TECHNICALBRIEF
BEDEP
Introduction
Zero-day vulnerability exploit incidents topped thesecurity headlines in late January to early February
2015. The vulnerabilities1 involved some versions ofAdobe® Flash® Player2 and were discovered to be twodifferent ones. The first incident was designated as CVE2015-03113 and the second incident as CVE-2015-0313.4
The first zero-day incident was discovered by security
researcher Kafeine5 and involved malvertisements
posted on legitimate sites being used to deliver theexploit to vulnerable systems. Our analysis showed that
the Angler exploit kit was used here.
The second zero-day, discovered by Trend Micro,
also displayed the same delivery of the threat andexploitation method, with the dailymotion.com, alegitimate site, identified as the hosting site. Certain
similarities in the obfuscation method of the exploitdelivery initially showed that the Angler. Further
analysis, including a feedback from Kafeine, provedthat the Hanjuan exploit kit was used in this instance.
The obfuscation method in this case involves
the function used to load and execute the exploit
loadbyte(). The function itself is obfuscated throughstring operations. In both attacks, this method is usedin near-identical fashion to load the malicious Flashfile with the exploit code detected as SWF_ANGZIA.A6
for the first attack, and SWF_EXPLOIT.MSJT7 for thesecond.

Figure 1. Similar obfuscation methods between two recent zero-days

TREND MICRO | TECHNICAL BRIEF
Another similarity is the malware used as a payload. The
payload in both attacks have been identified as BEDEP,8 amalware family whose main purpose is advertising fraud,turning any system it infects into a member of its botnet.
This report provides an in-depth technical description of
the malware BEDEP.

Threat Details

routines include advertising fraud and downloadingof other malicious files onto an affected system.
From our analysis, we believe that its main purpose
is to induct the system it infects into a botnet, most
likely to perform other malicious activities (besides
advertising fraud).Attackers can even command
vulnerable Dynamic Host Configuration Protocol(DHCP) server to execute arbitrary code on clientsystems.

BEDEP was first spotted in September 14, 2014.
Identified as backdoor malware, BEDEP’s malicious

Arrival Routine and Concealment Method

Figure 2. How BEDEP arrives

2TREND MICRO | TECHNICAL BRIEF
BEDEP usually arrives into systems either as the final
payload of a malvertisement attack (as describedin the January 2014 zero-day Flash vulnerabilityincidents) or by being downloaded by a potentiallyunwanted application (PUA)9 installer. PUAs aresoftware that may not harbor malicious code butcould expose a user to threats like information theftor other downloaded malware.

BEDEP and its strains are known to skirt detection
because of its heavy encryption. It also comesmanipulated Microsoft file properties to make it
appear legitimate upon inspection.

In the first method, a system is infected when its user
unwittingly visits a site that hosts malvertisements.
The malvertisement then leads the user to a landing
page hosting the exploit, which in turn, downloads
BEDEP strains onto vulnerable systems, specifically,
BKDR64_BEDEP.E10 and TROJ64_BEDEP.E. These
downloaded BEDEP strains are then executedwithout user authorization. The exploit file is detectedin the Angler attack as SWF_ANGZIA.A and
SWF_EXPLOIT.MJST.

BEDEP strains feature the following malicious
routines:

As for the second method, it is downloaded alongwith other component files by PUA/grayware that isvoluntarily downloaded and installed by the user. The
downloaded component file is discovered to be of
the .DLL variety and bore the file name rifa.dll.

• Post stolen system information (build ID, bot ID,
processor and OS version) to its C&C servers

Arrival Routine and Concealment Method• Malicious code injection into processes (explorer.
exe and iexplore.exe).
• Download and execute arbitrary code
• Connect to malicious URLs/remote malicious
users• Update itself

Figure 3. BEDEP’s fake Microsoft file properties

3

TREND MICRO | TECHNICAL BRIEF
BEDEP also has the ability to distinguish theprocessor of the system it is infecting, installing either
32-bit or 64-bit variant, whichever is suitable. This
bypasses the security measures of 64-bit versions
and ensure that the execution of the malicious
routines takes place.

ImpactFrom November 2014 to February 2015, we kept trackof BEDEP’s infection count worldwide, taking into
account all BEDEP strains currently in the wild, including
their 32-bit and 64-bit variants. What we discovered:• The U.S. is region with the highest number of
infections during the four-month tracking period.
• Japan is the next hardest hit, with over 21% of
the total infection count.
• The spike in infection count takes place inJanuary and extends to February, accounting for
more than half of total infections.

Figure 4. Total BEDEP infection count from November 2014 toFebruary 2015

The peak in BEDEP’s infection count in January
can be attributed to the Adobe Flash zero-day
vulnerability events, as well as the usage of theAngler exploit kit that takes advantage of thevulnerability itself. We can also look at this as
proof of the effectiveness of the infection method
used: malvertisements hosted on popular videohosting websites. Delivering exploits throughmalvertisements is not a new tactic, but being able tolead users to a malicious URL without any interaction
from the users’ part makes this technique a serious
threat.

Solutions andRecommendations
Properly configured endpoint solutions can ensure
the prevention of BEDEP coming into the machine ornetwork it’s connected to.
Components of OfficeScan™ Endpoint Protection,11such as such as SmartScan, Web Reputation
Service, Behavior Monitoring, and Smart Feedback
offer the best protection against BEDEP by detecting
malicious files.
Worry-Free™ Business Security/Services (WFBS/WFBS-SVC)12 is also equipped with technologies that
detect and remove BEDEP in infected machines andnetworks.
Some best practices that can be adopted to prevent
BEDEP infection:• Think before you click. Reckless browsing
behavior often leads to a compromised online
experience.
• Update and patch. Updating software is usuallya baseline best practice for enterprise and homeusers. However, if the situation allows, disabling thevulnerable software (such as Flash in this instance)

4

TREND MICRO | TECHNICAL BRIEF
may be more advisable until the patch that addresses
the vulnerability comes out.
• Stay tuned. Be in-the-know of the latest forms
of infection used by cybercriminals. Read up on thelatest in online security. This would give you a firm
grasp on what to do to stay away from becoming avictim.
Trend Micro customers are protected from BEDEP
and the elements that lead to its infection.

References
1. Weimin Wu. (January 22, 2015). TrendLabs
Security Intelligence Blog. “Flash Greets2015 With New Zero-Day.” Last accessed
March 09, 2015, http://blog.trendmicro.com/
trendlabs-security-intelligence/flash-greets2015-with-new-zero-day/.
2. Peter Pi. (February 02, 2015). TrendLabs
Security Intelligence Blog. “Trend Micro
Discovers New Adobe Flash Zero-Day Exploit
Used in Malvertisements.” Last accessed
March 09, 2015, http://blog.trendmicro.com/
trendlabs-security-intelligence/trend-microdiscovers-new-adobe-flash-zero-day-exploitused-in-malvertisements/.
3. The MITRE Corporation. (2015). CVE. “CVE2015-0311.” Last accessed March 09, 2015,
http://www.cve.mitre.org/cgi-bin/cvename.
cgi?name=CVE-2015-0311.
4. The MITRE Corporation. (2015). CVE. “CVE2015-0313.” Last accessed March 09, 2015,
http://www.cve.mitre.org/cgi-bin/cvename.
cgi?name=CVE-2015-0313.
5. Kafeine. (January 2015). Malware Don’t NeedCoffee. “Unpatched Vulnerability (0day) in Flash
Player Is Being Exploited by Angler EK.” Lastaccessed March 09, 2015, http://malware.
dontneedcoffee.com/2015/01/unpatchedvulnerability-0day-in-flash.html.
6. Trend Micro Incorporated. (2015).
Threat Encyclopedia. “SWF_ANGZIA.A.”
Last accessed March 09, 2015, http://about-threats.trendmicro.com/malware.
aspx?language=au&name=SWF_ANGZIA.A.
7. Trend Micro Incorporated. (2015). Threat
Encyclopedia. “SWF_EXPLOIT.MJST.”
Last accessed March 09, 2015, http://www.
trendmicro.com/vinfo/us/threat-encyclopedia/
malware/SWF_EXPLOIT.MJST.
8. Trend Micro Incorporated. (2015). Threat
Encyclopedia. “Putting Issues of BEDEP
to Bed.” Last accessed March 09, 2015,
http://www.trendmicro.com/vinfo/us/threatencyclopedia/web-attack/148/putting-issuesof-bedep-to-bed.
9. Trend Micro Incorporated. (2015). Glossary.
“Potentially Unwanted App.” Last accessed
March 09, 2015, http://www.trendmicro.
com/vinfo/us/security/definition/potentiallyunwanted-app.
10. Trend Micro Incorporated. (2015). Threat
Encyclopedia. “BKDR64_BEDEP.E.” Last
accessed March 09, 2015, http://www.
trendmicro.com/vinfo/us/threat-encyclopedia/
malware/BKDR64_BEDEP.E.
11. Trend Micro Incorporated. (2015). OfficeScan- Endpoint Protection. Last accessed March09, 2015, http://www.trendmicro.com/us/enterprise/product-security/officescan/.
12. Trend Micro Incorporated. (2015). Worry-FreeBusiness Security Services. Last accessed
March 09, 2015, http://www.trendmicro.com/
us/small-business/product-security/worry-freeservices/.

5

TREND MICRO LEGAL DISCLAIMER
The information provided herein is for general information and educational purposes only. It is not intended and should not be construed to constitute legal advice.
The information contained herein may not be applicable to all situations and may not reflect the most current situation. Nothing contained herein should be relied onor acted upon without the benefit of legal advice based on the particular facts and circumstances presented and nothing herein should be construed otherwise. Trend
Micro reserves the right to modify the contents of this document at any time without prior notice.
Translations of any material into other languages are intended solely as a convenience. Translation accuracy is not guaranteed nor implied. If any questions arise
related to the accuracy of a translation, please refer to the original language official version of the document. Any discrepancies or differences created in thetranslation are not binding and have no legal effect for compliance or enforcement purposes.
Although Trend Micro uses reasonable efforts to include accurate and up-to-date information herein, Trend Micro makes no warranties or representations of any kindas to its accuracy, currency, or completeness. You agree that access to and use of and reliance on this document and the content thereof is at your own risk. Trend
Micro disclaims all warranties of any kind, express or implied. Neither Trend Micro nor any party involved in creating, producing, or delivering this document shallbe liable for any consequence, loss, or damage, including direct, indirect, special, consequential, loss of business profits, or special damages, whatsoever arisingout of access to, use of, or inability to use, or in connection with the use of this document, or any errors or omissions in the content thereof. Use of this information
constitutes acceptance for use in an “as is” condition.

Trend Micro Incorporated, a global leader in security software, strives to make theworld safe for exchanging digital information. Our innovative solutions for consumers,businesses and governments provide layered content security to protect information
on mobile devices, endpoints, gateways, servers and the cloud. All of our solutions are
powered by cloud-based global threat intelligence, the Trend Micro™ Smart Protection
Network™, and are supported by over 1,200 threat experts around the globe. For more
information, visit www.trendmicro.com.
©2015 by Trend Micro, Incorporated. All rights reserved. Trend Micro and the Trend
Micro t-ball logo are trademarks or registered trademarks of Trend Micro, Incorporated.
All other product or company names may be trademarks or registered trademarks of
their owners.

10101 N. De Anza Blvd.
Cupertino, CA 95014
U.S. toll-free: 1 +800.228.5651
Phone: 1 +408.257.1500
Fax: 1 +408.257.2003