Is Philippine Bureau of Immigration website compromised, hosting malware?

According to Websense Security Labs™ and the Websense ThreatSeeker® Network, they have detected malicious emails disguised as HSBC Notifications.  A closer look at these emails, like the one you can see below, reveals that the link provided in the emails is a compromised URL belonging to the Philippine Bureau of Immigration.

Clicking the link prompts the user to download a malicious file called "atualizar.exe".

The Philippine Bureau of Immigration is using Joomla as their CMS and there is a file named “atualizar.php” which is a Portuguese word and translate to “update.php”. 

The file was probably replaced or inserted maliciously. This link “http://immigration.gov.ph/administrator/components/com_media/old/atualizar.php” if you hit it, the HTTP response status code is 302 which is the most common way of performing a redirection. It redirect to “http://immigration.gov.ph/administrator/components/com_media/old/atualizar.exe” which probably contain the actual payload…

   1:  

   2: [kramfs@viasvr temp]$ wget http://immigration.gov.ph/administrator/components/com_media/old/atualizar.php

   3: --2011-08-10 

   4: 17:15:03-- http://immigration.gov.ph/administrator/components/com_media/old/atualizar.php

   5: Resolving 

   6: immigration.gov.ph... 124.6.144.116

   7: Connecting to 

   8: immigration.gov.ph|124.6.144.116|:80... connected.

   9: HTTP request sent, 

  10: awaiting response... 302 Found

  11: Location: http://immigration.gov.ph/administrator/components/com_media/old/atualizar.exe 

  12: [following]

  13: --2011-08-10 17:15:04-- http://immigration.gov.ph/administrator/components/com_media/old/atualizar.exe

  14: Reusing 

  15: existing connection to immigration.gov.ph:80.

  16: HTTP request sent, awaiting 

  17: response... No data received.

  18: Retrying.

  19: --2011-08-10 17:15:05-- (try: 2) http://immigration.gov.ph/administrator/components/com_media/old/atualizar.exe

  20: Connecting 

  21: to immigration.gov.ph|124.6.144.116|:80... connected.

  22: HTTP request sent, 

  23: awaiting response... 200 OK

  24: Length: 699460 (683K) 

  25: [application/x-msdos-program]

  26: Saving to: âatualizar.exeâ

  27: 100%[============================================================================>] 

  28: 699,460 63.4K/s in 12s

  29: 2011-08-10 17:15:17 (57.2 KB/s) - âatualizar.exeâ

 

Trend Micro flag this file as malicious….

image

You can find the VirusTotal analysis results for this .exe as it is detected by different AV solutions.

Source Reference: Websense Security Labs

1,714 Comments

  1. mink lashes

    Hey I am so excited I found your blog page, I really found you by mistake, while I was searching on Bing for something else, Nonetheless I am here now and would just like to say many thanks for a incredible post and a all round thrilling blog (I also love the theme/design), I don’t have time to read through it all at the moment but I have book-marked it and also added your RSS feeds, so when I have time I will be back to read a great deal more, Please do keep up the fantastic work.

    Reply
  2. click here

    I’m amazed, I have to admit. Seldom do I come across a blog that’s both equally educative and engaging, and let me tell you, you’ve hit the nail on the head. The problem is an issue that not enough men and women are speaking intelligently about. Now i’m very happy that I came across this during my hunt for something regarding this.

    Reply
  3. click here

    I’m not sure why but this website is loading incredibly slow for me. Is anyone else having this problem or is it a issue on my end? I’ll check back later and see if the problem still exists.

    Reply
  4. home page

    Hi terrific website! Does running a blog such as this require a lot of work? I have absolutely no knowledge of coding but I had been hoping to start my own blog soon. Anyways, should you have any ideas or tips for new blog owners please share. I know this is off topic however I just had to ask. Thanks a lot!

    Reply
  5. click here

    Wow that was strange. I just wrote an really long comment but after I clicked submit my comment didn’t appear. Grrrr… well I’m not writing all that over again. Anyway, just wanted to say excellent blog!

    Reply
  6. click here

    Right away I am going to do my breakfast, when having my breakfast coming over again to read additional news.

    Reply
  7. 360 frontal

    joli laconique 360 frontal https://www.youtube.com/watch?v=ny8rUpI_98I, très migon, message très agile

    Reply
  8. click here

    Why people still use to read news papers when in this technological globe everything is existing on net?

    Reply
  9. website

    Great article.

    Reply
  10. homepage

    An intriguing discussion is definitely worth comment. I do believe that you should publish more on this issue, it might not be a taboo subject but generally people do not speak about these subjects. To the next! Cheers!!

    Reply
  11. madden 18 coins

    I am now not sure where you’re getting your info, but good topic. I must spend some time finding out much more or working out more. Thank you for wonderful info I was searching for this information for my mission.

    Reply
  12. click here

    I think that is among the such a lot vital info for me. And i am glad reading your article. But should statement on few normal issues, The site style is perfect, the articles is truly excellent : D. Just right process, cheers

    Reply
  13. home page

    Everyone loves what you guys are usually up too. This kind of clever work and reporting! Keep up the good works guys I’ve incorporated you guys to our blogroll.

    Reply
  14. pikachu onesie

    This information is priceless. Where can I find out more?

    Reply
  15. click here

    This post is actually a fastidious one it helps new net visitors, who are wishing for blogging.

    Reply
  16. click here

    No matter if some one searches for his essential thing, so he/she wants to be available that in detail, thus that thing is maintained over here.

    Reply
  17. home page

    Greetings from Los angeles! I’m bored to tears at work so I decided to browse your site on my iphone during lunch break. I love the knowledge you present here and can’t wait to take a look when I get home. I’m shocked at how quick your blog loaded on my cell phone .. I’m not even using WIFI, just 3G .. Anyways, wonderful site!

    Reply
  18. my blog

    It’s enormous that you are getting ideas from this piece of writing as well as from our discussion made at this time.

    Reply
  19. black skate shoes wholesale with design

    ok welcome to you, get free software!

    Reply
  20. click here

    Yes! Finally someone writes about %keyword1%.
    click here http://vpub.binhduong.gov.vn/Default.aspx?tabid=60&UserID=329595

    Reply
  21. view my blog

    Hi! I could have sworn I’ve been to this website before but after browsing through a few of the posts I realized it’s new to me. Nonetheless, I’m certainly happy I discovered it and I’ll be book-marking it and checking back frequently!
    view my blog http://ocispain.com/index.php/component/k2/itemlist/user/531626

    Reply
  22. fifa 18 coins

    Hey I know this is off topic but I was wondering if you knew of any widgets I could add to my blog that automatically tweet my newest twitter updates. I’ve been looking for a plug-in like this for quite some time and was hoping maybe you would have some experience with something like this. Please let me know if you run into anything. I truly enjoy reading your blog and I look forward to your new updates.
    fifa 18 coins http://pif.org.in/UserProfile/tabid/42/UserID/318697/Default.aspx

    Reply
  23. Lelio Vieira Carneiro

    Saved as a favorite, I really like your web site!

    Reply
  24. code scanner types

    I’d like to thank you for the efforts you have put in writing this blog.

    I really hope to view the same high-grade blog posts by you
    later on as well. In truth, your creative writing abilities
    has inspired me to get my own, personal blog now 😉

    Reply
  25. www.qbn.com

    Hi there i am kavin, its my first occasion to commenting anywhere, when i read this post i thought i could also create comment due to this
    sensible article.

    Reply
  26. Lelio Vieira Carneiro Junior

    Hey there! I know this is kind of off topic but I was wondering which blog platform are you using
    for this site? I’m getting fed up of WordPress because I’ve had problems with hackers
    and I’m looking at alternatives for another platform. I would be great if you could point me
    in the direction of a good platform.

    Reply
  27. Emil

    This site certainly has all of the information and facts I needed concerning
    this subject and didn’t know who to ask.

    Reply
  28. specific niche podcast

    Pretty great post. I just stumbled upon your weblog and wanted to say that I have really loved surfing around your weblog posts.
    In any case I will be subscribing in your rss feed
    and I am hoping you write once more very soon!

    Reply
  29. security service

    Heya! I just wanted to ask if you ever have any problems with hackers?
    My last blog (wordpress) was hacked and I ended up losing many months of
    hard work due to no backup. Do you have any methods to prevent hackers?

    Reply
  30. car diagnostics automobile

    I know this if off topic but I’m looking into starting my own weblog and was wondering what all
    is required to get setup? I’m assuming having a blog like yours would
    cost a pretty penny? I’m not very web savvy so I’m not 100% certain. Any recommendations
    or advice would be greatly appreciated. Many thanks

    Reply
  31. theater systems

    I all the time emailed this blog post page to all my friends, because if like to
    read it then my links will too.

    Reply
  32. Mittie

    Hello, I check your blog daily. Your writing style is awesome, keep up
    the good work!

    Reply
  33. route travel

    Greate pieces. Keep posting such kind of information on your
    blog. Im really impressed by your site.
    Hey there, You have done a fantastic job. I will definitely digg it and individually suggest to my friends.

    I’m sure they’ll be benefited from this website.

    Reply
  34. Silvia Odete Morani Massad

    This design is steller! You certainly know how to keep a reader amused.

    Between your wit and your videos, I was almost moved to start my own blog (well, almost…HaHa!) Great job.
    I really loved what you had to say, and more than that,
    how you presented it. Too cool!

    Reply
  35. traveling wilburys

    Nice post. I learn something new and challenging on sites I stumbleupon every day.
    It’s always exciting to read articles from other writers and use a little something from other
    web sites.

    Reply
  36. heart disease

    My brother suggested I would possibly like this
    blog. He was entirely right. This submit truly made my day.
    You can not believe simply how so much time I had spent
    for this information! Thank you!

    Reply
  37. chief executive officer job description

    It’s awesome for me to have a site, which is helpful in favor of
    my know-how. thanks admin

    Reply
  38. having holiday travel

    I have been surfing on-line greater than 3 hours lately,
    yet I by no means found any attention-grabbing article like yours.
    It is lovely worth sufficient for me. In my view,
    if all webmasters and bloggers made just right content as
    you did, the internet will likely be much more useful than ever before.

    Reply
  39. Wilbert

    Piece of writing writing is also a excitement, if
    you know afterward you can write if not it is complex to write.

    Reply
  40. developing heart disease

    Nice blog right here! Also your site quite a bit up fast!
    What host are you using? Can I am getting your affiliate hyperlink on your host?
    I wish my site loaded up as fast as yours lol

    Reply
  41. wonderful business idea

    After I originally commented I appear to have clicked on the -Notify me when new
    comments are added- checkbox and from now on every time a comment is added
    I receive four emails with the same comment.
    There has to be a way you are able to remove me from that
    service? Thank you!

    Reply
  42. cheap skate shoes

    good posts,the good article haha!download free now

    Reply
  43. soccer jerseys well-marked

    Your style is very unique compared to other folks I’ve read stuff from.
    Many thanks for posting when you have the opportunity, Guess I’ll just
    bookmark this site.

    Reply
  44. heart disease multiply

    Thanks for your marvelous posting! I really enjoyed reading it, you’re a great author.
    I will ensure that I bookmark your blog and may come back from now
    on. I want to encourage you to ultimately continue your great
    work, have a nice holiday weekend!

    Reply
  45. mooc.cau.ac.kr

    Great weblog right here! Additionally your web site so much up fast!
    What web host are you the use of? Can I get your associate link to
    your host? I desire my site loaded up as quickly as yours lol

    Reply
  46. heart protection

    Hello, I think your blog might be having browser compatibility issues.
    When I look at your blog site in Chrome, it looks fine but when opening
    in Internet Explorer, it has some overlapping. I just wanted to give
    you a quick heads up! Other then that, fantastic blog!

    Reply
  47. confer heart protection

    Great site you have here but I was curious about if you knew of any community
    forums that cover the same topics talked about here? I’d really love to be
    a part of online community where I can get advice from other knowledgeable individuals that share the same interest.
    If you have any recommendations, please let me know.
    Thanks!

    Reply
  48. media reaches

    Hi friends, how is the whole thing, and what you want
    to say regarding this paragraph, in my view
    its in fact awesome in favor of me.

    Reply
  49. computer protection professionals

    Good day! This is my first visit to your blog! We are a team of volunteers and starting a new initiative in a community
    in the same niche. Your blog provided us useful information to work on. You have done a
    outstanding job!

    Reply
  50. http://www.pssquared.co.uk

    I like it when folks get together and share ideas.

    Great site, continue the good work!

    Reply

Leave a Comment

Your email address will not be published. Required fields are marked *