Virus Characteristics
------------- Updated 1st August 2012 -------------------
"Exploit-CVE2012-1723" is the detection for a malicious Java class files stored within a Java archive (.JAR) , which attempts to exploit a vulnerability in the Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.
This exploit may be encountered when visiting a compromised webpage that contains the malicious code.
The code is created by an attacker using the "Blackhole" Exploit Kit and inserted into a compromised webpage.
When the page is visited by a user running vulnerable versions of Java, the malicious Java class runs and allows the execution of arbitrary code.
The vulnerability exists due to “type confusion” between a static variable and an instance variable. A static variable is common in a class, whereas an instance variable is only valid in an instantiated class.
The malicious Java package may contain the following malicious Java class files:
1. t_eea/t_eea [Detected as Exploit-CVE2012-1723.a]
2. t_eea/t_eeb [Detected as Exploit-CVE2012-1723.a]
3. t_eea/t_eec [Detected as Exploit-CVE2012-1723.a]
4. t_eea/t_eed [Detected as Exploit-CVE2012-1723.a]
-----------------------------------------------------------------------------------------------------------------------------
Downloader-BCS is a java applet trojan intended to silently download and execute malicious content from a remote server.
The trojan exploits a Buffer Overflow Vulnerability in Java Runtime Environment (JRE) while parsing certain image file formats like GIF.
When the applet is run on the victim machine having a vulnerable installation of Java Runtime Environment, the trojan downloads another malware from the remote server and executes it.
The following files are downloaded . The applet file (game.class) is of 24,739 bytes in size.
- game.class --> Malicious Java applet
- picsj.exe --> variant of Proxy-Agent.o
The trojan automatically connects to the following domain to download additional malware.
- http://216.32.92[blocked]/