Trojan.Expiro.I
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 278 |
| Threat Level: | 80 % (High) |
| Infected Computers: | 400,030 |
| First Seen: | October 8, 2021 |
| Last Seen: | November 13, 2026 |
| OS(es) Affected: | Windows |
Trojan.Expiro.I is a Windows Trojan rated 8 out of 10 for danger. It has been seen for several years: the first detection was recorded on 2021-10-08 and the most recent on 2026-11-13. The feed lists more than 400,000 detections, so this is not a rare or short-lived threat.
Table of Contents
What Trojan.Expiro.I does
Expiro.I installs itself stealthily and then runs quietly in the background, so a user may not notice anything unusual. Once it is on a system, it may give attackers complete control over the computer. It may also covertly delete files and install additional malware. Trojans of this kind typically also collect information from the infected PC, but the feed text does not give a full list, so treat that as typical behavior rather than a confirmed detail.
The analyzed file is a 32-bit native Windows executable with a graphical (GUI) subsystem. It is not a .NET program and is not packed. The file also imports a debugger check (IsDebuggerPresent), a technique malware often uses to make analysis harder.
The file's version information presents it as the Microsoft "Windows Problem Reporting" component, and its signature chains mention Microsoft. However, the signature status is reported as Self Signed. A name, description or copyright line that looks like a Windows component does not prove a file is genuine. Malware often copies the look of trusted system files to avoid suspicion.
How it usually gets onto computers
According to the feed, Expiro.I most often arrives by:
- Exploiting system vulnerabilities and security flaws.
- Software downloads from malicious websites.
- Email attachments from untrusted sources, usually .exe, .pif, .avi and even .jpg files.
Files with media-style extensions are a common disguise. A file that appears to be a picture or video but behaves like a program deserves suspicion.
Risks for the user
- Loss of control: an attacker with full access can do almost anything the logged-in user can do.
- Data loss: files may be deleted without warning.
- More infections: the Trojan may download and install other malware.
- Privacy and account risk: as is typical with Trojans, personal data and passwords on the machine may be exposed.
Signs of infection
Because the threat is designed to stay hidden, visible symptoms may be few. These warning signs are typical of Trojan infections and are not confirmed specifically for Expiro.I:
- A system process that appears in an unexpected location or behaves oddly, especially one that claims to be a Windows component.
- Unexplained slowdowns, crashes or high resource use.
- Files that go missing or programs you did not install.
- Unexpected network activity or security settings that change on their own.
How to stay protected
- Keep Windows and your software updated so known vulnerabilities are closed.
- Be careful with email attachments from unknown senders, especially .exe or .pif files, or any "picture" or "video" that asks to be run.
- Download software only from official sources and avoid unfamiliar websites.
- Use a reputable, up-to-date security solution with real-time protection and run full system scans regularly.
- Do not trust a file just because of its name or description. Check where it is stored and whether its digital signature is valid.
- Keep backups of important files on a disconnected drive or separate storage.
If you suspect an infection, disconnect the computer from the internet, run a full scan with an up-to-date anti-malware tool, and change important passwords from a clean device. If the system still behaves strangely afterward, consider professional help or a clean reinstall of Windows.
Analysis Report
General information
| Family Name: | Trojan.Expiro.I |
|---|---|
| Signature status: | Self Signed |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
c7191ac917ba703648750fc98c749c99
SHA1:
2a0fb4af8e099d342250d3fbd49134d9b3a9d4d2
SHA256:
4772FFAFCBB7B4EB5830AC608D029722104DF8851C0CCDEF58042835BEBA9326
File Size:
506.22 KB, 506216 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have exports table
- File is 32-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Company Name | Microsoft Corporation |
| File Description | Windows Problem Reporting |
| File Version | 10.0.19041.7811 (WinBuild.160101.0800) |
| Internal Name | WerFault |
| Legal Copyright | © Microsoft Corporation. All rights reserved. |
| Original Filename | WerFault.exe |
| Product Name | Microsoft® Windows® Operating System |
| Product Version | 10.0.19041.7811 |
Digital Signatures
Digital Signatures
This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.| Signer | Root | Status |
|---|---|---|
| Microsoft Windows | Microsoft Windows Production PCA 2026 RSA2048-SHA256 | Self Signed |
| Microsoft Windows | Windows Production PCA 2023 | Self Signed |
File Traits
- HighEntropy
- ntdll
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 1,090 |
|---|---|
| Potentially Malicious Blocks: | 1 |
| Whitelisted Blocks: | 572 |
| Unknown Blocks: | 517 |
Visual Map
? - Unknown Block
x - Potentially Malicious Block
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Anti Debug |
|
