ExplorerFrame[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

ExplorerFrame.dll
Size

4.1MB
MD5

e2684b872a181ac640dfb11aabceea88
SHA1

d79bfc89ac1f3b515a053dd019ba97f5480dd624
SHA256

263663440a982d9b2256d12f7b663afc64a6d9ec63a02ffa8dea3eac38c4417e
SHA512

d4f9fe906f4b29c2a18f9a95fb6b71a3c9559653d6a2c3561464cfaf4ae4750cb5042e595a0045c9a80f8ed0d5e13d5228b21d036a05b0cc671cb3def2920c1d
SSDEEP

49152:e8uCgPEL/XySam3FYlJij78A0ZjSCDO6w3raoaLVekv4Kl5:ywXDlKiYnZ2CDmaoaLVekv48

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ExplorerFrame.dll

Files

ExplorerFrame.dll
.dll windows:10 windows x86 arch:x86

ec0765ae2cfe2e11dc0bedf8c0065afa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

ExplorerFrame.pdb

Imports

msvcrt

memcmp
_ftol2_sse
_vsnwprintf
_ftol2
memmove
_except_handler4_common
memcpy
_onexit
__dllonexit
_unlock
_lock
_initterm
malloc
_amsg_exit
_XcptFilter
_wcsicmp
free
strncpy_s
_get_errno
strchr
sprintf_s
_errno
strtol
_set_errno
memmove_s
_vsnprintf_s
memcpy_s
rand
realloc
toupper
__CxxFrameHandler3
memset

shcore

ord145
IUnknown_QueryService
IUnknown_SetSite
SHAnsiToUnicode
ord143
ord170
SHCreateMemStream
ord122
ord142
ord190
IStream_Read
ord193
SHDeleteKeyW
ord200
SHSetValueW
ord123
SHRegGetValueW
ord126
SHTaskPoolQueueTask
ord120
SHQueryValueExW
SHStrDupW
IStream_Reset
ord172
SHSetThreadRef
ord140
SHCreateThreadRef
GetDpiForMonitor
ord141
IsOS
SHOpenRegStream2W
ord191
ord188
SHGetValueW
IStream_Write
IUnknown_GetSite
SHDeleteValueW
SHUnicodeToAnsi
ord192
ord130
GetProcessDpiAwareness
ord175
ord125
ord182
ord162
ord102
ord183
ord186
ord187
IStream_Size
SHEnumValueW
SHCreateThread
ord131
SHStrDupA
SHGetThreadRef
IUnknown_Set

shell32

SHSetTemporaryPropertyForItem
SHGetTemporaryPropertyForItem
SHGetNameFromIDList
ord88
ord193
ord71
ord787
ord727
SHGetIconOverlayIndexW
SHCreateShellItemArrayFromShellItem
SHELL32_AreAllItemsAvailable
ord6
SHCreateItemInKnownFolder
ord912
ord862
ord897
SHELL32_GetPlaceholderStatesFromFileAttributesAndReparsePointTag
ord893
SHGetFolderLocation
ord945
ord98
ord853
ord27
SHGetPathFromIDListA
ord103
ord90
SHGetPropertyStoreForWindow
ord59
Shell_GetCachedImageIndexW
SHCreateItemFromParsingName
ord941
ord942
SHCreateShellItemArray
ord888
ord95
SHGetItemFromDataObject
ord22
ord134
ord129
ord136
ord173
ord654
ord652
ord747
SHParseDisplayName
SHCreateItemFromIDList
ord850
SHGetKnownFolderPath
SHGetIDListFromObject
ord884
ord77
SHBindToParent
SHGetFileInfoW
ord155
ord100
ord16
SHCreateShellItemArrayFromDataObject
ord829
SHGetPathFromIDListW
SHGetFolderPathEx
ord153
SHGetSpecialFolderLocation
ord152
ord85
ord162
ord14
SHChangeNotify
SHGetKnownFolderItem
SHGetInstanceExplorer
ShellExecuteExW
SHChangeNotifyRegisterThread
ord176
ord900
ord102
ord870
ord851
ord824
ord147
ord881
ord137
SHAppBarMessage
ord823
ord777
SHGetItemFromObject
SHCreateShellItemArrayFromIDLists
ord866
ord833
ord882
ord24
ord4
ord2
SHGetKnownFolderIDList
ord68
ord873
ord23
ord645
ord644
ord939
ord21
SHCreateItemWithParent
SHGetDesktopFolder
SHBindToObject
ord17
ord18
ord19
SHBindToFolderIDListParentEx
ord25
DragQueryFileW
ord67
ord132
ord74
ord840
SHPathPrepareForWriteW
ShellAboutW
SHBindToFolderIDListParent
ord871

shlwapi

ord540
ord208
ord209
ord179
ord187
ord384
ord192
GetMenuPosFromID
ord282
ord635
ord288
ord240
PathCreateFromUrlA
UrlUnescapeA
SHCreateShellPalette
ord287
ord210
UrlCanonicalizeW
UrlCreateFromPathW
UrlApplySchemeW
ord516
ord517
HashData
ord154
ord581
IntlStrEqWorkerW
StrToIntW
StrPBrkW
StrToIntExW
StrCmpNIW
PathFindExtensionW
ord538
ord487
ord533
ord639
PathRemoveExtensionW
ord317
PathRemoveFileSpecW
PathAppendW
ord1
PathFileExistsW
PathCompactPathExW
StrCmpIW
StrTrimW
ord239
ord545
ord157
ord571
StrCmpNW
ord156
ord181
SHRegGetBoolUSValueW
ord638
PathCreateFromUrlW
ord283
ord281
ord286
PathFindFileNameW
ord284
PathStripToRootW
PathUnquoteSpacesW
StrStrW
ord178
StrChrW
PathGetDriveNumberW
ord616
ord515
ord167
ord168
PathParseIconLocationW
AssocQueryStringW
ord484
SHRegGetUSValueW
ord24
ord197
ord433
ord158
ord201
ord191
ord186
ord190
ord478
ord182
ord198
ord177
ord202
ord479
ord200
ord268
ord267
ord388
ord204
StrCmpW
StrDupW
PathFindNextComponentW
StrStrIW
PathIsURLW
PathIsRelativeW
ord172
ord164
ord165
ord163
ord509
ord481
ChrCmpIW
ord225
ord173
ord219
ord2
PathSkipRootW
PathIsUNCW
AssocCreate

api-ms-win-core-libraryloader-l1-2-0

LockResource
LoadStringW
LoadResource
FindResourceExW
GetModuleHandleW
GetModuleFileNameW
GetProcAddress
LoadLibraryExW
GetModuleHandleExW
DisableThreadLibraryCalls
GetModuleFileNameA
FreeLibrary

api-ms-win-core-synch-l1-1-0

ReleaseSemaphore
OpenMutexW
AcquireSRWLockShared
WaitForSingleObject
CreateMutexExW
InitializeCriticalSectionEx
CreateSemaphoreExW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
OpenSemaphoreW
CreateEventW
SetEvent
ResetEvent
WaitForMultipleObjectsEx
EnterCriticalSection
ReleaseMutex
OpenEventW
WaitForSingleObjectEx
ReleaseSRWLockShared

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapDestroy
HeapReAlloc
HeapFree
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

GetLastError
UnhandledExceptionFilter
RaiseException
SetLastError
SetUnhandledExceptionFilter

api-ms-win-core-com-l1-1-0

PropVariantClear
CoCreateFreeThreadedMarshaler
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
GetHGlobalFromStream
PropVariantCopy
StringFromCLSID
CoMarshalInterface
CoCreateGuid
CoCreateInstance
CreateStreamOnHGlobal
CoUnmarshalInterface
CoRegisterClassObject
CoGetClassObject
CoRevokeClassObject
CoFreeUnusedLibraries
CLSIDFromString
StringFromGUID2
CoGetApartmentType
CoWaitForMultipleHandles
CoGetInterfaceAndReleaseStream
CoReleaseMarshalData
CoMarshalInterThreadInterfaceInStream
CoInitializeEx
CoUninitialize
CoGetMalloc

api-ms-win-core-processthreads-l1-1-0

SetThreadPriority
GetCurrentProcess
GetCurrentThread
GetCurrentProcessId
TlsAlloc
TlsSetValue
GetThreadPriority
TerminateProcess
GetStartupInfoW
CreateThread
TlsFree
GetCurrentThreadId
TlsGetValue

api-ms-win-core-localization-l1-2-0

GetLocaleInfoW
FindNLSString
FormatMessageW
GetThreadLocale
GetUserDefaultLCID
GetThreadUILanguage
FindNLSStringEx

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-registry-l1-1-0

RegGetValueW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegEnumValueW
RegSetValueExW
RegCreateKeyExW
RegEnumKeyExW
RegDeleteValueW

api-ms-win-core-sysinfo-l1-1-0

GetLocalTime
GetSystemTimeAsFileTime
GetWindowsDirectoryW
GetTickCount
GetSystemTime
GetTickCount64

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventRegister
EventSetInformation
EventWriteTransfer
EventProviderEnabled
EventActivityIdControl
EventWrite
EventEnabled

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer

api-ms-win-core-synch-l1-2-0

SleepConditionVariableSRW
WakeAllConditionVariable
InitOnceExecuteOnce
Sleep
InitOnceComplete
InitOnceBeginInitialize

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryA
LoadLibraryW

api-ms-win-core-string-l1-1-0

GetStringTypeW
CompareStringOrdinal
WideCharToMultiByte
MultiByteToWideChar
CompareStringW

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
TraceMessage

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW

rpcrt4

UuidCreate

api-ms-win-core-path-l1-1-0

PathCchRemoveExtension
PathCchRemoveFileSpec
PathCchCombine

api-ms-win-core-heap-l2-1-0

LocalAlloc
GlobalFree
LocalFree
GlobalAlloc
LocalReAlloc

api-ms-win-core-com-l1-1-1

RoGetAgileReference

api-ms-win-core-file-l1-1-0

GetDriveTypeW

api-ms-win-core-wow64-l1-1-1

IsWow64Process2

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW
GetEnvironmentVariableW
GetCurrentDirectoryW

api-ms-win-core-sysinfo-l1-2-0

GetProductInfo

api-ms-win-core-string-l2-1-0

CharUpperW
CharNextW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureStackBackTrace

api-ms-win-core-version-l1-1-0

VerQueryValueW
GetFileVersionInfoExW
GetFileVersionInfoSizeExW

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

ntdll

RtlNtStatusToDosError
RtlQueryWnfStateData
_ultow_s
WinSqmAddToStreamEx
WinSqmSetDWORD
RtlQueryResourcePolicy
WinSqmAddToStream
WinSqmIncrementDWORD

advapi32

RegCreateKeyW
RegEnumKeyW
RegQueryInfoKeyW
RegOpenKeyW

imm32

ImmGetContext
ImmNotifyIME
ImmReleaseContext
ImmSetCandidateWindow
ImmGetCompositionStringW
ImmGetDefaultIMEWnd
ImmIsIME
ImmSetCompositionStringW

kernel32

lstrcmpiW
lstrlenW
MulDiv
lstrcmpW
GlobalLock
GetUserDefaultUILanguage
GlobalSize
lstrcmpA
UnregisterWait
RegisterWaitForSingleObject
ActivateActCtx
DeactivateActCtx
GetComputerNameW
ReleaseActCtx
AddAtomW
lstrlenA
GlobalUnlock
CreateActCtxW

user32

UpdateWindow
CloseGestureInfoHandle
GetGestureInfo
SetGestureConfig
DestroyWindow
IsWindow
IsWinEventHookInstalled
GetCurrentInputMessageSource
RemoveMenu
PhysicalToLogicalPointForPerMonitorDPI
CopyIcon
IsHungAppWindow
CreateMenu
EnumWindows
LoadIconW
CallMsgFilterW
DestroyAcceleratorTable
GetSystemMetrics
GetWindowRect
RemoveClipboardFormatListener
GetSysColor
SetTimer
SetMenuItemInfoW
KillTimer
SystemParametersInfoW
InsertMenuItemW
AddClipboardFormatListener
LoadMenuW
GetWindowTextW
DrawTextExW
GetDesktopWindow
GetClassInfoExW
SendInput
IsClipboardFormatAvailable
RegisterWindowMessageW
GetDpiForWindow
GetFocus
SetFocus
TranslateAcceleratorW
GetSystemMetricsForDpi
GetIconInfo
LoadBitmapW
AppendMenuW
WindowFromPoint
ChangeClipboardChain
SetClipboardViewer
GetMessageExtraInfo
GetDoubleClickTime
GetKeyState
SendMessageW
SetMessageExtraInfo
SetMenuDefaultItem
GetMenuDefaultItem
GetDlgCtrlID
EndPaint
ShowWindow
BeginPaint
NotifyWinEvent
DrawEdge
GetSysColorBrush
FillRect
RegisterClassExW
AnimateWindow
DrawTextW
GetMenuStringW
EnumDisplayMonitors
ReleaseDC
GetDC
TranslateMessage
EnumDesktopWindows
WaitMessage
GetPhysicalCursorPos
IsIconic
IsWindowEnabled
GetWindowPlacement
DispatchMessageW
SetWindowPlacement
RegisterPowerSettingNotification
UnregisterPowerSettingNotification
DestroyIcon
GetShellWindow
GetLastActivePopup
SetForegroundWindow
GetWindowThreadProcessId
GetForegroundWindow
AttachThreadInput
MsgWaitForMultipleObjectsEx
PostQuitMessage
EqualRect
LoadCursorW
MonitorFromRect
SetRect
MessageBeep
SetWindowRgn
IsRectEmpty
IntersectRect
SetRectEmpty
SetParent
MoveWindow
AdjustWindowRectEx
GetActiveWindow
GetMessagePos
GetMonitorInfoW
MonitorFromPoint
InsertMenuW
GetMenuState
GetSubMenu
GetMenuItemInfoW
GetMenuItemID
GetClassWord
CopyRect
ClientToScreen
TrackPopupMenuEx
SetClipboardData
DefWindowProcA
IsWindowUnicode
IsWindowVisible
MonitorFromWindow
TrackPopupMenu
DestroyMenu
DeleteMenu
EnableMenuItem
CheckMenuItem
CreatePopupMenu
ScreenToClient
ReleaseCapture
GetCapture
InflateRect
SetCapture
PostMessageW
GetMenuItemCount
RegisterClipboardFormatW
GetWindow
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
LockWindowUpdate
RedrawWindow
UnionRect
IsChild
RegisterWindowMessageA
CloseClipboard
GetClipboardData
OpenClipboard
SendNotifyMessageW
SendMessageTimeoutW
FindWindowW
GetClassNameW
PeekMessageW
PtInRect
MapWindowPoints
GetCursorPos
SetCursor
GetWindowTextLengthW
EnableWindow
TrackMouseEvent
GetAncestor
GetAsyncKeyState
InvalidateRect
OffsetRect
DefWindowProcW
GetWindowLongW
GetClientRect
SetWindowPos
GetParent
GetSystemMenu
CallWindowProcW
RemovePropW
GetPropW
SetWindowTextW
SetPropW
RegisterClassW
GetScrollBarInfo
GetKeyboardLayout
ActivateKeyboardLayout
CreateWindowExW
SetWindowLongW
ValidateRect
GetMessageTime
GetMenuInfo
ord2707
SetMenuInfo
CreateCaret
ShowCaret
HideCaret
SetCaretPos
DestroyCaret
GetClassLongW
ord2705
GetWindowBand
EnumChildWindows
LoadAcceleratorsW

gdi32

GetClipRgn
OffsetViewportOrgEx
ExtTextOutW
GetTextMetricsW
SelectClipRgn
GdiTransparentBlt
CreateBitmapFromDxSurface
GetCurrentDpiInfo
CreatePalette
RealizePalette
SelectPalette
GetStockObject
SetPaletteEntries
GetPaletteEntries
GetDCDpiScaleValue
SetViewportOrgEx
LPtoDP
GetViewportOrgEx
GetRgnBox
GetCharWidth32W
GetLayout
GetObjectType
StretchDIBits
GetDIBits
CreateDIBSection
BitBlt
SetBkMode
GetClipBox
SetWindowOrgEx
OffsetWindowOrgEx
GetObjectW
SetBkColor
EqualRgn
CombineRgn
SetRectRgn
CreateRectRgn
CreateRectRgnIndirect
StretchBlt
SetTextAlign
GetTextExtentPoint32W
CreateSolidBrush
SetTextColor
SetLayout
DeleteDC
GdiAlphaBlend
CreateCompatibleBitmap
CreateCompatibleDC
DeleteObject
CreateFontIndirectW
GetTextExtentPointW
SelectObject
GetDeviceCaps

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllGetVersion

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 105KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ec0765ae2cfe2e11dc0bedf8c0065afa

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

shcore

shell32

shlwapi

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-string-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-registry-l1-1-1

rpcrt4

api-ms-win-core-path-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-com-l1-1-1

api-ms-win-core-file-l1-1-0

api-ms-win-core-wow64-l1-1-1

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-version-l1-1-0

api-ms-win-core-apiquery-l1-1-0

ntdll

advapi32

imm32

kernel32

user32

gdi32

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 1.5MB - Virtual size: 1.5MB

.data Size: 2KB - Virtual size: 7KB

.idata Size: 19KB - Virtual size: 19KB

.didat Size: 3KB - Virtual size: 2KB

.rsrc Size: 2.5MB - Virtual size: 2.5MB

.reloc Size: 105KB - Virtual size: 105KB

.text
Size: 1.5MB - Virtual size: 1.5MB

.data
Size: 2KB - Virtual size: 7KB

.idata
Size: 19KB - Virtual size: 19KB

.didat
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 2.5MB - Virtual size: 2.5MB

.reloc
Size: 105KB - Virtual size: 105KB