Win32/Kryptik.GWU malicious file

The Win32/Kryptik.GWU is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Kryptik.GWU virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Russian
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid

How to determine Win32/Kryptik.GWU?

File Info:
name: 10CFB44F4440E925C78C.mlw
path: /opt/CAPEv2/storage/binaries/e939494e7252d550f2ac2af751bb69d3f4021591bcf26aa1f18306e51d9d002f
crc32: 911D8CB6
md5: 10cfb44f4440e925c78c1751da05c9fd
sha1: a9032f2944c96d100e980a23d09f52ea3d9b4197
sha256: e939494e7252d550f2ac2af751bb69d3f4021591bcf26aa1f18306e51d9d002f
sha512: 6974d0c227a1a8cbffab5c029cfb88bb2b2d01ee7d3063b4b9402bc9fe160358e1a1b5666161e0ecc546f668411cf94ecb2b262cabb6c3049e53460c8e4ffe02
ssdeep: 3072:82qncqHrHJFOukJLS1rWriV/um/8SwMXapWW/RhZ:82qcqHJEuk41hFLiMXGWW/d
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1B9E3F16771E43F05C63B7EF63047CE3DD869452B2568A5E8E3DE4382A9F1EA4053A06C
sha3_384: 792e4be1a2a0cbde2435af3abd3ce0a349efc084a518560fe844b109918497ea15d46fb5438fc44b76252cfb2c5a1e06
ep_bytes: 60be153035018dbeebdf0aff57eb0b90
timestamp: 2004-04-14 12:38:05

Version Info:
0: [No Data]

Win32/Kryptik.GWU also known as:

How to remove Win32/Kryptik.GWU?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.