Home Malware Programs Trojans JS_EXPLT.QYUA

JS_EXPLT.QYUA

Posted: January 27, 2012

Threat Metric

Ranking: 5,022
Threat Level: 2/10
Infected PCs: 4,804
First Seen: January 27, 2012
Last Seen: October 16, 2023
OS(es) Affected: Windows

JS_EXPLT.QYUA is a noxious Trojan which is used by HTML_EXPLT.QYUA to exploit a recently and publicly disclosed vulnerability, the MIDI Remote Code Execution Vulnerability (CVE-2012-0003). The said vulnerability is provoked when Windows Multimedia Library in Windows Media Player (WMP) fails to cope with a specially crafted MIDI file, finally enabling remote attackers to execute arbitrary code. HTML_EXPLT.QYUA is a malicious HTML which has been found hosted on the URL hxxp://images.{BLOCKED}p.com/mp.html. HTML_EXPLT.QYUA exploits the vulnerability by using two components that are also hosted on the same URL. A JavaScript JS_EXPLT.QYU is one of the two detected files. The other one is a MIDI file detected as TROJ_MDIEXP.QYUA. HTML_EXPLT.QYUA calls TROJ_MDIEXP.QYUA to provoke the exploit, and uses JS_EXPLT.QYUA to decode the shellcode inserted in HTML_EXPLT.QYUA's body.

Technical Details

Additional Information

The following URL's were detected:
captchareverse.com
Loading...