Malvertising Leading To Flash Zero Day Via Angler EK

Zscaler ThreatLabZ observed a malvertising campaign directing users to Angler Exploit Kit pages that exploited a zero-day Adobe Flash vulnerability (active in early 2015) to silently install a 64-bit Bedep Trojan; the payload performs AdFraud/ClickFraud, uses incremental XOR obfuscation, a DGA for C2, and establishes persistence via copied DLLs and COM CLSID registry entries (MD5 EFB584DEA6CBC03765487633BD5A5920).