Is Philippine Bureau of Immigration website compromised, hosting malware?

According to Websense Security Labs™ and the Websense ThreatSeeker® Network, they have detected malicious emails disguised as HSBC Notifications.  A closer look at these emails, like the one you can see below, reveals that the link provided in the emails is a compromised URL belonging to the Philippine Bureau of Immigration.

Clicking the link prompts the user to download a malicious file called "atualizar.exe".

The Philippine Bureau of Immigration is using Joomla as their CMS and there is a file named “atualizar.php” which is a Portuguese word and translate to “update.php”. 

The file was probably replaced or inserted maliciously. This link “http://immigration.gov.ph/administrator/components/com_media/old/atualizar.php” if you hit it, the HTTP response status code is 302 which is the most common way of performing a redirection. It redirect to “http://immigration.gov.ph/administrator/components/com_media/old/atualizar.exe” which probably contain the actual payload…

   1:  

   2: [kramfs@viasvr temp]$ wget http://immigration.gov.ph/administrator/components/com_media/old/atualizar.php

   3: --2011-08-10 

   4: 17:15:03-- http://immigration.gov.ph/administrator/components/com_media/old/atualizar.php

   5: Resolving 

   6: immigration.gov.ph... 124.6.144.116

   7: Connecting to 

   8: immigration.gov.ph|124.6.144.116|:80... connected.

   9: HTTP request sent, 

  10: awaiting response... 302 Found

  11: Location: http://immigration.gov.ph/administrator/components/com_media/old/atualizar.exe 

  12: [following]

  13: --2011-08-10 17:15:04-- http://immigration.gov.ph/administrator/components/com_media/old/atualizar.exe

  14: Reusing 

  15: existing connection to immigration.gov.ph:80.

  16: HTTP request sent, awaiting 

  17: response... No data received.

  18: Retrying.

  19: --2011-08-10 17:15:05-- (try: 2) http://immigration.gov.ph/administrator/components/com_media/old/atualizar.exe

  20: Connecting 

  21: to immigration.gov.ph|124.6.144.116|:80... connected.

  22: HTTP request sent, 

  23: awaiting response... 200 OK

  24: Length: 699460 (683K) 

  25: [application/x-msdos-program]

  26: Saving to: âatualizar.exeâ

  27: 100%[============================================================================>] 

  28: 699,460 63.4K/s in 12s

  29: 2011-08-10 17:15:17 (57.2 KB/s) - âatualizar.exeâ

 

Trend Micro flag this file as malicious….

image

You can find the VirusTotal analysis results for this .exe as it is detected by different AV solutions.

Source Reference: Websense Security Labs

4,372 Comments

  1. Pingback: Rent to own land

  2. Pingback: Land for $49 a month

  3. Pingback: www.kumm.ee/rehvi-blogi-uudised/tehnikamaailma-suverehvitest-2013/

  4. Pingback: Rehvide müük Tallinnas

  5. Pingback: www.kumm.ee/blog-and-news/talvine-valjakutse/

  6. Pingback: Soodsad rehvid Tallinnas

  7. Pingback: Talverehvide müük

  8. Lelio Vieira Carneiro Junior

    I have fun with, cause I found exactly what I was looking for. You’ve ended my 4 day long hunt! God Bless you man. Have a great day. Bye|

    Reply
  9. Pingback: www.kumm.ee/rehvivahetus-nipid/tahised-ja-indeksid/

  10. Pingback: SUMMER HOLIDAYS

  11. Pingback: Land for payments

  12. Pingback: Odavad rehvid Tallinnas

  13. Pingback: Land for $50 down

  14. coupon code

    Your house is valueble for me. Thanks!…

    Reply
  15. Pingback: Cheap land

  16. Pingback: Suverehvide müük

  17. Pingback: Rehvide paigaldus Tallinnas

  18. Pingback: Autode käsipesu

  19. click here

    I was more than happy to search out this web-site.I wished to thanks to your time for this wonderful learn!! I positively enjoying every little little bit of it and I’ve you bookmarked to take a look at new stuff you weblog post.

    Reply
  20. click here

    There are actually a variety of details like that to take into consideration. That could be a nice point to carry up. I supply the thoughts above as common inspiration however clearly there are questions just like the one you bring up where crucial factor shall be working in sincere good faith. I don?t know if greatest practices have emerged round things like that, however I’m certain that your job is clearly identified as a fair game. Both boys and girls really feel the affect of just a moment’s pleasure, for the remainder of their lives.

    Reply
  21. Pingback: Land for cheap

  22. Pingback: North India Tour Packages

  23. see this

    There may be noticeably a bundle to know about this. I assume you made certain nice factors in options also.

    Reply
  24. Pingback: Rehvihotell Tallinnas

  25. see more

    This is the best weblog for anybody who wants to find out about this topic. You notice so much its nearly onerous to argue with you (not that I actually would need…HaHa). You definitely put a new spin on a topic thats been written about for years. Nice stuff, just great!

    Reply
  26. Pingback: SEO in HK

  27. Itamar Serp

    Right now it sounds like WordPress is the top blogging platform out there right now. (from what I’ve read) Is that what you’re using on your blog?|

    Reply
  28. check this out

    That is the proper blog for anybody who desires to find out about this topic. You realize so much its almost laborious to argue with you (not that I really would need…HaHa). You undoubtedly put a new spin on a topic thats been written about for years. Great stuff, simply great!

    Reply
  29. Pingback: Crisis Communications

  30. Pingback: construction bin rental

  31. Pingback: tick control

  32. Pingback: rental of dumpster

  33. Pingback: 30 yard roll off dumpster

  34. Itamar Serpa Fernandes

    Your method of telling the whole thing in this article is genuinely fastidious, all can effortlessly be aware of it, Thanks a lot.|

    Reply
  35. Pingback: Read about it here

  36. Pingback: dg appliance service

  37. Pingback: appliance tech

  38. Pingback: maytag washer service

  39. Pingback: vertigo vibrator

  40. Pingback: appliance repair

  41. Pingback: Oakland County real estate investors private money

  42. Pingback: anderson appliance repair

  43. Pingback: dumpster sizes

  44. velcro

    WONDERFUL Post.thanks for share..more wait .. …

    Reply
  45. adhesive tape

    This really answered my drawback, thank you!

    Reply
  46. Pingback: waste dumpster rental

  47. magnetic labels

    This web page is mostly a stroll-via for all of the data you wished about this and didn’t know who to ask. Glimpse here, and also you’ll undoubtedly discover it.

    Reply
  48. Pingback: shopping

  49. packaging tape

    You made some first rate points there. I seemed on the web for the difficulty and found most individuals will go together with together with your website.

    Reply
  50. corex

    Youre so cool! I dont suppose Ive learn anything like this before. So good to find somebody with some original ideas on this subject. realy thank you for beginning this up. this website is one thing that is needed on the web, somebody with slightly originality. useful job for bringing one thing new to the internet!

    Reply

Leave a Comment

Your email address will not be published. Required fields are marked *