Analysis by: Nikko Tamana
ALIASES:

Exploit:Java/CVE-2012-1723 (Microsoft)

 PLATFORM:

Windows 2000, Windows Server 2003, Windows XP (32-bit, 64-bit), Windows Vista (32-bit, 64-bit), Windows 7 (32-bit, 64-bit)

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:

  • Threat Type: Trojan

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  OVERVIEW

This Trojan may be hosted on a website and run when a user accesses the said website.

It requires its main component to successfully perform its intended routine.

  TECHNICAL DETAILS

File Size: 3,201 bytes
File Type: Java Class
Initial Samples Received Date: 12 Feb 2013

Arrival Details

This Trojan may be hosted on a website and run when a user accesses the said website.

Download Routine

This Trojan downloads a possibly malicious file from a certain URL. The URL where this malware downloads the said file depends on the parameter passed on to it by its components.

Other Details

This Trojan requires its main component to successfully perform its intended routine.

NOTES:

When a user accesses a website where JAVA_XPLOYT.WOQ is hosted and the affected machine is vulnerable, JAVA_XPLOYT.WOQ is loaded.

The files that are downloaded and executed may change depending on the attacker's choice. Downloaded and executed files may also be a malware.