About “Win32/Kryptik.AFAF” infection

The Win32/Kryptik.AFAF is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Kryptik.AFAF virus can do?

• Behavioural detection: Executable code extraction – unpacking
• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Presents an Authenticode digital signature
• Creates RWX memory
• Dynamic (imported) function loading detected
• Performs HTTP requests potentially not found in PCAP.
• HTTPS urls from behavior.
• Network anomalies occured during the analysis.
• Enumerates running processes
• CAPE extracted potentially suspicious content
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid
• A ping command was executed with the -n argument possibly to delay analysis
• Uses Windows utilities for basic functionality
• Deletes its original binary from disk
• Attempts to modify proxy settings
• Anomalous binary characteristics
• Uses suspicious command line tools or Windows utilities

How to determine Win32/Kryptik.AFAF?

File Info:
name: E9F097145C4B3FB5E435.mlw
path: /opt/CAPEv2/storage/binaries/c52e394d2f2ec3d8013b4351d5271d8e90edcac6203cdfad0289440b4c398e87
crc32: 580B115F
md5: e9f097145c4b3fb5e435906227b51695
sha1: 3d4cf168ddfefce278ce559d22e665cc505ab536
sha256: c52e394d2f2ec3d8013b4351d5271d8e90edcac6203cdfad0289440b4c398e87
sha512: 1d213e7495306fc6f225dccbd6b5d01e9d095e018eb32f43eec8f6623436cdc09d3d988554e0d3d2ede9276dc665dc0b5bc0d9b76d86f5c6000a882d6473060a
ssdeep: 384:qa6/dmXSebmeKSHrvt7MtNCnnHtp+bkFWNHWR9+EMQw:qndmBPLtvnNYLY9l0
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T19ED2916293F80107F4BB3A7518760A546E37FC661B308ADF2760D18E5923BD4AD347AE
sha3_384: df379f25196f4081574337acb051cabf76f5aaa09c02386d97c13bde0420a4881e48b5717257c670768945ddf3025cae
ep_bytes: 558bec81ec94010000c785e4feffff04
timestamp: 2012-04-19 08:11:04

Version Info:
CompanyName: Microsoft Corporation
FileDescription: Character Map
FileVersion: 5.00.2134.1
InternalName: charmap.exe
LegalCopyright: Copyright (C) Microsoft Corp. 1981-1999
OriginalFilename: charmap.exe
ProductName: Microsoft(R) Windows (R) 2000 Operating System
ProductVersion: 5.00.2134.1
Translation: 0x0409 0x04b0

Win32/Kryptik.AFAF also known as:

How to remove Win32/Kryptik.AFAF?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.