Should I remove “Win32/Kryptik.OBF”?

The Win32/Kryptik.OBF is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Kryptik.OBF virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid

How to determine Win32/Kryptik.OBF?

File Info:
name: 0BDB3F7B1A1821A8F983.mlw
path: /opt/CAPEv2/storage/binaries/f812e9fe4e21b45ddea46b21e68abd7da97e5d394e1cc7741ed84968428c1774
crc32: 82B45D68
md5: 0bdb3f7b1a1821a8f9836e063844098f
sha1: 07ceddfa9770bd078931899d9b2ea3cb0f812191
sha256: f812e9fe4e21b45ddea46b21e68abd7da97e5d394e1cc7741ed84968428c1774
sha512: 31374fc64116f3ebb22dde61ecac5f82b3c641bf92ef0db337d7c37174ca72e9398c409b313de20bcc888aee7fba6b8387fc2874b4a1245f301a5ce939c4eeaa
ssdeep: 3072:lBdiK3ZBc7Q09YeUet6E4O50es2XlDZbFASX4cD0BNfu/k5uX0d:zdiR7Q09TH4QeolFpASX5Dqu
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T106F3022A6BE60037D083023769F1DB620A7F15158B6258CB5ADC29DE7E313D12C3E76B
sha3_384: 4433a91479a483283e9d6ae987cf4e2246d4e2eb0c7975f021b68a93baae6623e97dba70c848fc22f29cde8cb37ecd80
ep_bytes: 558bec6aff68d8f0400068243c400064
timestamp: 2011-05-06 11:23:07

Version Info:
Comments: 
CompanyName: GmbH
FileDescription: Configuration Panel
FileVersion: 10.00.13.16
InternalName: Configuration Panel
LegalCopyright: Copyright © 2000 - 2010 GmbH. All rights reserved.
LegalTrademarks: AntiVir® is a registered trademark of GmbH, Germany.
OriginalFilename: avconfig.exe
PrivateBuild: 
ProductName: AntiVir Desktop
ProductVersion: 10.00.13.16
SpecialBuild: 
Translation: 0x0409 0x04b0

Win32/Kryptik.OBF also known as:

How to remove Win32/Kryptik.OBF?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.