Threat behavior
Exploit:JS/ShellCode.Z is a generic detection for JavaScript objects that construct shellcode. These scripts may be embedded within other document files such as specially-crafted .PDF files, for example.
This detection also includes malicious JavaScript that attempts to exploit an uninitialized memory corruption vulnerability (
CVE-2010-0806) that allows the execution of arbitrary code. Microsoft released
Microsoft Security Bulletin MS10-018 to mitigate this vulnerability.
Installation
This threat may be encountered when visiting a malicious Web page or by viewing malicious HTML content containing the exploit. If the exploit runs on a vulnerable computer, it could result in the download and execution of arbitrary files.
Payload
Execution of arbitrary code
The exploit attempts to take advantage of an uninitialized memory corruption vulnerability that allows the execution of arbitrary code. One example of the exploit attempts to initialize shellcode to download other malware from the domain "x3.cndlq.com". At the time of this writing, the requested file was not available for analysis.
Analysis by Tim Liu
Prevention
