CVE-2018-5002 - Adobe Flash Zero-Day Leveraged for Targeted Attack in Middle East
https://www.icebrg.io/blog/adobe-flash-zero-day-targeted-attack

CVE-2018-5002 – Analysis of the Second Wave of Flash Zero-day Exploit in 2018
http://blogs.360.cn/blog/cve-2018-5002-en/

Sample for Flash 0 Day - CVE-2018-5002

1. XLSX file with ActiveX Control to download 1st stage SWF
2. 1st stage SWF downloads 2nd stage AES encrypted SWF
3. 1st stage SWF decrypts and loads the 2nd stage SWF (0 day)

https://www.virustotal.com/#/file/0b4f0d8d57fd1cb9b4408013aa7fe5986339ce66ad09c941e76626b5d872e0b5/details

Decrypted SWF for CVE-2018-5002, the full hash is:
f63a51e78116bebfa1780736d343c9eb

#expdev #flash #darw1n