CVE-2013-0074/3896 (Silverlight) integrates Exploit Kits

Angler EK's first move on 2013-11-05. Spotted by @node5 and @EKWatcher : CVE-2013-0634. Confirmed by @timohirvonen pic.twitter.com/HOvpqhW0qm
— kafeine (@kafeine) November 7, 2013

Looks like "Angler EK" is including a Silverlight Exploit - in preference to ones for vulnerable Flash and Java
— Chris Wakelin (@EKwatcher) November 13, 2013

CVE-2013-0074 successful pass in Angler EK 2013-11-13

Silverlight 5.1.10411.0 Addon In IE  used in that pass

Sliverlight version checks Angler EK 2013-11-13

Deciding if Silverlight must be fired : "sterlings" in Angler - 2013-11-13

Call for Silverlight Exploit in Angler 2013-11-13

Silverlight Call

Content of that zip

Dll TimeStamp

One of the US Reveton Design 2013-11-13

Silverlight 5.1.10411.0 Addon In Firefox 17

Firefox Warning on Silverlight call from Angler EK 2013-11-13

Silverlight 5.1.10411.0 - Firefox 17 Angler EK 2013-11-13

@kafeine @EKwatcher It makes sense that it's PacketStore exploit, as that is 0074 combined with a mem disclosure and it's open source
— James Forshaw (@tiraniddo) November 19, 2013

CVE-2013-0074 positive pass in Styx Kein 2013-11-19 (payload taken from Angler EK...or more likely from here :/ )

Once Decoded This is the Java detected that will choose to fire CVE based on your version. Should be : jorg.html should be CVE-2013-0431 or CVE-2013-0422 jvvn.html should be CVE-2013-2465 jply.html could be CVE-2013-2472 + Click 2 play bypass if it's same as in Styx If Java does not Fire...then let's check PDF !

Once decoded : We can see the conditions to fire the CVE-2011-3402 (fnts.html) Then some checks to fire CVE-2010-0188 (PDF) And if PDF conditions two bullets are fired : CVE-2013-2551 ( iexp.html) and CVE-2013-0074 (silverlight)

Call for s.html

Call for Silverlight Exploit (and preparation of Variable to give to the Exploit - note xlkey = 1)

Content of the Silverlight Call Rip from Angler EK (or more likely from this blog... :/ )

CVE-2013-0074/3896 Successful pass in FlashPack 2013-12-06

silver.php

Content of the "eot"

2nd "eot" (seems to contains parameters).

CVE-2013-0074/3896 successful pass in Fiesta 2014-01-03

Seems after days of failed attempts GoonEK finally got Silverlight CVE-2013-0074 Exploit working. Neutrino rip-off pic.twitter.com/R18AO7Rh3K
— William Metcalf (@node5) January 22, 2014

Successfull path in Goon on 2014-01-22 Then Kelihos Spambot loading Simda and Kelihos bot

end of CVE-2013-2551 and Silverlight call

Shellcode as Parameter

Xap contains

Silverlight.dll in dotpeek.

Silverlight CVE-2013-0074/3896 positive path in Himan 2014-01-23

Silverlight Exploit call in HiMan 2014-01-23 http://pastebin.com/q4a0ayzd