ExplorerFrame[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

ExplorerFrame.dll
Size

4.2MB
MD5

9865fb6cc8fd8b5e47948ac6a122525c
SHA1

e114d7e52c0c5903af12268e1fb58021ee3cbee1
SHA256

520701afbf7d925b35d7fe13054bd4d77c6f286727916db17488551759013e38
SHA512

53e7ba94c6dbd7f9bf137aa361b6c69e1e67ad04f8afda3bcfd2c4da727d624e62289f075cc401c13f4565be5b8153932fd21202d4cc6a9a58b289192aef7120
SSDEEP

49152:bfBvCZLdWunHnHHn88c88OvfmzfnAr/XlXMoTKZOwKw1Z0aoaLVeWv4KI:UAnz/Ar/X1VTWz8aoaLVeWv4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ExplorerFrame.dll

Files

ExplorerFrame.dll
.dll windows:10 windows x86 arch:x86

4eaa47d0596bbc7ce895c12400ad162c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

ExplorerFrame.pdb

Imports

msvcrt

_ftol2_sse
memcmp
_vsnwprintf
memcpy
_ftol2
_except_handler4_common
__CxxFrameHandler3
_onexit
__dllonexit
_unlock
_lock
_initterm
_amsg_exit
_XcptFilter
_wcsicmp
memmove_s
strncpy_s
_get_errno
strchr
sprintf_s
_errno
strtol
_set_errno
malloc
free
memcpy_s
memmove
_CIexp
rand
realloc
memset

shcore

SHStrDupA
ord131
SHCreateThread
SHEnumValueW
IStream_Size
ord187
ord186
ord183
ord102
ord162
ord182
ord125
ord175
GetProcessDpiAwareness
ord130
ord192
SHUnicodeToAnsi
SHDeleteValueW
IUnknown_GetSite
ord143
IStream_Write
ord188
SHGetValueW
ord191
SHOpenRegStream2W
IsOS
ord141
GetDpiForMonitor
ord140
ord172
IStream_Reset
SHStrDupW
SHQueryValueExW
ord120
SHSetThreadRef
SHCreateThreadRef
SHGetThreadRef
ord142
ord126
SHRegGetValueW
ord123
SHSetValueW
ord200
SHDeleteKeyW
IStream_Read
ord190
ord122
SHCreateMemStream
ord170
ord193
SHAnsiToUnicode
IUnknown_SetSite
IUnknown_QueryService
IUnknown_Set
ord145

shell32

SHSetTemporaryPropertyForItem
SHGetTemporaryPropertyForItem
SHGetNameFromIDList
SHGetPropertyStoreFromIDList
ord88
ord193
ord71
ord787
ord727
SHGetIconOverlayIndexW
ord873
ord6
SHCreateItemInKnownFolder
ord912
ord862
ord897
ord893
SHGetFolderLocation
ord945
ord98
ord27
SHGetPathFromIDListA
ord103
SHCreateShellItemArrayFromDataObject
SHGetPropertyStoreForWindow
ord59
ShellAboutW
SHCreateItemFromParsingName
ord941
ord942
SHCreateShellItemArray
ord888
ord95
SHGetItemFromDataObject
ord22
ord134
ord129
ord136
ord173
ord654
ord652
ord747
SHCreateItemFromIDList
Shell_GetCachedImageIndexW
ord829
SHGetPathFromIDListW
SHGetFolderPathEx
SHBindToFolderIDListParent
ord153
SHGetSpecialFolderLocation
ord152
ord85
ord162
ord14
SHChangeNotify
SHGetKnownFolderItem
SHGetInstanceExplorer
ShellExecuteExW
SHChangeNotifyRegisterThread
ord176
ord900
ord871
ord870
ord851
ord824
ord147
ord881
ord137
SHAppBarMessage
ord823
ord777
SHGetItemFromObject
SHCreateShellItemArrayFromIDLists
ord866
ord833
ord882
ord24
ord4
ord2
SHGetKnownFolderIDList
ord68
ord23
ord645
ord644
ord939
ord21
SHCreateItemWithParent
SHGetDesktopFolder
SHBindToObject
ord17
ord18
ord19
ord25
DragQueryFileW
ord67
ord132
ord74
ord840
SHPathPrepareForWriteW
ord102
ord90
SHParseDisplayName
ord16
ord100
ord155
SHGetFileInfoW
SHBindToParent
ord77
ord884
SHBindToFolderIDListParentEx
SHGetIDListFromObject
SHGetKnownFolderPath
ord850

shlwapi

AssocCreate
ord540
ord208
ord209
ord179
ord187
ord384
ord192
GetMenuPosFromID
ord282
ord635
ord288
ord240
PathCreateFromUrlA
UrlUnescapeA
SHCreateShellPalette
ord287
ord210
UrlCanonicalizeW
UrlCreateFromPathW
UrlApplySchemeW
ord516
ord517
HashData
StrToIntW
ord154
ord581
IntlStrEqWorkerW
StrPBrkW
StrToIntExW
PathFindExtensionW
ord538
ord533
ord487
ord639
PathRemoveExtensionW
ord317
PathRemoveFileSpecW
PathAppendW
ord1
PathFileExistsW
PathCompactPathExW
StrCmpIW
StrTrimW
ord239
ord545
ord157
ord571
StrCmpNW
ord156
ord181
SHRegGetBoolUSValueW
ord638
PathCreateFromUrlW
ord283
ord281
ord286
PathFindFileNameW
ord284
PathStripToRootW
PathUnquoteSpacesW
StrStrW
ord178
StrChrW
ord616
ord515
ord167
ord168
PathParseIconLocationW
AssocQueryStringW
ord484
SHRegGetUSValueW
ord24
ord197
ord433
ord158
ord201
ord191
ord186
ord190
ord478
ord182
ord198
ord177
ord202
ord479
ord200
ord268
ord267
ord388
ord204
StrCmpW
StrDupW
PathFindNextComponentW
StrStrIW
PathIsURLW
PathIsRelativeW
ord172
ord164
ord165
ord163
ord509
ord481
ChrCmpIW
ord225
ord173
ord219
ord2
PathSkipRootW
PathIsUNCW
PathGetDriveNumberW

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
GetModuleHandleW
FreeLibraryAndExitThread
DisableThreadLibraryCalls
GetProcAddress
GetModuleFileNameA
FreeLibrary
LoadStringW
LoadLibraryExW
GetModuleFileNameW
LockResource
LoadResource
FindResourceExW

api-ms-win-core-synch-l1-2-0

WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexExW
WaitForMultipleObjectsEx
InitOnceExecuteOnce
ReleaseMutex
InitOnceComplete
WaitForSingleObject
OpenEventW
Sleep
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeCriticalSectionEx
CreateEventExW
ReleaseSemaphore
CreateSemaphoreExW
InitializeSRWLock
OpenMutexW
ResetEvent
AcquireSRWLockShared
SetEvent
InitOnceBeginInitialize
ReleaseSRWLockShared
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
CreateEventW

api-ms-win-core-heap-l1-2-0

HeapReAlloc
HeapDestroy
HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-errorhandling-l1-1-1

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
SetLastError
RaiseException

api-ms-win-core-com-l1-1-1

StringFromCLSID
PropVariantCopy
CoTaskMemRealloc
CoTaskMemFree
CoGetApartmentType
RoGetAgileReference
CoMarshalInterThreadInterfaceInStream
CoReleaseMarshalData
CoGetInterfaceAndReleaseStream
CoWaitForMultipleHandles
CoMarshalInterface
CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
StringFromGUID2
CoCreateGuid
CLSIDFromString
CoFreeUnusedLibraries
CoRevokeClassObject
CoGetClassObject
CoRegisterClassObject
PropVariantClear
CoGetMalloc
CoUnmarshalInterface
CreateStreamOnHGlobal
CoCreateInstance
CoUninitialize
CoInitializeEx
GetHGlobalFromStream

api-ms-win-core-processthreads-l1-1-2

GetCurrentProcessId
GetThreadPriority
TerminateProcess
TlsGetValue
TlsFree
TlsAlloc
GetCurrentThreadId
TlsSetValue
CreateThread
GetStartupInfoW
GetCurrentProcess
SetThreadPriority
GetCurrentThread

api-ms-win-core-localization-l1-2-1

FindNLSStringEx
GetThreadLocale
FormatMessageW
GetThreadUILanguage
GetLocaleInfoW
GetUserDefaultLCID
FindNLSString

api-ms-win-core-debug-l1-1-1

OutputDebugStringW

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegGetValueW
RegQueryValueExW

api-ms-win-core-sysinfo-l1-2-1

GetProductInfo
GetSystemTime
GetTickCount64
GetTickCount
GetSystemTimeAsFileTime
GetLocalTime
GetWindowsDirectoryW

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventActivityIdControl
EventEnabled
EventWriteTransfer
EventSetInformation
EventWrite
EventRegister

api-ms-win-core-libraryloader-l1-2-2

LoadLibraryW
LoadLibraryA

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
GetStringTypeW
WideCharToMultiByte
CompareStringW
CompareStringOrdinal

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW

api-ms-win-core-path-l1-1-0

PathCchRemoveFileSpec
PathCchCombine
PathCchRemoveExtension

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree
LocalReAlloc
GlobalAlloc
GlobalFree

api-ms-win-core-threadpool-l1-2-0

CallbackMayRunLong
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolTimer
FreeLibraryWhenCallbackReturns
TrySubmitThreadpoolCallback

api-ms-win-core-synch-l1-2-1

CreateSemaphoreW

api-ms-win-core-file-l1-2-1

GetDriveTypeW

api-ms-win-core-processenvironment-l1-2-0

GetCurrentDirectoryW
GetEnvironmentVariableW
ExpandEnvironmentStringsW

api-ms-win-core-string-l2-1-0

CharNextW
CharUpperW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-rtlsupport-l1-2-0

RtlCaptureStackBackTrace

api-ms-win-core-version-l1-1-0

VerQueryValueW
GetFileVersionInfoSizeExW
GetFileVersionInfoExW

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

ntdll

RtlQueryWnfStateData
RtlNtStatusToDosError
_ultow_s
WinSqmIncrementDWORD
WinSqmAddToStreamEx
RtlQueryResourcePolicy
WinSqmSetDWORD
WinSqmAddToStream

advapi32

RegOpenKeyW
RegQueryInfoKeyW
RegEnumKeyW
RegCreateKeyW

imm32

ImmIsIME
ImmGetDefaultIMEWnd
ImmNotifyIME
ImmSetCompositionStringW
ImmGetCompositionStringW
ImmSetCandidateWindow
ImmReleaseContext
ImmGetContext

kernel32

GlobalLock
MulDiv
GetUserDefaultUILanguage
lstrcmpA
lstrcmpiW
lstrcmpW
GlobalUnlock
UnregisterWait
RegisterWaitForSingleObject
ActivateActCtx
DeactivateActCtx
CreateActCtxW
GlobalSize
ReleaseActCtx
GetComputerNameW
AddAtomW
lstrlenA
lstrlenW

user32

CopyRect
ClientToScreen
TrackPopupMenuEx
SetClipboardData
DefWindowProcA
GetClassLongW
DestroyCaret
IsWindowUnicode
IsWindowVisible
MonitorFromWindow
TrackPopupMenu
DestroyMenu
DeleteMenu
SetCaretPos
HideCaret
EnableMenuItem
ShowCaret
CreateCaret
CheckMenuItem
CreatePopupMenu
ScreenToClient
ReleaseCapture
GetCapture
InflateRect
SetCapture
PostMessageW
GetMenuItemCount
RegisterClipboardFormatW
GetWindow
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
LockWindowUpdate
RedrawWindow
IsChild
GetWindowTextLengthW
SetMenuInfo
GetMenuInfo
GetMessageTime
RegisterWindowMessageA
ValidateRect
CreateWindowExW
ActivateKeyboardLayout
GetKeyboardLayout
GetScrollBarInfo
CloseClipboard
GetClipboardData
OpenClipboard
SendNotifyMessageW
UnionRect
SendMessageTimeoutW
FindWindowW
EnumChildWindows
UpdateWindow
CloseGestureInfoHandle
GetGestureInfo
SetGestureConfig
GetClassNameW
PeekMessageW
PtInRect
MapWindowPoints
GetCursorPos
IsWinEventHookInstalled
SetCursor
EnableWindow
TrackMouseEvent
GetCurrentInputMessageSource
RemoveMenu
GetAncestor
PhysicalToLogicalPointForPerMonitorDPI
CopyIcon
IsHungAppWindow
CreateMenu
GetAsyncKeyState
EnumWindows
InvalidateRect
OffsetRect
GetClientRect
SetWindowPos
GetParent
GetSystemMenu
LoadIconW
CallWindowProcW
RemovePropW
CallMsgFilterW
GetPropW
RemoveClipboardFormatListener
SetMenuItemInfoW
SetWindowTextW
InsertMenuItemW
AddClipboardFormatListener
LoadMenuW
DrawTextExW
GetDesktopWindow
GetClassInfoExW
SetPropW
SendInput
IsClipboardFormatAvailable
RegisterWindowMessageW
RegisterClassW
LoadAcceleratorsW
DestroyWindow
IsWindow
DestroyAcceleratorTable
GetIconInfo
GetSystemMetrics
SystemParametersInfoW
GetWindowRect
GetSysColor
SetTimer
KillTimer
GetWindowTextW
LoadBitmapW
AppendMenuW
WindowFromPoint
GetFocus
ChangeClipboardChain
SetClipboardViewer
GetMessageExtraInfo
SetFocus
TranslateAcceleratorW
GetDoubleClickTime
SetMessageExtraInfo
GetKeyState
SendMessageW
SetMenuDefaultItem
GetMenuDefaultItem
GetDlgCtrlID
EndPaint
BeginPaint
NotifyWinEvent
DrawEdge
GetSysColorBrush
FillRect
ShowWindow
ReleaseDC
RegisterClassExW
AnimateWindow
DrawTextW
GetMenuStringW
EnumDisplayMonitors
GetDC
TranslateMessage
DispatchMessageW
LoadCursorW
GetClassWord
GetMenuItemID
GetMenuItemInfoW
GetSubMenu
GetMenuState
InsertMenuW
MonitorFromPoint
PostThreadMessageW
MsgWaitForMultipleObjectsEx
GetMonitorInfoW
GetMessagePos
GetActiveWindow
AdjustWindowRectEx
MoveWindow
SetParent
SetRectEmpty
IntersectRect
IsRectEmpty
EnumDesktopWindows
SetWindowRgn
MessageBeep
SetRect
MonitorFromRect
EqualRect
PostQuitMessage
AttachThreadInput
GetForegroundWindow
GetWindowThreadProcessId
SetForegroundWindow
GetLastActivePopup
GetShellWindow
DestroyIcon
SetWindowPlacement
GetWindowPlacement
IsWindowEnabled
IsIconic
GetPhysicalCursorPos
WaitMessage
GetWindowBand
ord2704
ord2705
ord2707
SetWindowLongW
GetWindowLongW
DefWindowProcW

gdi32

GetClipRgn
OffsetViewportOrgEx
ExtTextOutW
GetTextMetricsW
SelectClipRgn
GdiTransparentBlt
CreateBitmapFromDxSurface
GetCurrentDpiInfo
CreatePalette
GetRgnBox
SelectPalette
GetStockObject
SetPaletteEntries
GetPaletteEntries
SetViewportOrgEx
GetCharWidth32W
GetDeviceCaps
SelectObject
GetTextExtentPointW
CreateFontIndirectW
DeleteObject
GetLayout
SetLayout
GetViewportOrgEx
RealizePalette
GetObjectType
StretchDIBits
CreateCompatibleDC
CreateCompatibleBitmap
GdiAlphaBlend
GetDIBits
CreateDIBSection
BitBlt
SetBkMode
DeleteDC
GetTextExtentPoint32W
SetTextColor
SetTextAlign
StretchBlt
CreateRectRgnIndirect
CreateRectRgn
SetRectRgn
CombineRgn
EqualRgn
CreateSolidBrush
GetClipBox
SetBkColor
SetWindowOrgEx
OffsetWindowOrgEx
GetObjectW
LPtoDP

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllGetVersion

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 108KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4eaa47d0596bbc7ce895c12400ad162c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

shcore

shell32

shlwapi

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-com-l1-1-1

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-localization-l1-2-1

api-ms-win-core-debug-l1-1-1

api-ms-win-core-handle-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-libraryloader-l1-2-2

api-ms-win-core-string-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-registry-l1-1-1

api-ms-win-core-path-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-file-l1-2-1

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-rtlsupport-l1-2-0

api-ms-win-core-version-l1-1-0

api-ms-win-core-apiquery-l1-1-0

ntdll

advapi32

imm32

kernel32

user32

gdi32

api-ms-win-core-delayload-l1-1-1

Exports

Exports

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.data Size: 2KB - Virtual size: 7KB

.idata Size: 19KB - Virtual size: 18KB

.didat Size: 3KB - Virtual size: 2KB

.rsrc Size: 2.5MB - Virtual size: 2.5MB

.reloc Size: 108KB - Virtual size: 108KB

.text
Size: 1.6MB - Virtual size: 1.6MB

.data
Size: 2KB - Virtual size: 7KB

.idata
Size: 19KB - Virtual size: 18KB

.didat
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 2.5MB - Virtual size: 2.5MB

.reloc
Size: 108KB - Virtual size: 108KB