TrojanDownloader:Java/Vadkad.A

TrojanDownloader:Java/Vadkad.A is a Java class file, 2989 bytes in size, that is used to download and execute malicious files from a specified location. The class file is reused as a functional component by malicious software, and is a part of a Java archive (.jar) package 12384 bytes in size. The .jar package contains an applet "main" and the following class files:

 

 

The TrojanDownloader:Java/Vadkad.A class file is called from a class file "g6kl" which is in turn called by an applet "main" within the .jar package.

 

The TrojanDownloader:Java/Vadkad.A class file consists of several functions with obfuscated names such as:

 

 

The class receives a malicious file URL as an argument, and uses it to download and drop a file locally as "mstsc.exe". Once downloaded, the trojan will attempt to execute the downloaded file up to 10 times - if unsuccessful - before quitting.

A number of legitimate websites could be compromised or unwillingly host a malicious applet through advertising frames which could redirect to, or host a malicious Java applet. It is not uncommon for antivirus software to detect malicious Java applets in a web browser's cache. It doesn’t necessarily mean that the system is compromised. Most of the time it reflects the fact that, at some stage, a webpage with a malicious applet had been visited and cached internally. To thwart such a notification it is often enough to purge the cache using a web browser's configurable security options.