265252cf91670abcdb2daab478eedacb_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

265252cf91670abcdb2daab478eedacb_JaffaCakes118
Size

1.0MB
MD5

265252cf91670abcdb2daab478eedacb
SHA1

a785d20bb38f9eb3da1bb0baf95474dc571f8714
SHA256

7b31fa24f80bd98191fbca6e176885636706c4601519729e977f6a857c7c4dcd
SHA512

e340758812a5d0f966edbb18084562bbdbb3aefc3fa25ad5d5a1c77c2626bdbafc693b7434f4a22fc39ef6f800d47ee3605bae269381bee756a52d0296dcc99c
SSDEEP

24576:JLHZE4rK5WjtLbe47viFBs2cOb6uFyc3vRUaOW:V3OWhLbfrEOOxFtCa1

Score

3^/10

Malware Config

Signatures

Unsigned PE 6 IoCs

Checks for missing Authenticode signature.

resource
265252cf91670abcdb2daab478eedacb_JaffaCakes118
unpack001/tbu04815/Money-Booster-skinnyV1.0.7_1012.dll
unpack001/tbu04815/tbcore3.dll
unpack001/tbu04815/tbhelper.dll
unpack001/tbu04815/uninstall.exe
unpack001/tbu04815/update.exe

NSIS installer 1 IoCs

installer

resource	yara_rule
sample	nsis_installer_1

Files

265252cf91670abcdb2daab478eedacb_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a23455b2d570c1e80b11b92360e41c00

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetFileSize
GetModuleFileNameA
GetTickCount
GetCurrentProcess
CopyFileA
ExitProcess
GetWindowsDirectoryA
SetFileTime
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetTempPathA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
CreateDialogParamA
DestroyWindow
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 40KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
tbu04815/Money-Booster-skinnyV1.0.7_1012.dll
.dll regsvr32 windows:5 windows x86 arch:x86

32af71368cbdf173ab04d242843ebffe

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Users\Artem\Documents\Visual Studio 2008\Projects\update_crutch\Release\update_crutch.pdb

Imports

shell32

ShellExecuteW

kernel32

GetTickCount
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetLastError
InterlockedDecrement
HeapFree
Sleep
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
VirtualAlloc
HeapReAlloc
WriteFile
LoadLibraryA
InitializeCriticalSectionAndSpinCount
RtlUnwind
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
HeapSize

Exports

Exports

DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
tbu04815/Thumbs.db
tbu04815/about.gif
.gif
tbu04815/affid.dat
tbu04815/arrow_refresh.png
.png
tbu04815/basis.xml
.xml
tbu04815/business.gif
.gif
tbu04815/cog.png
.png
tbu04815/computer_delete.png
.png
tbu04815/dictionary.gif
.gif
tbu04815/downloads.gif
.gif
tbu04815/facebook18.png
.png
tbu04815/facebook_25.png
.png
tbu04815/feedback.gif
.gif
tbu04815/fun.gif
.gif
tbu04815/games.gif
.gif
tbu04815/help.gif
.gif
tbu04815/home.gif
.gif
tbu04815/ico_gadgets.png
.png
tbu04815/ico_goodies.png
.png
tbu04815/ico_smartwallet.png
.png
tbu04815/icons.bmp
tbu04815/icons_old.bmp
tbu04815/info.txt
tbu04815/inspiration.gif
.gif
tbu04815/lock_ok.gif
.gif
tbu04815/money.gif
.gif
tbu04815/money_booster.png
.png
tbu04815/movies.gif
.gif
tbu04815/music.gif
.gif
tbu04815/refresh.gif
.gif
tbu04815/script.html
.html .js polyglot
tbu04815/shopping.gif
.gif
tbu04815/smartwallet.png
.png
tbu04815/software.gif
.gif
tbu04815/starpulse_25.png
.png
tbu04815/tbcore3.dll
.dll regsvr32 windows:5 windows x86 arch:x86

972c855c505004207a9c52c09d786c00

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\projects\toolbar\toolbar4\Release_bin\tbcore3U.pdb

Imports

wininet

InternetCloseHandle
InternetWriteFile
FtpOpenFileW
FindCloseUrlCache
InternetOpenW
FindNextUrlCacheEntryW
FindFirstUrlCacheEntryW
FtpSetCurrentDirectoryW
InternetConnectW
FtpCreateDirectoryW
DeleteUrlCacheEntryW

shlwapi

PathFileExistsW
PathRemoveFileSpecW

rpcrt4

UuidCreate
UuidToStringW
RpcStringFreeW

winmm

PlaySoundW

dbghelp

SymSetOptions
SymGetSymFromAddr
SymGetModuleBase
SymGetLineFromAddr
SymFunctionTableAccess
StackWalk
MiniDumpWriteDump
SymInitialize
SymLoadModule
SymCleanup
SymGetOptions

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

iphlpapi

GetAdaptersInfo

kernel32

GetProcAddress
GetFileAttributesW
GetVersion
GetCurrentThreadId
RaiseException
FlushInstructionCache
GetCurrentProcess
FindResourceW
SizeofResource
LockResource
LoadResource
FindResourceExW
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
lstrlenW
LoadLibraryA
IsBadCodePtr
HeapFree
GetProcessHeap
SetUnhandledExceptionFilter
HeapAlloc
IsBadWritePtr
GetCurrentProcessId
lstrcpynW
lstrlenA
FormatMessageW
IsBadReadPtr
ReadProcessMemory
GetCurrentThread
GetVersionExW
CreateFileW
CloseHandle
OpenProcess
WideCharToMultiByte
OpenMutexW
InitializeCriticalSection
DeleteCriticalSection
FreeLibrary
LoadLibraryExW
lstrcmpiW
InterlockedIncrement
WaitForSingleObject
SetEvent
CreateEventW
ResumeThread
ResetEvent
GlobalUnlock
GlobalLock
TerminateThread
CreateThread
CopyFileW
VerLanguageNameW
ReadFile
GetFileSize
DeleteFileW
RemoveDirectoryW
WriteFile
GetTempPathW
MoveFileW
CreateDirectoryW
GetModuleFileNameW
TerminateProcess
Process32NextW
GetModuleHandleW
Module32FirstW
Process32FirstW
CreateToolhelp32Snapshot
GetFullPathNameW
FindFirstFileW
FindNextFileW
FindClose
GlobalFree
GlobalReAlloc
GlobalAlloc
lstrcmpW
MulDiv
WriteProcessMemory
DisableThreadLibraryCalls
lstrcpyW
lstrcatW
MoveFileExW
ReleaseMutex
CreateMutexW
GetUserDefaultLangID
Sleep
MapViewOfFile
CreateFileMappingW
OpenFileMappingW
UnmapViewOfFile
LocalFree
LocalAlloc
FileTimeToSystemTime
SetFilePointer
GetFileInformationByHandle
SystemTimeToFileTime
GetLocalTime
GetTickCount
SetCurrentDirectoryW
GlobalSize
IsProcessorFeaturePresent
InterlockedCompareExchange
InterlockedExchange
UnhandledExceptionFilter
IsDebuggerPresent
ExitProcess
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetConsoleCP
GetConsoleMode
SetHandleCount
GetFileType
GetStartupInfoA
FlushFileBuffers
FatalAppExitA
HeapCreate
GetCPInfo
GetACP
GetOEMCP
LoadLibraryW
OutputDebugStringA
GetLastError
SetLastError
InterlockedDecrement
Module32NextW
GetModuleHandleA
IsValidCodePage
LCMapStringW
GetTimeZoneInformation
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
SetConsoleCtrlHandler
InitializeCriticalSectionAndSpinCount
GetLocaleInfoW
GetLocaleInfoA
GetSystemTimeAsFileTime
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
LCMapStringA
GetStringTypeA
VirtualFree
VirtualAlloc
HeapDestroy
HeapReAlloc
HeapSize
RtlUnwind
ExitThread
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
CompareStringA
CompareStringW
SetEnvironmentVariableA
SetEndOfFile
CreateFileA
GetLongPathNameW
GetCommandLineA

user32

CloseClipboard
EmptyClipboard
OpenClipboard
CharLowerBuffW
DialogBoxIndirectParamW
GetIconInfo
UnregisterClassA
EnumChildWindows
GetWindow
MonitorFromWindow
GetMonitorInfoW
EndDialog
GetActiveWindow
EnableWindow
DrawEdge
DrawFocusRect
FillRect
EndPaint
BeginPaint
SetWindowPos
GetMenu
AdjustWindowRectEx
GetDlgCtrlID
SetCapture
IsWindowEnabled
KillTimer
SetTimer
UpdateWindow
PtInRect
ReleaseCapture
GetCapture
SystemParametersInfoW
InflateRect
SetFocus
SetActiveWindow
GetWindowTextW
GetAsyncKeyState
TranslateMessage
DispatchMessageW
InvalidateRect
CharUpperBuffW
MessageBoxW
CharNextW
SetLastErrorEx
wsprintfW
IsChild
GetDlgItem
GetMessagePos
MapWindowPoints
ReleaseDC
GetWindowDC
GetWindowThreadProcessId
SetWindowsHookExW
WindowFromDC
OffsetRect
GetMenuItemInfoW
UnhookWindowsHookEx
LoadMenuIndirectW
LoadMenuW
GetClientRect
GetWindowLongW
DefWindowProcW
CallWindowProcW
PostMessageW
SetWindowLongW
RegisterClassExW
LoadCursorW
GetClassInfoExW
GetParent
ShowWindow
MoveWindow
SetWindowTextW
CreateWindowExW
SendMessageW
GetFocus
IsWindow
DestroyWindow
DestroyMenu
CreatePopupMenu
GetSubMenu
InsertMenuW
InsertMenuItemW
SetMenuItemBitmaps
TrackPopupMenu
EnableMenuItem
LoadCursorFromFileW
LoadImageW
SetWindowRgn
DrawFrameControl
LoadBitmapW
GetCursorPos
EndMenu
DrawTextW
CopyRect
InvalidateRgn
ScreenToClient
CreateAcceleratorTableW
GetDesktopWindow
RedrawWindow
GetSysColor
DestroyAcceleratorTable
RegisterWindowMessageW
UnregisterClassW
GetDC
GetKeyState
GetSysColorBrush
DialogBoxParamW
GetClassNameW
AppendMenuW
WindowFromPoint
ClientToScreen
IsWindowVisible
CallNextHookEx
SetCursor
DestroyCursor
SetDlgItemTextW
GetWindowRect
MessageBeep
GetSystemMetrics
GetWindowTextLengthW

gdi32

GetTextExtentPoint32W
ExtTextOutW
CreateFontW
DeleteObject
FrameRgn
CreateSolidBrush
CreateRectRgnIndirect
GetStockObject
DeleteDC
BitBlt
CreateCompatibleDC
Rectangle
CreatePatternBrush
CreatePen
GetTextExtentPointW
GetTextMetricsW
CreateCompatibleBitmap
GetDeviceCaps
GetObjectW
SetBkMode
SetTextColor
SaveDC
RestoreDC
GetClipBox
SelectClipRgn
SetBkColor
CombineRgn
CreateBrushIndirect
CreateRectRgn
PatBlt
SetBrushOrgEx
CreateDIBPatternBrushPt
CreateDIBSection
GetDIBits
RealizePalette
SetDIBitsToDevice
SetStretchBltMode
ExtSelectClipRgn
StretchBlt
CreateBitmap
RectVisible
StretchDIBits
CreateFontIndirectW
SelectObject

shell32

SHCreateDirectoryExW
ShellExecuteW
SHEmptyRecycleBinW
SHAddToRecentDocs
DragQueryFileW
SHLoadInProc
DoEnvironmentSubstW

ole32

CoTaskMemAlloc
CoCreateInstance
CoTaskMemFree
CoTaskMemRealloc
RegisterDragDrop
ReleaseStgMedium
CoUninitialize
CoInitialize
OleUninitialize
CreateStreamOnHGlobal
OleInitialize
CoGetClassObject
CLSIDFromProgID
CLSIDFromString
StringFromGUID2
OleLockRunning
CoCreateGuid
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream

oleaut32

SafeArrayDestroy
SysFreeString
DispCallFunc
VariantInit
VariantClear
LoadRegTypeLi
CreateErrorInfo
SetErrorInfo
GetErrorInfo
VarBstrCat
VariantChangeType
SafeArrayCreate
SafeArrayPutElement
SysStringByteLen
UnRegisterTypeLi
RegisterTypeLi
SysAllocStringByteLen
SafeArrayCreateVector
SafeArrayAccessData
SafeArrayUnaccessData
LoadTypeLi
OleCreateFontIndirect
SysAllocStringLen
VariantCopy
VarBstrCmp
VarUI4FromStr
SysStringLen
SysAllocString

Exports

Exports

??0CxFile@@QAE@ABV0@@Z
??0CxFile@@QAE@XZ
??0CxIOFile@@QAE@ABV0@@Z
??0CxIOFile@@QAE@PAU_iobuf@@@Z
??0CxMemFile@@QAE@ABV0@@Z
??1CxFile@@UAE@XZ
??1CxIOFile@@UAE@XZ
??1CxImage@@UAE@XZ
??4CxFile@@QAEAAV0@ABV0@@Z
??4CxIOFile@@QAEAAV0@ABV0@@Z
??4CxMemFile@@QAEAAV0@ABV0@@Z
??_7CxFile@@6B@
??_7CxIOFile@@6B@
??_7CxImage@@6B@
??_7CxMemFile@@6B@
??_FCxIOFile@@QAEXXZ
??_FCxImage@@QAEXXZ
??_FCxMemFile@@QAEXXZ
??_OCxImage@@QAEXAAV0@@Z
?Close@CxIOFile@@UAE_NXZ
?Eof@CxIOFile@@UAE_NXZ
?Error@CxIOFile@@UAEJXZ
?Flush@CxIOFile@@UAE_NXZ
?GetC@CxIOFile@@UAEJXZ
?GetS@CxIOFile@@UAEPADPADH@Z
?Open@CxIOFile@@QAE_NPB_W0@Z
?PutC@CxFile@@UAE_NE@Z
?PutC@CxIOFile@@UAE_NE@Z
?Read@CxIOFile@@UAEIPAXII@Z
?Scanf@CxIOFile@@UAEJPBDPAX@Z
?Seek@CxIOFile@@UAE_NJH@Z
?Size@CxIOFile@@UAEJXZ
?Tell@CxIOFile@@UAEJXZ
?Write@CxIOFile@@UAEIPBXII@Z
CanReload
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetUpdaterAPI
MyUnregisterServer
TBStudioReg

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 429KB - Virtual size: 429KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.SHARED
Size: 253KB - Virtual size: 253KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 74KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
tbu04815/tbhelper.dll
.dll regsvr32 windows:5 windows x86 arch:x86

976dea5a19b78b2c6236d00ae0642caf

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\projects\toolbar\toolbar4\Release_bin\tbhelperU.pdb

Imports

wininet

HttpAddRequestHeadersW
InternetSetOptionW
InternetQueryOptionW
InternetCloseHandle
HttpSendRequestW
HttpQueryInfoW
InternetReadFile
FtpOpenFileW
FtpGetFileSize
InternetQueryDataAvailable
HttpOpenRequestW
InternetOpenW
InternetConnectW

rpcrt4

UuidFromStringA

kernel32

WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
InterlockedExchange
IsValidLocale
EnumSystemLocalesA
MultiByteToWideChar
InterlockedDecrement
FindResourceW
SizeofResource
LockResource
LoadResource
FindResourceExW
DisableThreadLibraryCalls
GetModuleHandleW
GetModuleFileNameW
lstrlenW
GetLastError
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
FreeLibrary
LoadLibraryExW
lstrcmpiW
SetEndOfFile
RaiseException
InterlockedIncrement
CloseHandle
TerminateThread
WaitForSingleObject
OpenThread
GlobalUnlock
GlobalLock
WideCharToMultiByte
WriteFile
CreateFileW
DeleteFileW
GetCurrentThreadId
lstrlenA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
InitializeCriticalSectionAndSpinCount
FlushFileBuffers
GetConsoleMode
GetTimeZoneInformation
CreateFileA
CompareStringA
CompareStringW
SetEnvironmentVariableA
ExitProcess
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetProcAddress
GetConsoleCP
SetStdHandle
GetLocaleInfoA
GetLocaleInfoW
LoadLibraryA
SetConsoleCtrlHandler
GetModuleHandleA
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
Sleep
VirtualAlloc
FatalAppExitA
VirtualFree
HeapCreate
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
SetFilePointer
GetStartupInfoA
GetFileType
SetHandleCount
ReadFile
GetModuleFileNameA
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
RtlUnwind
ExitThread
CreateThread
GetSystemTimeAsFileTime
GetCommandLineA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThread
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStdHandle

user32

CharNextW
PostThreadMessageW
IsWindow
CharLowerBuffW
CloseClipboard
GetClipboardData
OpenClipboard
PeekMessageW
SendMessageW

advapi32

RegQueryValueExW
RegQueryInfoKeyW
RegSetValueExW
RegEnumKeyExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW

ole32

CLSIDFromProgID
CoCreateInstance
CoCreateGuid
CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc
StringFromGUID2
CoUninitialize
CoInitialize
CoGetInterfaceAndReleaseStream

oleaut32

VarBstrCmp
UnRegisterTypeLi
RegisterTypeLi
SysStringLen
LoadTypeLi
LoadRegTypeLi
VarUI4FromStr
CreateErrorInfo
SysAllocStringByteLen
VariantCopy
VariantClear
VariantInit
SysFreeString
SysAllocString
GetErrorInfo
VariantChangeType
SetErrorInfo
SysStringByteLen

Exports

Exports

CreateHelperObject
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IsUnicode

Sections

.text
Size: 265KB - Virtual size: 264KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 61KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.SHARED
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
tbu04815/tools.gif
.gif
tbu04815/translate.gif
.gif
tbu04815/tv.gif
.gif
tbu04815/tweater_25.png
.png
tbu04815/twitter.png
.png
tbu04815/twitter18.png
.png
tbu04815/twitter_s.png
.png
tbu04815/twitters.png
.png
tbu04815/uninstall.exe
.exe windows:5 windows x86 arch:x86

5110e5d7b2cbf49a2652fe8c09ea2e0d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\projects\toolbar\toolbar4\Release_bin\uninstall.pdb

Imports

kernel32

CreateMutexW
GetLastError
LoadLibraryW
GetProcAddress
FreeLibrary
CloseHandle
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
VirtualAlloc
HeapReAlloc
RtlUnwind
HeapSize
GetLocaleInfoA
WideCharToMultiByte
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW

ole32

CoInitialize
CoUninitialize

Sections

.text
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
tbu04815/update.exe
.exe windows:5 windows x86 arch:x86

2ba1583b28a40b01eeb85819c1851d96

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\projects\toolbar\toolbar4\release_bin\update.pdb

Imports

setupapi

SetupIterateCabinetW

shell32

ShellExecuteW
CommandLineToArgvW

kernel32

LocalFree
lstrlenW
GetLastError
InterlockedIncrement
InterlockedDecrement
GetProcAddress
FreeLibrary
LoadLibraryW
lstrcpyW
CreateToolhelp32Snapshot
Process32FirstW
CreateMutexW
Sleep
GetCommandLineW
CopyFileW
MoveFileW
CreateDirectoryW
SetCurrentDirectoryW
DeleteFileW
HeapSize
InitializeCriticalSectionAndSpinCount
Process32NextW
TlsFree
LoadLibraryA
GetStartupInfoW
HeapFree
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
InitializeCriticalSection
SetLastError
GetCurrentThreadId
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
HeapAlloc
VirtualAlloc
HeapReAlloc
RtlUnwind
RaiseException
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA

user32

LoadStringW
MessageBoxW

advapi32

RegCloseKey
RegDeleteValueW
RegCreateKeyExW

ole32

CoInitialize

Sections

.text
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
tbu04815/useful.gif
.gif
tbu04815/version.txt
tbu04815/video.gif
.gif
tbu04815/your_logo.png
.png
tbu04815/youtube18.png
.png
tbu04815/youtube_25.png
.png

Sharing

General

Malware Config

Signatures

Files

a23455b2d570c1e80b11b92360e41c00

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 22KB - Virtual size: 21KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 107KB

.ndata Size: - Virtual size: 40KB

.rsrc Size: 16KB - Virtual size: 16KB

32af71368cbdf173ab04d242843ebffe

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

shell32

kernel32

Exports

Exports

Sections

.text Size: 25KB - Virtual size: 24KB

.rdata Size: 7KB - Virtual size: 7KB

.data Size: 3KB - Virtual size: 6KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 3KB - Virtual size: 3KB

972c855c505004207a9c52c09d786c00

Headers

File Characteristics

PDB Paths

Imports

wininet

shlwapi

rpcrt4

winmm

dbghelp

version

iphlpapi

kernel32

user32

gdi32

shell32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 1.8MB - Virtual size: 1.8MB

.rdata Size: 429KB - Virtual size: 429KB

.data Size: 36KB - Virtual size: 47KB

.SHARED Size: 253KB - Virtual size: 253KB

.rsrc Size: 22KB - Virtual size: 21KB

.reloc Size: 74KB - Virtual size: 73KB

976dea5a19b78b2c6236d00ae0642caf

Headers

File Characteristics

PDB Paths

Imports

wininet

rpcrt4

kernel32

user32

advapi32

ole32

oleaut32

Exports

Exports

.text
Size: 22KB - Virtual size: 21KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 107KB

.ndata
Size: - Virtual size: 40KB

.rsrc
Size: 16KB - Virtual size: 16KB

.text
Size: 25KB - Virtual size: 24KB

.rdata
Size: 7KB - Virtual size: 7KB

.data
Size: 3KB - Virtual size: 6KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 3KB - Virtual size: 3KB

.text
Size: 1.8MB - Virtual size: 1.8MB

.rdata
Size: 429KB - Virtual size: 429KB

.data
Size: 36KB - Virtual size: 47KB

.SHARED
Size: 253KB - Virtual size: 253KB

.rsrc
Size: 22KB - Virtual size: 21KB

.reloc
Size: 74KB - Virtual size: 73KB

.text
Size: 265KB - Virtual size: 264KB

.rdata
Size: 61KB - Virtual size: 61KB

.data
Size: 7KB - Virtual size: 24KB

.SHARED
Size: 512B - Virtual size: 8B

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 11KB - Virtual size: 10KB

.text
Size: 24KB - Virtual size: 24KB

.rdata
Size: 7KB - Virtual size: 7KB

.data
Size: 3KB - Virtual size: 6KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 3KB - Virtual size: 3KB

.text
Size: 37KB - Virtual size: 37KB

.rdata
Size: 12KB - Virtual size: 11KB

.data
Size: 3KB - Virtual size: 6KB

.rsrc
Size: 1KB - Virtual size: 1KB