Win32/Expiro.NAN information

The Win32/Expiro.NAN is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Expiro.NAN virus can do?

• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is likely packed with VMProtect
• Authenticode signature is invalid
• Anomalous binary characteristics
• Yara detections observed in process dumps, payloads or dropped files

How to determine Win32/Expiro.NAN?

File Info:
name: AF1E37B61A4C7A18AEC9.mlw
path: /opt/CAPEv2/storage/binaries/db3bc715bfba7ef9db7d444b3f8e04508449849627e3e2bd564d4c606b8fe02d
crc32: B8AB8D8B
md5: af1e37b61a4c7a18aec9c36ea0771ecc
sha1: 0212dfa5dea436642d47ceb3659613d5567cf4d4
sha256: db3bc715bfba7ef9db7d444b3f8e04508449849627e3e2bd564d4c606b8fe02d
sha512: 8aa45a0299f9f04395446ac04c49db8c00bbf67408f318942eee921601a7b158b5167bfcffef0504195c4fa364c9b1e1016f2b4fa0fcdc372463a63c05e847a3
ssdeep: 6144:1/auogvgA8rFhe8MU65iKbMUZeBr9PislEN:1D7vqPe8MU65iK9CP4N
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T12D44AF5210E0CF3BD4E9B63D59AD3B6FDB687CA4BD6322261C7E44E1D7E24C304252A9
sha3_384: a9aa010a5ef6176be2282627466f3dfca60ccd7e7c3ae84e0413e545366409e77eedc3bb0b6a9efbb37092f466be2450
ep_bytes: 50519052905390545556575589e583ec
timestamp: 2008-04-13 15:33:05

Version Info:
CompanyName: Microsoft Corporation
FileDescription: Win32 Cabinet Self-Extractor                                           
FileVersion: 6.00.2900.5512 (xpsp.080413-2105)
InternalName: Wextract                
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: WEXTRACT.EXE            
ProductName: Microsoft® Windows® Operating System
ProductVersion: 6.00.2900.5512
Translation: 0x0409 0x04b0

Win32/Expiro.NAN also known as:

How to remove Win32/Expiro.NAN?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.