• Malware Analysis: Havij_Load.exe

    Is Havij_Load.exe a virus?

    After listening to this inquiry from numerous readers, I've chosen to post a in depth report on Havij_load.exe. In straightforward words it is not an infection itself but rather can be binded with a malware. Here, we're checking the original file.


    This file was executed on windows 7 under administrator privileges.

    Actions:

    No alarming behaviours, doesn't delete or modify system files.

    Creates 'C:\Windows\SysWOW64\HavijPro\' folder and adds non-infected files into it.

    OCX files are registered.


    Registry is not affected.

    No startup entries and IFEO hijacks are made.

    Size
    File Size:
    24241 bytes (23.67 KB)

    Hashes
    MD5:C54226211F2A5C979BA14B7B8D3C6B3A
    SHA-1:5D36A6C38DB9F6A25B6D975FE867C19CBE678101

    Created files:
    • %SysDir%\HavijPro\columns.txt
      %SysDir%\HavijPro\Havij.exe
      %SysDir%\HavijPro\Havij_Load.exe
      %SysDir%\HavijPro\Help.chm
      %SysDir%\HavijPro\Read Me.txt

      Autostart registry keys:

      HKLM\Software\Classes\CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}\InprocServer32\: “%SysDir%\MSCOMCTL.OCX”
      HKLM\Software\Classes\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\: “%SysDir%\Mswinsck.ocx”
      HKLM\Software\Classes\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\: “%SysDir%\Mswinsck.ocx”
      HKLM\Software\Classes\CLSID\{2C247F23-8591-11D1-B16A-00C0F0283628}\InprocServer32\: “%SysDir%\MSCOMCTL.OCX”
      HKLM\Software\Classes\CLSID\{35053A22-8589-11D1-B16A-00C0F0283628}\InprocServer32\: “%SysDir%\MSCOMCTL.OCX”
      HKLM\Software\Classes\CLSID\{3B7C8860-D78F-101B-B9B5-04021C009402}\InprocServer32\: “%SysDir%\RICHTX32.OCX”
      HKLM\Software\Classes\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\InprocServer32\: “%SysDir%\MSINET.OCX”
      HKLM\Software\Classes\CLSID\{48E59294-9880-11CF-9754-00AA00C00908}\InprocServer32\: “%SysDir%\MSINET.OCX”
      HKLM\Software\Classes\CLSID\{48E59295-9880-11CF-9754-00AA00C00908}\InprocServer32\: “%SysDir%\MSINET.OCX”
      HKLM\Software\Classes\CLSID\{66833FE6-8583-11D1-B16A-00C0F0283628}\InprocServer32\: “%SysDir%\MSCOMCTL.OCX”
      HKLM\Software\Classes\CLSID\{78E5A540-1850-11CF-9D53-00AA003C9CB6}\InprocServer32\: “%SysDir%\RICHTX32.OCX”
      HKLM\Software\Classes\CLSID\{7DA06D40-54A0-11CF-A521-0080C77A7786}\InprocServer32\: “%SysDir%\TABCTL32.OCX”
      HKLM\Software\Classes\CLSID\{8E3867A3-8586-11D1-B16A-00C0F0283628}\InprocServer32\: “%SysDir%\MSCOMCTL.OCX”
      HKLM\Software\Classes\CLSID\{AFC634B0-4B8B-11CF-8989-00AA00688B10}\InprocServer32\: “%SysDir%\RICHTX32.OCX”
      HKLM\Software\Classes\CLSID\{B617B991-A767-4F05-99BA-AC6FCABB102E}\InprocServer32\: “%SysDir%\RICHTX32.OCX”
      HKLM\Software\Classes\CLSID\{BDC217C5-ED16-11CD-956C-0000C04E4C0A}\InprocServer32\: “%SysDir%\TABCTL32.OCX”
      HKLM\Software\Classes\CLSID\{BDD1F04B-858B-11D1-B16A-00C0F0283628}\InprocServer32\: “%SysDir%\MSCOMCTL.OCX”
      HKLM\Software\Classes\CLSID\{C27CCE32-8596-11D1-B16A-00C0F0283628}\InprocServer32\: “%SysDir%\MSCOMCTL.OCX”
      HKLM\Software\Classes\CLSID\{C27CCE33-8596-11D1-B16A-00C0F0283628}\InprocServer32\: “%SysDir%\MSCOMCTL.OCX”
      HKLM\Software\Classes\CLSID\{C27CCE34-8596-11D1-B16A-00C0F0283628}\InprocServer32\: “%SysDir%\MSCOMCTL.OCX”
      HKLM\Software\Classes\CLSID\{C27CCE35-8596-11D1-B16A-00C0F0283628}\InprocServer32\: “%SysDir%\MSCOMCTL.OCX”
      HKLM\Software\Classes\CLSID\{C27CCE36-8596-11D1-B16A-00C0F0283628}\InprocServer32\: “%SysDir%\MSCOMCTL.OCX”
      HKLM\Software\Classes\CLSID\{C27CCE37-8596-11D1-B16A-00C0F0283628}\InprocServer32\: “%SysDir%\MSCOMCTL.OCX”
      HKLM\Software\Classes\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283628}\InprocServer32\: “%SysDir%\MSCOMCTL.OCX”
      HKLM\Software\Classes\CLSID\{C27CCE39-8596-11D1-B16A-00C0F0283628}\InprocServer32\: “%SysDir%\MSCOMCTL.OCX”
      HKLM\Software\Classes\CLSID\{C27CCE3A-8596-11D1-B16A-00C0F0283628}\InprocServer32\: “%SysDir%\MSCOMCTL.OCX”
      HKLM\Software\Classes\CLSID\{C27CCE3B-8596-11D1-B16A-00C0F0283628}\InprocServer32\: “%SysDir%\MSCOMCTL.OCX”
      HKLM\Software\Classes\CLSID\{C27CCE3C-8596-11D1-B16A-00C0F0283628}\InprocServer32\: “%SysDir%\MSCOMCTL.OCX”
      HKLM\Software\Classes\CLSID\{C27CCE3D-8596-11D1-B16A-00C0F0283628}\InprocServer32\: “%SysDir%\MSCOMCTL.OCX”
      HKLM\Software\Classes\CLSID\{C27CCE3E-8596-11D1-B16A-00C0F0283628}\InprocServer32\: “%SysDir%\MSCOMCTL.OCX”
      HKLM\Software\Classes\CLSID\{C27CCE3F-8596-11D1-B16A-00C0F0283628}\InprocServer32\: “%SysDir%\MSCOMCTL.OCX”
      HKLM\Software\Classes\CLSID\{C27CCE40-8596-11D1-B16A-00C0F0283628}\InprocServer32\: “%SysDir%\MSCOMCTL.OCX”
      HKLM\Software\Classes\CLSID\{C27CCE41-8596-11D1-B16A-00C0F0283628}\InprocServer32\: “%SysDir%\MSCOMCTL.OCX”
      HKLM\Software\Classes\CLSID\{C27CCE42-8596-11D1-B16A-00C0F0283628}\InprocServer32\: “%SysDir%\MSCOMCTL.OCX”
      HKLM\Software\Classes\CLSID\{C74190B6-8589-11D1-B16A-00C0F0283628}\InprocServer32\: “%SysDir%\MSCOMCTL.OCX”
      HKLM\Software\Classes\CLSID\{DD9DA666-8594-11D1-B16A-00C0F0283628}\InprocServer32\: “%SysDir%\MSCOMCTL.OCX”
      HKLM\Software\Classes\CLSID\{F08DF954-8592-11D1-B16A-00C0F0283628}\InprocServer32\: “%SysDir%\MSCOMCTL.OCX”

    • Overall Rating: 100% safe

    No comments:

    Post a Comment

    Follow me on Facebook

    Thanks to Google

    Powered by Blogger.