The threat determines what browser, operating system and the version of various applications you are using.
It checks if you have vulnerable versions of Internet Explorer, Microsoft Silverlight, Adobe Flash Player, or Java.
Exploits vulnerabilities in Internet Explorer and Microsoft Silverlight
If you're using Internet Explorer, the threat tries to exploit the vulnerability referred to as CVE-2013-2551.
The threat also checks if the Microsoft Silverlight plugin is installed and enabled. If it is, it tries to exploit the vulnerability referred to as CVE-2013-0074, which we detect as Exploit:MSIL/CVE-2013-0074.
Exploits vulnerabilities in Adobe Flash Player
The threat checks for vulnerabilities in Adobe Flash Player and tries to exploit the following vulnerabilities:
It uses an Adobe Flash Player vulnerability to download and run files on your PC, including malware.
The following versions of Adobe Flash Player are vulnerable:
Adobe Flash Player 220.127.116.116 and earlier versions
Adobe Flash Player 18.104.22.1684 and earlier 13.x versions
Adobe Flash Player 22.214.171.1240 and earlier 11.x versions
Exploits vulnerabilities in the
Java Runtime Environment
The threat checks for vulnerabilities in Java. We have observed it attempting to exploit the vulnerability CVE-2013-2460, which we detect as Exploit:Java/CVE-2013-2460.
If the threat successfully exploits a vulnerability, it tries to download malware onto your PC. We have observed this threat trying to download files from the following URLs:
We have seen it try to download Ransom:Win32/Reveton and variants of Win32/Bedep.
This threat is part of the exploit kit called "Angler". See our page on exploits for more information.
Analysis by Stefan Sellmer