Gridinsoft Logo

Set-up.exe Trojan Kryptik Analysis

Updated 1 minute ago
Checked by Malware Check
Set-up.exe

Technical Analysis

File Name Set-up.exe
File Type
PE32+ executable (GUI) x86-64, for MS Windows
Scanner Version 1.0.220.174
Database Version 2025-07-17 01:00:23 UTC
⚠

Trojan.Win64.Kryptik.sa

Malware family: Kryptik

Kryptik is a backdoor Trojan that provides unauthorized system access to threat actors. It enables remote control capabilities and allows attackers to execute various malicious activities on compromised systems.
N/A
Detection Rate
1,412,096
File Size (bytes)
2025-07-17
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
a1e7e77ed8630e9264714e2058200698
SHA1
2df63378e310ba7ed52fcb3bbd53ab949c674104
SHA256
88f96e361cf13faa3abba70c3f44794f50b81289003a08861068fbba7d6c23b5
SHA512
3dca7ca6645c2c1faf8b2b02debcf5feb11a5d313750addad72048e4af04fd0659862ad83cae67c722138ffe433a481ddbe9a1c8f0f266fae55f9b84153a82c1
ImpHash
f5f30b7b5f259a4a0b7809ee71919fa8

PE Analysis

Basic Information

▼
Image Base 0x140000000
Entry Point 0x140075948
Compilation Time 2025-07-15 17:33:48
Checksum 0x00000000 (Actual: 0x00161c2b)
OS Version 6.0
PEiD Signatures PE32+ executable (GUI) x86-64, for MS Windows
Digital Signature No valid SignedData structure was found.
Imports 3 libraries
KERNEL32, GDI32, USER32
Exports 0 functions
Resources 0 Resources
Sections 9 Sections

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00001000 630,784 bytes 628,224 bytes 6.90 (Compressed) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ FF5DF9955B959CE10858F04CDAF203BC
.rdata 0x0009b000 69,632 bytes 66,560 bytes 4.89 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 98EE4403C3043133942B4369AF01FFF7
.data 0x000ac000 20,480 bytes 5,632 bytes 2.86 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 7D543BF0699984111719F13D62F03F0D
.pdata 0x000b1000 16,384 bytes 12,800 bytes 5.68 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 4D90418CB0A25E0BBC1E2AF4A0B0C6A1
.gxfg 0x000b5000 20,480 bytes 9,216 bytes 5.03 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 0E833EE47F7E6028CF83133C3BA852DA
_RDATA 0x000ba000 4,096 bytes 512 bytes 4.24 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ C2E9283575ED529AE7450E77598C70B5
.reloc 0x000bb000 2,652 bytes 3,072 bytes 5.15 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 59433702E11759E4351D251D376926FD
.eye 0x000bc000 342,016 bytes 342,016 bytes 8.00 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 6BC86D1416841251BAF133C356A33A31
.eye 0x00110000 342,016 bytes 342,016 bytes 8.00 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 6BC86D1416841251BAF133C356A33A31
Entropy Analysis Alert

2 section(s) with high entropy (≥7.5) detected - possible packing/encryption

1 section(s) with elevated entropy (≥6.5) - possible compression

Certificate Chain Analysis

▼
No Digital Signatures

This file is not digitally signed.

Security Implications:
  • Cannot verify the publisher's identity
  • Increased security risk when running this file
  • May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Trojan.Win64.Kryptik.sa Removal

Gridinsoft has the capability to identify and eliminate Trojan.Win64.Kryptik.sa without requiring further user intervention.

Download Anti-Malware

Removal Instructions

Follow these steps to completely remove the threat from your system

  1. Start by downloading Gridinsoft Anti-Malware to your computer.
  2. Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
  3. Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
  4. Click on the "Standard Scan" button to begin scanning your computer for threats.
  5. After the scanning process is finished, click on "Clean Now" to remove any detected threats.
  6. If prompted, restart your system to complete the removal process and ensure all threats are eliminated.
Important: Before You Start
Disconnect from the internet to prevent the malware from spreading or downloading additional threats. Run the scan in Safe Mode for better detection and removal of persistent threats.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware