SWF_EXPLOYT.YYKN
Exp.CVE-2015-5119 (Symantec)
Windows
![](/vinfo/imgFiles/legend.jpg)
Threat Type: Trojan
Destructiveness: No
Encrypted: Yes
In the wild: Yes
OVERVIEW
Downloaded from the Internet
This Trojan executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system. As of this writing, the said sites are inaccessible.
TECHNICAL DETAILS
15,485 bytes
SWF
Yes
22 Jul 2015
Arrival Details
This Trojan may be downloaded from the following remote sites:
- http://rpt.{BLOCKED}ale.com/en/rep201507101.pdf
- http://rpt.{BLOCKED}ale.com/en/show.swf
Download Routine
After successfully exploiting the said vulnerability, this malware connects to the following URLs to possibly download other malicious files:
- http://{URL where it is hosted}/b.gif
It then executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.
As of this writing, the said sites are inaccessible.
Other Details
This Trojan is a zero-day exploit for the following vulnerability:
SOLUTION
9.750
11.806.04
22 Jul 2015
11.807.00
23 Jul 2015
Step 1
Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must disable System Restore to allow full scanning of their computers.
Step 2
Close all opened browser windows
Step 3
Scan your computer with your Trend Micro product to delete files detected as SWF_EXPLOYT.YYKN. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.
Step 4
Download and apply this security patch Refrain from using these products until the appropriate patches have been installed. Trend Micro advises users to download critical patches upon release by vendors.
- https://helpx.adobe.com/security/products/flash-player/apsb15-16.html
Did this description help? Tell us how we did.