File name:

expiro.exe

Full analysis: https://app.any.run/tasks/4adbd6b2-1694-45f6-a9e1-dc0f35e2f1ff
Verdict: Malicious activity
Analysis date: October 27, 2018, 07:16:41
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5:

5421DC4A41E3BF3840E1EE03E3EDD2F7

SHA1:

B0AA441438715A3B25C3E2D1398A0FD835A3D3D7

SHA256:

9B0A6005551A4CE0B6E8098248C2296FD0EC4280D008390E60B6D5396757639C

SSDEEP:

6144:+4xYHzcSYM//RgruEiVpYY/MNfozucxGl+Sx4gMvJHW/uXgO:CcSYCgry2foBxcmgM+Mg

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes internet zones settings

      • expiro.exe (PID: 2224)

    • Actions looks like stealing of personal data

      • expiro.exe (PID: 2224)

  • SUSPICIOUS

    • Creates files in the user directory

      • expiro.exe (PID: 2224)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2003:04:02 02:33:41+02:00
PEType: PE32
LinkerVersion: 8.12
CodeSize: 44544
InitializedDataSize: 25088
UninitializedDataSize: -
EntryPoint: 0x9a10
OSVersion: 5
ImageVersion: 13.23
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 5.0.2195.6699
ProductVersionNumber: 5.0.2195.6699
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Russian
CharacterSet: Unicode
CompanyName: Корпорация Майкрософт
FileDescription: Отладчик DrWatson
FileVersion: 5.00.2195.6699
InternalName: drwtsn32.exe
LegalCopyright: (C) Корпорация Майкрософт (Microsoft Corp.), 1981-1999
OriginalFileName: drwtsn32.exe
ProductName: Операционная система Microsoft (R) Windows (R) 2000
ProductVersion: 5.00.2195.6699

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 02-Apr-2003 00:33:41
Detected languages:
  • Russian - Russia
Debug artifacts:
  • exe\drwtsn32.dbg
CompanyName: Корпорация Майкрософт
FileDescription: Отладчик DrWatson
FileVersion: 5.00.2195.6699
InternalName: drwtsn32.exe
LegalCopyright: (C) Корпорация Майкрософт (Microsoft Corp.), 1981-1999
OriginalFilename: drwtsn32.exe
ProductName: Операционная система Microsoft (R) Windows (R) 2000
ProductVersion: 5.00.2195.6699

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000C8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 4
Time date stamp: 02-Apr-2003 00:33:41
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_DEBUG_STRIPPED
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x0000AC90
0x0000AE00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.19311
.data
0x0000C000
0x00004850
0x00002E00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
3.78133
.rsrc
0x00011000
0x000033E4
0x00003400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.45519
PACK
0x00015000
0x0006A000
0x00028000
IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
6.87421

Resources

Title
Entropy
Size
Codepage
Language
Type
1
3.92611
928
Latin 1 / Western European
Russian - Russia
RT_VERSION
2
2.953
744
Latin 1 / Western European
Russian - Russia
RT_ICON
3
3.17318
304
Latin 1 / Western European
Russian - Russia
RT_ICON
13
3.85174
620
Latin 1 / Western European
Russian - Russia
RT_STRING
14
4.01126
1048
Latin 1 / Western European
Russian - Russia
RT_STRING
15
3.47213
164
Latin 1 / Western European
Russian - Russia
RT_STRING
501
3.63742
264
Latin 1 / Western European
Russian - Russia
RT_DIALOG
503
3.83281
648
Latin 1 / Western European
Russian - Russia
RT_DIALOG
504
3.84756
708
Latin 1 / Western European
Russian - Russia
RT_DIALOG
507
3.69078
144
Latin 1 / Western European
Russian - Russia
RT_DIALOG

Imports

ADVAPI32.dll
DBGHELP.dll
KERNEL32.dll
MSVCRT.dll
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
33
Monitored processes
1
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start expiro.exe

Process information

PID
CMD
Path
Indicators
Parent process
2224"C:\Users\admin\AppData\Local\Temp\expiro.exe" C:\Users\admin\AppData\Local\Temp\expiro.exe
explorer.exe
User:
admin
Company:
Корпорация Майкрософт
Integrity Level:
MEDIUM
Description:
Отладчик DrWatson
Exit code:
0
Version:
5.00.2195.6699
Modules
Images
c:\users\admin\appdata\local\temp\expiro.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
c:\windows\system32\user32.dll
Total events
43
Read events
28
Write events
15
Delete events
0

Modification events

(PID) Process:(2224) expiro.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
Operation:writeName:1609
Value:
0
(PID) Process:(2224) expiro.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
Operation:writeName:2103
Value:
0
(PID) Process:(2224) expiro.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
Operation:writeName:1406
Value:
0
(PID) Process:(2224) expiro.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
Operation:writeName:1609
Value:
0
(PID) Process:(2224) expiro.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
Operation:writeName:2103
Value:
0
(PID) Process:(2224) expiro.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
Operation:writeName:1406
Value:
0
(PID) Process:(2224) expiro.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
Operation:writeName:1609
Value:
0
(PID) Process:(2224) expiro.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
Operation:writeName:2103
Value:
0
(PID) Process:(2224) expiro.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
Operation:writeName:1406
Value:
0
(PID) Process:(2224) expiro.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
Operation:writeName:1609
Value:
0
Executable files
0
Suspicious files
2
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
2224expiro.exeC:\Users\admin\AppData\Local\wsr24zt32.dllbinary
MD5:—
SHA256:—
2224expiro.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\extensions\{ec9032c7-c20a-464f-7b0e-13a3a9e97385}\components\red.jstext
MD5:—
SHA256:—
2224expiro.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\extensions\{ec9032c7-c20a-464f-7b0e-13a3a9e97385}\chrome\content.jarcompressed
MD5:—
SHA256:—
2224expiro.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\extensions\{ec9032c7-c20a-464f-7b0e-13a3a9e97385}\chrome.manifesttext
MD5:947EA0DB52388EC417A0F1D58CA826E7
SHA256:6E9F7B7647E9FCCDFCDF2D60DC2D721FB11DE14366EC74D4288AB153B19A35D9
2224expiro.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\extensions\{ec9032c7-c20a-464f-7b0e-13a3a9e97385}\install.rdfxml
MD5:E297FC3B4CB47A9AA34B38C2AE8C9905
SHA256:ECBE110FE345787E18018AAEBC22D9296BA5DA5F07255B21EC3DE5CCD46AC054
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
expiro.exe