[Michael]

The following Czech site (otylkaaotesanek.cz ) contains an exploit:



In Google Chrome you will see a PDF automatically downloaded (thankfully I did not have Adobe reader installed on this machine)



The malware author took the time to credit this PDF to security researcher miekiemoes. That sounds pretty similar to a Dancho Danchev fan club ;-)





This is a malicious PDF:



Only one AV vendor from Virus Total (Sophos) detected this threat:



Opening the PDF with a vulnerable version of Adobe Reader will launch the following payload:

http://dom2cn.cn/13b/load.php?spl=pdf_exp

http://jzion.cn/etc242342534252435223/1.php

http://jzion.cn/etc242342534252435223/soft14.exe

dom2cn.cn/13b/load.php?spl=pdf_exp
jzion.cn/etc242342534252435223/1.php
jzion.cn/etc242342534252435223/soft14.exe

The last file is a Trojan detected by 35% of the AV vendors from Virus Total, at the time of writing.

Jerome Segura

Malware ID:*t1L8XD644LtNd.pdf.zip

Warning: all links contained in this post may infect your computer!