Exploit:JS/Blacole.A

Exploit:JS/Blacole.A is the detection for malicious Javascript that loads a series of other exploits. If the computer runs a vulnerable version of certain software and exploitation is successful, various malware may be downloaded.

Installation

Exploit:JS/Blacole.A may arrive in a computer when a user visits a malicious webpage.

Payload

Loads exploit files
Exploit:JS/Blacole.A may load various exploits based on what software is vulnerable in the computer. These exploits include:

• Exploit:Java/CVE-2010-0840.EW
• Exploit:Win32/Pdfjsc.RF
• Exploit:Win32/Pdfjsc.RM

Exploit:JS/Blacole.A may download various malware to the affected computer. The observed downloaded families include:

• Win32/Cycbot
• Win32/Sinowal
• Win32/FakeSysdef
• Win32/Carberp
• Win32/Zbot
• Win32/EyeStye
• Win32/Meteit
• Win32/Cutwail
• Win32/FakeRean
• Win32/Drstwex

Analysis by Shawn Wang