Exploit:JS/Blacole.Q

Exploit:JS/Blacole.Q is the detection for malicious JavaScript that loads a series of other exploits that are distributed as components of the "Blackhole kit". If the computer runs a vulnerable version of certain software and exploitation is successful, various malware may be downloaded.

Installation

• CVE-2007-5659 - Multiple buffer overflows in Adobe Reader and Acrobat 8.1.1 and earlier
• CVE-2009-0927 - Stack-based buffer overflow in Adobe Reader and Adobe Acrobat 9 before 9.1, 8 before 8.1.3, and 7 before 7.1.1 allows remote attackers to execute arbitrary code
• CVE-2010-0886 - Java Deployment Toolkit
• CVE-2010-1885 - Help Center URL Validation Vulnerability
• CVE-2011-2110 - Adobe Flash Player Unspecified Memory Corruption Vulnerability

The malware works together with other files, usually served in the same compromised host server and is also known to contain malicious code, detected as Exploit:Java/CVE-2010-0840.

Upon accessing a webpage infected with Exploit:JS/Blacole.Q, the following may be displayed:

Payload

Exploits vulnerabilities to download arbitrary files

Exploit:JS/Blacole.Q exploits the following known vulnerabilities to download malicious files to the infected computer:

• CVE-2007-5659 - Multiple buffer overflows in Adobe Reader and Acrobat 8.1.1 and earlier
• CVE-2009-0927 - Stack-based buffer overflow in Adobe Reader and Adobe Acrobat 9 before 9.1, 8 before 8.1.3, and 7 before 7.1.1 allows remote attackers to execute arbitrary code
• CVE-2010-0886 - Java Deployment Toolkit
• CVE-2010-1885 - Help Center URL Validation Vulnerability
• CVE-2011-2110 - Adobe Flash Player Unspecified Memory Corruption Vulnerability

The malware attempts to load arbitrary Java code with the current user's privileges from a remote server "sbcsfnksmcp.com" to download and execute a binary file. The downloaded file is saved in the following directory as:

• %Temp%\wpbt0.dll

At the time of this writing, the requested URL and file was unavailable for analysis.

Downloads other malware

Exploit:JS/Blacole.Q attempts to load a file from a certain URL, which is commonly within a malicious Java applet:

• <domain>/content/field.jar - detected as Exploit:Java/CVE-2010-0840

where <domain> is the domain name where Exploit:JS/Blacole.Q is located.