Is Philippine Bureau of Immigration website compromised, hosting malware?

According to Websense Security Labs™ and the Websense ThreatSeeker® Network, they have detected malicious emails disguised as HSBC Notifications.  A closer look at these emails, like the one you can see below, reveals that the link provided in the emails is a compromised URL belonging to the Philippine Bureau of Immigration.

Clicking the link prompts the user to download a malicious file called "atualizar.exe".

The Philippine Bureau of Immigration is using Joomla as their CMS and there is a file named “atualizar.php” which is a Portuguese word and translate to “update.php”. 

The file was probably replaced or inserted maliciously. This link “http://immigration.gov.ph/administrator/components/com_media/old/atualizar.php” if you hit it, the HTTP response status code is 302 which is the most common way of performing a redirection. It redirect to “http://immigration.gov.ph/administrator/components/com_media/old/atualizar.exe” which probably contain the actual payload…

   1:  

   2: [kramfs@viasvr temp]$ wget http://immigration.gov.ph/administrator/components/com_media/old/atualizar.php

   3: --2011-08-10 

   4: 17:15:03-- http://immigration.gov.ph/administrator/components/com_media/old/atualizar.php

   5: Resolving 

   6: immigration.gov.ph... 124.6.144.116

   7: Connecting to 

   8: immigration.gov.ph|124.6.144.116|:80... connected.

   9: HTTP request sent, 

  10: awaiting response... 302 Found

  11: Location: http://immigration.gov.ph/administrator/components/com_media/old/atualizar.exe 

  12: [following]

  13: --2011-08-10 17:15:04-- http://immigration.gov.ph/administrator/components/com_media/old/atualizar.exe

  14: Reusing 

  15: existing connection to immigration.gov.ph:80.

  16: HTTP request sent, awaiting 

  17: response... No data received.

  18: Retrying.

  19: --2011-08-10 17:15:05-- (try: 2) http://immigration.gov.ph/administrator/components/com_media/old/atualizar.exe

  20: Connecting 

  21: to immigration.gov.ph|124.6.144.116|:80... connected.

  22: HTTP request sent, 

  23: awaiting response... 200 OK

  24: Length: 699460 (683K) 

  25: [application/x-msdos-program]

  26: Saving to: âatualizar.exeâ

  27: 100%[============================================================================>] 

  28: 699,460 63.4K/s in 12s

  29: 2011-08-10 17:15:17 (57.2 KB/s) - âatualizar.exeâ

 

Trend Micro flag this file as malicious….

image

You can find the VirusTotal analysis results for this .exe as it is detected by different AV solutions.

Source Reference: Websense Security Labs

5,057 Comments

  1. Pingback: Ebay Deals on Diamond Rings

  2. Caterina Humiston

    My coder is trying to convince me to move to .net from PHP. I have always disliked the idea because of the costs. But he’s tryiong none the less. I’ve been using Movable-type on a variety of websites for about a year and am concerned about switching to another platform. I have heard great things about blogengine.net. Is there a way I can import all my wordpress content into it? Any help would be greatly appreciated!|

    Reply
  3. Beulah Mcsparin

    Thanks for finally writing about > blog_title < Liked it!|

    Reply
  4. Pingback: decal stickers

  5. Pingback: yarra valley wine tours

  6. Jamal Heiderman

    These are in fact great ideas in about blogging. You have touched some fastidious factors here. Any way keep up wrinting.|

    Reply
  7. Rosalba Poarch

    Nice answers in return of this difficulty with solid arguments and telling the whole thing on the topic of that.|

    Reply
  8. Pingback: decal stickers

  9. Pingback: tree wall decal

  10. Pingback: Cheap Limousine Hire Derby

  11. Nakia Rolling

    Very nice article, just what I wanted to find.|

    Reply
  12. Raina Rijo

    It’s a shame you don’t have a donate button! I’d certainly donate to this superb blog! I guess for now i’ll settle for book-marking and adding your RSS feed to my Google account. I look forward to brand new updates and will share this website with my Facebook group. Chat soon!|

    Reply
  13. Pingback: Dermalogica Facials Oldham

  14. Pingback: houses4rentflorida.com

  15. Pingback: telford escort

  16. landscaping services san jose

    We love the individuals over at Benjamin Garden & Panorama!

    Reply
  17. Pingback: yarra valley wine tours & best yarra valley wine tours

  18. Pingback: coventry escorts

  19. Pingback: web design

  20. Pingback: computer security

  21. camping company towing tucson

    We are extra than just your towing company, we are household.

    Reply
  22. videos for teens

    My brother recommended I may like this web
    site. He was once entirely right. This post truly made my day.

    You can not imagine just how a lot time I had spent for this information! Thank you!

    Reply
  23. Tomiko Billotti

    Thanks for sharing your thoughts. I truly appreciate your efforts and I will be waiting for your further post thanks once again.|

    Reply
  24. Heriberto Romack

    Good post. I learn something new and challenging on blogs I stumbleupon on a daily basis. It will always be useful to read through articles from other authors and use something from their websites. |

    Reply
  25. pressure washing services seattle

    We are a professional strain washing service.

    Reply
  26. Marilu Bresser

    Hi everyone, it’s my first visit at this web page, and paragraph is genuinely fruitful for me, keep up posting these posts.|

    Reply
  27. Lyndon Cavness

    My family members every time say that I am killing my time here at net, but I know I am getting familiarity daily by reading such good articles or reviews.|

    Reply
  28. best lubricant

    Very soon this web page will be famous amid all blogging viewers,
    due to it’s good articles or reviews

    Reply
  29. viral videos

    I think that what you said was very reasonable. But, consider this,
    suppose you wrote a catchier title? I am not suggesting your information is not solid,
    but suppose you added a post title that makes people desire more?
    I mean Is Philippine Bureau of Immigration website
    compromised, hosting malware? – Kramfs Tech Chronicles is kinda plain. You might peek
    at Yahoo’s home page and watch how they create article titles to get viewers interested.
    You might add a video or a pic or two to get people interested about what you’ve got to say.
    Just my opinion, it could bring your posts a little livelier.

    Reply
  30. water based lube

    If you wish for to obtain a good deal from this article then you have to apply these strategies to your won webpage.

    Reply
  31. cleaning services near me cheap

    Chantelle walked behind the distraught Madame Deville.

    Reply
  32. asbestos removal companies in miami

    — It’s essential to report your asbestos removal initiatives.

    Reply
  33. landscaping services wilmington nc

    Copyright 2017 Skilled Landscaping Services, LLC.

    Reply
  34. Almeta Jayson

    Great article.|

    Reply
  35. Pedro Amancio

    Very nice post. I just stumbled upon your weblog and wished to say that I have truly enjoyed surfing around your blog posts. In any case I’ll be subscribing to your feed and I hope you write again soon!|

    Reply
  36. Pingback: Jocuricutomsijerry Insurance

  37. ellaone pill

    Good day! I could have sworn I’ve visited this blog before but after going through a few of the posts I
    realized it’s new to me. Nonetheless, I’m definitely delighted I discovered it and I’ll be bookmarking it and checking back frequently!

    Reply
  38. gold for light's hope lightbringer

    I was able to find good info from your blog articles.

    Reply
  39. tgbks.enter.co.nz

    For latest information you have to go to see world wide web and on web I found this website as
    a finest web site for most up-to-date updates.

    Reply
  40. veganrestaurantfinder.com

    Hi, just wanted to say, I enjoyed this blog post.
    It was inspiring. Keep on posting!

    Reply
  41. carpet cleaning rentals home depot

    Maintain lint rollers and pet hair removers clear.

    Reply
  42. Pingback: work from home

  43. Pingback: buy quality instagram views

  44. Pingback: buy real instagram views

  45. Pingback: lofts for rent in michigan

  46. Pingback: lofts for rent in michigan

  47. Pingback: furnished apartments in michigan

  48. Curtis Persia

    Hi there colleagues, its fantastic article about tutoringand fully explained, keep it up all the time.|

    Reply
  49. Benedict Bukhari

    Great blog! Do you have any recommendations for aspiring writers? I’m hoping to start my own website soon but I’m a little lost on everything. Would you propose starting with a free platform like WordPress or go for a paid option? There are so many options out there that I’m totally confused .. Any tips? Cheers!|

    Reply
  50. Pingback: apartments in detroit area

Leave a Comment

Your email address will not be published. Required fields are marked *