Categories: Malware

Win32/Injector.DVHN removal

The Win32/Injector.DVHN is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Injector.DVHN virus can do?

Behavioural detection: Executable code extraction – unpacking
Yara rule detections observed from a process memory dump/dropped files/CAPE
Creates RWX memory
Dynamic (imported) function loading detected
Reads data out of its own binary image
A process created a hidden window
CAPE extracted potentially suspicious content
Drops a binary and executes it
Authenticode signature is invalid
A scripting utility was executed
Uses Windows utilities for basic functionality
Installs itself for autorun at Windows startup
A script process created a new process
Anomalous binary characteristics

How to determine Win32/Injector.DVHN?


File Info:
name: 02CEED4AD8FF9C62D401.mlwpath: /opt/CAPEv2/storage/binaries/e6e8abd9c253ab7addcf6c44721e3755324e975e670a4ff031293f57481b4ceacrc32: 43347A55md5: 02ceed4ad8ff9c62d4011986559ae047sha1: fe6aa60613e351f7aef5b5679f0b0f801751c3b2sha256: e6e8abd9c253ab7addcf6c44721e3755324e975e670a4ff031293f57481b4ceasha512: f6c3a3feb513e74df4f1b0706505842629459c720bc0c7d0b71efaa152e2da856dc65c4b83e67b7dd6640025c81b0a132fd5076b3d45f5faea2be0ae476eb204ssdeep: 3072:MRlRIWQiQHMGxRVC8c2jR74kSBOXJ8X2Yec/CEUIuqNYz9I/9sb0T:yoWQi2MGxR5pzXo2L+3/5N9uQtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T17A84E1E10679C777D27497B09706BA397B36EE000AC6141C6D49AD2CF671991DAC0B3Bsha3_384: a6882a7497f0dce9a955e706e7b89a32b848e9a705bc0e0f435df0f15e1cc5220e87de56652b43c6a40ecc849b1ef002ep_bytes: 6808144000e8eeffffff000000000000timestamp: 2018-01-24 10:14:04
Version Info:
Translation: 0x0409 0x04b0CompanyName: CJSC ^computing forces^FileDescription: NAtomsora'ProductName: taVAGOsaFileVersion: 8.01ProductVersion: 8.01InternalName: Racehorse8OriginalFilename: Racehorse8.exe

Win32/Injector.DVHN also known as:

Bkav	W32.AIDetect.malware2
Elastic	malicious (high confidence)
DrWeb	Trojan.Siggen15.60099
MicroWorld-eScan	Trojan.Agent.CTYM
FireEye	Generic.mg.02ceed4ad8ff9c62
McAfee	Packed-YP!02CEED4AD8FF
Cylance	Unsafe
Zillya	Trojan.Injector.Win32.1283586
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
K7GW	Trojan ( 00524dc51 )
K7AntiVirus	Trojan ( 00524dc51 )
BitDefenderTheta	Gen:NN.ZevbaF.34062.ym0@auiaDhbi
Cyren	W32/VBInject.OB.gen!Eldorado
Symantec	Packed.Generic.519
ESET-NOD32	a variant of Win32/Injector.DVHN
TrendMicro-HouseCall	TSPY_HPFAREIT.SMVB
ClamAV	Win.Dropper.Fareitvb-9895670-0
Kaspersky	Trojan.Win32.VBKrypt.yycx
BitDefender	Trojan.Agent.CTYM
NANO-Antivirus	Trojan.Win32.VBKrypt.exoabe
Avast	Win32:Malware-gen
Tencent	Malware.Win32.Gencirc.114cdacb
Ad-Aware	Trojan.Agent.CTYM
Sophos	ML/PE-A + Mal/FareitVB-M
TrendMicro	TSPY_HPFAREIT.SMVB
McAfee-GW-Edition	BehavesLike.Win32.Fareit.fz
SentinelOne	Static AI – Malicious PE
Emsisoft	Trojan.Agent.CTYM (B)
GData	Trojan.Agent.CTYM
Jiangmin	Trojan.VBKrypt.chom
Avira	HEUR/AGEN.1127814
Antiy-AVL	Trojan/Generic.ASMalwS.2443813
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
Cynet	Malicious (score: 100)
AhnLab-V3	Win-Trojan/VBKrypt.RP02.X1828
Acronis	suspicious
VBA32	Trojan.VBKrypt
ALYac	Trojan.Agent.CTYM
TACHYON	Trojan/W32.VB-VBKrypt.405504.N
Malwarebytes	Malware.AI.4234976363
APEX	Malicious
Rising	Trojan.Kryptik!1.AFE7 (CLASSIC)
MAX	malware (ai score=83)
eGambit	Unsafe.AI_Score_100%
Fortinet	W32/VBKryptik.DZLN!tr
AVG	Win32:Malware-gen
Panda	Trj/Genetic.gen