What is “MSIL/Kryptik.AFHV”?

The MSIL/Kryptik.AFHV is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What MSIL/Kryptik.AFHV virus can do?

Dynamic (imported) function loading detected
Unconventionial language used in binary resources: Latvian
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Anomalous .NET characteristics

How to determine MSIL/Kryptik.AFHV?


File Info:
name: A042796B1EB8EC38E79E.mlw
path: /opt/CAPEv2/storage/binaries/c222d1a930e85d4859534823335260566a2682cc5f86bf52fe7401acc4e0dd34
crc32: 25E892E2
md5: a042796b1eb8ec38e79e9c6d26088a3a
sha1: 8a58194fb5d787f5cb52c308a1773f5b45252087
sha256: c222d1a930e85d4859534823335260566a2682cc5f86bf52fe7401acc4e0dd34
sha512: 409dc12af44d7c1b7b421a8930664ab7ac2405dfcf585cbdae6ddb4c661b2e88e5890b5a4dd9eea7b6d99b3b39627fcb60731101148f3ae05ccffcef84bd6d5d
ssdeep: 98304:FEnV8esKu2A+afIm6wLyr5MN2WiFAqP2S8aRdha9+ha9Jha99:FEV8xZIm6wcJWihda9Ga9Da9
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T17A66D00037A59D11C2ADE63459B7FA380B22FCF2169587479CE67C97317B31A989F382
sha3_384: 841bf5ab81f1a960bfe19dcf333fe0528600498bc89246c7d924ea470f5fbc4df6245453fe42db1381421e2cc94bd1c2
ep_bytes: ff250020400000000000000000000000
timestamp: 2022-05-22 10:00:15

Version Info:
Translation: 0x0000 0x04b0
Comments: csc
CompanyName: Microsoft Corporation
FileDescription: csc
FileVersion: 1.2.3.4
InternalName: file_for_check.exe
LegalCopyright: © Microsoft Corporation.  All rights reserved.
OriginalFilename: file_for_check.exe
ProductName: Microsoft® Windows® Operating System
ProductVersion: 1.2.3.4
Assembly Version: 0.0.0.0

MSIL/Kryptik.AFHV also known as:

MicroWorld-eScan	Trojan.GenericKD.49051048
ALYac	Trojan.GenericKD.49051048
Cylance	Unsafe
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan ( 0059312e1 )
Alibaba	Trojan:MSIL/Kryptik.b902322c
K7GW	Trojan ( 0059312e1 )
Cybereason	malicious.fb5d78
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/Kryptik.AFHV
Paloalto	generic.ml
ClamAV	Win.Packed.Cerbu-9952791-0
Kaspersky	UDS:Trojan.Multi.GenericML.xnet
BitDefender	Trojan.GenericKD.49051048
Avast	Win32:Trojan-gen
Ad-Aware	Trojan.GenericKD.49051048
Emsisoft	Trojan.GenericKD.49051048 (B)
TrendMicro	TROJ_GEN.R002C0WEP22
McAfee-GW-Edition	BehavesLike.Win32.Generic.vc
FireEye	Generic.mg.a042796b1eb8ec38
Sophos	Mal/Generic-S
GData	Trojan.GenericKD.49051048
MAX	malware (ai score=81)
Arcabit	Trojan.Generic.D2EC75A8
Microsoft	Trojan:Win32/Wacatac.B!ml
Cynet	Malicious (score: 100)
Acronis	suspicious
McAfee	Artemis!A042796B1EB8
TrendMicro-HouseCall	TROJ_GEN.R002C0WEP22
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.82199810.susgen
Fortinet	MSIL/Kryptik.AFEA!tr
BitDefenderTheta	Gen:NN.ZemsilF.34742.@p0@a4jaiPnc
AVG	Win32:Trojan-gen
CrowdStrike	win/malicious_confidence_100% (W)

How to remove MSIL/Kryptik.AFHV?

MSIL/Kryptik.AFHV removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X