Analysis by: Jasen Sumalapao
ALIASES:

Exploit.Java.CVE-2012-1723.bh (Kaspersky), Trojan.Gen.2 (Symantec), Exploit-CVE2012-1723.f !! (NAI), EXP/2012-0507.CO.3 (Antivir), Java/CVE_2012_1723.BH!exploit (Fortinet), Exploit.Java.CVE-2012 (Ikarus), Java/Exploit.CVE-2012-0507.DN trojan (NOD32)

 PLATFORM:

Windows 2000, Windows XP, Windows Server 2003

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:

  • Threat Type: Trojan

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  OVERVIEW

This Trojan may arrive bundled with malware packages as a malware component. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It may be hosted on a website and run when a user accesses the said website.

It exports functions used by other malware. It requires its main component to successfully perform its intended routine.

  TECHNICAL DETAILS

File Size: 5,464 bytes
File Type: Java Class
Memory Resident: Yes
Initial Samples Received Date: 07 Aug 2012

Arrival Details

This Trojan may arrive bundled with malware packages as a malware component.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It may be hosted on a website and run when a user accesses the said website.

Download Routine

This Trojan takes advantage of the following software vulnerabilities to download possibly malicious files:

  • CVE-2012-1723

Other Details

This Trojan exports functions used by other malware.

It requires its main component to successfully perform its intended routine.