Win32/Kryptik.HVIE (file analysis)

The Win32/Kryptik.HVIE is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Kryptik.HVIE virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Executed a command line with /C or /R argument to terminate command shell on completion which can be used to hide execution
• Uses Windows utilities for basic functionality
• Performs HTTP requests potentially not found in PCAP.
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Behavioural detection: Injection (inter-process)
• Behavioural detection: Injection with CreateRemoteThread in a remote process
• Attempts to modify proxy settings
• Deletes executed files from disk
• Created a service that was not started
• Anomalous binary characteristics

How to determine Win32/Kryptik.HVIE?

File Info:
name: 1CB66FE1A4F9167AC74B.mlw
path: /opt/CAPEv2/storage/binaries/25655cb039f8d642f595c2059f026426c4b74ce672dab721c29a925f9581bba1
crc32: E0C4BEBE
md5: 1cb66fe1a4f9167ac74b260275fd9d74
sha1: 13d682e7d15349541ddf3746dc4c308c12dc85ce
sha256: 25655cb039f8d642f595c2059f026426c4b74ce672dab721c29a925f9581bba1
sha512: f96294b0f1994fb187e6e02621e5d975515e41e2dffccfe9e921c4c6c31471d9d1239716f3b7281fa300db2a162982270bf7bc4b232202c97a23b33364808124
ssdeep: 3072:6bxNY6vZicBCD+qan1wqhCWn2eP3ANxtZBBUpeXE+B7pmKactjR73Ps9ZYKWtsuo:6QVcW+Tn1wzWxCDBU+eKth8cDV2j
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1AC3423E7B7122D06C2BE253504DE3B2817B1DB26C77EEBCDA246E3544606E5DE43E860
sha3_384: 1633307e545f17f44bc3662bb303f90cdbfea588b01dbbcf42e80fb7c62571680f377a9fd8eaca27394bbcca37990059
ep_bytes: 53b835060100bb78563412b978563412
timestamp: 2000-11-09 15:40:09

Version Info:
0: [No Data]

Win32/Kryptik.HVIE also known as:

How to remove Win32/Kryptik.HVIE?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.