JAVA_EXPLOIT.BB

This malware is involved in a malicious spam campaign leveraging the April 2013 Boston Marathon Bombing. It takes advantage of certain software vulnerabilities to download malicious files onto the affected system.

To get a one-glance comprehensive view of the behavior of this Trojan, refer to the Threat Diagram shown below.

This Trojan may be hosted on a website and run when a user accesses the said website.

It executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

Arrival Details

This Trojan may be hosted on a website and run when a user accesses the said website.

Download Routine

This Trojan takes advantage of the following software vulnerabilities to download possibly malicious files:

• Oracle Java 7 Security Manager Bypass Vulnerability (CVE-2013-0422)

It saves the files it downloads using the following names:

• %User Temp%\{random file name}.exe

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, and 8.)

It then executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

It downloads a possibly malicious file from a certain URL. The URL where this malware downloads the said file depends on the following parameter(s) passed on to it by its components:

• name