Chris Mosby at myITforum.com

Apple (QuickTime exploit) with a twist

Four days after news of the recent Apple QuickTime vulnerability began to spread, a new proof-of-concept exploit, with a twist, has been published. While the shell code in the previous exploit was contained within a malicious RTSP data stream, this time the shell code is sent via JavaScript, separate from the stream.

Let’s break down how this might play out. A client requests a Web page from a malicious site. The page that is sent contains malicious shell code and a request for a QuickTime movie. If the client is using Internet Explorer, the shell code is written to a heap area for later use. Meanwhile, the browser receives the QuickTime movie and then opens it with QuickTime, creating an RTSP stream to the malicious server. Only the RTSP server in this scenario is hosting a hacked version, which actually sends back a stream that overwrites the stack in the client’s QuickTime install. The end of the buffer overflow then calls the shell code that was previously written to the heap, and voila!, the malicious code is executed.

This method of exploiting the vulnerability has its advantages and disadvantages. On the plus side, the server hosting the exploit must have a hacked RTSP server for this to work, since standard RTSP servers will not operate in this way. On the downside, this new exploit makes it much easier for attackers to use their own shell code in an attack using this vulnerability.

The good news is that this exploit is easily enough avoided by taking a few precautionary measures. Symantec antivirus products with the latest definitions will detect this threat as Trojan.Quimkids. We also recommend the following options if you’d like to further protect yourself from such attacks:

Prohibit the RSTP protocol on your networks
Unless there is a need for using this protocol, it is best to avoid it for the time being.

Disable QuickTime browser objects
If QuickTime ActiveX controls in Internet Explorer and plug-ins in Firefox are disabled, the exploit will not work.

Disable JavaScript where possible
If the script cannot execute, it cannot write shell code to the heap.

Avoid untrusted QuickTime files
If you’re unsure of the source of a QuickTime file, do not execute it.

Domo arigato to Kazumasa Itabashi for his work in analyzing this new exploit.

Posted by Ben Nahorney on November 28, 2007 08:11 AM

Source: Symantec Security Response Weblog: Apple (QuickTime exploit) with a twist

Exploit Haunts WinRAR

November 28th, 2007 by JM Hipolito

SANS Internet Storm Center reports that an exploit code that takes advantage of a buffer flow vulnerability in WinRAR archiving software is making rounds in the wild. The said exploit code affects WinRAR versions 3.50 and earlier.

Further analysis by TrendLabs researchers reveal that the said exploit (detected as TROJ_RDROPPER.A) arrives as a malicious .RAR file. Once the said file successfully exploits the WinRAR flaw, it proceeds to drop the file %User Temp%WINRAR.EXE, which is detected by Trend Micro as BKDR_DARKMOON.AH. The dropped backdoor, in turn, opens a random port and allows remote code execution by a malicious user.

This is not the first time a bug was discovered in earlier versions of WinRAR. As early as 2005, Threat Researchers Jonell Baltazar and Joey Costoya were able to procure of an exploit code that also takes advantage of a buffer overflow vulnerability. At that time, however, they concluded that the said exploit could not be used for malicious purposes.

Trend Micro strongly recommends WinRAR users that they upgrade to the latest version of the program (3.61) to avoid possible infection. Users of Trend Micro products are also advised to update their patterns.

Source: Exploit Haunts WinRAR - TrendLabs | Malware Blog - by Trend Micro

Wednesday, November 28, 2007

More on the massive SEO poisoning -- it was targeted at Google. And it was more crafty than we thought.

As a follow-up to our recent posts, here’s some additional information.
First, we can ring the all-clear bell. Google took action on these domains and you won’t find them anymore in Google.
However, check out this javascript:
(source: cxsjrkelgvjs(dot)cn/gopnikovnet(dot)js << malware site)

So. if you use search terms like “inurl” and “site”, you won’t see these malware pages in your results. Clever, since that’s one way for malware researchers to find stuff (I recently wrote an article on this subject for VirusBulletin). And, it only cares if you’re coming from Google.
Quite interesting.
Alex Eckelberry
(Thanks to Sunbelt researchers Adam Thomas and Francesco Benedini)

Source: SunbeltBLOG: More on the massive SEO poisoning -- it was targeted at Google. And it was more crafty than we thought.

Pharming Pharmaceuticals

Earlier today there was a report about Al Gore's site, climatecrisis.net, being hacked. The site contained links that weren't visible to the visitors, which pointed to various pharmaceutical products. The links could be viewed by looking into the source code of the page being displayed. The fact that Al Gore's site got hacked or compromised, while definitely of significance, uncovers a much bigger technique now being used by spammers. Here is a snapshot of the links from the hacked climatecrisis.net site:

(Click for larger image)

As you can see, there are loads of links to a university's server. None of the links work. However, the hackers were able to get to the top of search results by creating links such as these. No one visiting the hacked site would have noticed these links or been affected by any malicious program - not as of yet anyway.

Here is a picture showing the results of a search for "discount zovirax c.o.d." What you'll see is that most of the results show up as being served from some university or other legitimate business site not affiliated with such pharmaceutical products:

(Click for larger image)

How did this happen? Well, the comment spammers added tons of comments into various forums using custom search terms. These comments all lead to either a link within one of the forums or another site. The number of links from these forums pointing to one entry or page raised its position in the search engine's results:

(Click for larger image)

Following that link from the forum leads one to the following page:

(Click for larger image)

As you can see, the spammers were able to get a hacked university page to the top of the search engine results. Following that link leads you to the eventual pharmaceutical Web site being marketed here:

(Click for larger image)

The spammers and hackers took over legitimate blogs, mostly running some vulnerable version of WordPress Web publishing software. Once they were able to inject their code into these pages the search engines looking at this source were able to pick them up and place them high enough for visibility. In some cases, it seems like the server hosting the vulnerable versions of WordPress was completely compromised. Here is a snapshot of one of the search results:

(Click for larger image)

Clicking on the link using the search engine takes us to 'http://www(dot)canadacertified(dot)com'. However, if you copy and paste the URL shown in the search engine, you'll not be referred to the pharmaceutical site and are instead shown a "404 Page Not Found."

We've seen the spammers go from comment spamming to hacking WordPress, to injecting links, to getting top listing on the search engine results, to finally marketing pharmaceutical sites through a large network of interwoven links. So far, the only visible damage caused is for the administrators of the servers with the hacked Word Press. This could have been much worse had the hackers decided to insert links to malicious programs. Fortunately, the ka-ching! of cash trumps notoriety.

Posted by Vikram Thakur on November 27, 2007 03:37 PM

Source: Symantec Security Response Weblog: Pharming Pharmaceuticals

Tuesday, November 27, 2007

Malware redirects: The aftermath

Hi all, Adam Thomas here from the Malware Research Team. I just wanted to post a follow up to our blog post yesterday regarding malware redirects from search engine results.

Sunbelt Software has uncovered tens of thousands of individual pages that have been meticulously created with the goal of obtaining high search engine ranking. Just about any search term you can think of can be found in these pages.

For example, the image below shows one page that focuses heavily on searches including the word “infinity”.

This example shows hundreds of search terms for “hospice”. Pretty sick.

For months now, our Research Team has monitored a network of bots whose sole purpose is to post spam links and relevant keywords into online forms (typically comment forms and bulletin board forums). This network, combined with thousands of pages such as the two seen above, have given the attackers very good (if not top) search engine position for various search terms.

In our previous post, we mentioned that the malicious pages also contained an IFRAME link which would attempt to exploit vulnerable systems. If you were unlucky enough to run across one of these links while surfing with a vulnerable system, you would become infected with a family of malware that we call Scam.Iwin. With Scam.Iwin, the victim's computer is used to generate income for the attacker in a pay-per-click affiliate program by transmitting false clicks to the attacker's URLs without the user's knowledge. The infected Scam.Iwin files are not ordinarily visible to the user. The files are executed and run silently in the background when the user starts the computer and/or connects to the internet.

Scam.Iwin is also used to load malware for other groups. In this case, one of those malware groups is known to have been associated with the infamous RBN (Russia Business Network).

Links loaded by Scam.Iwin:

So far we have observed the following malware being installed:

Trojan.Crypt.XPACK.Gen
Trojan-Downloader.Small.AAGX
Trojan-Downloader.Win32.Agent.ev
Trojan-Downloader.Win32.Agent.bnm
Trojan-Downloader.Win32.Agent.eus
Trojan-Downloader.Gen
Trojan-Downloader.Win32.Obfuscated.n
Trojan-Downloader.Win32.Small.ddx
Trojan-Downloader.Win32.Small.cib
Trojan-Proxy.Win32.Xorpix.Fam
Trojan.DNSChanger.Gen
Trojan.Win32.Patched.q
Trojan.Rawlam.C
Trojan.FakeAlert
Trojan.SpamThru (Spam-Bot)
Trojan.Netview (Information Stealer)
Trojan-Downloader.Win32.BHO.bt
Trojan.Win32.Pakes.bqt
Scam.Iwin
Dialer.Win32.GBDialer.i (v)
Backdoor.Rustock (spam-bot)
Trojan.Srizbi
Trojan-PWS.Win32.Bzub.gen (Information stealer)
Backdoor.Win32.Small.lu (Information Stealer)
Awola (Rogue Security Program)
Ultimate SecuritySuite (Rogue Security Program)

If your system was not vulnerable (i.e. your system is fully up-to-date with the latest patches), and you were duped into installing the “ActiveX Upgrade”, then you might simply be left with a toolbar installed into Internet Explorer as well as some pesky pop-up advertising for Rogue Security Software.

Of course, the team over at Google has been notified of this. Other search engine companies are welcome to contact us for more information.

Oh, what a tangled web we do weave . . .

Adam

Source: SunbeltBLOG: Malware redirects: The aftermath

Fake YouTube URLs Downloading Suspicious Executable

Malicious code writers have always used popular Web brand names to spread malicious code through spam vectors and these days the YouTube brand name is popping up more and more. However, the spoofed URL in this latest scam redirects visitors to dynamic domain names with seemingly unusual top level domains (TLDs), such as .li, .ch, and .es. Last month, spammers used the YouTube brand name in an attempt to spread spam regarding male enhancement pills and get-rich-quick schemes.

The email looks harmless enough, because the “From” header is spoofed to appear as if it's coming from "YouTube Service" , which helps it to look like a legitimate invitation. The video's description is enticing and seems innocuous, inviting potential victims to open a shared video file, which is a fake YouTube link. Here is a sample of one of these scam emails:

From: "YouTube Service" service@youtube.com
To: [REMOVED]
Bcc: [REMOVED]
Subject: Your friend sent you a video!
Date: Thu, 15 Nov 2007 08:58:31 +1000

Note: The domains that are used to impersonate the YouTube Web site are giower.li, fineir.ch, and be4koy.com.es. These TLDs are not the usual .com or .net domains. The links will force the download of a malicious executable “install_flash_player.exe,” which in fact is a threat already detected by Symantec.

There were a number of spoofed URLs included in the spam emails during the campaign. Fortunately the Web sites associated with the URLs have since been taken down. Below are a few examples of the spoofed URLs:

(Click for larger image)

Posted by Jitender Sarda on November 28, 2007 05:00 AM

Source: Symantec Security Response Weblog: Fake YouTube URLs Downloading Suspicious Executable

I have been hearing a lot about this yesterday and today, sounds like it is getting ugly…

 

Google Search Campaign

Published: 2007-11-28,
Last Updated: 2007-11-28 15:07:23 UTC
by Mari Kirby Nichols (Version: 1)

Computerworld is reporting a "large scale, coordinated campaign to steer users toward malware-spewing Websites from Google search results is under way."  

• They are quoting approximately 40,000 pages may be hosting malware. 
• 27  different domains are involved.
• Each with up to 1499 malicious pages.
• Tactics Used per Sunbelt:
  • "comment spam" - bots hide in comment sections with links
  • "blog spam" -bogus blog posts
  • plug links into any web form requesting a link

Please let us know if you are seeing this activity via our contact page.

Thanks, Mari Nichols

Source: SANS Internet Storm Center; Cooperative Network Security Community - Internet Security - isc

Lotus Notes buffer overflow in the Lotus WorkSheet file processor

Published: 2007-11-27,
Last Updated: 2007-11-27 19:19:47 UTC
by Joel Esler (Version: 2)

Core Security has put out a new advisory concerning a buffer overflow in Lotus Notes. Both remotely and locally exploitable.

Core lists the vulnerable software pieces as:

- Lotus Notes version 7.x
- Lotus Notes version 8.x (not confirmed by Core)
- Lotus Notes version 6.5.6 (not confirmed by Core)
- Other software packages using Verity KeyView SDK using vulnerable
versions of l123sr.dll

Although it's prudent to keep in mind that as of now 8.x and 6.5.6 are NOT confirmed by Core (as in their advisory, and the cut and paste above).

Cut and Paste from Core's Advisory:

Lotus Notes customers should follow the instructions of the following
support Technote, which outlines the available options based on specific
versions of Lotus Notes:

http://www.ibm.com/support/docview.wss?rs=475&uid=swg21285600

Workaround 1: Delete the keyview.ini file in the Notes program directory.
This disables ALL viewers. When a user clicks View (for any file), a
dialog box will display with the message "Unable to locate the viewer
configuration file.".

Workaround 2: Delete the problem file l123sr.dll file. When a user tries
to view the specific file type, a dialog box will display with the message
"The viewer display window could not be initialized." All other file types
work without returning the error message.

Workaround 3: Comment out specific lines in keyview.ini for any references
to the problem file (l123sr.dll). To comment a line, you precede it with a
semi-colon (;). When a user tries to view the specific file type, a dialog
box will display with the message "The viewer display window could not be
initialized". For example:
[KVWKBVE]
;81.2.0.5.0=l123sr.dll
;81.2.0.9.0=l123sr.dll

Workaround 4:  Filter inbound emails with attachments with potentially
malicious files.  Lotus 1-2-3 files are usually associated to MIME
Content-Type headers set to the following strings:
application/lotus-1-2-3
application/lotus123
application/x-lotus123
application/wks
application/x-wks
application/vnd.lotus-1-2-3
Note however that workaround #4 is a simply stop gap measure that could be
circumvented by relatively unsophisticated attackers.

 

Joel Esler

http://www.joelesler.net

0 comment(s) digg_url = 'http://isc.sans.org/diary.html?storyid=3696'; digg_title = 'Lotus Notes buffer overflow in the Lotus WorkSheet file processor'; digg_skin='compact'; digg_topic = 'security';

0 comment(s)

Source: SANS Internet Storm Center; Cooperative Network Security Community - Internet Security - isc

Cries of Joy ring out throughout the land!! 

IE Automatic Component Activation (Changes to IE ActiveX Update)

Back in April 2006, we made a change to how Internet Explorer handled embedded controls used on some webpages. Some sites required users to “click to activate” before they could interact with the control. Microsoft has now licensed the technologies from Eolas, removing  the “click to activate” requirement in Internet Explorer. Because of this, we're removing the “click to activate” behavior from Internet Explorer!

It’s important (and cool) to note that this change will require no modifications to existing webpages, and no new actions for developers creating new pages. We are simply reverting to the old behavior. Once Internet Explorer is updated, all pages that currently require “click to activate” will no longer require the control to be activated. They’ll just work.  

	Before April 2006	After April 2006 IE Active X update	After April 2008 Removal
Controls Injected Via JavaScript	No “Click to Activate”	No “Click To Activate”	No “Click To Activate”
Controls loaded Direct In HTML (<object>, <embed>, <applet>)	No “Click to Activate”	“Click To Activate” Required	No “Click To Activate”

So you’re probably wondering when we are going to release this update? The first chance will be with an optional preview release, called the Internet Explorer Automatic Component Activation Preview, available in December 2007 via the Microsoft Download Center. Additionally this change will be made part of the next pre-release versions of Windows Vista SP1 and Windows XP SP3. After giving people enough time to prepare for this change, we’ll roll this behavior into the IE Cumulative Update in April 2008, and all customers who install the update will get the change.

If you have a custom application using WebOC or MSHTML, there may be some changes that affect your application. For example:

• If your application uses the DOCHOSTUI flag to opt-in to the current “Click To Activate” behavior, that behavior will continue to be respected and your application will require “Click To Activate”
• If you application uses the registry key FEATURE_ENABLE_ACTIVEX_INACTIVATE_MODE to opt-in to the current “Click To Activate” behavior, this registry key will no long be respected. If you wish to continue to use the “Click to Activate” behavior, please use the DOCHOSTUI flag.

In the coming weeks, we'll be updating the MSDN article with descriptions of the new behavior. Keep an eye out here for when the preview goes live. 

Thanks,

PEte LePage
Senior Product Manager

Source: IEBlog : IE Automatic Component Activation (Changes to IE ActiveX Update)

Time to update your Firefoxes! (Firefox 2.0.0.10)

Published: 2007-11-27,
Last Updated: 2007-11-27 15:48:34 UTC
by Joel Esler (Version: 1)

There's a new update for Firefox out.  2.0.0.10.

Copy and Paste from Mozilla.org on the updated security features:

MFSA 2007-39 Referer-spoofing via window.location race condition
MFSA 2007-38 Memory corruption vulnerabilities (rv:1.8.1.10)
MFSA 2007-37 jar: URI scheme XSS hazard

Source: SANS Internet Storm Center; Cooperative Network Security Community - Internet Security - isc

Hacker targets Mac fan blogs

Tuesday November 27, 2007 at 6:16 am CST
Posted by Harish Garg

Trackback

A self-proclaimed Mac user is targeting Mac fan blogs. He has already defaced 2 famous Mac related blogs.

http://www.applematters.com/

http://iphonematters.com/

In his own words ” I’M A MAC USER. I JUST HAVE A STRONG DISTASTE FOR MAC SYCOPHANTS.”

This is possibly the first time a hacker is targeting Mac related websites. This is interesting month for the Mac user base, with multiple Trojans/malware appearing along with a horde of security updates from Apple itself.

Things are definitely heating up in Mac Land!

Source: Computer Security Research - McAfee Avert Labs Blog

Malicious Advertisements

On November 2, 2007 I had the opportunity to participate in a panel at the Federal Trade Commission on the future of online behavioral advertising. While this topic is not one that is normally associated with information protection issues, there are some interesting implications that I touched upon at the panel and that I thought I’d reiterate here.

First, let’s think about some of the overall trends related to Web advertising. To begin with, the Web has certainly exploded in popularity and people are spending more and more time each day surfing their favorite sites.

Second, online advertising has proven itself to be a viable business model for many companies. Countless Web sites display ads that are viewed by an even greater number of people.

Third, along these same lines the online advertising supply chain is fairly complex. In the simplest incarnation, an advertiser might work with an ad network who will arrange to have the ad published through one or more content publishers. In a more complex, but still quite common incarnation, an ad network might work with a syndicator (and the syndicator might work with sub-syndicators).

Fourth, advertising itself has become very rich. While text-based advertisements are still popular, we are definitely seeing more fancy ads that use technologies like Flash. The reality is that an advertisement is more than just ad – it's a small piece of software that runs on your machine in the context of your Web browser.

And finally, browsers are becoming more complex. In addition to the core Web browser, people often enhance their Web experience through one or more plug-ins. For example, Flash is enabled on a Web browser through a plug-in.

This increase in prevalence combined with the increased complexity makes online advertising a ripe target for attackers. Since an advertisement is a piece of software, there is potential for that software to be malicious. One example that I blogged about previously involved a social networking site, a little over a year ago. One of the advertisements they served took advantage of a well known Windows vulnerability. Over a million people saw the advertisement. Although the vulnerability was known, and although a patch had been issued, it’s likely that many people who viewed the ad didn’t have their patches up to date. In these cases, companies are otherwise innocent bystanders since the advertisement content itself is being provided by the ad network.

Along the same lines, anything one can do in a scripting language like JavaScript can also be done in Flash. So, in principle, Flash-based advertisements can implement the kinds of attacks possible through malicious JavaScript. These include scanning internal network hosts and drive-by pharming.

\What makes attacks leveraging online advertising especially powerful is that it is entirely possible for an otherwise trustworthy, popular, and well-meaning site to host an advertisement containing malicious code. While there have thus far only been a few instances of malicious online ads, I expect it to be a growing trend.

The unfortunate moral here is that there are no real safe locations on the Internet. That shouldn’t stop you from surfing the Web but merely realizing that if you do so it’s important to be protected. Recognizing that these types of issues would come up, Symantec has built a number of excellent Web-browsing protections into our 2008 products, which were launched recently.

Posted by Zulfikar Ramzan on November 27, 2007 05:00 AM

Source: Symantec Security Response Weblog: Malicious Advertisements

ConfigMgr 2007: Microsoft Exchange Server 2003 MSIT Intermediate Configuration Pack for Configuration Manager 2007

Overview

The Microsoft Exchange Server 2003 MSIT Intermediate Configuration Pack is designed to be used for managing the configuration of Exchange 2003 servers. This configuration pack defines recommended configurations based on a substantial number of settings affecting the configuration of Exchange 2003 servers in the Microsoft IT environment. A partial list of the included configuration items and settings can be obtained by downloading the Microsoft Exchange Server 2003 MSIT Basic Configuration Pack; more extensive configuration items and settings can be obtained by downloading the Microsoft Exchange Server 2003 MSIT Comprehensive Configuration Pack. It is recommended that users begin by evaluating their configuration against the Basic configuration pack, and then progress to the Intermediate and Comprehensive configuration packs as desired configurations are verified.

Once imported into SCCM 2007, this configuration pack and its included configuration items can be targeted to collections of systems which are then audited for compliance with the recommended configurations. When settings are detected to be out of compliance, events will be generated and sent to the Configuration Manager server where the data is available for reporting. This enables early detection of potentially detrimental configuration changes and allows the administrator to correct the settings before they may cause downtime events.

Please note that the configuration items, settings, and values used by Microsoft IT and included in this configuration pack will not necessarily reflect the desired configuration for every possible Exchange Server 2003 environment. The administrator should verify that the rules being evaluated reflect the desired configuration for their specific environment. If desired, the administrator can also modify the configuration pack by changing the value(s) specified for given settings-based configuration items or by adding/removing configuration items from the model through the Desired Configuration Management user interface within the SCCM 2007 console. Where settings and values are represented by a Parent and Child configuration item pair, the Child configuration item will contain the editable rules and values that an administrator may choose to modify.

Feature Bullet Summary:
The Microsoft Exchange Server 2003 MSIT Basic Configuration Pack includes configuration items for the following:

• Exchange Core
• Bridgehead (BH)
• Front End (FE)
• Internet Mail Connector (IMC)
• Mailbox (MBX)
• Public Folder (PF)
• Windows Hotfixes (W2K3_Ent)

In some cases, the settings and values will be represented by a Parent and Child configuration item pair. Please note that the Child configuration item will contain the editable rules and values that an administrator may choose to modify to reflect the desired configuration for their specific environment.

To understand in detail what each configuration item will be evaluating please review the properties of that configuration item in the context of the server role being addressed.

To read more and to download the configuration pack visit http://www.microsoft.com/downloads/details.aspx?FamilyId=40D9D7C0-B2A0-4052-8615-533C3BD06A2B&displaylang=en.

J.C. Hornbeck

Source: SMS&MOM : ConfigMgr 2007: Microsoft Exchange Server 2003 MSIT Intermediate Configuration Pack for Configuration Manager 2007

New Vulnerability in QuickTime
Posted by Patrik @ 04:04 GMT |

---

Not very long ago we posted about fixed vulnerabilities in QuickTime. Now another vulnerability has been discovered, this time in the way QuickTime handles the RTSP Content-Type header. RTSP is a protocol used to stream media. Unfortunately there's public exploit code available and no patch yet from Apple.

The team over at US-CERT has posted some workarounds such as disabling the QuickTime ActiveX Controls, blocking RTSP. If you do the registry changes, make sure you revert them once you have installed the coming patch or else you won't be able to view any streaming QuickTime media.
Additional Notes: Symantec has some excellent analysis located here. They found that this exploit crashes the ActiveX Control in IE. Firefox on the other hand passes off the QuickTime request directly to QuickTime player. So Firefox users may therefore be more vulnerable, not because of the browser itself, but because Firefox will deliver the exploit directly to its most optimal platform.
Also, while this exploit allows remote code execution and is potentially quite severe, it's not yet being implemented in the wild. There is however a very good chance of that changing as QuickTime is one of a growing number of popular third-party applications targeted by the bad guys.

Source: New Vulnerability in QuickTime - F-Secure Weblog : News from the Lab

My Egyptian Vacation
Posted by Mikko @ 11:32 GMT |

---

No, we haven't visited Egypt. But we're seeing a malware distribution run using a unique lure.
First, you get an e-mail like this from "Anita":

The ZIP contains these files:

How nice, Anita has even included an image viewer for us so we can take a look at her photos.
However, if you run viewer_img.exe, you'll get just an empty Paintbrush window:

Of course, this is just a bluff. In the background it's dropping and executing a variant of the LdPinch data-stealing trojan.
Let's see. It loads up a Russian version of pbrush.exe. The images are named "egipet.jpg" — Egipet is the Russian spelling of Egypt. And LdPinch is Russian malware. So this attack is probably (we're guessing) coming from … Denmark!

Source: My Egyptian Vacation - F-Secure Weblog : News from the Lab