MSIL/Kryptik.AEWR malicious file

The MSIL/Kryptik.AEWR is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What MSIL/Kryptik.AEWR virus can do?

Dynamic (imported) function loading detected
CAPE extracted potentially suspicious content
Authenticode signature is invalid

How to determine MSIL/Kryptik.AEWR?


File Info:
name: AB6DCD0C0539ABF46F5A.mlw
path: /opt/CAPEv2/storage/binaries/e0baa3e4b53099cd3bcae88e19f64801568d1b9dadfca64f4d128cb4d399ab33
crc32: 4A4C4C51
md5: ab6dcd0c0539abf46f5a658898698548
sha1: c6f832bc939bcd256c822ef0b023a8183d37acde
sha256: e0baa3e4b53099cd3bcae88e19f64801568d1b9dadfca64f4d128cb4d399ab33
sha512: bde8b8592338fbb3355b752c00a387108cdd8feab05412e8543b658566a33412e682673bd85c501ac810f8e8b75fe480292045343daf51daa3bd841109f1b89d
ssdeep: 6144:DR7n7XiXZrPZ0uRyIjD7GA6iq2Bhb2k+wEvsR5Q7Ig1aTZWxoOv+f3y6UEz:DkJrxa4mdGhbX+wPMhNcr
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T15CD49DE2CDB0250EC9549B38E0D3CCB0E5DDE144506EB78878705B172E9D7C4DADA7AA
sha3_384: b6ac975b0e1321b31ff21b43d7b3a900dfb0848aaaad8659b59b767e458b437af35a9bdd2ee618f3f2b6f960ae39805d
ep_bytes: ff250020400000000000000000000000
timestamp: 2022-04-22 21:40:37

Version Info:
Translation: 0x0000 0x04b0
Comments: Direct3D Helper Module
CompanyName: 
FileDescription: D3DHelper
FileVersion: 1.0.0.0
InternalName: XOBK.exe
LegalCopyright: 
LegalTrademarks: 
OriginalFilename: XOBK.exe
ProductName: D3DHelper
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

MSIL/Kryptik.AEWR also known as:

Bkav	W32.AIDetectNet.01
Elastic	malicious (high confidence)
Cyren	W32/MSIL_Kryptik.HCH.gen!Eldorado
Symantec	Scr.Malcode!gdn30
ESET-NOD32	a variant of MSIL/Kryptik.AEWR
APEX	Malicious
Paloalto	generic.ml
Kaspersky	UDS:Trojan.MSIL.Crypt.gen
Alibaba	Trojan:Win32/starter.ali1000139
Rising	Trojan.Generic/MSIL@AI.90 (RDM.MSIL:1henrBF0vK3e6pRCg2qlaA)
McAfee-GW-Edition	BehavesLike.Win32.AgentTesla.jh
FireEye	Generic.mg.ab6dcd0c0539abf4
Sophos	ML/PE-A
Ikarus	Trojan.MSIL.Agent
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
Acronis	suspicious
McAfee	AgentTesla-FDFR!AB6DCD0C0539
VBA32	Malware-Cryptor.MSIL.AgentTesla.Heur
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/Kryptik.AEVQ!tr
BitDefenderTheta	Gen:NN.ZemsilF.34606.Mm0@aKDuJ4l
AVG	Win32:PWSX-gen [Trj]
Avast	Win32:PWSX-gen [Trj]
CrowdStrike	win/malicious_confidence_100% (D)

How to remove MSIL/Kryptik.AEWR?

MSIL/Kryptik.AEWR removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X