W32/Expiro-AV malicious file

The W32/Expiro-AV is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What W32/Expiro-AV virus can do?

The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Anomalous binary characteristics

How to determine W32/Expiro-AV?


File Info:
name: 31363D38B9369600867C.mlw
path: /opt/CAPEv2/storage/binaries/8734e21353458db3ab1b87c466fcd78c38c08cd0603d4cbdc6e8f8d0a947f334
crc32: 248C2BB6
md5: 31363d38b9369600867c1df7d912f4a0
sha1: 0c19660cfe3dddd2e0734a3b9b7c7ed0caf5a686
sha256: 8734e21353458db3ab1b87c466fcd78c38c08cd0603d4cbdc6e8f8d0a947f334
sha512: 15f494db27ec4504654b21ad1c44f87c881c22548cd755ad339e8e026ffd0ea1ec3d109b01ef4124764ea199c2fcb03be483a184df978b8e1acffa4b866c574f
ssdeep: 24576:pRwWA10Gpsliir8RwWA10GpOliif8mq0duQZVQJ:H8LpoiirW8Lpuiikmq03ZV
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T15B05AE65D65060FBC32A6A3439DAF7B5882DED3053C151D3AEF6FD5B3168291A33820B
sha3_384: 3585f8d3b0ba7f3f33924cb48b0c01ef3718a24994301425a4853ada789396ffba4dd78672b139107b88eccfe1745ed8
ep_bytes: e84e050000e939feffffcccccccccccc
timestamp: 2001-08-15 22:27:25

Version Info:
CompanyName: Microsoft Corporation
FileDescription: Windows Command Processor
FileVersion: 10.0.17134.1 (WinBuild.160101.0800)
InternalName: cmd
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: Cmd.Exe
ProductName: Microsoft® Windows® Operating System
ProductVersion: 10.0.17134.1
Translation: 0x0409 0x04b0

W32/Expiro-AV also known as:

Elastic	malicious (high confidence)
DrWeb	Win32.Expiro.153
MicroWorld-eScan	Win32.Expiro.Gen.6
FireEye	Generic.mg.31363d38b9369600
ALYac	Win32.Expiro.Gen.6
CrowdStrike	win/malicious_confidence_80% (D)
Cyren	W32/Expiro.AH.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	Win32/Expiro.NDJ
ClamAV	Win.Virus.Expiro-9891450-0
Kaspersky	HEUR:Virus.Win32.Expiro.gen
BitDefender	Win32.Expiro.Gen.6
NANO-Antivirus	Virus.Win32.Gen.ccmw
Avast	Win32:Xpirat-C [Inf]
Ad-Aware	Win32.Expiro.Gen.6
Sophos	W32/Expiro-AV
VIPRE	Trojan.Win32.Generic!BT
Emsisoft	Win32.Expiro.Gen.6 (B)
GData	Win32.Expiro.Gen.6 (2x)
Avira	TR/Patched.Gen
Microsoft	Trojan:Win32/Wacatac.B!ml
Cynet	Malicious (score: 100)
MAX	malware (ai score=86)
VBA32	BScope.Trojan.Wacatac
Malwarebytes	Malware.AI.520647366
APEX	Malicious
Fortinet	W32/Expiro.NS!tr
AVG	Win32:Xpirat-C [Inf]
Cybereason	malicious.8b9369
Panda	Trj/Genetic.gen
MaxSecure	virus.win64.expiro.gen

How to remove W32/Expiro-AV?

W32/Expiro-AV removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X