Categories: Malware

What is “Win64/Expiro.DP”?

The Win64/Expiro.DP is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win64/Expiro.DP virus can do?

The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Binary compilation timestomping detected

How to determine Win64/Expiro.DP?


File Info:
name: CEAD4DBC20651C47706D.mlwpath: /opt/CAPEv2/storage/binaries/4e37faa099388e34b2fa207ae5dacb0cc74c52fa01c79b9db2276d737dcce316crc32: C82D3A85md5: cead4dbc20651c47706d15547a8a6179sha1: eba6e4b198037db6931e3522793c8b10ab361f70sha256: 4e37faa099388e34b2fa207ae5dacb0cc74c52fa01c79b9db2276d737dcce316sha512: 6faa561b07964005fe6304cfe500543bb33fd2bdd7bbe8b1317c9ded3cca93a48cb91f8cc81f2bb07244cc567fab69621e4a15c4278fffcaa7a8944ec541d373ssdeep: 24576:TfPaezgNmgM5NJWsAbK/11MNYYdO5QH6fFfr35P4inBikO4p4V2QGHMzZhjQ3Je:TfPfgkQu/1uNYYdO5QH6fFf75PtVOOQ5type: PE32+ executable (console) x86-64, for MS Windowstlsh: T19665AE1EA3DC0896D4BB81348A518A16EB727C2E1B22D6CF2160C33D2F67ED55E75F06sha3_384: ad5ce6f08b99a151b2987d411697db609cafe8d71bc3ba13adfc7bc6be94f993812bfd6829bc0b7e08e9f812905b0eebep_bytes: 4883ec28e8d70300004883c428e95efetimestamp: 2047-11-07 06:47:09
Version Info:
CompanyName: Microsoft CorporationFileDescription: Windows Media Player Network Sharing ServiceFileVersion: 12.0.22000.795 (WinBuild.160101.0800)InternalName: Windows Media Player Network Sharing ServiceLegalCopyright: © Microsoft Corporation. All rights reserved.OriginalFilename: WMPNetwk.exeProductName: Microsoft® Windows® Operating SystemProductVersion: 12.0.22000.795Translation: 0x0409 0x04b0

Win64/Expiro.DP also known as:

DrWeb	Win32.Expiro.153
MicroWorld-eScan	Win64.Expiro.Gen.7
ALYac	Win64.Expiro.Gen.7
VIPRE	Win64.Expiro.Gen.7
Sangfor	Virus.Win32.Save.a
K7AntiVirus	Virus ( 00592e701 )
K7GW	Virus ( 00592e701 )
Cybereason	malicious.198037
Cyren	W64/Expiro.AR.gen!Eldorado
Symantec	W64.Xpiro.J!dam
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win64/Expiro.DP
Kaspersky	Virus.Win64.Moiva.a
BitDefender	Win64.Expiro.Gen.7
NANO-Antivirus	Virus.Win64.Virut-Gen.bwpxnc
Avast	Win64:Expiro-AJ [Inf]
Tencent	Virus.Win64.VirMoiva.a
Ad-Aware	Win64.Expiro.Gen.7
TACHYON	Virus/W64.Movia
Emsisoft	Win64.Expiro.Gen.7 (B)
F-Secure	Malware.W32/Infector.Gen
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.cead4dbc20651c47
Sophos	Mal/Generic-S
SentinelOne	Static AI – Malicious PE
GData	Win64.Expiro.Gen.7
Google	Detected
Avira	W32/Infector.Gen
Antiy-AVL	Virus/Win32.Expiro.x
Arcabit	Win64.Expiro.Gen.7
ZoneAlarm	Virus.Win64.Moiva.a
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
Cynet	Malicious (score: 100)
AhnLab-V3	Virus/Win.Expiro.X2155
Acronis	suspicious
MAX	malware (ai score=85)
Ikarus	Virus.Win64.Expiro
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	W64/Expiro.CU
AVG	Win64:Expiro-AJ [Inf]
Panda	W64/Moyv.A
CrowdStrike	win/malicious_confidence_100% (D)