Virus:Win32/Expiro.EK!MTB (file analysis)

The Virus:Win32/Expiro.EK!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Virus:Win32/Expiro.EK!MTB virus can do?

• Behavioural detection: Executable code extraction – unpacking
• CAPE extracted potentially suspicious content
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Virus:Win32/Expiro.EK!MTB?

File Info:
name: 64982FE6D4F159D21161.mlw
path: /opt/CAPEv2/storage/binaries/684fa4b552e135aaca89c5b1ccb85f8f6e9ab390c03c8d0b615fd234e14f5e6c
crc32: 00C714BD
md5: 64982fe6d4f159d211614c8f0da3ac2b
sha1: 5d646877d597cf8f78dc01a1206dffbd81cb330c
sha256: 684fa4b552e135aaca89c5b1ccb85f8f6e9ab390c03c8d0b615fd234e14f5e6c
sha512: 50225444d0c51fb3029eb6841556461da6e5cf440d60304b58089ed3967aba6f2b690e4914286c96244d7c3fd5b0607a9944f686dec60da1180b4c6a629dc565
ssdeep: 12288:JGmfXz7Mbb67QTF4malJQTv5VF6NdY8VJ0KYkekt+M:J1fXPWbg8GmalJuvj0vVJzVecN
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1C5D42362A6FA49EBDB8291F69837854DE4B66DF043786BD31B90381C1C315D1CE3353A
sha3_384: 66bf06a472a69987e880a8237dacba94bb1901acafd5a890cfcf539abf694e86bc39f4c2c2aa6315b12aefe96e3e3ffa
ep_bytes: e863060000e978feffffcccccccccccc
timestamp: 2020-09-11 13:55:03

Version Info:
CompanyName: Adobe Systems Incorporated
FileDescription: AcroTextExtractor
FileVersion: 20.12.20048.400142
LegalCopyright: Copyright 1984-2020 Adobe Systems Incorporated and its licensors. All rights reserved.
OriginalFilename: AcroTextExtractor.exe
ProductName: Adobe Acrobat text extractor for non-PDF files
ProductVersion: 20.12.20048.400142
Translation: 0x0409 0x04b0

Virus:Win32/Expiro.EK!MTB also known as:

How to remove Virus:Win32/Expiro.EK!MTB?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.