ThreatExpert Report: Exploit-CVE2011-3251

Technical Details:

File System Modifications

The following files were created in the system:

Filename(s)

File Size

File Hash

Alias

%Temp%\ac\kt$1.class

504 bytes

MD5: 0x076D8CCCFFED72BC84703C6E222F0AB6
SHA-1: 0xA650FEEECAEFAD2C2918A8F0B89C40A870B871B6

Exploit-CVE2011-3251 [McAfee]

%Temp%\ac\kt.class

1,448 bytes

MD5: 0x8F52B45BD714374A7809581DF85BEE50
SHA-1: 0x8B514CCEA49F1A381E6457A336E69B2C6A244D5E

(not available)

%Temp%\ax\ase.class

407 bytes

MD5: 0xAA3F3D791E2250D7EC1ADF61E05E24E6
SHA-1: 0x50DFEDFDA1E1C2515E44619CE7358780BADD2495

Exploit-CVE2011-3251 [McAfee]

%Temp%\ax\C.class

256 bytes

MD5: 0xBB75528862EBF8AC0C3056D7F3F8B849
SHA-1: 0x4813AAC1F8356F8B3FC019B16A2C618AB48B601B

Exploit-CVE2011-3251 [McAfee]

%Temp%\ax\os.class

2,054 bytes

MD5: 0x8D1425D7196A368D96B97EFD5AED8104
SHA-1: 0x4A4DF5E483517758638D1D17A6BBE9BEAADD8837

Exploit-CVE2011-3251 [McAfee]

%Temp%\ax\os2.class

498 bytes

MD5: 0x4C1483566B749E846C28CBDCE1F3810A
SHA-1: 0x11BA75AD3CA2FAEC248D15270794130717EC04F7

Exploit-CVE2011-3251 [McAfee]

%Temp%\ax\Zs.class

296 bytes

MD5: 0x4EDC8386F05BDC3CD498C605E42CC06B
SHA-1: 0x91148A099F4D6F4F4267545AADE8D668FDA0B9DD

Exploit-CVE2011-3251 [McAfee]

%Temp%\en\en.class

2,125 bytes

MD5: 0x1F2752199670FAFC0D1887DA9D0494CA
SHA-1: 0xE4F4BD415959B942D013E0A0E5557601643C7237

(not available)

%Temp%\META-INF\MANIFEST.MF

71 bytes

MD5: 0x4086345EF1CBA0F7AC42B3C35C616935
SHA-1: 0xBA2930A2AD8B1BBD3D71AD0B1188B5ECC85E7FFB

(not available)

%Temp%\VLMKESGY

138,752 bytes

MD5: 0x5A55DF4D31D311F89EE86907C1581B92
SHA-1: 0x25C71FABE3B14BC1043D055893CEB0650B2CBE4F

(not available)

[file and pathname of the sample #1]

59,200 bytes

MD5: 0x6C719BCC6D168EA6B0C2711617EB0280
SHA-1: 0x5BF3AC900EFB079B9AB78A78428917FFC900C564

(not available)

Note:

%Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).

The following directories were created:

%Temp%\ac
%Temp%\ax
%Temp%\en
%Temp%\META-INF

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.

Submission Summary:

Technical Details: