z_v�a��Fɕ��X�4P./BkX���|L�`W/Fk|FZ���?Ւ�%'���,�{#��4���j��&{N;�]�:W���Ĺ^G48� H�0��?TMc���0G�$}������9X)UN�M�C��,��d�V/�'/� �#MԼ{z��_7�����%����ތ���1�p�+��;�٤��O�Gg��������0<����hs.y.���Y�D��7���ϤWČ��� $�T/��>�����ࡪ� zG�ޠ��Y8�D��MB%|�Bs`�_4�E�n����_&����ȱ>1P����i�j�:U���� �Xo�X���l�%������z�y�} D�G��=�bS��m�Xl�Fz�i���s+4^��"���V�e_`�SO�~s�)�yt���G�N?2�5�g�p��tm>;\l��D�M�`<�E���خ��� �<.�����:����]7��)Ik��$e� ���u>�t�Ö�T]e�x`��杒>L����TYIu��W���7.��tz��)��B̊�8H�ć��f�~��mq~�-rRㅻ\�}��/h���p��gkRC��G� �,���#��-<�U�C�����qF�n.#�i6m�Re53��m��0)��rS�Iy�!�ɒ�w;�Z*�*Z��U>x�.�)�Z�Ew�2����-H����/ƈ0Ϲ��.q֊k��t3�)'g �����}��)T��<NUp���H��Z��T�71e�)d����;��e��Y ��/��Ի��0u�%�;�3^�g��:��M���!y���1Q�����PD�1(H�-��/T�ڷ�M�M��<�*�}���R��3�_� �!C�1�{�%BK�����4�z�\}��5�W煏G�9i��-�~��F]vz�A�u(�'(�T��/�y���[��q���э�E�Xo;oA?�O?�TԄ��ϝ(<�b��{��/U��s����6Ny �h@��ok�ǯ������z�)��Fn��@������܌�ID@����+���u#���A����Hu?4���r0�����{Y����u����,�����Q G��őW�Aq����r��\�9_�\%MBd`��@0sr��﹜ī������Ӡ9U��W���������<4j:�jS�b���IU=��*���{Z�O���������RҠ��r� ۚG1 a��Q��A���Z�U @j���=�n�2, Z/���K�9)����m#���Ҫ#�+߁yp��i�gRh�aB���K����t��M�T�2��w,�5,� j#�FG���B,��n�x� uz?(G2RD��F��^:v��[RI@]|LA�;J!V�ψFT��kH�u���zd�����Ax3� ���� ����Ɓއ�K��u�7Gr�O?��l ���D5�L5[G��#��H���3��\fO?��=JƜpIZ�<6�3��<�w?Т���;#�5�K`�B�7���<*�~�+u�,��I�d*K��nm�e$ �'���D��x��d���vt�/v�i %�.�!SD�ÂX�Ҥ���+إE턾�]�4~n��O���5���T���Ւ����A�v��&+�[鶳�[������hh�9D8Y�D��5x�\5^�.�����U ������`0�QZ3���������U<�ᛐ+-�o�������IoX��2�����q<b���"A���П|�V�Z^!�!�+��f��왽�����!ҵט(>��r����8)�Y�����~�rG�>�����J�'��GC��<�Cb=S��� �-K���{�~����+�"��� �8�|�!�f'� �0�i�dt7�06%��F� ߫K������}"`��{Ts5�ٟ���͠a�t��S(�/�õ��Ү4d�Y�Y]C�ڹz����ŋ������z�>��l<1Yi{�푴�;Ӝk�)[��ZJcF�p���u�����E1�YM��]�3P=��=6�*Ӧ^I� ^���ӹ�/w��[y'�NQ$E,J���F�� ���Eu�ņ����[B����ͧGa�� �O�;\���;�nX��3���,��v�~��r�V��W�#!bM�|��ɴ���^��������T̻�mS�$��ȩ�l���O�ۓ5���-� ���lfέ�jbI+�gX�j�7����&J/�琲',��$1����0����V~w���u┼��/r�ر1�C����&�S�Cx�ϊb���9�J!|�ԃXP�{W������h��ޭ��D�BfLa��^.�e(��/�?����3Qh`2#��~g�> �%�< ��m�j��^Żf���~���ϯA~8G߈K. ~�Q6������k^��/P_��V^����B@C%��O$y.����ȱ�cJ�W��U��6������\\m@�Yf*K�#LtS���IOu{=y��$��'�oZ: ��ɵ�(���������?��m�U���j��yC@ _��C-묭"�4x��-X����\��ﴀFϗ���w/��a��d�B��V�3�=)��Em_�s܈ͫ�V�%��c�\� Rv&���Չ�Ug��J��R6k���L����$oGt?�Ν���坙��T��A�l�� �$O���0��*I2�|�h������&��yb6e��w�d�c�}��Q;�ya��g��8���咱���f(�m_��%������|�n5I#bY)~�vB���p����vn��`!���Q��SN�\+LO��ۄϾF���B�GK��k���ؕi���8�]n2��݈Q��h�s�����p��q��:�����?�`h�en)�$��2+,�A�,�0��צ;�l�6�K����T�yצ� 1j�ї��O�h<dNު��[�C�����ڃJ�Q�+�vh*튄�A��^���t��|.lc�9�#U� Lj쎯w:���m��u�&���]��W�h_<���:b�r���k��A�R��9�Ip���1�����%M��dx0��~o��6볍�:��'})[�cqI��W�IO0�)2���8w@���<�&�ʈ��̶-�!�>
Behavioral task
behavioral1
Sample
Havij.exe
Resource
win10v2004-20220812-en
General
-
Target
Havij.exe
-
Size
3.1MB
-
MD5
a9985fd7ba9b20f84f65d924656e8d52
-
SHA1
f79c9e82de92ae8271961ca455ca450b5d166d1f
-
SHA256
e9ddb4f8036a3885a32f7ca720079d038bb97b2fbc30e1cf3e4dfe079fb3d7d3
-
SHA512
a003817d16abbd3da73e10001e407690aeb73c39e19ed6415e0a093259389bf3d378f7ce803ecb143ad9c2cc0d2cf1d0e2ea3f177780b7a0b1dcc417b994f37e
-
SSDEEP
98304:24j+2v3lqrveF1ftxpbBpmeAaDnwEv80:24rN4i/FpFDnwEv
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
Havij.exe.exe windows x86
7cc6c77c3fd096a0cca62b299e454b2f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaPut3
kernel32
Thread32First
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 3.1MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ