Exp/20121889-A detects samples attempting to exploit a vulnerability in Microsoft XML Core Services which could allow Remote Code Execution (CVE-2012-1889). Please see the following security advisories for more information:
- http://technet.microsoft.com/en-us/security/advisory/2719615
- http://www.sophos.com/en-us/threat-center/threat-analyses/vulnerabilities/VET-000352.aspx
Examples of Exp/20121889-A include:
Example 1
File Information
- Size
- 5.7K
- SHA-1
- 03e3b78230e8574a0c13b7ecb3ba9b591f57e009
- MD5
- df531cff54c3e16b9ef3d4c8c8aab449
- CRC-32
- f543aa29
- File type
- Hypertext Markup Language
- First seen
- 2012-07-05
Runtime Analysis
HTTP Requests
- http://www.nkorea.or.kr/main/images/hpy.cab
DNS Requests
Example 2
File Information
- Size
- 119
- SHA-1
- 03ea9c44f4563287ca5bbab80842044cebc6a1b8
- MD5
- cd7d29b5b866f5def17139350dcf4f48
- CRC-32
- bceec600
- File type
- JavaScript
- First seen
- 2012-06-14
Example 3
File Information
- Size
- 36K
- SHA-1
- 64588870923b6687e3a2776ff5efc088942b4c0f
- MD5
- 6a297dca4b5361aca55fc88abb3525fd
- CRC-32
- 607744cb
- File type
- Hypertext Markup Language
- First seen
- 2012-06-21
Runtime Analysis
IP Connections