explorer[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

explorer.exe
Size

3.1MB
MD5

38ae1b3c38faef56fe4907922f0385ba
SHA1

84123a3decdaa217e3588a1de59fe6cee1998004
SHA256

d5bc504277172be5c54b60ad5c13209dc1f729131def084de3ec8c72e54c58ef
SHA512

eb678243a7125c7d3a2f41250e375319e3c6a8d8b6f101e312df15d5b04139e130f5559330bda1a8ecf89cf23d991bcedb404bef574b557658199572d8a5d018
SSDEEP

98304:6AQexfDvYYYYYYYYYYYRYYYYYYYYYYE3ia0eojk221:6AQexfDl3r7ojk22

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
explorer.exe

Files

explorer.exe
.exe windows:6 windows x64 arch:x64

7b25fa94e1025d7d12fbbe15b602a44f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

explorer.pdb

Imports

advapi32

RegCreateKeyW
RegCloseKey
RegOpenKeyExW
RegGetValueW
EventWrite
EventEnabled
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
RegQueryValueExW
GetLengthSid
GetTokenInformation
OpenProcessToken
RegCreateKeyExW
RegSetValueExW
EventRegister
RegDeleteKeyExW
EventUnregister
TraceMessage
RegOpenKeyW
RegDeleteValueW
RegQueryInfoKeyW
RegEnumValueW
ConvertStringSidToSidW
CreateWellKnownSid
RegEnumKeyExW
StartServiceW
CloseServiceHandle
OpenServiceW
OpenSCManagerW
QueryServiceStatus
CheckTokenMembership
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
LsaLookupSids
GetSidSubAuthority
OpenThreadToken
LsaOpenPolicy
GetSidSubAuthorityCount
LsaClose
IsValidSid
LsaFreeMemory
StartTraceW
EnableTraceEx
StopTraceW
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext

kernel32

DelayLoadFailureHook
LoadLibraryExA
ReadFile
GetFileSize
CreateFileW
FlushInstructionCache
RaiseException
SetLastError
OpenThread
GetSystemTimeAsFileTime
GetLocaleInfoW
GetDateFormatW
GetTimeFormatW
GetLocalTime
MultiByteToWideChar
GetCurrentThreadId
GetCurrentProcessId
GetModuleHandleW
OpenEventW
CloseHandle
CreateJobObjectW
GetLastError
SetInformationJobObject
AssignProcessToJobObject
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
SetUnhandledExceptionFilter
SetTermsrvAppInstallMode
InterlockedPushEntrySList
VirtualAlloc
InterlockedPopEntrySList
VirtualFree
GetLongPathNameW
ResumeThread
GetPriorityClass
SetPriorityClass
CreateThread
Sleep
FindClose
FindNextFileW
lstrcmpiW
CompareStringOrdinal
FindFirstFileW
GetFileAttributesW
GlobalGetAtomNameW
ExpandEnvironmentStringsW
SystemTimeToFileTime
GetSystemTime
MulDiv
GetTickCount64
GetThreadPriority
LeaveCriticalSection
EnterCriticalSection
SetEvent
GetCurrentThread
SetThreadPriority
GetTickCount
UnmapViewOfFile
MapViewOfFile
SearchPathW
GetDynamicTimeZoneInformation
GetTimeZoneInformation
GetBinaryTypeW
QueryPerformanceFrequency
QueueUserWorkItem
LoadLibraryExW
GetProductInfo
TerminateThread
CreateIoCompletionPort
GetQueuedCompletionStatus
LoadLibraryA
DeleteFileW
GetProcessId
GetModuleHandleA
CompareStringW
lstrcmpA
CompareFileTime
QueryFullProcessImageNameW
CreateFileMappingW
ResetEvent
WideCharToMultiByte
GlobalFree
DuplicateHandle
GetCurrentDirectoryW
WaitForMultipleObjects
GetComputerNameW
GlobalLock
GlobalUnlock
GlobalAlloc
lstrlenA
DeactivateActCtx
ActivateActCtx
ReleaseActCtx
CreateActCtxW
LockResource
LoadResource
FindResourceExW
GetUserDefaultLangID
GetWindowsDirectoryW
ExitProcess
HeapDestroy
RegisterApplicationRestart
SetProcessShutdownParameters
GetStartupInfoW
ReleaseMutex
CreateMutexW
InitializeCriticalSection
DeleteCriticalSection
SetErrorMode
CreateEventW
GetSystemDirectoryW
GetVersionExW
FreeLibrary
GetProcAddress
LoadLibraryW
GetUserDefaultUILanguage
WaitForSingleObject
HeapAlloc
HeapFree
GetProcessHeap
GetCurrentProcess
GetCommandLineW
GetPrivateProfileStringW
GetModuleFileNameW
CreateProcessW
lstrlenW
OpenProcess
LocalFree
LocalAlloc
QueryInformationJobObject

gdi32

SetDIBits
ExtTextOutW
GetLayout
SetLayout
LPtoDP
GetRgnBox
OffsetViewportOrgEx
GetStockObject
GdiFlush
CombineRgn
OffsetRgn
GetTextMetricsW
SetWindowOrgEx
StretchBlt
GetTextExtentPoint32W
CreatePen
Polyline
GetRegionData
ExtCreateRegion
GetTextColor
SelectClipRgn
SetViewportOrgEx
GetViewportOrgEx
IntersectClipRect
GetClipRgn
CreateRectRgn
GetBkColor
PatBlt
CreateBitmap
SetBkMode
SetTextColor
SetBkColor
OffsetWindowOrgEx
CreateCompatibleBitmap
GetTextExtentPointW
GetClipBox
GetObjectW
GdiAlphaBlend
BitBlt
GetDeviceCaps
CreateFontIndirectW
CreateRectRgnIndirect
CreateCompatibleDC
CreateDIBSection
SelectObject
DeleteObject
DeleteDC

user32

MapWindowPoints
SetTimer
SetPropW
CreateWindowExW
DialogBoxParamW
GetClassInfoW
GetClassInfoExW
GetMenuItemInfoW
GetMenuItemCount
GetClassNameW
ActivateKeyboardLayout
GetKeyboardLayout
InsertMenuW
GetMenuStringW
SetMenuItemInfoW
InsertMenuItemW
IsChild
IsWinEventHookInstalled
IsProcessDPIAware
IsRectEmpty
UnionRect
GetClassLongW
SetClassLongW
GetGUIThreadInfo
GetDlgCtrlID
GetNextDlgGroupItem
GetNextDlgTabItem
MoveWindow
ChildWindowFromPointEx
GetWindowDC
CharUpperW
UnregisterClassW
FrameRect
WindowFromDC
SendMessageCallbackW
UpdateLayeredWindow
GetUserObjectInformationW
GetProcessWindowStation
GetThreadDesktop
ShowWindowAsync
BringWindowToTop
GetClassLongPtrW
GetIconInfo
RegisterShellHookWindow
DeregisterShellHookWindow
FlashWindowEx
SetThreadDesktop
EndTask
OpenInputDesktop
CloseDesktop
GetMenuState
IsZoomed
SetScrollInfo
GetScrollInfo
SetScrollPos
InternalGetWindowText
GetWindowInfo
GetCaretBlinkTime
SetLayeredWindowAttributes
GetLayeredWindowAttributes
GetUpdateRect
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
KillTimer
SetWindowPos
GetWindowLongPtrW
PostQuitMessage
SetWindowLongPtrW
DestroyWindow
ShutdownBlockReasonCreate
LoadStringW
PostMessageW
PeekMessageW
ReleaseDC
GetDC
FindWindowW
GetSystemMetrics
SystemParametersInfoW
DestroyMenu
GetMenuDefaultItem
CreatePopupMenu
DispatchMessageW
TranslateMessage
GetMessageW
CharPrevW
CharNextW
GetWindow
PtInRect
GetWindowRect
RegisterClassW
MonitorFromRect
MonitorFromPoint
GetMonitorInfoW
ShowWindow
CopyRect
LockSetForegroundWindow
TrackMouseEvent
DefWindowProcW
GetCursorPos
SetFocus
GetAncestor
GhostWindowFromHungWindow
SendMessageW
EnumChildWindows
ReleaseCapture
GetDoubleClickTime
RegisterWindowMessageW
SetWindowTextW
SetWindowPlacement
SetRectEmpty
EnumDisplayMonitors
InflateRect
EqualRect
UpdateWindow
SendNotifyMessageW
ChangeWindowMessageFilterEx
IntersectRect
MonitorFromWindow
IsWindowVisible
GetForegroundWindow
EnumWindows
GetParent
IsWindow
TranslateAcceleratorW
WaitMessage
GetWindowTextW
GetClientRect
TrackPopupMenuEx
SetActiveWindow
GetKeyState
SubtractRect
RedrawWindow
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
InvalidateRect
OffsetRect
SendMessageTimeoutW
SetWindowRgn
UpdateLayeredWindowIndirect
GetWindowRgnBox
LoadImageW
GetWindowPlacement
SetForegroundWindow
GetLastInputInfo
RemovePropW
GetLastActivePopup
SwitchToThisWindow
MessageBeep
GetActiveWindow
GetFocus
SetCursor
UnregisterHotKey
RegisterHotKey
SendDlgItemMessageW
EndDialog
GetDesktopWindow
GetAsyncKeyState
GetShellWindow
ChildWindowFromPoint
SetCursorPos
GetMessagePos
BeginPaint
FillRect
DrawEdge
EndPaint
GetSystemMenu
EnableMenuItem
ExitWindowsEx
LoadIconW
DestroyIcon
IsIconic
DeleteMenu
CheckMenuItem
ModifyMenuW
WindowFromPoint
ClientToScreen
TrackPopupMenu
IsHungAppWindow
GetWindowThreadProcessId
AppendMenuW
CascadeWindows
TileWindows
LockWorkStation
ScreenToClient
RegisterClipboardFormatW
NotifyWinEvent
GetSysColor
DrawFocusRect
AdjustWindowRectEx
CopyIcon
MsgWaitForMultipleObjects
SetWinEventHook
RegisterClassExW
GetDlgItem
EnableWindow
GetDlgItemInt
SetDlgItemInt
IsDlgButtonChecked
IsWindowEnabled
CheckDlgButton
CallWindowProcW
SetCapture
DrawTextW
AdjustWindowRect
SetRect
LoadCursorW
CalculatePopupWindowPosition
GetMessageExtraInfo
GetCapture
SetGestureConfig
DrawIconEx
RemoveMenu
SetMenuDefaultItem
LoadMenuW
GetSubMenu
AllowSetForegroundWindow
GetSysColorBrush
GetPropW
GetWindowLongW
HungWindowFromGhostWindow
SetWindowCompositionAttribute
MsgWaitForMultipleObjectsEx
LoadAcceleratorsW

msvcrt

memcpy
memmove
memcmp
_wtoi
ceil
sqrt
cosf
_vsnwprintf
swprintf_s
free
wcsstr
iswalpha
wcschr
realloc
malloc
__wgetmainargs
_wcsicmp
bsearch
memset
__C_specific_handler
_XcptFilter
_exit
_cexit
exit
_wcmdln
_initterm
_amsg_exit
?terminate@@YAXXZ
__setusermatherr
_commode
_fmode
__set_app_type
_unlock
__dllonexit
_lock
_onexit
sin

ntdll

WinSqmEventEnabled
WinSqmAddToStream
EtwEventWrite
EtwEventEnabled
RtlGetProductInfo
NtOpenThreadToken
NtClose
NtOpenProcessToken
NtQueryInformationToken
NtSetSystemInformation
WinSqmAddToStreamEx
WinSqmSetDWORD
WinSqmSetString
WinSqmIsOptedIn
NtSetInformationProcess
NtQueryInformationProcess

shlwapi

ord164
ord175
StrStrIW
ord172
SHStrDupW
ord199
ord176
ord467
AssocQueryStringW
PathQuoteSpacesW
ord433
SHDeleteKeyW
ord560
ord24
SHRegGetUSValueW
ord548
ord630
ord212
ord184
ord559
PathIsNetworkPathW
ord213
SHOpenRegStream2W
ord631
SHRegGetBoolUSValueW
StrChrIW
ord413
ord478
ord460
PathFileExistsW
PathGetDriveNumberW
ord204
ord165
ord197
ord157
ord292
PathRemoveFileSpecW
PathIsDirectoryW
ord479
ord388
ord279
PathFindExtensionW
ord163
ord193
ord629
ord240
ord278
ord16
PathAppendW
SHDeleteValueW
SHSetValueW
ord618
ord635
PathGetArgsW
StrCmpNIW
PathRemoveBlanksW
PathRemoveArgsW
PathFindFileNameW
SHGetValueW
ChrCmpIW
ord510
AssocQueryKeyW
PathStripPathW
ord509
PathIsRootW
ord156
PathParseIconLocationW
StrCmpIW
ord437
StrCmpW
PathIsPrefixW
ord571
ord225
ord237
ord177
ord178
ord484
SHCreateStreamOnFileW
SHQueryInfoKeyW
StrCmpNW
StrTrimW
ord12
ord168
ord256
PathStripToRootW
StrRetToBufW
PathCommonPrefixW
ord503
ord502
ord236
SHStrDupA
ord154
PathRemoveExtensionW
ord487
PathIsFileSpecW
ord439
SHRegGetValueW
ord215
AssocCreate
ord632
ord476
ord217
StrRetToStrW
ord174
SHSetThreadRef
SHCreateThreadRef
ord10
PathCombineW
ord158
ord9
ord8
StrChrW
StrToIntW
ord270
ord219

shell32

ord152
ord95
ord850
ord23
SHGetSpecialFolderLocation
SHCreateItemWithParent
SHBindToFolderIDListParent
SHBindToFolderIDListParentEx
ord28
SHChangeNotify
ord747
ord727
SHGetFileInfoW
ord102
SHCreateShellItemArrayFromIDLists
ord22
ord134
DragQueryFileW
SHGetKnownFolderPath
SHCreateShellItemArrayFromShellItem
SHCreateItemFromParsingName
ord818
ord849
ord814
ord885
ord165
SHCreateDataObject
SHGetLocalizedName
ord787
ord790
ord193
ord100
ord85
ord18
SHParseDisplayName
ord155
ord190
SHGetFolderLocation
ord176
SHGetSpecialFolderPathW
SHBindToObject
ord89
ord245
ord200
ord723
ord68
ord680
SHGetKnownFolderIDList
ShellExecuteExW
ord899
ord188
ord660
ord201
SHGetNameFromIDList
ord892
SHCreateShellItem
ord67
ord17
ord2
ord711
SHChangeNotifyRegisterThread
ord19
ord16
ord25
ord21
ord137
ord733
ord753
ord644
ord645
ord4
SHGetPathFromIDListW
ord731
ord244
SHFileOperationW
SHGetFolderPathEx
SHUpdateRecycleBinIcon
ord60
ord896
ord64
ord61
SHBindToParent
SHGetFolderPathW
SHGetPathFromIDListA
ShellExecuteW
SHEnableServiceObject
ord54
ord88
ord886
ord91
ord132
SHGetIDListFromObject
SHCreateItemFromIDList
ord893
SHAddToRecentDocs
Shell_NotifyIconW
Shell_NotifyIconGetRect
ExtractIconExW
SHEvaluateSystemCommandTemplate
ord162
ord894
SHGetPropertyStoreForWindow
ord181
ord265
SHGetStockIconInfo
ord241
ord154
ord840
Shell_GetCachedImageIndexW
ord74
ord902
ord895
ord6
ord254

ole32

CoTaskMemFree
CoCreateInstance
CoRegisterClassObject
CoRevokeClassObject
OleInitialize
OleUninitialize
StringFromGUID2
CoRegisterMessageFilter
CoFreeUnusedLibraries
CoMarshalInterThreadInterfaceInStream
CoUninitialize
RegisterDragDrop
RevokeDragDrop
CoGetInterfaceAndReleaseStream
CoGetMalloc
CoTaskMemAlloc
CLSIDFromString
CoCreateFreeThreadedMarshaler
CreateBindCtx
PropVariantClear
ReleaseStgMedium
CreateStreamOnHGlobal
CoInitializeEx
CoInitialize

oleaut32

VariantInit
VariantClear
SysFreeString
SysAllocString
SysAllocStringLen
SysAllocStringByteLen

explorerframe

ord110
ord111

uxtheme

GetThemeMargins
EndBufferedPaint
DrawThemeTextEx
BeginBufferedPaint
GetThemePartSize
GetThemeBackgroundContentRect
GetWindowTheme
DrawThemeParentBackground
GetThemeBackgroundExtent
DrawThemeText
GetThemeTextExtent
DrawThemeBackground
GetThemeMetric
SetWindowTheme
CloseThemeData
OpenThemeData
IsCompositionActive
IsAppThemed
BufferedPaintUnInit
BufferedPaintClear
IsThemeActive
GetThemeRect
IsThemePartDefined
GetThemeColor
GetThemeBackgroundRegion
GetThemeBool
DrawThemeIcon
GetBufferedPaintBits
ord86
BufferedPaintInit

powrprof

PowerDeterminePlatformRole
CallNtPowerInformation
GetPwrCapabilities

dwmapi

DwmIsCompositionEnabled
ord105
ord113
DwmEnableBlurBehindWindow
ord127
ord114
DwmUnregisterThumbnail
DwmUpdateThumbnailProperties
ord124
DwmQueryThumbnailSourceSize
DwmSetWindowAttribute

slc

SLGetWindowsInformationDWORD

gdiplus

GdiplusStartup
GdipFree
GdipAlloc
GdipDisposeImage
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetCompositingMode
GdipSetInterpolationMode
GdipDrawImageRectI
GdipCreateBitmapFromHBITMAP
GdipGetImageHeight
GdipGetImageWidth
GdipCloneImage
GdiplusShutdown

secur32

GetUserNameExW

rpcrt4

RpcBindingFromStringBindingW
RpcStringBindingComposeW
RpcBindingSetAuthInfoExW
RpcBindingFree
RpcStringFreeW
I_RpcExceptionFilter
NdrClientCall3

propsys

VariantToStringAlloc
PSCreateMemoryPropertyStore
VariantToInt32WithDefault
PropVariantToBoolean
PropVariantToUInt64
PropVariantToUInt32
PropVariantToStringAlloc
VariantToStringWithDefault
PropVariantToString
VariantToBooleanWithDefault
PropVariantToInt64

Sections

.text
Size: 737KB - Virtual size: 737KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 188KB - Virtual size: 188KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7b25fa94e1025d7d12fbbe15b602a44f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

gdi32

user32

msvcrt

ntdll

shlwapi

shell32

ole32

oleaut32

explorerframe

uxtheme

powrprof

dwmapi

slc

gdiplus

secur32

rpcrt4

propsys

Sections

.text Size: 737KB - Virtual size: 737KB

.rdata Size: 188KB - Virtual size: 188KB

.data Size: 15KB - Virtual size: 16KB

.pdata Size: 52KB - Virtual size: 51KB

.rsrc Size: 2.1MB - Virtual size: 2.1MB

.reloc Size: 10KB - Virtual size: 9KB

.text
Size: 737KB - Virtual size: 737KB

.rdata
Size: 188KB - Virtual size: 188KB

.data
Size: 15KB - Virtual size: 16KB

.pdata
Size: 52KB - Virtual size: 51KB

.rsrc
Size: 2.1MB - Virtual size: 2.1MB

.reloc
Size: 10KB - Virtual size: 9KB