ThreatExpert Report: Exploit.Java.CVE-2012, Java.CVE.2011, Generic Exploit!rsl, Virus.Java.Exploit..

Technical Details:

File System Modifications

The following files were created in the system:

Filename(s)

File Size

File Hash

Alias

%Temp%\btawebtaewa.class

9,827 bytes

MD5: 0xF2B07C4660EF958EB89D39F317216707
SHA-1: 0x19D0CBE8467F1CA3526CD722CCEC08160DF9F53A

Java.CVE.2011 [Ikarus]

%Temp%\btawebtaewb.class

7,289 bytes

MD5: 0xAB249C36C41811678EE82269D233686E
SHA-1: 0x3CEF7F709E77827D0B55414B20B244C261B165B0

Generic Exploit!rsl [McAfee]
Virus.Java.Exploit [Ikarus]

%Temp%\btawebtaewc.class

2,838 bytes

MD5: 0x608F9240ECA6D056477BFEE47EAD02CE
SHA-1: 0x106BA8644AA3E3495DDE3E7D85E8A03E7F1C996D

Exploit.Java.CVE-2012 [Ikarus]

%Temp%\chcyih.class

11,041 bytes

MD5: 0x9BC160058B902110135E2EB479121635
SHA-1: 0xA120160E328DBDE2ED762324986F359AC4389A3E

JV/Exploit-Blacole.s [McAfee]
Virus.Java.Exploit [Ikarus]

%Temp%\META-INF\MANIFEST.MF

98 bytes

MD5: 0xBF9243AC8D17FAC5BAF4E729A3F94BBA
SHA-1: 0xE4FA175A853E806693CE050736F04631856DAF4F

(not available)

[file and pathname of the sample #1]

16,369 bytes

MD5: 0x119836E62FF1B956BC8BEEB71896DCBE
SHA-1: 0xA61235008BF89DE33980E37885EEAAF62F1E8376

Exploit.Java.CVE-2012 [Ikarus]

Note:

%Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).

The following directory was created:

%Temp%\META-INF

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.

Submission Summary:

Technical Details: