Microsoft security software detects and removes this threat.

This threat uses a Java vulnerability to download and run files on your PC, including other malware.

It runs when you visit a hacked or malicious website and you have a vulnerable version of Java.

The following versions of Java are vulnerable:

  • Oracle Java SE 7 update 17 and earlier.
  • OpenJDK 7 update 17 and earlier.

To check if you're running a vulnerable version of Java:

  1. In Control Panel, double-click Programs.
  2. If Java is installed you will see it in the list of installed programs. Click it to open the Java Control Panel.
  3. On the General tab, click About to see which version of Java you have installed.

You may get an alert about this threat even if you're not using a vulnerable version of Java. This is because we detect when a website tries to use the vulnerability, even if it isn't successful.

What to do now

The following free Microsoft software detects and removes this threat:

You should also run a full scan. A full scan might find other hidden malware.

Update Java

Make sure you install all available Java updates. You can read more about this vulnerability and download software updates from these links:

You should remove older versions of Java, as keeping old and unsupported versions of Java on your PC is a serious security risk:

If you continue to get alerted about this threat, deleting your temporary Java files can help:

It's also important to keep your other software up to date:

Get more help

You can also visit our advanced troubleshooting page or search the Microsoft virus and malware community for more help.

If you’re using Windows XP, see our Windows XP end of support page.

Threat behavior

Threat in context

Java is a general-purpose programming language, but cases of this exploit are targeted against the Java plug-in for web browsers. The intent of the Java plug-in is that Java programs (or "applets") can be offered by websites, and run in a "sandbox" where the Java plug-in enforces rules on what the Java applet can do so that it cannot escape restricted environment.

What is an exploit?

Exploits are written to take advantage of weaknesses (or vulnerabilities) in legitimate software. A project called Common Vulnerabilities and Exposures (CVE) gives each vulnerability a unique number, in this case "CVE-2013-2423". The portion "2013" refers to the year the vulnerability was discovered, and "2423" is a unique ID for this specific vulnerability. You can find more information on the CVE website.


Downloads and installs files

If you visit a website containing the malicious code while using a vulnerable version of Java, Exploit:Java/CVE-2013-2423 is loaded. It then tries to download and run files from a remote host/URL. The files that are downloaded and run could include other malware.

Additional technical details

This exploit works by causing an exploit called "type confusion" in the Java component "MethodHandles", where the Java interpreter will write 8 bytes into a 4 byte variable, thus overflowing the data into adjacent memory, (somewhat like a buffer overflow), and overriding a security check.

Attacking the security model means that the exploit might be effective on any platform the Java interpreter is on; for example Windows, MacOS, Linux, etc.

Usually the exploits are written using a few Java classes working together. The various class files are bundled into an archive called a JAR, which uses the ZIP file format. Every JAR contains a Manifest.MF file to identify itself to the Java Runtime. Since it is found in every JAR, it won't be listed.

Below are some examples of the JAR files that exploit the vulnerability described in CVE-2013-2423:

  • 061be17741f0918bbf458812f6a04ebf3b70dea5
    • Astra.class
    • GGG1.class
    • GGG4.class
    • Gomenoz.class
    • Lodka1.class
    • Lodka2.class
    • Siura.class
    • Sloza.class
    • V5.class
    • V7.class
    • XXX2.class
    • XXX3.class
    • XXX8.class
    • ZZ61.class
    • ZZ6Z.class
  • 28dc42c7b66a6a9e45d07397f1be684e1acb1372
    • Auto.class
    • Bommon.class
    • Doner.class
    • Geme.class
    • GrabmGold.class
    • Hoper.class
    • J3.class
    • MMM2.class
    • Rumine.class
    • Semen.class
    • Soliter.class
    • Tamana.class
    • Truten.class
    • Uglerod.class
  • 3866d78f233e5458c3244043b43006e9b3213582
    • Auto.class
    • Barmendsha.class
    • Doperz.class
    • GotikaRot.class
    • Jan.class
    • Mzama.class
    • Rollkatak.class
    • Smortan1.class
    • Svergo2.class
    • Svilis.class
    • Symerki.class
    • Tronzone.class
    • Ulikidema.class
  • 5b90f226256b2853e38ffab6f3b1cb651b9f90b2
    • ActiveX.class
    • C1.class
    • C2.class
    • Exploit.class
    • SystemClass.class
    • SystemClassBase.class
    • Union1.class
    • Union2.class
    • Z1.class
  • 5e0ad173659e9e2e06d89ffa3e98738a6ddecdac
    • Auto.class
    • Bommon.class
    • Doner.class
    • Geme.class
    • GeraDold.class
    • Humonad.class
    • kis.av
    • MMM2.class
    • MMM3.class
    • Rumine.class
    • Samurain.class
    • Slemge.class
    • Temerlan.class
    • Truten.class
    • Ulitka.class
  • 6c388af46e222a264344c67168d21569cf6e088c
    • Archive.class
    • Chrdak.class
    • Cont.class
    • Egnxuir.class
    • Fuj.class
    • Igid.class
    • Ivuy.class
    • Kiparic.class
    • Klpmm.class
    • Luka.class
    • Nakei.class
    • Rom.class
    • Tepvi.class
  • 8619454ec435a727f52ca795c2b1316420e82c4e
    • FieldAdd.class
    • FieldMn22.class
    • ImageAdd.class
    • ImagManM2C2S2.class
    • ImagManM2y2B2i2g2I2n2t2.class
    • ImagManML.class
    • ImagMan.class
    • Inner.class
    • Main.class23
    • MainestAddi.class
    • MainestAddi2.class
    • SysoClass.class
    • Union11111111.class
    • Union22222222.class

Once the exploit obtains full privileges on your PC, it may:

  • Run an executable file (that might be malware) included in the JAR
  • Run an executable file (that might be malware) from a URL hard-coded in the exploit's file
  • Take instructions from the HTML file (like a URL to the malware executable) that loaded them
Related information / Related references

You can read more about this exploit in the following articles:

Analysis by Chris Stubbs


Alerts from your security software may be the only symptom.


Alert level: Severe
First detected by definition: 1.149.1015.0
Latest detected by definition: 1.203.357.0 and higher
First detected on: May 01, 2013
This entry was first published on: May 01, 2013
This entry was updated on: Oct 29, 2014

This threat is also detected as:
No known aliases