ExplorerFrame[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

ExplorerFrame.dll
Size

1.6MB
MD5

c7a77895796d9a9d43d40a6516f07fa2
SHA1

d854686a91a34243bddd9e88724b3d03eb454372
SHA256

20bebcd9fbf7589404d90cb40a1a181ac31e687c444f35a78e469da2d554261c
SHA512

b87420ef09db9b806a0597722c28ee33cb2ab1ee7930512936a582637ab246c2f42260925346f8205ecadb63ea1a2769d97548185b7bcf3410c5c1388967058b
SSDEEP

49152:JLLWiUAvmWUVtziejwgYS7/+maCeU3jfdK:uAvmJFjwU9aC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ExplorerFrame.dll

Files

ExplorerFrame.dll
.dll windows:10 windows x86 arch:x86

18cb6a600d0fcc2c1b8b2b45ffaba189

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

ExplorerFrame.pdb

Imports

api-ms-win-crt-string-l1-1-0

memset
wcsncmp

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o_free
_o___std_type_info_destroy_list
_o_memcpy_s
_o_rand
_o_realloc
_o_strncpy_s
_o_strtol
_o_toupper
__CxxFrameHandler3
_except_handler4_common
_o__set_errno
_o__seh_filter_dll
_o__register_onexit_function
_o__purecall
_o__wcsicmp
_o__ultow_s
_o__invalid_parameter_noinfo
_o__initialize_onexit_table
_o__initialize_narrow_environment
_o__get_errno
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsnprintf_s
strchr
memmove
memcmp
memcpy

shcore

ord188
SHGetValueW
IStream_Write
IUnknown_GetSite
SHDeleteValueW
SHUnicodeToAnsi
ord192
ord130
GetProcessDpiAwareness
ord175
ord125
ord182
SHOpenRegStream2W
ord102
ord183
ord186
ord187
IStream_Size
SHEnumValueW
SHCreateThread
ord131
SHStrDupA
SHGetThreadRef
IsOS
ord191
ord141
GetDpiForMonitor
SHCreateThreadRef
ord140
SHSetThreadRef
ord172
IStream_Reset
SHStrDupW
SHQueryValueExW
ord120
SHTaskPoolQueueTask
ord126
SHRegGetValueW
ord123
SHSetValueW
ord200
SHDeleteKeyW
ord193
IStream_Read
ord190
ord122
SHCreateMemStream
ord170
ord143
ord142
SHAnsiToUnicode
IUnknown_SetSite
IUnknown_QueryService
ord145
ord162
IUnknown_Set

shell32

ord873
ord68
SHGetKnownFolderIDList
ord2
ord4
ord24
ord882
ord833
ord866
SHCreateShellItemArrayFromIDLists
SHGetItemFromObject
ord777
ord823
SHAppBarMessage
ord137
ord881
ord147
ord824
ord851
RegenerateUserEnvironment
ord870
ord871
ord900
ord176
SHChangeNotifyRegisterThread
ShellExecuteExW
SHGetInstanceExplorer
SHGetKnownFolderItem
SHChangeNotify
ord14
ord162
ord85
ord152
SHGetSpecialFolderLocation
ord153
SHGetFolderPathEx
SHGetPathFromIDListW
ord829
Shell_GetCachedImageIndexW
SHCreateShellItemArrayFromDataObject
SHSetTemporaryPropertyForItem
SHGetTemporaryPropertyForItem
SHGetNameFromIDList
ord645
ord193
ord71
ord787
ord727
SHGetIconOverlayIndexW
SHCreateShellItemArrayFromShellItem
SHELL32_AreAllItemsAvailable
ord6
SHCreateItemInKnownFolder
ord912
ord862
ord897
ord893
SHGetFolderLocation
ord945
ord98
ord853
ord27
SHGetPathFromIDListA
ord103
StateRepoNewMenuCache_EnsureCacheAsync
ord90
SHGetPropertyStoreForWindow
ord59
ShellAboutW
SHCreateItemFromParsingName
ord941
ord942
SHCreateShellItemArray
ord888
ord95
SHGetItemFromDataObject
ord22
ord134
ord129
ord136
ord173
ord654
ord652
ord747
ord23
ord16
ord88
ord100
ord155
SHGetFileInfoW
SHBindToParent
ord77
ord884
SHCreateItemFromIDList
SHGetIDListFromObject
SHGetKnownFolderPath
ord850
SHParseDisplayName
ord102
SHBindToFolderIDListParent
SHPathPrepareForWriteW
ord840
ord74
ord132
ord67
DragQueryFileW
ord25
SHBindToFolderIDListParentEx
ord19
ord18
ord17
SHBindToObject
SHGetDesktopFolder
SHCreateItemWithParent
ord21
ord644
ord939

shlwapi

ord182
ord198
ord177
ord202
ord479
ord200
ord268
ord267
ord388
ord204
StrCmpW
StrDupW
PathFindNextComponentW
StrStrIW
PathIsURLW
PathIsRelativeW
ord172
ord164
ord165
ord163
ord509
ord481
ChrCmpIW
ord225
ord173
ord219
ord2
ord190
ord186
ord191
PathIsUNCW
ord201
ord158
ord433
ord197
ord24
SHRegGetUSValueW
ord484
ord478
AssocQueryStringW
PathParseIconLocationW
ord168
ord167
ord515
ord616
PathGetDriveNumberW
StrChrW
ord178
StrStrW
PathUnquoteSpacesW
PathStripToRootW
ord284
PathFindFileNameW
ord286
ord281
ord283
PathCreateFromUrlW
PathSkipRootW
ord638
SHRegGetBoolUSValueW
ord181
ord156
StrCmpNW
ord571
ord157
ord545
ord239
StrTrimW
StrCmpIW
PathCompactPathExW
ord1
PathAppendW
PathRemoveFileSpecW
ord317
PathRemoveExtensionW
PathFileExistsW
ord533
ord487
ord538
PathFindExtensionW
StrCmpNIW
StrToIntExW
StrPBrkW
StrToIntW
IntlStrEqWorkerW
ord581
ord154
HashData
ord517
ord516
UrlApplySchemeW
UrlCreateFromPathW
UrlCanonicalizeW
ord210
ord287
SHCreateShellPalette
UrlUnescapeA
PathCreateFromUrlA
ord240
ord288
ord635
ord282
GetMenuPosFromID
ord192
ord384
ord187
ord179
ord209
ord208
ord540
AssocCreate
ord639

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
GetModuleHandleW
GetModuleHandleExW
GetProcAddress
DisableThreadLibraryCalls
LockResource
LoadStringW
LoadResource
FindResourceExW
FreeLibrary
GetModuleFileNameW
GetModuleFileNameA

api-ms-win-core-synch-l1-1-0

OpenSemaphoreW
OpenEventW
CreateEventW
WaitForSingleObjectEx
CreateMutexExW
InitializeCriticalSectionAndSpinCount
WaitForMultipleObjectsEx
ReleaseSemaphore
OpenMutexW
WaitForSingleObject
ResetEvent
EnterCriticalSection
LeaveCriticalSection
CreateEventExW
InitializeCriticalSection
ReleaseMutex
DeleteCriticalSection
InitializeCriticalSectionEx
CreateSemaphoreExW
AcquireSRWLockExclusive
SetEvent
ReleaseSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared

api-ms-win-core-heap-l1-1-0

HeapDestroy
HeapFree
GetProcessHeap
HeapReAlloc
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

SetLastError
RaiseException
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError

api-ms-win-core-com-l1-1-0

CoTaskMemAlloc
CoTaskMemFree
GetHGlobalFromStream
PropVariantCopy
StringFromCLSID
CoMarshalInterface
CoCreateGuid
CoCreateInstance
CreateStreamOnHGlobal
CoUnmarshalInterface
CoRegisterClassObject
CoGetClassObject
CoRevokeClassObject
CoFreeUnusedLibraries
CLSIDFromString
StringFromGUID2
CoGetApartmentType
CoWaitForMultipleHandles
CoGetInterfaceAndReleaseStream
CoReleaseMarshalData
CoMarshalInterThreadInterfaceInStream
CoGetMalloc
CoInitializeEx
CoUninitialize
CoCreateFreeThreadedMarshaler
PropVariantClear
CoTaskMemRealloc

api-ms-win-core-processthreads-l1-1-0

TlsFree
TlsAlloc
OpenProcessToken
GetCurrentProcessId
TlsSetValue
TerminateProcess
SetThreadPriority
GetCurrentThread
GetCurrentProcess
GetStartupInfoW
GetCurrentThreadId
GetThreadPriority
OpenThreadToken
CreateThread
TlsGetValue

api-ms-win-core-localization-l1-2-0

FindNLSString
GetThreadLocale
GetThreadUILanguage
GetLocaleInfoW
GetUserDefaultLCID
FormatMessageW
FindNLSStringEx

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-registry-l1-1-0

RegEnumValueW
RegQueryValueExW
RegDeleteValueW
RegGetValueW
RegOpenKeyExW
RegQueryInfoKeyW
RegCloseKey
RegSetValueExW
RegCreateKeyExW
RegEnumKeyExW

api-ms-win-core-sysinfo-l1-1-0

GetTickCount64
GetSystemTimeAsFileTime
GetLocalTime
GetWindowsDirectoryW
GetSystemTime
GetTickCount

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
SetThreadpoolTimer

api-ms-win-eventing-provider-l1-1-0

EventWrite
EventActivityIdControl
EventWriteTransfer
EventSetInformation
EventRegister
EventProviderEnabled
EventUnregister
EventEnabled

api-ms-win-core-synch-l1-2-0

Sleep
InitOnceComplete
InitOnceBeginInitialize
InitOnceExecuteOnce

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryA
LoadLibraryW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
CompareStringOrdinal
GetStringTypeW
CompareStringW
WideCharToMultiByte

api-ms-win-eventing-classicprovider-l1-1-0

UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
TraceMessage

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW

rpcrt4

UuidCreate

api-ms-win-core-path-l1-1-0

PathCchCombine
PathCchRemoveFileSpec
PathCchRemoveExtension

api-ms-win-core-heap-l2-1-0

LocalFree
LocalReAlloc
LocalAlloc
GlobalAlloc
GlobalFree

api-ms-win-core-com-l1-1-1

RoGetAgileReference

api-ms-win-core-file-l1-1-0

GetDriveTypeW

api-ms-win-core-wow64-l1-1-1

IsWow64Process2

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentVariableW
GetCurrentDirectoryW
ExpandEnvironmentStringsW

api-ms-win-core-sysinfo-l1-2-0

GetProductInfo

api-ms-win-core-string-l2-1-0

CharUpperW
CharNextW

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureStackBackTrace

api-ms-win-core-version-l1-1-0

VerQueryValueW
GetFileVersionInfoSizeExW
GetFileVersionInfoExW

api-ms-win-security-base-l1-1-0

GetTokenInformation
GetSidSubAuthority

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

ntdll

WinSqmAddToStream
RtlQueryResourcePolicy
WinSqmSetDWORD
WinSqmAddToStreamEx
WinSqmIncrementDWORD
RtlQueryWnfStateData
RtlNtStatusToDosError

advapi32

RegOpenKeyW
RegEnumKeyW
RegCreateKeyW

imm32

ImmNotifyIME
ImmReleaseContext
ImmSetCandidateWindow
ImmGetCompositionStringW
ImmSetCompositionStringW
ImmGetDefaultIMEWnd
ImmIsIME
ImmGetContext

kernel32

ActivateActCtx
RegisterWaitForSingleObject
UnregisterWait
lstrcmpA
GetUserDefaultUILanguage
GlobalSize
GlobalUnlock
lstrcmpW
MulDiv
lstrcmpiW
lstrlenW
DeactivateActCtx
GetComputerNameW
AddAtomW
lstrlenA
CreateActCtxW
ReleaseActCtx
GlobalLock

user32

ord2707
ord2705
GetWindowBand
GetClassLongW
DestroyCaret
SetCaretPos
HideCaret
ShowCaret
CreateCaret
QueryDisplayConfig
GetDisplayConfigBufferSizes
GetCurrentInputMessageSource
SetMenuInfo
GetMenuInfo
GetMessageTime
ValidateRect
CreateWindowExW
ActivateKeyboardLayout
GetKeyboardLayout
GetScrollBarInfo
UnionRect
EnumChildWindows
UpdateWindow
CloseGestureInfoHandle
GetGestureInfo
SetWindowLongW
GetWindowLongW
DefWindowProcW
LoadCursorW
DispatchMessageW
TranslateMessage
GetDC
ReleaseDC
GetWindowRect
SystemParametersInfoForDpi
GetDpiForWindow
GetSystemMetricsForDpi
ShowWindow
SendMessageW
GetKeyState
TranslateAcceleratorW
SetFocus
GetFocus
GetWindowTextW
SystemParametersInfoW
KillTimer
SetTimer
GetSysColor
GetSystemMetrics
DestroyAcceleratorTable
IsWindow
DestroyWindow
LoadAcceleratorsW
RegisterClassW
SetPropW
SetWindowTextW
GetPropW
RemovePropW
CallWindowProcW
GetSystemMenu
GetParent
SetWindowPos
GetClientRect
OffsetRect
InvalidateRect
GetAsyncKeyState
GetAncestor
TrackMouseEvent
EnableWindow
GetWindowTextLengthW
SetCursor
GetCursorPos
MapWindowPoints
PtInRect
PeekMessageW
SendNotifyMessageW
GetClassNameW
FindWindowW
SendMessageTimeoutW
GetForegroundWindow
GetDesktopWindow
ScreenToClient
OpenClipboard
GetClipboardData
CloseClipboard
RegisterWindowMessageA
IsChild
RedrawWindow
LockWindowUpdate
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
GetWindow
RegisterClipboardFormatW
GetMenuItemCount
PostMessageW
SetCapture
InflateRect
GetCapture
ReleaseCapture
CreatePopupMenu
CheckMenuItem
EnableMenuItem
DeleteMenu
DestroyMenu
TrackPopupMenu
MonitorFromWindow
IsWindowVisible
IsWindowUnicode
DefWindowProcA
SetClipboardData
TrackPopupMenuEx
ClientToScreen
CopyRect
GetClassWord
GetMenuItemID
GetMenuItemInfoW
GetSubMenu
GetMenuState
InsertMenuW
MonitorFromPoint
GetMonitorInfoW
GetMessagePos
GetActiveWindow
AdjustWindowRectEx
MoveWindow
SetParent
SetRectEmpty
IntersectRect
IsRectEmpty
SetWindowRgn
MessageBeep
SetRect
MonitorFromRect
EqualRect
PostQuitMessage
MsgWaitForMultipleObjectsEx
AttachThreadInput
GetWindowThreadProcessId
SetForegroundWindow
GetLastActivePopup
GetShellWindow
DestroyIcon
UnregisterPowerSettingNotification
RegisterPowerSettingNotification
SetWindowPlacement
GetWindowPlacement
IsWindowEnabled
IsIconic
GetPhysicalCursorPos
WaitMessage
EnumDesktopWindows
EnumDisplayMonitors
GetMenuStringW
DrawTextW
AnimateWindow
RegisterClassExW
FillRect
GetSysColorBrush
DrawEdge
NotifyWinEvent
BeginPaint
EndPaint
GetDlgCtrlID
GetMenuDefaultItem
SetMenuDefaultItem
SetMessageExtraInfo
GetDoubleClickTime
GetMessageExtraInfo
SetClipboardViewer
ChangeClipboardChain
WindowFromPoint
AppendMenuW
LoadBitmapW
GetIconInfo
RegisterWindowMessageW
IsClipboardFormatAvailable
SendInput
GetClassInfoExW
DrawTextExW
LoadMenuW
AddClipboardFormatListener
InsertMenuItemW
SetMenuItemInfoW
RemoveClipboardFormatListener
CallMsgFilterW
LoadIconW
EnumWindows
CreateMenu
IsHungAppWindow
CopyIcon
PhysicalToLogicalPointForPerMonitorDPI
RemoveMenu
IsWinEventHookInstalled
SetGestureConfig

gdi32

DeleteObject
GetDeviceCaps
SelectObject
GetTextExtentPointW
CreateCompatibleDC
CreateCompatibleBitmap
GdiAlphaBlend
DeleteDC
SetTextColor
CreateSolidBrush
GetTextExtentPoint32W
CreateFontIndirectW
StretchBlt
CreateRectRgnIndirect
CreateRectRgn
SetRectRgn
CombineRgn
EqualRgn
SetBkColor
GetObjectW
OffsetWindowOrgEx
SetWindowOrgEx
GetClipBox
SetBkMode
BitBlt
CreateDIBSection
GetDIBits
StretchDIBits
GetObjectType
GetLayout
SetLayout
GetViewportOrgEx
LPtoDP
SetViewportOrgEx
GetDCDpiScaleValue
GetPaletteEntries
SetPaletteEntries
GetStockObject
SelectPalette
RealizePalette
CreatePalette
CreateBitmapFromDxSurface
GdiTransparentBlt
SelectClipRgn
GetTextMetricsW
ExtTextOutW
OffsetViewportOrgEx
GetClipRgn
GetRgnBox
GetCharWidth32W
SetTextAlign

api-ms-win-stateseparation-helpers-l1-1-0

GetPersistedRegistryLocationW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllGetVersion

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 105KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

18cb6a600d0fcc2c1b8b2b45ffaba189

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

shcore

shell32

shlwapi

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-string-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-registry-l1-1-1

rpcrt4

api-ms-win-core-path-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-com-l1-1-1

api-ms-win-core-file-l1-1-0

api-ms-win-core-wow64-l1-1-1

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-version-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-apiquery-l1-1-0

ntdll

advapi32

imm32

kernel32

user32

gdi32

api-ms-win-stateseparation-helpers-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 1.5MB - Virtual size: 1.5MB

.data Size: 2KB - Virtual size: 8KB

.idata Size: 20KB - Virtual size: 20KB

.didat Size: 3KB - Virtual size: 2KB

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 105KB - Virtual size: 105KB

.text
Size: 1.5MB - Virtual size: 1.5MB

.data
Size: 2KB - Virtual size: 8KB

.idata
Size: 20KB - Virtual size: 20KB

.didat
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 105KB - Virtual size: 105KB