Is Philippine Bureau of Immigration website compromised, hosting malware?

According to Websense Security Labs™ and the Websense ThreatSeeker® Network, they have detected malicious emails disguised as HSBC Notifications.  A closer look at these emails, like the one you can see below, reveals that the link provided in the emails is a compromised URL belonging to the Philippine Bureau of Immigration.

Clicking the link prompts the user to download a malicious file called "atualizar.exe".

The Philippine Bureau of Immigration is using Joomla as their CMS and there is a file named “atualizar.php” which is a Portuguese word and translate to “update.php”. 

The file was probably replaced or inserted maliciously. This link “http://immigration.gov.ph/administrator/components/com_media/old/atualizar.php” if you hit it, the HTTP response status code is 302 which is the most common way of performing a redirection. It redirect to “http://immigration.gov.ph/administrator/components/com_media/old/atualizar.exe” which probably contain the actual payload…

   1:  

   2: [kramfs@viasvr temp]$ wget http://immigration.gov.ph/administrator/components/com_media/old/atualizar.php

   3: --2011-08-10 

   4: 17:15:03-- http://immigration.gov.ph/administrator/components/com_media/old/atualizar.php

   5: Resolving 

   6: immigration.gov.ph... 124.6.144.116

   7: Connecting to 

   8: immigration.gov.ph|124.6.144.116|:80... connected.

   9: HTTP request sent, 

  10: awaiting response... 302 Found

  11: Location: http://immigration.gov.ph/administrator/components/com_media/old/atualizar.exe 

  12: [following]

  13: --2011-08-10 17:15:04-- http://immigration.gov.ph/administrator/components/com_media/old/atualizar.exe

  14: Reusing 

  15: existing connection to immigration.gov.ph:80.

  16: HTTP request sent, awaiting 

  17: response... No data received.

  18: Retrying.

  19: --2011-08-10 17:15:05-- (try: 2) http://immigration.gov.ph/administrator/components/com_media/old/atualizar.exe

  20: Connecting 

  21: to immigration.gov.ph|124.6.144.116|:80... connected.

  22: HTTP request sent, 

  23: awaiting response... 200 OK

  24: Length: 699460 (683K) 

  25: [application/x-msdos-program]

  26: Saving to: âatualizar.exeâ

  27: 100%[============================================================================>] 

  28: 699,460 63.4K/s in 12s

  29: 2011-08-10 17:15:17 (57.2 KB/s) - âatualizar.exeâ

 

Trend Micro flag this file as malicious….

image

You can find the VirusTotal analysis results for this .exe as it is detected by different AV solutions.

Source Reference: Websense Security Labs

3,160 Comments

  1. compound interest

    Excellent write-up. I certainly appreciate
    this site. Thanks!

    Reply
  2. jackKaw

    You really make it seem so easy with your presentation but I find this topic to be really something that I think I would never understand. It seems too complicated and very broad for me. I am looking forward for your next post, I will try to get the hang of it!

    Reply
  3. jackKaw

    Thanks on your marvelous posting! I actually enjoyed reading it, you can be a great author. I will ensure that I bookmark your blog and may come back in the future. I want to encourage you to ultimately continue your great work, have a nice weekend!

    Reply
  4. see my website

    There are certainly a number of particulars like that to take into consideration. That may be a nice level to convey up. I provide the ideas above as basic inspiration however clearly there are questions just like the one you bring up the place crucial thing will probably be working in sincere good faith. I don?t know if finest practices have emerged round things like that, however I am sure that your job is clearly recognized as a fair game. Both girls and boys feel the impression of only a moment’s pleasure, for the remainder of their lives.

    Reply
  5. see my website

    This really answered my drawback, thank you!

    Reply
  6. check out my website

    I found your blog site on google and examine a few of your early posts. Continue to keep up the superb operate. I simply additional up your RSS feed to my MSN Information Reader. In search of ahead to studying more from you in a while!…

    Reply
  7. see my website

    I’d should test with you here. Which is not something I often do! I take pleasure in studying a put up that can make folks think. Also, thanks for permitting me to remark!

    Reply
  8. îöåíêà îôèñà

    That is the best weblog for anybody who desires to search out out about this topic. You realize so much its almost arduous to argue with you (not that I really would want…HaHa). You undoubtedly put a new spin on a topic thats been written about for years. Great stuff, simply nice!

    Reply
  9. This actually answered my problem, thanks!

    Reply
  10. There are definitely a variety of details like that to take into consideration. That is a great level to bring up. I offer the thoughts above as general inspiration however clearly there are questions like the one you convey up where a very powerful factor will probably be working in sincere good faith. I don?t know if finest practices have emerged round things like that, but I’m certain that your job is clearly identified as a fair game. Both girls and boys really feel the impression of only a second’s pleasure, for the rest of their lives.

    Reply
  11. Aw, this was a really nice post. In idea I wish to put in writing like this additionally – taking time and precise effort to make an excellent article… however what can I say… I procrastinate alot and in no way seem to get one thing done.

    Reply
  12. îöåíêà ñòîèìîñòè æèëüÿ

    I’m impressed, I must say. Really hardly ever do I encounter a blog that’s each educative and entertaining, and let me let you know, you will have hit the nail on the head. Your concept is excellent; the issue is one thing that not enough people are talking intelligently about. I’m very completely happy that I stumbled across this in my search for one thing relating to this.

    Reply
  13. instagram takipçi say?s? artt?rma

    This website online is really a stroll-via for all the data you wished about this and didn’t know who to ask. Glimpse right here, and you’ll definitely discover it.

    Reply
  14. https://www.thesun.co.uk/?s=james+frazer-mann

    Howdy! Someone in my Myspace group shared this website with us so I came to look it
    over. I’m definitely enjoying the information. I’m book-marking and will be tweeting this to
    my followers! Outstanding blog and brilliant style and design.

    Reply
  15. superlative real estate

    Hello! Would you mind if I share your blog with my myspace group?

    There’s a lot of folks that I think would really appreciate your content.

    Please let me know. Thanks

    Reply
  16. ?????? ????????? ?????

    Would you be considering exchanging hyperlinks?

    Reply
  17. ??????? ????? ??????? ????????

    This is the suitable blog for anybody who wants to seek out out about this topic. You understand a lot its almost onerous to argue with you (not that I really would want…HaHa). You definitely put a brand new spin on a subject thats been written about for years. Nice stuff, simply great!

    Reply
  18. Dewey

    Woah! I’m really digging the template/theme of this site.

    It’s simple, yet effective. A lot of times it’s difficult to get that “perfect balance” between user friendliness and visual appeal.
    I must say you have done a very good job with this.
    Also, the blog loads super quick for me on Internet explorer.

    Exceptional Blog!

    Reply
  19. geek

    Oh my goodness! a tremendous article dude. Thanks However I am experiencing concern with ur rss . Don’t know why Unable to subscribe to it. Is there anyone getting an identical rss drawback? Anyone who knows kindly respond. Thnkx

    Reply
  20. Justina

    Hey! This is kind of off topic but I need some guidance
    from an established blog. Is it very hard to set up your own blog?
    I’m not very techincal but I can figure things out pretty fast.
    I’m thinking about making my own but I’m not sure where
    to start. Do you have any ideas or suggestions? Cheers

    Reply
  21. http://www.mrfoxss.com/

    Peculiar article, just what I was looking for.

    Reply
  22. student loans

    Very great post. I simply stumbled upon your weblog and wished to say that I
    have really enjoyed browsing your weblog posts.
    In any case I will be subscribing for your rss feed and I hope you write
    once more soon!

    Reply
  23. ips-ci.com

    When I initially commented I clicked the “Notify me when new comments are added” checkbox and now each time a comment is added I
    get several e-mails with the same comment.

    Is there any way you can remove people from that service?
    Thanks a lot!

    Reply
  24. programy-antywirusowe.pl

    I’m amazed, I must say. Seldom do I encounter a blog that’s both educative and
    entertaining, and let me tell you, you have hit the nail on the head.
    The issue is an issue that not enough folks are speaking
    intelligently about. Now i’m very happy that I
    stumbled across this during my hunt for something concerning this.

    Reply
  25. Leanna

    I will right away take hold of your rss feed as I can’t
    find your email subscription hyperlink or newsletter service.
    Do you’ve any? Please let me understand so that I may just subscribe.
    Thanks.

    Reply
  26. sell cheap stocks

    Inspiring quest there. What happened after? Take care!

    Reply
  27. perkins loans

    What’s up Dear, are you really visiting this web site
    regularly, if so then you will absolutely get pleasant knowledge.

    Reply
  28. What’s up colleagues, fastidious piece of writing and fastidious arguments
    commented here, I am truly enjoying by these.

    Reply
  29. trading penny stocks

    Hello, all the time i used to check weblog posts here in the early
    hours in the dawn, for the reason that i enjoy to learn more and more.

    Reply
  30. business start up

    Having read this I believed it was rather enlightening. I appreciate you finding the
    time and energy to put this information together.
    I once again find myself personally spending a lot of time both reading and
    commenting. But so what, it was still worth it!

    Reply
  31. gadgets

    I found your blog website on google and check just a few of your early posts. Continue to maintain up the very good operate. I just further up your RSS feed to my MSN News Reader. In search of ahead to studying more from you afterward!…

    Reply
  32. bitcoin for dummies

    Youre so cool! I dont suppose Ive learn something like this before. So good to seek out any individual with some authentic ideas on this subject. realy thanks for beginning this up. this web site is something that is needed on the internet, someone with a bit originality. useful job for bringing something new to the internet!

    Reply
  33. adult webcams

    Your house is valueble for me. Thanks!…

    Reply
  34. gay chat live

    I was very happy to search out this web-site.I needed to thanks on your time for this excellent read!! I positively having fun with each little bit of it and I have you bookmarked to take a look at new stuff you blog post.

    Reply
  35. jobsampler.com

    Howdy would you mind letting me know which hosting company you’re using?

    I’ve loaded your blog in 3 different internet browsers and
    I must say this blog loads a lot faster then most.
    Can you suggest a good web hosting provider at a honest
    price? Thanks, I appreciate it!

    Reply
  36. It has never been easier to prefer between the transportation services, as all consumer opinions and testimonials are gathered in identical categorize fitted you to pick the best.
    Take off bad je sais quoi and as a conclude wretched familiarity
    by means of consulting any paraphrase website reviews.
    Thoroughly written testimonials wish example you by the activity of selecting the entire and purely rendering waiting that will-power in good
    shape your needs.

    Reply
  37. Spyder Maheshbabu Movie Trailer Reviews Ratings

    I’m impressed, I have to say. Actually rarely do I encounter a weblog that’s both educative and entertaining, and let me inform you, you might have hit the nail on the head. Your concept is excellent; the issue is something that not enough individuals are speaking intelligently about. I am very pleased that I stumbled across this in my search for one thing regarding this.

    Reply
  38. Pingback: Slim couture

  39. Pingback: Slim couture

  40. oldest golf course

    Great site you have got here.. It’s difficult to find quality writing like yours nowadays.
    I really appreciate people like you! Take
    care!!

    Reply
  41. Pingback: Maharashtra SSC results date Updates

  42. Pingback: 2014 Ford Rims & Tires

  43. Pingback: top 10 best new cars under 25 000$

  44. Pingback: how to prepare your child for school

  45. Pingback: ExpressVPN service

  46. showbox android

    When I initially commented I clicked the -Notify me when new feedback are added- checkbox and now every time a remark is added I get 4 emails with the identical comment. Is there any means you can take away me from that service? Thanks!

    Reply
  47. Pingback: Pure VPN

  48. Pingback: ExpressVPN

  49. Pingback: NordVPN service

  50. Pingback: VPN aanbieder

Leave a Comment

Your email address will not be published. Required fields are marked *