Win32/Kryptik.GFYD malicious file

The Win32/Kryptik.GFYD is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Kryptik.GFYD virus can do?

• Behavioural detection: Executable code extraction – unpacking
• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Presents an Authenticode digital signature
• Creates RWX memory
• Guard pages use detected – possible anti-debugging.
• Dynamic (imported) function loading detected
• Enumerates running processes
• CAPE extracted potentially suspicious content
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Queries information on disks, possibly for anti-virtualization
• Detects the presence of Wine emulator via registry key
• Anomalous binary characteristics

How to determine Win32/Kryptik.GFYD?

File Info:
name: 43695ABB5D1EE17611CB.mlw
path: /opt/CAPEv2/storage/binaries/952a4bde31e8f534420c5cd069aa16a507301f8cabae3cd1cde3fe25a2bf0a7c
crc32: 9370C43E
md5: 43695abb5d1ee17611cb16c081d598e8
sha1: 54e4cf184266c1e3fb6cf3604b0cda12f407b19e
sha256: 952a4bde31e8f534420c5cd069aa16a507301f8cabae3cd1cde3fe25a2bf0a7c
sha512: 51788dba63becb12a59072e9ded27017979d61252356dfee698fae2ff43481c57cc599706a7f2fa407241be00628f7558c548eb3a4270d9f6b9947f6762b0138
ssdeep: 49152:uujJJ9Su3cgsUTB/HZJCzEM1nznTzBec7vEfO:uiJJ4ws2bJ0JnTTAc7vEf
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T169853313BBD942ABF2AA043101EE5B732D777DA7B431C6AF13103A174A63B409659B93
sha3_384: 826f8cd81fac8b816f8f379adc5ca08e60d03eb1e7a5af77cc0643c103a113c6d686bcafb743105b07ce200200232c8e
ep_bytes: 558bec6aff68a8814a00681cf7480064
timestamp: 2018-04-22 04:26:21

Version Info:
FileDescription: Win32 Cabinet Self-Extractor                                           
FileVersion: 11.00.15063.0 (WinBuild.160101.0800)
InternalName: Wextract                
OriginalFilename: WEXTRACT.EXE            .MUI
ProductVersion: 11.00.15063.0
Translation: 0x0409 0x04b0

Win32/Kryptik.GFYD also known as:

How to remove Win32/Kryptik.GFYD?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.