Is Philippine Bureau of Immigration website compromised, hosting malware?

According to Websense Security Labs™ and the Websense ThreatSeeker® Network, they have detected malicious emails disguised as HSBC Notifications.  A closer look at these emails, like the one you can see below, reveals that the link provided in the emails is a compromised URL belonging to the Philippine Bureau of Immigration.

Clicking the link prompts the user to download a malicious file called "atualizar.exe".

The Philippine Bureau of Immigration is using Joomla as their CMS and there is a file named “atualizar.php” which is a Portuguese word and translate to “update.php”. 

The file was probably replaced or inserted maliciously. This link “http://immigration.gov.ph/administrator/components/com_media/old/atualizar.php” if you hit it, the HTTP response status code is 302 which is the most common way of performing a redirection. It redirect to “http://immigration.gov.ph/administrator/components/com_media/old/atualizar.exe” which probably contain the actual payload…

   1:  

   2: [kramfs@viasvr temp]$ wget http://immigration.gov.ph/administrator/components/com_media/old/atualizar.php

   3: --2011-08-10 

   4: 17:15:03-- http://immigration.gov.ph/administrator/components/com_media/old/atualizar.php

   5: Resolving 

   6: immigration.gov.ph... 124.6.144.116

   7: Connecting to 

   8: immigration.gov.ph|124.6.144.116|:80... connected.

   9: HTTP request sent, 

  10: awaiting response... 302 Found

  11: Location: http://immigration.gov.ph/administrator/components/com_media/old/atualizar.exe 

  12: [following]

  13: --2011-08-10 17:15:04-- http://immigration.gov.ph/administrator/components/com_media/old/atualizar.exe

  14: Reusing 

  15: existing connection to immigration.gov.ph:80.

  16: HTTP request sent, awaiting 

  17: response... No data received.

  18: Retrying.

  19: --2011-08-10 17:15:05-- (try: 2) http://immigration.gov.ph/administrator/components/com_media/old/atualizar.exe

  20: Connecting 

  21: to immigration.gov.ph|124.6.144.116|:80... connected.

  22: HTTP request sent, 

  23: awaiting response... 200 OK

  24: Length: 699460 (683K) 

  25: [application/x-msdos-program]

  26: Saving to: âatualizar.exeâ

  27: 100%[============================================================================>] 

  28: 699,460 63.4K/s in 12s

  29: 2011-08-10 17:15:17 (57.2 KB/s) - âatualizar.exeâ

 

Trend Micro flag this file as malicious….

image

You can find the VirusTotal analysis results for this .exe as it is detected by different AV solutions.

Source Reference: Websense Security Labs

1,718 Comments

  1. augusto de arruda botelho

    Oh my goodness! Amazing article dude! Thanks, However I am going through issues
    with your RSS. I don’t know why I can’t subscribe to it.
    Is there anybody having identical RSS problems? Anybody who knows the answer will you kindly respond?
    Thanx!!

    Reply
  2. cialis onlie

    a shower alternative to viagra and cialis military generic cialis
    s blade can viagra and cialis be taken together direction [url=http://hqcialismog.com/]generic cialis online[/url] cialis canada discount chain

    Reply
  3. Lelio Vieira Carneiro Junior

    Hurrah! In the end I got a webpage from where I be capable of actually obtain valuable
    data concerning my study and knowledge.

    Reply
  4. all these things that i've done

    Hi there, You have done a great job. I will certainly digg
    it and personally suggest to my friends. I’m sure they
    will be benefited from this web site.

    Reply
  5. Eugenio

    It’s really very complicated in this active life to listen news on TV, so I simply
    use internet for that purpose, and get the latest information.

    Reply
  6. cialis online

    is generic cialis legal in the us
    buy generic cialis
    quanto tempo prima devo prendere il cialis
    [url=http://buyscialisrx.com/]generic cialis online[/url]
    viagra vs cialis canada

    Reply
  7. cari cara cepat hamil

    you’re actually a good webmaster. The site loading velocity
    is amazing. It sort of feels that you’re doing any distinctive trick.
    Also, The contents are masterpiece. you have done a excellent task in this subject!

    Reply
  8. tku.16mb.com

    Wow, incredible blog layout! How long have you been blogging
    for? you made blogging look easy. The overall look of your site is great, as well as the content!

    Reply
  9. Silvia Odete Morani Massad

    It’s going to be end of mine day, except before end I am reading this great paragraph to improve my knowledge.

    Reply
  10. Lelio Vieira Carneiro Junior

    This post is worth everyone’s attention. Where can I find out
    more?

    Reply
  11. Brodie

    Hi there would you mind stating which blog platform you’re using?
    I’m going to start my own blog soon but I’m having a tough
    time making a decision between BlogEngine/Wordpress/B2evolution and Drupal.
    The reason I ask is because your layout seems different
    then most blogs and I’m looking for something unique.

    P.S My apologies for getting off-topic but I had to ask!

    Reply
  12. ??????

    ????????????????????????????????????? ??????????????????? ???????? ???????????????????????????????????? ‘ Shift + Del ?? FAT32 ???????????????????????????????????????????????????? ? ?????????????????????????????????????????? ?????????????????????????????????????????? ????????????????????? , ???????????????????????????????????????????

    Reply
  13. Matthias

    I am not sure where you are getting your information, but good
    topic. I needs to spend some time learning more or understanding more.

    Thanks for fantastic info I was looking for this information for my mission.

    Reply
  14. Mary

    whoah this weblog is wonderful i like reading your posts. Stay up
    the good work! You realize, a lot of persons are
    looking around for this information, you can aid them greatly.

    Reply
  15. Joan

    I think the admin of this web site is actually working hard in support of his website,
    because here every stuff is quality based stuff.

    Reply
  16. data recovery software

    thanks for the posts,it’right! get free now yorn rov

    Reply
  17. data recovery software

    nice posts, the good article haha!download free now rov PC, rov download

    Reply
  18. hyip review

    This web site is really a walk-through for all of the info you wanted about this and didn?t know who to ask. Glimpse here, and you?ll definitely discover it.

    Reply
  19. trading penny stocks

    Thank you for another fantastic post. The place else could
    anyone get that type of info in such an ideal approach of writing?
    I have a presentation subsequent week, and I’m on the search for such info.

    Reply
  20. Camgirl

    You made some decent points there. I looked on the internet for the issue and found most individuals will go along with with your website.

    Reply
  21. rodemb.co.kr

    Howdy very nice web site!! Guy .. Excellent .. Superb .. I
    will bookmark your site and take the feeds additionally? I’m happy to find numerous
    helpful info right here within the post, we need develop extra strategies on this regard, thank
    you for sharing. . . . . .

    Reply
  22. see my website

    When I originally commented I clicked the -Notify me when new comments are added- checkbox and now each time a comment is added I get four emails with the same comment. Is there any way you can remove me from that service? Thanks!

    Reply
  23. start up business loans

    Thanks for your marvelous posting! I quite enjoyed reading it, you happen to be a great author.
    I will be sure to bookmark your blog and definitely will come back in the foreseeable future.
    I want to encourage that you continue your great work, have a nice day!

    Reply
  24. students

    Nice post. I learn something more challenging on different blogs everyday. It will always be stimulating to read content from other writers and practice a little something from their store. I?d prefer to use some with the content on my blog whether you don?t mind. Natually I?ll give you a link on your web blog. Thanks for sharing.

    Reply
  25. street wear

    It?s hard to find knowledgeable people on this topic, but you sound like you know what you?re talking about! Thanks

    Reply
  26. Budget Couture

    This is the right blog for anyone who wants to find out about this topic. You realize so much its almost hard to argue with you (not that I actually would want?HaHa). You definitely put a new spin on a topic thats been written about for years. Great stuff, just great!

    Reply
  27. see my site

    I am often to blogging and i really appreciate your content. The article has really peaks my interest. I am going to bookmark your site and keep checking for new information.

    Reply
  28. see more

    This web site is really a walk-through for all of the info you wanted about this and didn?t know who to ask. Glimpse here, and you?ll definitely discover it.

    Reply
  29. see my website

    WONDERFUL Post.thanks for share..more wait .. 😉 ?

    Reply
  30. perkins loans allow

    What’s up, I wish for to subscribe for this web site to take most up-to-date updates, thus where can i do it please help.

    Reply
  31. buku panduan cepat hamil dr rosdiana

    Thank you, I have just been looking for info about
    this topic for a long time and yours is the best I’ve discovered till
    now. However, what concerning the conclusion? Are you
    positive concerning the supply?

    Reply
  32. pc computer cleaner resource 641

    you can get freeware now ,after click the link,get free now

    Reply
  33. Tamela

    What’s up to every , since I am genuinely eager of reading
    this webpage’s post to be updated regularly. It contains fastidious material.

    Reply
  34. see more about my site

    It’s onerous to seek out educated folks on this matter, but you sound like you already know what you’re talking about! Thanks
    see more about my site

    Reply
  35. see more about my site

    You need to participate in a contest for top-of-the-line blogs on the web. I will advocate this website!
    see more about my site

    Reply
  36. kontol

    This is the proper blog for anybody who needs to find out about this topic. You notice a lot its virtually laborious to argue with you (not that I truly would need…HaHa). You definitely put a brand new spin on a subject thats been written about for years. Nice stuff, simply great!

    Reply
  37. con-ciencia.cl

    Pretty! This has been an extremely wonderful post.

    Thank you for supplying these details.

    Reply
  38. Shore excursions Saint Lucia

    You need to participate in a contest for among the finest blogs on the web. I’ll suggest this web site!
    Shore excursions Saint Lucia

    Reply
  39. caribbean wedding cost

    There are definitely a lot of details like that to take into consideration. That is a nice level to deliver up. I supply the thoughts above as common inspiration however clearly there are questions just like the one you convey up where a very powerful factor might be working in sincere good faith. I don?t know if greatest practices have emerged round issues like that, however I’m positive that your job is clearly recognized as a fair game. Both girls and boys feel the influence of only a moment’s pleasure, for the rest of their lives.

    Reply
  40. things you need to go camping

    Hey there excellent blog! Does running a blog like this take a large amount of work?

    I have absolutely no expertise in programming however I had been hoping to start my own blog soon. Anyway, if you have any ideas or techniques for new blog owners
    please share. I understand this is off topic nevertheless I just had to ask.

    Appreciate it!

    Reply
  41. putlocker

    Nice post. I be taught one thing more difficult on completely different blogs everyday. It is going to all the time be stimulating to read content from other writers and observe just a little one thing from their store. I’d want to use some with the content material on my weblog whether or not you don’t mind. Natually I’ll provide you with a link on your net blog. Thanks for sharing.

    Reply
  42. check more at my website

    Once I initially commented I clicked the -Notify me when new comments are added- checkbox and now every time a comment is added I get 4 emails with the same comment. Is there any method you can remove me from that service? Thanks!

    Reply
  43. Michaeljinty

    [url=http://genericcialisonline5.com/]buying generic cialis[/url]
    cialis generic best price
    buy generic cialis online
    cialis generic best price

    Reply
  44. loan providers

    Hey! I could have sworn I’ve been to this
    site before but after browsing through some of the post I
    realized it’s new to me. Anyways, I’m definitely happy I found it and I’ll be bookmarking and checking back often!

    Reply
  45. real estate license

    May I simply just say what a relief to find someone who
    genuinely understands what they are talking about online.
    You actually know how to bring an issue to light
    and make it important. More and more people must check this out
    and understand this side of your story. I was surprised that you’re not more popular given that you most certainly possess the gift.

    Reply
  46. all you need to know about the music business

    Do you mind if I quote a couple of your articles as long as I provide credit and sources back
    to your website? My blog is in the exact same area of interest
    as yours and my visitors would truly benefit from a lot of the information you provide here.
    Please let me know if this okay with you.
    Thank you!

    Reply
  47. check out my website

    There are certainly a whole lot of details like that to take into consideration. That may be a great level to carry up. I provide the ideas above as normal inspiration but clearly there are questions just like the one you carry up where the most important factor will likely be working in sincere good faith. I don?t know if greatest practices have emerged around things like that, however I am sure that your job is clearly identified as a fair game. Both boys and girls feel the impact of just a second’s pleasure, for the rest of their lives.

    Reply
  48. see my website

    I’m usually to blogging and i actually admire your content. The article has really peaks my interest. I am going to bookmark your website and maintain checking for brand new information.

    Reply
  49. see my website

    This is the correct blog for anybody who desires to find out about this topic. You notice so much its nearly laborious to argue with you (not that I truly would need…HaHa). You positively put a brand new spin on a subject thats been written about for years. Great stuff, just great!

    Reply
  50. see my website

    Youre so cool! I dont suppose Ive read something like this before. So nice to find someone with some unique ideas on this subject. realy thanks for starting this up. this website is one thing that’s wanted on the internet, somebody with just a little originality. helpful job for bringing one thing new to the web!

    Reply

Leave a Comment

Your email address will not be published. Required fields are marked *