explorerpp_x64[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

explorerpp_x64.zip
Size

2.3MB
MD5

3d04d9c0d66257c6d1ea5c1f4d0b8aba
SHA1

dad3e69dd4c87cdd18aee4ef21ab5a00725ce271
SHA256

81ec54586dfef888b886d409afa22e31f22d4f6ba35d52d93074b4ee64b79b0c
SHA512

bd5041ec38a50706d4c867a68a850b043e94a7476170229a04ead807f822940db1451e03b886b93672a204152fa8f916583dbdabe9ed755e69557611d1eb97f6
SSDEEP

49152:qQDY60kKxW/x3VKPMNJAHwD/ExtbF/ugidzQuKsiXcKZYh3y:qg3R8aAQD/EogidzfFKf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Explorer++.exe

Files

explorerpp_x64.zip
.zip

Password: infected
Explorer++ Help.chm
.chm
Explorer++.exe
.exe windows:6 windows x64 arch:x64

Password: infected

7245ecd0af9173a7d1554090b7612e51

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\projects\explorerplusplus\Explorer++\Explorer++\x64\Release\Explorer++.pdb

Imports

shell32

SHCreateShellItemArrayFromIDLists
SHFileOperationW
SHGetFolderPathW
SHGetPathFromIDListW
ord19
SHBindToParent
ord152
SHGetIDListFromObject
ShellExecuteExW
ord4
ord23
SHGetDesktopFolder
ord727
SHGetKnownFolderIDList
SHCreateItemFromIDList
ord25
ord16
SHGetSpecialFolderPathW
SHFreeNameMappings
SHCreateItemFromParsingName
SHBrowseForFolderW
ord17
ord18
ord2
SHGetFolderLocation
DragQueryFileW
SHParseDisplayName
SHGetFileInfoW
ord71
ShellExecuteW

gdiplus

GdipCreateBitmapFromStream
GdipGetPropertyItem
GdipAlloc
GdipGetPropertyItemSize
GdipFree
GdipCloneImage
GdipDrawLineI
GdipDeletePen
GdipCreatePen1
GdipFillRectangleI
GdipGetPathGradientPointCount
GdipSetPathGradientSurroundColorsWithCount
GdipSetPathGradientCenterColor
GdipSetPathGradientCenterPointI
GdipCloneBrush
GdipDeleteBrush
GdipCreatePathGradientFromPath
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipGetImageHorizontalResolution
GdipGetImageVerticalResolution
GdipDisposeImage
GdipCreateHBITMAPFromBitmap
GdipCreateHICONFromBitmap
GdipBitmapSetResolution
GdipGetImageGraphicsContext
GdipDeleteGraphics
GdipScaleWorldTransform
GdipDrawImageI
GdipAddPathRectangleI
GdipDeletePath
GdipCreatePath
GdipCreateFromHDC
GdiplusStartup
GdiplusShutdown
GdipCreateBitmapFromScan0
GdipLoadImageFromFile

shlwapi

PathRemoveBackslashW
StrCmpW
StrChrW
StrRetToBufW
PathIsDirectoryW
PathIsUNCW
PathIsSameRootW
PathStripToRootW
PathRemoveBlanksW
ord219
PathRenameExtensionW
PathCombineW
StrCmpLogicalW
PathFindExtensionW
SHAutoComplete
PathStripPathW
PathRemoveExtensionW
SHDeleteKeyW
PathIsRootW
StrCmpIW
PathRemoveFileSpecW
PathCanonicalizeW
PathIsURLW
PathIsRelativeW
PathAppendW

mpr

WNetGetUniversalNameW

uxtheme

GetBufferedPaintBits
EndBufferedPaint
SetWindowTheme
BeginBufferedPaint

winmm

PlaySoundW

urlmon

URLDownloadToFileW

wininet

DeleteUrlCacheEntryW

propsys

VariantCompare

dwmapi

DwmSetIconicLivePreviewBitmap
DwmSetWindowAttribute
DwmSetIconicThumbnail
DwmInvalidateIconicBitmaps

kernel32

GetEnvironmentStringsW
GetOEMCP
GetACP
CreatePipe
GetExitCodeProcess
HeapReAlloc
GetTimeZoneInformation
SetStdHandle
GetConsoleMode
GetConsoleOutputCP
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetFileType
ExitProcess
CreateProcessW
DuplicateHandle
FreeLibraryAndExitThread
FreeEnvironmentStringsW
GetCommandLineA
LoadLibraryExW
RtlUnwind
InterlockedPushEntrySList
RtlUnwindEx
GetCurrencyFormatW
FoldStringW
EnumSystemLocalesA
HeapSize
WriteConsoleW
IsDBCSLeadByteEx
IsValidCodePage
GetLocaleInfoA
GetStartupInfoW
InitializeSListHead
InitializeCriticalSectionAndSpinCount
IsProcessorFeaturePresent
TerminateProcess
GetCommandLineW
SetEnvironmentVariableW
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
ReadConsoleW
GetModuleHandleW
GetLastError
SetLastError
FreeLibrary
CloseHandle
OutputDebugStringW
GetCurrentThreadId
FormatMessageW
IsDebuggerPresent
WaitForSingleObject
ReleaseSemaphore
OpenSemaphoreW
HeapFree
GetProcessHeap
HeapAlloc
DeactivateActCtx
LoadLibraryW
GetProcAddress
ActivateActCtx
FindActCtxSectionStringW
CreateActCtxW
GetModuleFileNameW
GetModuleHandleExW
QueryActCtxW
OutputDebugStringA
GlobalAlloc
GlobalLock
GlobalUnlock
GetCurrentProcessId
CreateMutexExW
ReleaseMutex
CreateSemaphoreExW
WaitForSingleObjectEx
LeaveCriticalSection
EnterCriticalSection
LocalFree
LocalAlloc
lstrcmpiW
lstrlenW
GetFileAttributesW
CreateMutexW
AttachConsole
FreeConsole
GetStdHandle
GetFileAttributesExW
GetComputerNameW
MultiByteToWideChar
GlobalMemoryStatusEx
CreateThread
GetDiskFreeSpaceExW
GetVolumeInformationW
GetLogicalDriveStringsW
InitializeCriticalSection
DeleteCriticalSection
lstrcmpW
CompareStringW
MulDiv
ReleaseSRWLockShared
AcquireSRWLockShared
InitializeSRWLock
OpenProcess
K32GetModuleFileNameExW
GetUserDefaultUILanguage
FindFirstFileW
FindNextFileW
FindClose
CreateEventA
WideCharToMultiByte
FormatMessageA
GetSystemTimeAsFileTime
SetEvent
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
SetThreadPriority
CreateFileW
GetFileSizeEx
ReadFile
WriteFile
GetLocaleInfoW
SetFileAttributesW
SetFileTime
GetModuleFileNameA
DebugBreak
SetCurrentDirectoryW
GetCurrentDirectoryW
GetDriveTypeW
GetTempPathW
GetTempFileNameW
DeleteFileW
GetLocalTime
GetCurrentProcess
SetUnhandledExceptionFilter
GlobalFree
CompareFileTime
GetCurrentThread
SystemTimeToFileTime
RtlCaptureContext
OpenEventA
ResetEvent
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetLocaleInfoEx
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
QueryPerformanceFrequency
QueryPerformanceCounter
GetCPInfo
CompareStringEx
LCMapStringEx
DecodePointer
EncodePointer
GetExitCodeThread
SleepConditionVariableSRW
SleepConditionVariableCS
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
TryEnterCriticalSection
InitializeCriticalSectionEx
RaiseException
RtlPcToFileHeader
GetFileInformationByHandleEx
MoveFileExW
DeviceIoControl
AreFileApisANSI
FindFirstFileExW
CreateDirectoryW
GetStringTypeW
LoadLibraryExA
FileTimeToSystemTime
TzSpecificLocalTimeToSystemTime
CancelIo
ReadDirectoryChangesW
ExitThread
SleepEx
SetErrorMode
QueueUserAPC
CreateEventW
LockResource
LoadResource
SizeofResource
FindResourceW
GlobalSize
GetDiskFreeSpaceW
FlushFileBuffers
SetFilePointer
SetEndOfFile
SetFilePointerEx
CreateHardLinkW
LocalFileTimeToFileTime
LCMapStringW
GetUserDefaultLangID
GetFileInformationByHandle
GetTimeFormatW
SystemTimeToTzSpecificLocalTime
GetDateFormatW

user32

SetRect
UnregisterDeviceNotification
RegisterDeviceNotificationW
DialogBoxParamW
CreateDialogParamW
GetKeyState
CheckMenuItem
EnableMenuItem
SystemParametersInfoW
OpenClipboard
DrawTextW
DrawIconEx
CloseClipboard
GetClipboardData
RedrawWindow
SetClipboardData
GetUpdateRect
EmptyClipboard
EndMenu
InflateRect
DispatchMessageW
TranslateMessage
TranslateAcceleratorW
IsDialogMessageW
GetMessageW
UpdateWindow
LoadAcceleratorsW
GetSystemMetrics
PrintWindow
IsWindowVisible
GetMenuBarInfo
IsIconic
UnregisterClassW
RegisterClassExW
ChangeWindowMessageFilter
RegisterWindowMessageW
GetIconInfo
GetWindowPlacement
GetCursorPos
DestroyWindow
ChangeClipboardChain
MoveWindow
PostMessageW
IntersectRect
KillTimer
PostQuitMessage
CreateMenu
MapWindowPoints
GetComboBoxInfo
ReleaseDC
GetDC
GetKeyNameTextW
MapVirtualKeyW
GetMenuItemInfoW
GetMenuItemID
GetMenuItemCount
SetMenuItemInfoW
GetMenu
SetMenu
DeleteMenu
SetTimer
SetClipboardViewer
ReleaseCapture
SetCapture
SetCursor
EndPaint
GetWindowTextW
BeginPaint
DefWindowProcW
SetWindowLongPtrW
GetWindowLongPtrW
CreateWindowExW
RegisterClassW
GetSysColorBrush
LoadCursorW
IsClipboardFormatAvailable
FindWindowExW
WindowFromPoint
GetMessagePos
GetFocus
GetDlgItemInt
SetWindowPos
GetWindowRect
SetDlgItemInt
LoadStringW
SetClassLongPtrW
LoadIconW
ShowWindow
SetForegroundWindow
FindWindowW
FillRect
GetClientRect
InvalidateRect
DestroyMenu
SetWindowPlacement
CreatePopupMenu
ScreenToClient
IsDlgButtonChecked
GetDlgItemTextW
GetWindowTextLengthW
SetFocus
CheckDlgButton
GetDlgItem
EnableWindow
SetWindowTextW
InsertMenuItemW
MessageBoxW
TrackPopupMenu
ClientToScreen
LoadMenuW
GetSubMenu
RegisterClipboardFormatW
DestroyAcceleratorTable
CreateAcceleratorTableW
CopyAcceleratorTableW
DestroyIcon
EndDialog
GetParent
SetDlgItemTextW
SendDlgItemMessageW
SendMessageW
LoadImageW
GetWindowLongW
PtInRect
CheckMenuRadioItem

gdi32

CreateSolidBrush
DeleteDC
SetBkMode
GetStockObject
CreateFontW
GetObjectW
CreateFontIndirectW
DeleteObject
TextOutW
GetTextExtentPoint32W
SetBitmapDimensionEx
GetBitmapDimensionEx
CreateCompatibleDC
SetStretchBltMode
SetBrushOrgEx
StretchBlt
SelectObject
SetTextColor
GetDIBits
CreateDIBSection
GetDeviceCaps
CreateCompatibleBitmap
BitBlt

winspool.drv

GetPrinterW
OpenPrinterW
ClosePrinter

advapi32

OpenProcessToken
RegEnumKeyExW
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW
CryptGenRandom
CryptAcquireContextW
FreeSid
GetSecurityInfo
LookupAccountSidW
ConvertSidToStringSidW
AllocateAndInitializeSid
CheckTokenMembership
GetTokenInformation

ole32

RegisterDragDrop
RevokeDragDrop
ReleaseStgMedium
OleGetClipboard
OleIsCurrentClipboard
OleFlushClipboard
CoTaskMemAlloc
OleUninitialize
DoDragDrop
PropVariantClear
CoCreateGuid
StringFromGUID2
OleDuplicateData
OleSetClipboard
StgCreateStorageEx
OleInitialize
CoInitializeEx
CoUninitialize
CLSIDFromString
CoCreateInstance
CreateStreamOnHGlobal
CoTaskMemFree

oleaut32

VariantClear
VariantInit
SysFreeString
SafeArrayGetElement
SafeArrayGetUBound
VariantChangeType
VariantTimeToSystemTime
SafeArrayGetDim
SafeArrayGetLBound
SysAllocString

iphlpapi

GetAdaptersAddresses

userenv

ExpandEnvironmentStringsForUserW

comctl32

ImageList_GetIcon
ImageList_ReplaceIcon
ord410
ord412
ord413

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

comdlg32

GetSaveFileNameW

Exports

Exports

?$TSS0@?1??create@?$StaticObject@UPolymorphicCasters@detail@cereal@@@detail@cereal@@CAAEAUPolymorphicCasters@34@XZ@4HA
??4?$StaticObject@UPolymorphicCasters@detail@cereal@@@detail@cereal@@QEAAAEAV012@AEBV012@@Z
?create@?$StaticObject@UPolymorphicCasters@detail@cereal@@@detail@cereal@@CAAEAUPolymorphicCasters@23@XZ
?getInstance@?$StaticObject@UPolymorphicCasters@detail@cereal@@@detail@cereal@@SAAEAUPolymorphicCasters@23@XZ
?instance@?$StaticObject@UPolymorphicCasters@detail@cereal@@@detail@cereal@@0AEAUPolymorphicCasters@23@EA
?t@?1??create@?$StaticObject@UPolymorphicCasters@detail@cereal@@@detail@cereal@@CAAEAUPolymorphicCasters@34@XZ@4U534@A

Sections

.text
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 623KB - Virtual size: 623KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 126KB - Virtual size: 173KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 119KB - Virtual size: 119KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 358KB - Virtual size: 358KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
History.txt
License.txt
Readme.txt

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

7245ecd0af9173a7d1554090b7612e51

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

shell32

gdiplus

shlwapi

mpr

uxtheme

winmm

urlmon

wininet

propsys

dwmapi

kernel32

user32

gdi32

winspool.drv

advapi32

ole32

oleaut32

iphlpapi

userenv

comctl32

version

comdlg32

Exports

Exports

Sections

.text Size: 2.7MB - Virtual size: 2.7MB

.rdata Size: 623KB - Virtual size: 623KB

.data Size: 126KB - Virtual size: 173KB

.pdata Size: 119KB - Virtual size: 119KB

_RDATA Size: 512B - Virtual size: 244B

.rsrc Size: 358KB - Virtual size: 358KB

.reloc Size: 19KB - Virtual size: 18KB

.text
Size: 2.7MB - Virtual size: 2.7MB

.rdata
Size: 623KB - Virtual size: 623KB

.data
Size: 126KB - Virtual size: 173KB

.pdata
Size: 119KB - Virtual size: 119KB

_RDATA
Size: 512B - Virtual size: 244B

.rsrc
Size: 358KB - Virtual size: 358KB

.reloc
Size: 19KB - Virtual size: 18KB