One of the malicious site is porn site "teensxtube.com", you will notices that following internet connections were established.
http://teensxtube.com/
http://teensxtube.com/wp.js
http://teensxtube.com/extra/sheduler.php
http://teensxtube.com/extra/count.php?gr=4
http://teensxtube.com/extra/count.php?gr=88
http://eccinput.com/rstat.htm
http://teensxtube.com/1.jpg
http://homesiteuk.com/index.php
http://eccinput.com/r/cnt-gif1x1.php?e=1600.1200&d=32&r=http%3A//teensxtube.com/&p=http%3A//eccinput.com/rstat.htm&t=
http://homesiteuk.com/x.x
http://homesiteuk.com//load.php?spl=mdac (VT 5/41); ThreatExpert Report
http://homesiteuk.com/index.php?spl=2&br=MSIE&vers=6.0&s=
http://homesiteuk.com//pdf.php
http://homesiteuk.com/index.php?spl=3&br=MSIE&vers=6.0&s=
http://saloongins.net/nop/tds2.php
http://autouploaders.net/mass/tds2.php
http://settopworld.net/incallspa.php
http://greatinstant.net/yourseekerz.php
http://getgreatguide.in/s/exx.php
http://promotds.com/in.cgi?16
http://promotds.com/in.cgi?6
http://trenublo.com/estplanete.php
http://getgreatguide.in/search.php?qq=young%20tight%20ass
http://teenbestmovie.com/pi.php
http://getgreatguide.in/s/exx.php
http://getgreatguide.in/search.php?qq=allure%20amateur%20paige
http://getgreatguide.in/search.php?qq=lesbian%20teen%20site%20myspace%20com
http://fuckthisteen.net/pi.php
http://teenbestmovie.com/index2.php
http://fuckthisteen.net/index2.php
http://bestwebtop.net/estvirtuel.php
http://getgreatguide.net/s/exx.php
http://www.unseencontent.com/
http://www.unseencontent.com/cgi-bin/atx/out.cgi?l=o
http://213.174.143.196/v/cj.php?d=80
http://topfuckmovies.net/
http://greattaby.com/addlinkworld.php
http://findyourlink.net/s/exx_new.php
http://findyourlink.net/search.php?qq=free%20gay%20guy%20sex%20video
http://fuckthisteen.net/out.php?t=3.0.2.178&url=http://www.campsnatch.com/hosted/index.php?ws/valik/teenybopperclub_mov500&s=2
http://cafebarplaza.cn/mostextra.php
http://tofindhomes.in/s/exx.php
http://tofindhomes.in/se.php?qq=hardcore%20big%20dick%20sex
http://settopworld.net/greattab.php
http://themiddel.com/s/exx.php
http://themiddel.com/search.php?qq=buy+soma+online
http://greatinstant.net/therealabc.php
http://themiddel.com/s/exx.php
http://themiddel.com/search.php?qq=buy+lipitor
http://trenublo.com/topext.php
http://findyourlink.net/s/exx_new.php
http://findyourlink.net/search.php?qq=cock%20first%20her%20massive
http://navigateguide.com/s/exx_new.php
http://navigateguide.com/search.php?qq=ebony%20free%20model%20pic%20woman
http://adprotraffic.com/asm.js?id=22592
http://homesiteuk.com//pdf.php, below is the decoded stream that captured from malicious pdf.
Seem like there have another layer code that need to decode. Without no surprising, you will get the actual codes after replacing "kru pop 32" with "%".
Obviously, analyst will get Unicode after decode using method UCS. http://homesiteuk.com//load.php?spl=pdf_0day
According to ThreatExpert, this malware categorized as Trojan Dropper and have Zbot characteristic. It will stole personal information and financial information. Besides that, it also generates lots traffics out to other porn websites.
Following generated connections:
autouploaders.net
saloongins.net
settopworld.net
greatinstant.net
trenublo.com
bestwebtop.net
greattaby.com
cafebarplaza.cn
discoverany.cn
d45648675.cn
moretds.in
From the malicious crafted pdf file, there have interesting that I noticed is about "/Author (Miekiemoes)"
Miekiesmoes is Assistant Director of Research @ Malwarebytes according from miekiemoes.blogspot.com
Seem like someone is joking with her! :-)
