Virus:Win32/Expiro.EK!MTB malicious file

The Virus:Win32/Expiro.EK!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Virus:Win32/Expiro.EK!MTB virus can do?

• Behavioural detection: Executable code extraction – unpacking
• CAPE extracted potentially suspicious content
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• CAPE detected the shellcode patterns malware family
• Yara detections observed in process dumps, payloads or dropped files

How to determine Virus:Win32/Expiro.EK!MTB?

File Info:
name: C92306F5CCEABD127C45.mlw
path: /opt/CAPEv2/storage/binaries/05ef4e2133d872967506b997bc2faef3e6c701ca0ba865944964523812fffe26
crc32: 0F310671
md5: c92306f5cceabd127c45abd16ec272b3
sha1: b9352309dd62fe72cd111b47dbf7b9ab601f6fb0
sha256: 05ef4e2133d872967506b997bc2faef3e6c701ca0ba865944964523812fffe26
sha512: 5a639e00d1c903d8ae693f6d4c2d3e1017b90fd7ea78ce82c753b943c64f32643e91f0d2738c611e00e3b61871aff037c5d2cf1bcd77275f650dcc9ad6654f5f
ssdeep: 12288:Bf3SBPjZZQOcPskdzM0DZdwPCrUQaoGFU3Q5QitdsOeg:BsdZCA6N3Q6itdsOeg
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T188D42305232D459ED79E17B854E0D274E62EBE286CF4ABB3D461351868368E7CC7A333
sha3_384: c8d3473491062a22e1f1515627de0364cd37ffde33be3b7f9d6ce4ac672fb852e10878506da2d884d2151e551b1a5f0b
ep_bytes: e8db120900e9d9fdffffcccccccccccc
timestamp: 1981-07-18 00:43:28

Version Info:
CompanyName: Microsoft Corporation
FileDescription: PVK/SPC to PFX file converter
FileVersion: 10.0.19041.685 (WinBuild.160101.0800)
InternalName: pvk2pfx
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: pvk2pfx.exe
ProductName: Microsoft® Windows® Operating System
ProductVersion: 10.0.19041.685
Translation: 0x0409 0x04b0

Virus:Win32/Expiro.EK!MTB also known as:

How to remove Virus:Win32/Expiro.EK!MTB?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.