Win32/Kryptik.HLUA (file analysis)

The Win32/Kryptik.HLUA is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32/Kryptik.HLUA virus can do?

Executable code extraction
Creates RWX memory
The binary likely contains encrypted or compressed data.
Network activity detected but not expressed in API logs

How to determine Win32/Kryptik.HLUA?


File Info:
crc32: 21756B55
md5: 8b16733dcb7b1477a70352b8b37893d8
name: 8B16733DCB7B1477A70352B8B37893D8.mlw
sha1: 0a7752872504ed87a1598f78633f940315acb558
sha256: 6e1a19c1ead7999ac95c9a6ec469cedfdda7b513dee65cf6c3c7ebf9385eaffc
sha512: 4abf4d4e3fc216bfeea33b400954a15a4d3c9cb913ef9bd032ddcc11be30b80650a4999309fd16bfc499101f13140365c0b2f438d9c719fc858022cc1bce7725
ssdeep: 3072:gbdeJIBwzBgXbJ26juQdZHT5K4PrsF2ATdwNBJUiG7NNNNNNNNNNNNNNNuItbXk:gZe2Gzm1dZtK4Puhha87NNNNNNNNNNN
type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright xa9 1997-2018 The PHP Group
InternalName: HSY8_12B heunwssnr
FileVersion: 4.4.7
CompanyName: The PHP Group
URL: http://www.php.net
LegalTrademarks: PHP
Comments: Thanks to Stig Bakken, Thies C. Arntzen, Andy Sautins, David Benson, Maxim Maletsky, Harald Radi, Antony Dovgal, Andi Gutmans, Wez Furlong, Christopher Jones, Oracle Corporation
ProductName: HSY
ProductVersion: 4.4.7
FileDescription: OCI8
OriginalFilename: hsy_utu8_12u.dll
Translation: 0x0409 0x04b0

Win32/Kryptik.HLUA also known as:

Bkav	W32.AIDetect.malware2
Lionic	Trojan.Multi.GenericML.4!c
Elastic	malicious (high confidence)
ClamAV	Win.Trojan.Generic-9880585-0
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_90% (W)
K7GW	Riskware ( 0040eff71 )
K7AntiVirus	Riskware ( 0040eff71 )
Cyren	W32/Trojan.GLKQ-4461
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Kryptik.HLUA
APEX	Malicious
Avast	Win32:TrojanX-gen [Trj]
Cynet	Malicious (score: 100)
Kaspersky	UDS:Trojan.Multi.GenericML.xnet
BitDefender	Trojan.GenericKD.37274333
NANO-Antivirus	Virus.Win32.Gen.ccmw
MicroWorld-eScan	Trojan.GenericKD.37274333
Ad-Aware	Trojan.GenericKD.37274333
Sophos	ML/PE-A
BitDefenderTheta	Gen:NN.ZedlaF.34050.ku8@aK!S5ggi
McAfee-GW-Edition	BehavesLike.Win32.Drixed.cc
FireEye	Generic.mg.8b16733dcb7b1477
Emsisoft	Trojan.GenericKD.37274333 (B)
SentinelOne	Static AI – Suspicious PE
eGambit	Unsafe.AI_Score_99%
Kingsoft	Win32.Troj.Undef.(kcloud)
Microsoft	Trojan:Win32/Emotet.LK!ml
GData	Trojan.GenericKD.37274333
Acronis	suspicious
McAfee	RDN/Generic.hbg
MAX	malware (ai score=80)
Rising	Trojan.Generic@ML.88 (RDML:4zZLbdHU9uz3Yvky22yS7w)
Fortinet	PossibleThreat.PALLAS.H
AVG	Win32:TrojanX-gen [Trj]
Qihoo-360	Win32/Trojan.Generic.HgkASY4A

How to remove Win32/Kryptik.HLUA?

Win32/Kryptik.HLUA removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X