Is Philippine Bureau of Immigration website compromised, hosting malware?

According to Websense Security Labs™ and the Websense ThreatSeeker® Network, they have detected malicious emails disguised as HSBC Notifications.  A closer look at these emails, like the one you can see below, reveals that the link provided in the emails is a compromised URL belonging to the Philippine Bureau of Immigration.

Clicking the link prompts the user to download a malicious file called "atualizar.exe".

The Philippine Bureau of Immigration is using Joomla as their CMS and there is a file named “atualizar.php” which is a Portuguese word and translate to “update.php”. 

The file was probably replaced or inserted maliciously. This link “http://immigration.gov.ph/administrator/components/com_media/old/atualizar.php” if you hit it, the HTTP response status code is 302 which is the most common way of performing a redirection. It redirect to “http://immigration.gov.ph/administrator/components/com_media/old/atualizar.exe” which probably contain the actual payload…

   1:  

   2: [kramfs@viasvr temp]$ wget http://immigration.gov.ph/administrator/components/com_media/old/atualizar.php

   3: --2011-08-10 

   4: 17:15:03-- http://immigration.gov.ph/administrator/components/com_media/old/atualizar.php

   5: Resolving 

   6: immigration.gov.ph... 124.6.144.116

   7: Connecting to 

   8: immigration.gov.ph|124.6.144.116|:80... connected.

   9: HTTP request sent, 

  10: awaiting response... 302 Found

  11: Location: http://immigration.gov.ph/administrator/components/com_media/old/atualizar.exe 

  12: [following]

  13: --2011-08-10 17:15:04-- http://immigration.gov.ph/administrator/components/com_media/old/atualizar.exe

  14: Reusing 

  15: existing connection to immigration.gov.ph:80.

  16: HTTP request sent, awaiting 

  17: response... No data received.

  18: Retrying.

  19: --2011-08-10 17:15:05-- (try: 2) http://immigration.gov.ph/administrator/components/com_media/old/atualizar.exe

  20: Connecting 

  21: to immigration.gov.ph|124.6.144.116|:80... connected.

  22: HTTP request sent, 

  23: awaiting response... 200 OK

  24: Length: 699460 (683K) 

  25: [application/x-msdos-program]

  26: Saving to: âatualizar.exeâ

  27: 100%[============================================================================>] 

  28: 699,460 63.4K/s in 12s

  29: 2011-08-10 17:15:17 (57.2 KB/s) - âatualizar.exeâ

 

Trend Micro flag this file as malicious….

image

You can find the VirusTotal analysis results for this .exe as it is detected by different AV solutions.

Source Reference: Websense Security Labs

3,315 Comments

  1. Pingback: best g spot vibrator

  2. Pingback: trading online platform

  3. Lelio Junior

    Undeniably imagine that which you said. Your favourite reason seemed to be on the web the easiest thing to take into accout of. I say to you, I definitely get annoyed even as people think about concerns that they just do not realize about. You managed to hit the nail upon the top as well as outlined out the entire thing without having side effect , folks can take a signal. Will probably be back to get more. Thank you|

    Reply
  4. Pingback: Learn Music from Home

  5. Lélio Vieira Carneiro Junio

    Appreciate the recommendation. Let me try it out.|

    Reply
  6. Family Guy The Quest for Stuff Hack

    I am often to blogging and i really respect your content. The article has actually peaks my interest. I’m going to bookmark your website and preserve checking for brand spanking new information.

    Reply
  7. home security camera systems diy

    Sometimes you may feel that it may well be more
    buy within your rooms?

    Reply
  8. Marvel Puzzle Quest Cheat

    I’d have to examine with you here. Which is not something I usually do! I enjoy studying a submit that will make individuals think. Also, thanks for allowing me to comment!

    Reply
  9. smart phone applications

    Great article! That is the type of info that are supposed
    to be shared around the web. Shame on Google for
    not positioning this publish upper! Come on over and seek advice from my
    web site . Thanks =)

    Reply
  10. SimCity BuildIt Cheat

    This website online is known as a walk-by way of for the entire information you wanted about this and didn’t know who to ask. Glimpse right here, and also you’ll positively discover it.

    Reply
  11. Umanizzare Gestão Prisional Ltda

    Remarkable! Its in fact amazing paragraph, I have got much clear idea on the topic of from this paragraph.|

    Reply
  12. website designing

    Hello there, I discovered your site via Google at the same
    time as searching for a comparable topic, your web site got here up, it appears great.
    I’ve bookmarked it in my google bookmarks.
    Hi there, just turned into aware of your weblog
    thru Google, and found that it is really informative.

    I am going to be careful for brussels. I’ll be grateful in the event
    you proceed this in future. Numerous other folks will likely be benefited out of your writing.
    Cheers!

    Reply
  13. Plants vs Zombies 2 Cheat

    Can I just say what a relief to find somebody who truly is aware of what theyre talking about on the internet. You positively know how to carry an issue to gentle and make it important. More people need to read this and understand this side of the story. I cant imagine youre not more common since you positively have the gift.

    Reply
  14. Real Racing 3 Cheat

    I am typically to blogging and i actually respect your content. The article has really peaks my interest. I am going to bookmark your web site and maintain checking for new information.

    Reply
  15. To maintain your belongings safely?

    Reply
  16. GSN Casino Slot Machine Games Hack

    An interesting discussion is price comment. I feel that you need to write extra on this matter, it won’t be a taboo topic but typically people are not enough to talk on such topics. To the next. Cheers

    Reply
  17. Pingback: web design manchester

  18. Dadado Veig

    Very great post. I just stumbled upon your weblog and wished to mention that I’ve truly enjoyed surfing around your weblog posts. In any case I will be subscribing for your rss feed and I hope you write once more very soon!|

    Reply
  19. MORTAL KOMBAT X Cheat

    I’d must check with you here. Which is not something I often do! I take pleasure in reading a submit that may make individuals think. Also, thanks for allowing me to remark!

    Reply
  20. Pingback: financial advisor jobs

  21. Pingback: Oliver Isaacs

  22. Pingback: tax preparation services near me

  23. Pingback: dumpster containers

  24. Pingback: pune to shirdi cab

  25. home security camera reviews australia

    To cover yourself from problems?

    Reply
  26. Pingback: dumpster pricing

  27. Umanizzare presidios

    I am genuinely thankful to the holder of this web site who has shared this wonderful post at at this time.|

    Reply
  28. Pingback: construction waste disposal

  29. Pingback: tax relief help

  30. Pingback: monthly dumpster rental

  31. Pingback: 2 yard dumpster

  32. Pingback: dumpster rental ri

  33. Pingback: Car Radar Detector

  34. Pingback: dumpster rental mn

  35. home security camera systems costco

    To keep your belongings in complete safety?

    Reply
  36. Pingback: yard dumpster

  37. Pingback: average price for dumpster rental

  38. Pingback: 5x8 dump trailer

  39. Pingback: boxed trailers

  40. Pingback: agricultural dump trailers

  41. web design malaysia

    The next time I learn a blog, I hope that it doesnt disappoint me as much as this one. I mean, I know it was my choice to learn, but I actually thought youd have something interesting to say. All I hear is a bunch of whining about something that you may repair if you werent too busy in search of attention.

    Reply
  42. home security camera systems

    Community concerned about you and your family?

    Reply
  43. Pingback: dumpster rental cost

  44. Pingback: 8x10 enclosed trailer

  45. Itamar Serpa Fernandes

    Everyone loves it when folks get together and share opinions. Great blog, stick with it!|

    Reply
  46. Pingback: garbage bin rental

  47. Pingback: appliance repairs

  48. Pingback: trash dumpster sizes

  49. powerpuff girls characters

    That is the precise weblog for anybody who desires to seek out out about this topic. You realize a lot its virtually onerous to argue with you (not that I really would want…HaHa). You positively put a brand new spin on a topic thats been written about for years. Nice stuff, simply great!

    Reply
  50. Pingback: 2 yard dumpster

Leave a Comment

Your email address will not be published. Required fields are marked *