c01644bf30569669b3ca4f7894f3d8be

Sharing

Copy URL

Twitter E-mail

General

Target

c01644bf30569669b3ca4f7894f3d8be
Size

407KB
MD5

c01644bf30569669b3ca4f7894f3d8be
SHA1

282ebb49b9762a0270be76c0b7d1b8406a0e9d1e
SHA256

cfffd9f4babb8f88516b887a0044422b2ddfd96e341067495c82180457a8129c
SHA512

7430787023237a1c25455d40cea7b418789032249ef22cd7487ec9956b8b48ba30a1d0ccae982a5f3541348c6a684a658bf39c9f768d60d7e3c5df4c0e86a44b
SSDEEP

12288:WHeQ+GvIIunqtkwHkGM24mLFuuCmJYxCIQKbfgwXz:lHGvP2qtVM21FuupIbfg8

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
c01644bf30569669b3ca4f7894f3d8be
unpack001//tbu09368/Search.dll
unpack001//tbu09368/tbhelper.dll

NSIS installer 1 IoCs

installer

resource	yara_rule
sample	nsis_installer_1

Files

c01644bf30569669b3ca4f7894f3d8be
.exe windows:4 windows x86 arch:x86

81c812ed76d4690c8678b3a4f0737a5f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

ImageList_Create
ord17
ImageList_AddMasked
ImageList_Destroy

kernel32

GetExitCodeProcess
WaitForSingleObject
ExpandEnvironmentStringsA
GetEnvironmentVariableA
lstrcmpiA
FindNextFileA
DeleteFileA
FindFirstFileA
SetFileTime
GetFileAttributesA
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
lstrcatA
SetCurrentDirectoryA
CreateDirectoryA
SetFileAttributesA
CreateFileA
GetFileSize
GetModuleFileNameA
GetTickCount
CopyFileA
SetErrorMode
lstrcpynA
GetCommandLineA
GetWindowsDirectoryA
GetTempPathA
GetUserDefaultLangID
GetDiskFreeSpaceA
GetVersion
GlobalUnlock
GlobalLock
GlobalAlloc
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
lstrcpyA
lstrlenA
GetSystemDirectoryA
EnterCriticalSection
Sleep
LeaveCriticalSection
InitializeCriticalSection
CloseHandle
GlobalFree
GetModuleHandleA
LoadLibraryA
CreateThread
GetProcAddress
FreeLibrary
MultiByteToWideChar
GetCurrentProcess
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
SetFilePointer
FindClose
MulDiv
ExitProcess

user32

CreateDialogParamA
DialogBoxParamA
GetClassInfoA
CreateWindowExA
SystemParametersInfoA
RegisterClassA
EndDialog
SetFocus
ScreenToClient
GetWindowRect
GetWindowLongA
SetClassLongA
IsWindowEnabled
SetWindowPos
LoadCursorA
SetCursor
GetDlgItemTextA
MapWindowPoints
GetMessagePos
LoadBitmapA
CallWindowProcA
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
MessageBoxA
CharPrevA
DestroyWindow
SetTimer
SetForegroundWindow
ShowWindow
CharNextA
wsprintfA
SendMessageTimeoutA
FindWindowExA
IsWindow
GetDlgItem
GetSysColor
SetWindowLongA
LoadImageA
GetDC
EnableWindow
PeekMessageA
DispatchMessageA
ExitWindowsEx
PostQuitMessage
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
GetWindowTextA
DrawTextA
EndPaint
InvalidateRect

gdi32

SetBkColor
GetDeviceCaps
CreateFontIndirectA
DeleteObject
CreateSolidBrush
CreateFontA
SetBkMode
SetTextColor
CreateBrushIndirect
SelectObject

advapi32

RegEnumValueA
RegEnumKeyA
RegQueryValueExA
RegSetValueExA
RegDeleteKeyA
RegOpenKeyExA
RegDeleteValueA
RegCreateKeyA
RegCloseKey

shell32

ShellExecuteA
SHBrowseForFolderA
SHGetPathFromIDListA
SHGetMalloc
SHGetSpecialFolderLocation
SHFileOperationA

ole32

OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 36KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
/tbu09368/Search.crc
/tbu09368/Search.dll
.dll regsvr32 windows:4 windows x86 arch:x86

05f99b258b54f01cfb01af03924b168d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\Projects\Work\Toolbar3\Release_bin\tbcore3U.pdb

Imports

wininet

FindNextUrlCacheEntryW
DeleteUrlCacheEntryW
FindCloseUrlCache
FindFirstUrlCacheEntryW

shlwapi

PathFileExistsW
PathFindExtensionW
PathRemoveFileSpecW

winmm

PlaySoundW

setupapi

SetupIterateCabinetW

dbghelp

SymGetModuleBase
SymGetSymFromAddr
StackWalk
SymFunctionTableAccess
SymGetLineFromAddr
SymSetOptions
SymGetOptions
SymCleanup
SymLoadModule
SymInitialize

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

kernel32

InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
SetLastError
GetLastError
OutputDebugStringA
LoadLibraryW
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetFileAttributesW
GetVersion
GetCurrentThreadId
RaiseException
InterlockedDecrement
InterlockedIncrement
lstrlenW
EnterCriticalSection
LeaveCriticalSection
HeapAlloc
GetProcessHeap
FlushInstructionCache
GetCurrentProcess
InitializeCriticalSection
DeleteCriticalSection
GetCurrentThread
CloseHandle
HeapFree
CreateDirectoryW
GetTempPathW
SetCurrentDirectoryW
LoadLibraryA
GlobalUnlock
GlobalLock
GlobalAlloc
DebugBreak
OutputDebugStringW
lstrlenA
lstrcmpW
lstrcpyW
MulDiv
IsBadCodePtr
SetUnhandledExceptionFilter
IsBadWritePtr
GetCurrentProcessId
lstrcpynW
FormatMessageW
IsBadReadPtr
GetVersionExW
CreateFileW
OpenProcess
MultiByteToWideChar
WideCharToMultiByte
WinExec
VerLanguageNameW
RemoveDirectoryW
MoveFileExW
DeleteFileW
WriteFile
CreateFileA
GetTempPathA
CopyFileW
MoveFileW
GetTempFileNameW
FreeLibrary
lstrcatW
FindFirstFileW
FindNextFileW
FindClose
GlobalFree
DisableThreadLibraryCalls
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
lstrcmpiW
Sleep
GetTickCount
MapViewOfFile
CreateFileMappingW
OpenFileMappingW
UnmapViewOfFile
TerminateProcess
ReadFile
TlsAlloc
GetModuleFileNameA
QueryPerformanceCounter
GetCommandLineA
GetSystemTimeAsFileTime
GetFullPathNameW
GetCurrentDirectoryW
SetEnvironmentVariableW
CreateThread
ResumeThread
ExitThread
HeapReAlloc
RtlUnwind
ExitProcess
GetVersionExA
LocalFree
LocalAlloc
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
SetStdHandle
FlushFileBuffers
GetDriveTypeA
GetCurrentDirectoryA
GetFullPathNameA
SetConsoleCtrlHandler
SetEndOfFile
GetLocaleInfoW
TlsFree
TlsSetValue
CompareStringA
CompareStringW
TlsGetValue
VirtualQuery
FatalAppExitA
HeapDestroy
SetEnvironmentVariableA
HeapCreate
ReadProcessMemory
VirtualAlloc
HeapSize
VirtualProtect
GetSystemInfo
LCMapStringA
LCMapStringW
UnhandledExceptionFilter
GetTimeZoneInformation
SetHandleCount
GetStdHandle
GetFileType
GetStringTypeA
GetStartupInfoA
SetFilePointer
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetCPInfo
VirtualFree

user32

GetAsyncKeyState
SetWindowRgn
InflateRect
IsWindowEnabled
SystemParametersInfoW
GetCapture
GetDlgCtrlID
AdjustWindowRectEx
GetMenu
DrawFocusRect
DrawEdge
DrawFrameControl
LoadBitmapW
GetCursorPos
PostMessageW
EndMenu
DrawTextW
CopyRect
KillTimer
UpdateWindow
LoadImageW
GetKeyState
SetWindowsHookExW
TrackPopupMenu
UnhookWindowsHookEx
CharLowerW
RegisterHotKey
UnregisterHotKey
GetSystemMetrics
DialogBoxIndirectParamW
wsprintfA
IsWindowVisible
CallNextHookEx
SetCursor
DestroyCursor
SetDlgItemTextW
IsDlgButtonChecked
CheckDlgButton
EndDialog
SetActiveWindow
MapWindowPoints
PtInRect
WindowFromDC
OffsetRect
GetMenuItemInfoW
CharUpperW
LoadMenuW
GetWindowRect
TranslateMessage
DispatchMessageW
GetSubMenu
DialogBoxParamW
GetActiveWindow
SetLastErrorEx
GetDlgItem
InvalidateRgn
SetCapture
ReleaseCapture
CreateAcceleratorTableW
GetDC
ReleaseDC
GetDesktopWindow
GetClassNameW
SetWindowPos
RedrawWindow
GetClientRect
BeginPaint
FillRect
EndPaint
IsChild
SetFocus
GetSysColor
DestroyAcceleratorTable
CallWindowProcW
CharNextW
wvsprintfW
GetWindowTextLengthW
GetWindowTextW
GetWindowLongW
DefWindowProcW
RegisterWindowMessageW
SetTimer
LoadCursorFromFileW
CharLowerBuffW
GetWindow
OpenClipboard
EmptyClipboard
CloseClipboard
MessageBoxW
UnregisterClassW
SetWindowLongW
RegisterClassExW
LoadCursorW
wsprintfW
GetClassInfoExW
LoadStringW
GetParent
ShowWindow
MoveWindow
SetWindowTextW
CreateWindowExW
SendMessageW
GetFocus
IsWindow
DestroyWindow
DestroyMenu
CreatePopupMenu
AppendMenuW
WindowFromPoint
ClientToScreen
InsertMenuW
PeekMessageW
EnableMenuItem
GetMessagePos
CharUpperBuffW
ScreenToClient
UnregisterClassA
InvalidateRect

gdi32

GetTextExtentPoint32W
SelectObject
ExtTextOutW
SetBkMode
CreateRectRgn
GetTextMetricsW
CreateBrushIndirect
CreateRectRgnIndirect
SetBkColor
SelectClipRgn
GetClipBox
RestoreDC
SaveDC
SetTextColor
GetTextExtentPointW
CreatePen
CreatePatternBrush
Rectangle
GetStockObject
GetObjectW
GetDeviceCaps
CreateSolidBrush
CreateCompatibleBitmap
CreateCompatibleDC
BitBlt
DeleteDC
DeleteObject
CreateFontW

shell32

SHAddToRecentDocs
SHEmptyRecycleBinW
ShellExecuteA
ShellExecuteW
DragQueryFileW
SHGetFolderPathW

ole32

ReleaseStgMedium
RegisterDragDrop
OleLockRunning
StringFromGUID2
CoTaskMemAlloc
CoUninitialize
CoInitialize
CoCreateInstance
OleUninitialize
CreateStreamOnHGlobal
OleInitialize
CoGetClassObject
CLSIDFromProgID
CLSIDFromString
CoTaskMemFree
CoTaskMemRealloc
CoCreateGuid
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream

oleaut32

SysAllocString
SysFreeString
SysStringLen
VarBstrCmp
SysAllocStringByteLen
VariantInit
SysStringByteLen
VariantClear
SysAllocStringLen
OleCreateFontIndirect
LoadRegTypeLi
LoadTypeLi
UnRegisterTypeLi
SafeArrayDestroy
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreateVector
DispCallFunc
VarUI4FromStr
RegisterTypeLi
SafeArrayPutElement
SafeArrayCreate
VariantCopy
VariantChangeType
VarBstrCat
GetErrorInfo
SetErrorInfo
CreateErrorInfo

Exports

Exports

CanReload
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
TBStudioReg

Sections

.text
Size: 948KB - Virtual size: 947KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 184KB - Virtual size: 182KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.SHARED
Size: 204KB - Virtual size: 202KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 48KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/tbu09368/basis.xml
/tbu09368/favicon.ico
/tbu09368/icons.bmp
/tbu09368/tbhelper.dll
.dll regsvr32 windows:4 windows x86 arch:x86

9aa8d2682457d4ed4a3c14687d6304c3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\Projects\Work\Toolbar3\Release_bin\tbhelperU.pdb

Imports

shlwapi

PathFindExtensionW
PathFileExistsW

wininet

InternetOpenW
InternetCloseHandle
HttpQueryInfoW
InternetOpenUrlW
InternetReadFile

rpcrt4

UuidFromStringA

urlmon

URLDownloadToFileW

kernel32

VirtualProtect
SetEndOfFile
SetConsoleCtrlHandler
Sleep
CreateThread
CloseHandle
TerminateThread
WriteFile
CreateFileW
GetLastError
DeleteFileW
InterlockedIncrement
InterlockedDecrement
lstrlenW
InitializeCriticalSection
DeleteCriticalSection
RaiseException
MultiByteToWideChar
lstrlenA
GetVersionExW
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetSystemInfo
EnterCriticalSection
LeaveCriticalSection
GetModuleHandleW
GetModuleFileNameW
lstrcpyW
FreeLibrary
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
lstrcmpiW
lstrcpynW
lstrcatW
GlobalUnlock
GlobalLock
GetStringTypeW
GetStringTypeA
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
LCMapStringW
GetTimeZoneInformation
GetLocaleInfoW
CompareStringA
CompareStringW
SetEnvironmentVariableA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
DisableThreadLibraryCalls
WideCharToMultiByte
LCMapStringA
LoadLibraryA
FlushFileBuffers
SetStdHandle
GetCPInfo
GetOEMCP
IsBadCodePtr
IsBadReadPtr
UnhandledExceptionFilter
GetEnvironmentStringsW
SetFilePointer
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
ReadFile
VirtualQuery
HeapSize
GetCurrentProcess
TerminateProcess
SetUnhandledExceptionFilter
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
LocalFree
GetVersionExA
RtlUnwind
ExitProcess
HeapReAlloc
HeapAlloc
HeapFree
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCommandLineA
TlsAlloc
SetLastError
GetCurrentThread
TlsFree
TlsSetValue
TlsGetValue
GetProcAddress
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetModuleFileNameA
FatalAppExitA
HeapDestroy

user32

UnregisterClassA
LoadStringW
UnregisterClassW
CharNextW
SendMessageW
CharLowerBuffW
OpenClipboard
GetClipboardData
CloseClipboard

advapi32

RegSetValueExW
RegEnumKeyExW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegQueryInfoKeyW

ole32

CoTaskMemFree
StringFromGUID2
CoGetInterfaceAndReleaseStream
CoUninitialize
CoCreateInstance
CLSIDFromProgID
CoInitialize
CoTaskMemRealloc
CoTaskMemAlloc

oleaut32

VariantCopy
VarBstrCmp
UnRegisterTypeLi
RegisterTypeLi
SysStringLen
LoadTypeLi
LoadRegTypeLi
VarUI4FromStr
CreateErrorInfo
SysFreeString
VariantClear
SysStringByteLen
SysAllocStringByteLen
SysAllocString
GetErrorInfo
VariantChangeType
SetErrorInfo
VariantInit

Exports

Exports

CreateHelperObject
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IsUnicode

Sections

.text
Size: 140KB - Virtual size: 139KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.SHARED
Size: 4KB - Virtual size: 3B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/tbu09368/version.txt

Sharing

General

Malware Config

Signatures

Files

81c812ed76d4690c8678b3a4f0737a5f

Headers

File Characteristics

Imports

comctl32

kernel32

user32

gdi32

advapi32

shell32

ole32

version

Sections

.text Size: 23KB - Virtual size: 23KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 108KB

.ndata Size: - Virtual size: 36KB

.rsrc Size: 3KB - Virtual size: 4KB

05f99b258b54f01cfb01af03924b168d

Headers

File Characteristics

PDB Paths

Imports

wininet

shlwapi

winmm

setupapi

dbghelp

version

kernel32

user32

gdi32

shell32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 948KB - Virtual size: 947KB

.rdata Size: 184KB - Virtual size: 182KB

.data Size: 20KB - Virtual size: 30KB

.SHARED Size: 204KB - Virtual size: 202KB

.rsrc Size: 20KB - Virtual size: 16KB

.reloc Size: 48KB - Virtual size: 44KB

9aa8d2682457d4ed4a3c14687d6304c3

Headers

File Characteristics

PDB Paths

Imports

shlwapi

wininet

rpcrt4

urlmon

kernel32

user32

advapi32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 140KB - Virtual size: 139KB

.rdata Size: 44KB - Virtual size: 43KB

.data Size: 8KB - Virtual size: 18KB

.SHARED Size: 4KB - Virtual size: 3B

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 23KB - Virtual size: 23KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 108KB

.ndata
Size: - Virtual size: 36KB

.rsrc
Size: 3KB - Virtual size: 4KB

.text
Size: 948KB - Virtual size: 947KB

.rdata
Size: 184KB - Virtual size: 182KB

.data
Size: 20KB - Virtual size: 30KB

.SHARED
Size: 204KB - Virtual size: 202KB

.rsrc
Size: 20KB - Virtual size: 16KB

.reloc
Size: 48KB - Virtual size: 44KB

.text
Size: 140KB - Virtual size: 139KB

.rdata
Size: 44KB - Virtual size: 43KB

.data
Size: 8KB - Virtual size: 18KB

.SHARED
Size: 4KB - Virtual size: 3B

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 8KB - Virtual size: 7KB