Threat Description

Exploit: HTML/IESlice.BK

Details

Category: Malware
Type: Exploit
Platform: JS
Aliases: Exploit:​HTML/IESlice.BK

Summary


Exploit:HTML/IESlice.BK exploits a vulnerability in an ActiveX control used by Xunlei Thunder 5.7.4.401.

Malicious or compromised websites use the exploit to download and execute arbitrary code.



Removal


Automatic action

Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.

More scanning & removal options

More information on scanning or removal options is available in the documentation for your F-Secure security product on the Downloads section of our Home - Global site.

You may also refer to the Knowledge Base on the F-Secure Community site for more information.

Contact Support

For further assistance, F-Secure customers can request support online via the Request support or the Chat forms on our Home - Global site.



Technical Details


Exploit:HTML/IESlice.BK is a script that exploits a heap-based buffer overflow in the PPlayer.XPPlayer.1 ActiveX control used by the pplayer.dll_1_work DLL of Xunlei Thunder 5.7.4.401.

Sucessful exploitation allows the attacker to download and execute arbitrary code on the victim's computer.

Exploitation is done via a malicious webpage containing the detected script.

This vulnerability is under review as CVE-2007-6144.

Exploit:HTML/IESlice.BK will attempt to download a file from the following URL and execute it:

  • https://9gg.biz/real.exe

The URL was inactive during investigations.






SUBMIT A SAMPLE

Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

Learn More