Trojan.Downloader.JS.Agent.PB

tag:Trojan   Downloader  

This trojan is written in JavaScript and it exploits a buffer overflow vulnerability of BaoFeng Storm ActiveX Control ( identified with the following CLSID: 6BE52E1D-E586-474F-A6E2-1A85A9B4D9FB). This is done by passing a long argument into rawParse() method of Mps.dll.
If the code stored in a JavaScript unescaped sequence is executed, it will download a malware from the following URL: http://www.[removed]hena.com/test.exe, save it under a.exe ant then execute it. When this description was made, the URL wasn Please let BitDefender delete your files.

This is a script that will download a file and save it on user's computer under a.exe, so there are no obvious symptoms unless the download succeeds and the script executes the downloaded file.

©Virus-Encyclopedia.com All Rights Reserved.