Threat Level: green Handler on Duty: Xavier Mertens

SANS ISC: evilcode.class - SANS Internet Storm Center SANS ISC InfoSec Forums

Participate: Learn more about our honeypot network

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

Exploit authors sometimes like to be cute:

A Java archive called "fun.jar" containing an "evilcode.class" file that runs as an applet of 1x1 pixels size ... well, this can't be anything good. And it indeed isn't. This code snippet was lurking on quite a few web sites over the past days.

Sending fun.jar to Virustotal shows that only 10 of 43 anti-virus tools actually recognize the exploit code, whereas 27/43 recognize the d.exe malware file that the exploit currently downloads and runs.

Evilcode.class exploits the Java Rhino Engine vulnerability (CVE2011-3544), published back in October 2011 and affecting all Java Runtime Engines up to JRE 1.6_27. The exploit still seems to work well enough for the bad guys that they don't see any need to re-tool to newer exploits. In slight modification of Oracle's own words:



385 Posts
ISC Handler
Mar 25th 2012
So, Daniel, what's your recommendation w/ respect to what to use other than Java?

135 Posts
In slight modification of Wesemann's own words:

<strikethough>Exploit</strikethrough> authors sometimes like to be cute: Java on your system presents a serious security risk.
1 Posts

Sign Up for Free or Log In to start participating in the conversation!