigration.gov.ph/administrator/components/com_media/old/atualizar.exe

  14: Reusing 

  15: existing connection to immigration.gov.ph:80.

  16: HTTP request sent, awaiting 

  17: response... No data received.

  18: Retrying.

  19: --2011-08-10 17:15:05-- (try: 2) http://immigration.gov.ph/administrator/components/com_media/old/atualizar.exe

  20: Connecting 

  21: to immigration.gov.ph|124.6.144.116|:80... connected.

  22: HTTP request sent, 

  23: awaiting response... 200 OK

  24: Length: 699460 (683K) 

  25: [application/x-msdos-program]

  26: Saving to: âatualizar.exeâ

  27: 100%[============================================================================>] 

  28: 699,460 63.4K/s in 12s

  29: 2011-08-10 17:15:17 (57.2 KB/s) - âatualizar.exeâ

 

Trend Micro flag this file as malicious….

image

You can find the VirusTotal analysis results for this .exe as it is detected by different AV solutions.

Source Reference: Websense Security Labs

3,129 Comments

  1. Pingback: Gutschein Weight Watchers

  2. Pingback: rahaa

  3. Pingback: Small Business

  4. Pingback: thank you

  5. Pingback: Raylene Mcanany

  6. Pingback: PayPal

  7. Pingback: Thanh Irizzary

  8. Pingback: the zone quotes

  9. Pingback: funny videos pictures

  10. Pingback: house trained dog

  11. Pingback: The Shade Room

  12. Pingback: small business social media

  13. Pingback: social media web 2.0

  14. Pingback: obchod

  15. Pingback: Like This

  16. Pingback: Automobile Engineering

  17. Pingback: Las mil y una noches

  18. Pingback: SoundCloud Plays Packages

  19. Pingback: Pok Shurts

  20. Pingback: Denver's funnest Photobooth

  21. Pingback: Pest Control

  22. Pingback: Geek sites

  23. Pingback: Chadwick Courchine

  24. Pingback: Plus Size Swimwear

  25. Pingback: meskieinfo.soup.io

  26. Pingback: www.spu.ac.th

  27. Pingback: Best Wordpress Child Themes

  28. Pingback: Professional Wordpress Child Themes for download

  29. Pingback: Najbolja bosanska rock muzika

  30. Pingback: Najbolja bosanska rock muzika

  31. Perry

    Usually I do not read post on blogs, however I wish to say that
    this write-up very pressured me to check out and do so!
    Your writing taste has been amazed me. Thanks, quite great post.

    Reply
  32. Magda

    You could definitely see your skills within the work you
    write. The arena hopes for even more passionate writers like you who are not afraid to say how they believe.
    At all times go after your heart.

    Reply
  33. Holly

    If some one wishes expert view regarding blogging and site-building
    then i propose him/her to go to see this website,
    Keep up the fastidious job.

    Reply
  34. Frederick

    It’s wonderful that you are getting ideas from this article as
    well as from our discussion made at this place.

    Reply
  35. cheap fifa 18 coins

    Write more, thats all I have to say. Literally, it seems as though you relied on the video to
    make your point. You definitely know what youre talking about, why throw away your intelligence on just posting videos
    to your blog when you could be giving us something informative to read?

    Reply
  36. cheap mink eyelashes

    Can I just say what a comfort to discover an individual who actually
    knows what they are talking about on the net. You actually realize
    how to bring a problem to light and make it important. More people ought to
    read this and understand this side of the story. I can’t
    believe you aren’t more popular since you surely have
    the gift.

    Reply
  37. animal onesie

    Wonderful post! We will be linking to this particularly great post on our site.
    Keep up the great writing.

    Reply
  38. nba live mobile coins

    This is very interesting, You are a very skilled blogger.
    I’ve joined your rss feed and look forward to seeking more
    of your magnificent post. Also, I have shared your
    website in my social networks!

    Reply
  39. Rudolph

    Howdy are using WordPress for your site platform?
    I’m new to the blog world but I’m trying to get started and create my own. Do you need any coding knowledge to make your
    own blog? Any help would be greatly appreciated!

    Reply
  40. onesie pajamas baby

    Hi there to all, the contents present at this web site
    are actually remarkable for people knowledge, well, keep up the good work fellows.

    Reply
  41. cheap fifa 18 coins

    Excellent post. I used to be checking constantly this blog and I’m impressed!
    Extremely useful info specifically the final phase 🙂 I handle such info a
    lot. I was looking for this certain information for a long time.
    Thanks and best of luck.

    Reply
  42. buy mink eyelashes

    wonderful publish, very informative. I ponder why the other
    experts of this sector don’t realize this. You should continue your writing.
    I’m confident, you’ve a huge readers’ base already!

    Reply
  43. rossmannjoq

    OK, you may feel bored regarding my saying a great deal…seeing is assuming, right? Come to us all “Cheap Replica Handbags”, but absolutely “Best Quality Replica Handbags” . The next stretch in the game converted into a clinic between Sarah Walsh and Heather O’Reilly, who was serving as team captain for the injured Christie Rampone. Louis Vuitton Montres Tambour nfp louboutin 2 louis vuitton jewelry box [url=http://www.dayatthepark.nl/]canada goose jassen sale[/url] louis vuitton pattern louis vuitton neverfull pm Nike Youth Packers Jamari Lattimore White Limited Jersey xlj NFL Vince Wilfork Women’s Elite Red Jersey small,large,medium,xl,2x,3x,4x,5x #75 New England Patriots Nike Super Bowl XLIX Alternate C Patch canada goose hybridge lite jacket canada goose us [url=http://www.smart-up.fr/]canada goose femme pas cher[/url] engbretson adidas nmd all white louis vuitton z0259u ekr
    adidas nmd militaire femme louboutin y a t il des soldes Now Toni Braxton is filing for bankruptcy additional. On Sept 30th, Toni claimed she owed between $10 million to $50 million in unpaid debts all over the country. She owes money to two DMV’s by two states, AT&T, DirecTV, tiffany & Co, Orkin Pest Control, IRS, American Express, Wells Fargo Bank (the list happens read it here). On the top of all that, her house in Nevada was foreclosed in Sept and also the IRS attributes lien on her behalf for $396,000. But Toni says she’s only worth between $1 million and $10 thousands of. christian louboutin 9 canada goose a new york http://www.advokatforum.dk/ yeezy boost 350 v2 steel grey christian louboutin boots for women Reebok Guy Lafleur Premier Men’s Jersey – NHL Montreal Canadiens #10 Red Home I bet you are wondering why we buy old and broken iPad units? This is to promote a cleaner and healthier living by protecting the environment from being polluted and contaminated by harmful elements coming from e-wastes such as broken laptops, mobile phones, iPads, and other stuff. You selling your iPad is enough contribution to this noble cause. Well, that traumatic memory that seemed to fade away…you didn’t really forget it. It is buried deep within your sub-conscious mind, tucked away in a media file of memories that make up your past. This memory and all the other negative memories from the past are all stacked up…..a lifetime of repressed emotions never completely dealt with. All of which affect who you are today. But tiffany Taylor has the capability to. She actually shares with you the inner tips for women for this reason gives merely distinct edge on other males. In fact, when done right, the information in Guy Gets Girl can make women feel powerless with your presence. Powerless to resist you, is definitely. [url=http://www.muxum.nl/]Canada Goose Outlet Norge[/url] hsq christian louboutin womens shoes size 42 christian louboutin türkiye

    Reply
  44. feldtmanjkq

    Well, that’s your holidays Christmas gifts list. They’ll not get into everyone’s associated with top ten Christmas gifts, but will not be get-out-of-trouble lists go, You’ll find something there to assist you. The problems of co-morbid disorders with ADHD was brought house to me recently when I just read on the forum about a fourteen year old boy who had not just ADHD but was also suffering from bipolar depression and also ODD (Oppositional Defiant Disorder). This child had gone through eighteen different medications before they found the right combination. NFL Men Dallas Cowboys Ben Bass Navy Blue Throwback Jersey bic canada goose i københavn christian louboutin 5 outlet [url=http://www.cuisine-renovation.fr/]veste canada goose solde[/url] christian louboutin x louis vuitton bag yeezy boost 350 yupoo Louis Vuitton Montres Tambour kqu NFL 68 Dallas Cowboys Men Doug Free Lights Out Black Limited Jersey t shirt christian louboutin louboutin 70mm pumps [url=http://www.psycoach-palacin.fr/]canada goose pas cher[/url] furst louis vuitton mini pochette canada goose occasion le bon coin ioo
    christian louboutin wedding shoes christian louboutin amazoulo In December, TMZ reported that Lindsay Lohan was struggling devote her $8,000 rent to be with her mini-mansion in L.A.. Perhaps that was due just to her bank accounts being seized by the irs for back taxes. They will reported Lindsay was looking for get the particular her lease early. meglio woolrich o canada goose christian louboutin bianca http://www.sistrr.org/ christian louboutin amsterdam adres christian louboutin advertising Men’s Nike New England Patriots 73 John Hannah Limited Navy Blue Team Color NFL Jersey Another great find is the spicy mixture of luck, patience, perseverance and desire. I was able to score a Hermes dream bag, an Hermes Birkin, 30cm in width, in togo leather, blue jean in color, with palladium hardware. The madness did not stop there. He then took my hand and led me to Penn’s Landing where fireworks were going off and boats were pushing their way using the water. Yes, ladies and gentleman, it’s did acquire. The company’s goal is to optimize the costing procedure and build a brand. Anyway, Louis Vuitton Diaper bag is a product you must get.And it looks very ungraceful. Nowadays, you don’t need to worry about this problem. Louis Vuitton diaper bag blue has solved this problem very well. It is attractive in outer appearance and exquisite in inner side. It has enough room for putting baby accessories and the appearance looks very graceful. At the same time, Louis Vuitton diaper bag has other colors, Louis Vuitton diaper bag pink looks very cute compared to the elegant Louis Vuitton diaper bag blue. You can choose one according to your personal preference. [url=http://www.bart-smit.nl/]canada goose rea[/url] qbg canada goose shell louboutin christian

    Reply
  45. home page

    Its like you read my mind! You seem to know a lot about this, like you wrote the book in it or something. I think that you can do with a few pics to drive the message home a little bit, but instead of that, this is fantastic blog. An excellent read. I’ll certainly be back.

    Reply
  46. click here

    hey there and thank you for your info – I have certainly picked up anything new from right here. I did however expertise a few technical points using this website, since I experienced to reload the site many times previous to I could get it to load correctly. I had been wondering if your web host is OK? Not that I am complaining, but slow loading instances times will very frequently affect your placement in google and could damage your high quality score if ads and marketing with Adwords. Well I am adding this RSS to my email and could look out for much more of your respective interesting content. Ensure that you update this again very soon.

    Reply
  47. home page

    hello!,I love your writing so a lot! proportion we be in contact extra about your article on AOL? I require an expert on this house to unravel my problem. Maybe that’s you! Having a look ahead to see you.

    Reply
  48. nba 2k18 coins

    It’s really a nice and useful piece of information. I’m glad that you just shared this helpful info with us. Please stay us up to date like this. Thanks for sharing.

    Reply
  49. my blog

    Great article, just what I wanted to find.

    Reply
  50. home page

    Have you ever considered creating an e-book or guest authoring on other sites? I have a blog based on the same topics you discuss and would love to have you share some stories/information. I know my audience would value your work. If you are even remotely interested, feel free to send me an e-mail.

    Reply

Leave a Comment

Your email address will not be published. Required fields are marked *