[hx1997]

Hi all,

I'm looking for samples related to the 0day CVE-2014-0497.

http://www.securelist.com/en/blog/8177/ ... nerability

According to the article, some of the detection names are as follows;
HEUR:Exploit.SWF.Agent.gen
Trojan-Downloader.Win32.Agent.hdzh
Trojan-Spy.Win32.Agent.cjuj
Backdoor.Win32.Agent.dfdq
Backdoor.Win32.Agent.dfdr (kboc.dll)

No hashes available for now.

Thanks in advance!

[360Tencent]

http://www.threatconnect.com/news/getti ... rsecurity/

[hx1997]

More info

Trojan-Downloader.Win32.Agent.hdzh was seen to download files from a level 3 domain: hxxp://thirdbase.bugs3.com/sizemore/css5.php (dead now), as reported by urlQuery https://urlquery.net/report.php?id=9239225.

[hx1997]

Hi,

I've found a POC of CVE-2014-0497.

[hx1997]

Hi,

According to MMPC article, 265fdeb993a09d2350daa130de4ce5b662bed628 is the SHA1 of TrojanDownloader:Win32/Siromost.A (aka Trojan-Downloader.Win32.Agent.hdzh by Kaspersky).

http://blogs.technet.com/b/mmpc/archive ... ploit.aspx

Can someone help?
Thanks!

[malwarelabs]

CVE-2014-0497 (Flash up to 12.0.0.43) integrating Exploit Kits
http://malware.dontneedcoffee.com/2014/ ... 20043.html
Sample at the end of this article