Microsoft security software detects and removes this threat.

This threat uses a Java vulnerability to download and run files on your PC, including other malware.

It runs when you visit a hacked or malicious website and you have a vulnerable version of Java.

The following versions of Java are vulnerable:

  • Java Development Kit, Java Runtime Environment 7 Update 11 and earlier

To check if you're running a vulnerable version of Java:

  1. Go to the control panel (Select Start then Control Panel)
  2. Select Programs. If Java is installed you will see it in the list of installed programs. Click it to open the Java Control Panel.
  3. On the General tab, click About to see which version of Java you have installed.

You might get an alert about this threat even if you're not using a vulnerable version of Java. This is because we detect when a website tries to use the vulnerability, even if it isn't successful.

What to do now

The following free Microsoft software detects and removes this threat:

Even if we've already detected and removed this particular threat, running a full scan might find other malware that is hiding on your PC.

You can also visit the Microsoft virus and malware community for more help.

Update Java

Make sure you install all available Java updates. You can read more about this vulnerability and download software updates from these links:

You should remove older versions of Java, as keeping old and unsupported versions of Java on your PC is a serious security risk:

If you continue to get alerted about this threat, deleting your temporary Java files can help:

It's also important to keep your other software up to date:

Threat behavior

Threat in context

Java is a general-purpose programming language, but cases of this exploit are targeted against the Java plug-in for web browsers. The intent of the Java plug-in is that Java programs (or "applets") can be offered by websites, and run in a "sandbox" where the Java plug-in enforces rules on what the Java applet can do so that it cannot escape restricted environment.

What is an exploit?

Exploits are written to take advantage of weaknesses (or vulnerabilities) in legitimate software. A project called Common Vulnerabilities and Exposures (or CVE) is used by many vendors and organizations and gives each vulnerability a unique number, in this case "CVE-2013-0431". The portion "2013" refers to the year the vulnerability was discovered, and "0431" is a unique identifier. There is more information on the Common Vulnerabilities and Exposures website.


Downloads and installs files

This exploit downloads and runs files from a remote server. The list of URLs used varies and are only active for a short time. The files that are downloaded can include other malware.

The exploits can run files from a hard-coded URL, or take instructions from the HTML file that loaded them - like loading a URL to run additional malware.

Additional information

Exploit:Java/CVE-2013-0431 uses a vulnerability that was first disclosed when Oracle released a patch in February 2013. The problem lies in the "com.sun.jmx.mbeanserver.Introspector" class which lets an insecure call to invoke a method of "java.lang.reflect.Method" class. An attacker can exploit this issue to bypass sandbox restrictions and run arbitrary code with elevated privileges.

The exploit attacks the security model instead of memory corruption issues. With memory corruption issues, the exploit is dependent on the specific CPU (Central Processing Unit) type and operating systems, and might be affected by mitigation technology like DEP (Data Execution Prevention) or ASLR (Address Space Layout Randomization).

Attacking the security model means that the exploit might be effective on any platform the Java interpreter is on; for example Windows, MacOS or Linux.

Usually the exploits are written using a few Java classes working together. The various class files are bundled into an archive called a JAR, which uses the ZIP file format. Every JAR contains a Manifest.MF file to identify itself to the Java Runtime Environment. Since it is usually found in every JAR, it won't be listed.

Below are some examples of files that exploit the vulnerability described in CVE-2013-0431:

  • 53fe88cfa1405790d97684dc1a5e44c967b455ad
    • bQLbvMvB.class
    • HCbdWGC.class
    • LmrKVvsU.class
    • MWpWd.hmrf
    • MzHCrXWlvg.class
    • pCXrJlkjl.class
    • YAW.class
    • zEC.class
  • cc18b9aceebdaa6b9c420bad230c418075160976
    • Asd.class
    • codehex.class
    • d.class
    • hw.class
    • Impossible.class
    • RunnerGood.class
    • test.class
    • test2.class
  • bef7ebd285841f0f064597e5d7dfb79d248ccde8
    • cfnD.class
    • gcSo.class
    • klowOWkGN.class
    • lPgOyYffM.class
    • sHARLdBue.class
    • VbidYCG.hmrf
    • YHMrMtQohR.class
    • yMDIs.class
  • 1a1607652fdd2e3a48ef8392dda559178998a194
    • BurkinoGoso.class
    • codehex.class
    • d.class
    • hw.class
    • Impossible.class
    • RunnerGood.class
  • 54b965557266f2fc29b674750d1f5cd27cdd6cd4
    • ddp.class
    • DOkU.class
    • EeUMUfASp.hmrf
    • etwGk.class
    • NQUzDuEIK.class
    • PYJTIGaCe.class
    • QkQoLAOA.class
    • sfslGDub.class
    • tOKIA.class
  • 1c22ab90fe81db14d69c52596287f6f9e9f055e9
    • dmq.class
    • dzsrrk.class
    • lem.class
    • mjcluzq.class
    • oxnadowf.class
    • pyt.class
    • rt.class
  • a0b32e4971d1b9c81dd7667e4db4e1d5cb3c98ad
    • EGYMsp.class
    • evJUJyJ.hmrf
    • FSKdGyKTTW.class
    • MJKMwLP.class
    • oegqxHDVz.class
    • PCMpjy.class
    • QRdcLx.class
    • rpjpq.class
    • WHXNv.class
  • 210fd654b32c33e18665df745e4ac39c9bf4eb01
    • a.class
    • alj.class
    • izemubql.class
    • me.class
    • vwxgngt.class
    • xmd.class
    • xp.class
  • 874c6b1a64145f8c17f83b67eab71f3e9cc2fb2d
    • acHthNK.class
    • bgWMw.class
    • cRdYJ.class
    • efbUDeuaSC.class
    • EqJHhipC.class
    • irn.class
    • lXVMM.class
    • qqpiNAuCR.class
    • SSuauhLQ.hmrf
  • dd3f18743914eb75df98a2c3e3b053377888e662
    • g.class
    • sox.class
    • Y.ser

The following articles explain some of the technical details of the weakness this vulnerability exploits:

Analysis by Tanmay Ganacharya


Alerts from your security software may be the only symptom.


Alert level: Severe
First detected by definition:
Latest detected by definition: 1.197.1367.0 and higher
First detected on: Feb 21, 2013
This entry was first published on: Feb 21, 2013
This entry was updated on: Oct 29, 2014

This threat is also detected as:
  • Java/Exploit.Agent.NIF trojan (ESET)
  • Troj/JavaDl-SA (Sophos)
  • JV/Blacole-FET!29A92C3EEDD7 (McAfee)
  • Exploit-FET!CVE2013-0431 (McAfee)
  • Troj/JavaDl-UG (Sophos)
  • Trojan.Maljava (Symantec)
  • JV/Blacole-FET!29A92C3EEDD7 (McAfee)
  • Exploit-FET!CVE2013-0431 (McAfee)
  • Exploit.CVE2013-0422.13 (Dr.Web)
  • Exploit-FET!Exploit-JAR (McAfee)
  • Mal/JavaJar-B (Sophos)
  • JV/Blacole-FHA!949BD2B7DE14 (McAfee)
  • Troj/JavaDl-FC (Sophos)
  • JAVA_EXPLOYT.BU (Trend Micro)
  • RDN/Generic Exploit!1mz (McAfee)
  • Troj/JavaDl-UL (Sophos)
  • Exploit.Java.458 (Dr.Web)
  • JV/Blacole-FHA!D0BA98FA1FE3 (McAfee)
  • Exploit.Java.461 (Dr.Web)
  • JV/Blacole-FHA!23C205BE86D0 (McAfee)
  • Java/Exploit.Agent.NLX trojan (ESET)
  • JAVA_EXPLOIT.WT (Trend Micro)