Win32/Kryptik.HPOA (file analysis)

The Win32/Kryptik.HPOA is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Kryptik.HPOA virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Dynamic (imported) function loading detected
• Enumerates the modules from a process (may be used to locate base addresses in process injection)
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Marathi
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• CAPE detected the RedLine malware family

How to determine Win32/Kryptik.HPOA?

File Info:
name: 8C12F6B1EE9836AFD8CF.mlw
path: /opt/CAPEv2/storage/binaries/6be0de07786f9c28056e646dbbd24eca408fc3d86966df81449be2f85d5732b2
crc32: 4A14FFF4
md5: 8c12f6b1ee9836afd8cf1852b92cc9d6
sha1: f55bb77fecb0a283fc731428af2de8c4f0073bf9
sha256: 6be0de07786f9c28056e646dbbd24eca408fc3d86966df81449be2f85d5732b2
sha512: f128aa51316b65f29c0456870de823d371df057f4aa4f98881c36e85a473b2b0a30f8c0d39517cd67148c611e78155ab7abeedd741fa339869eec2ecf226fa72
ssdeep: 6144:t9v1gLI1B22Z7C8jN5j46pnpRNS6Y0mfzTrYAs/ERt+iga3wVf:D1gLI1rJjN5bE0CH4mz
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1E294E041B790C871E1829E304874E7A5133FFC525A34644BF7A4BB5F2EBB390AA76316
sha3_384: 5cc99b2fc00e0811f2007ab3b4076efbe884c1127e343293f8233a4ab6ad0bfebf070e2f7ad55938829b875a7c6424af
ep_bytes: e83d300000e989feffff6a0aff158c10
timestamp: 2021-11-11 18:49:18

Version Info:
FileVersion: 49.46.71.23
Copyrighz: Copyright (C) 2022, pozkarte
ProjectVersion: 28.82.74.73

Win32/Kryptik.HPOA also known as:

How to remove Win32/Kryptik.HPOA?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.