a112e40270437a236bdd9dfcc948a571_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

a112e40270437a236bdd9dfcc948a571_JaffaCakes118
Size

1.2MB
MD5

a112e40270437a236bdd9dfcc948a571
SHA1

8a986bdf5b0271e563879d322f4cb0cb9baba466
SHA256

1558335060381a3a45cbd49ea18742a4d1f2bb7660905ba07fc01a215cc792d9
SHA512

943099e0d4a2f13437eef1a7b0dcdf72a3b3a7c78d5daaf9882b0433f2b5a06e53964b470b47a0585c2999707cdb663a460515360bbc82af83cdb827f273b48e
SSDEEP

24576:8RWbHmsmKbRL6lzZXgfWDzyMM65tkU3ytel:8AbHmsXRePXgfWDOMjkU3KQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 7 IoCs

Checks for missing Authenticode signature.

resource
a112e40270437a236bdd9dfcc948a571_JaffaCakes118
unpack001//tbu01932/autofill_plugin.dll
unpack001//tbu01932/communicomm.dll
unpack001//tbu01932/scengine.dll
unpack001//tbu01932/spellchecker_plugin.dll
unpack001//tbu01932/spyrem.exe
unpack001//tbu01932/tbhelper.dll

NSIS installer 1 IoCs

installer

resource	yara_rule
sample	nsis_installer_1

Files

a112e40270437a236bdd9dfcc948a571_JaffaCakes118
.exe windows:4 windows x86 arch:x86

81c812ed76d4690c8678b3a4f0737a5f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

ImageList_Create
ord17
ImageList_AddMasked
ImageList_Destroy

kernel32

GetExitCodeProcess
WaitForSingleObject
ExpandEnvironmentStringsA
GetEnvironmentVariableA
lstrcmpiA
FindNextFileA
DeleteFileA
FindFirstFileA
SetFileTime
GetFileAttributesA
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
lstrcatA
SetCurrentDirectoryA
CreateDirectoryA
SetFileAttributesA
CreateFileA
GetFileSize
GetModuleFileNameA
GetTickCount
CopyFileA
SetErrorMode
lstrcpynA
GetCommandLineA
GetWindowsDirectoryA
GetTempPathA
GetUserDefaultLangID
GetDiskFreeSpaceA
GetVersion
GlobalUnlock
GlobalLock
GlobalAlloc
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
lstrcpyA
lstrlenA
GetSystemDirectoryA
EnterCriticalSection
Sleep
LeaveCriticalSection
InitializeCriticalSection
CloseHandle
GlobalFree
GetModuleHandleA
LoadLibraryA
CreateThread
GetProcAddress
FreeLibrary
MultiByteToWideChar
GetCurrentProcess
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
SetFilePointer
FindClose
MulDiv
ExitProcess

user32

CreateDialogParamA
DialogBoxParamA
GetClassInfoA
CreateWindowExA
SystemParametersInfoA
RegisterClassA
EndDialog
SetFocus
ScreenToClient
GetWindowRect
GetWindowLongA
SetClassLongA
IsWindowEnabled
SetWindowPos
LoadCursorA
SetCursor
GetDlgItemTextA
MapWindowPoints
GetMessagePos
LoadBitmapA
CallWindowProcA
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
MessageBoxA
CharPrevA
DestroyWindow
SetTimer
SetForegroundWindow
ShowWindow
CharNextA
wsprintfA
SendMessageTimeoutA
FindWindowExA
IsWindow
GetDlgItem
GetSysColor
SetWindowLongA
LoadImageA
GetDC
EnableWindow
PeekMessageA
DispatchMessageA
ExitWindowsEx
PostQuitMessage
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
GetWindowTextA
DrawTextA
EndPaint
InvalidateRect

gdi32

SetBkColor
GetDeviceCaps
CreateFontIndirectA
DeleteObject
CreateSolidBrush
CreateFontA
SetBkMode
SetTextColor
CreateBrushIndirect
SelectObject

advapi32

RegEnumValueA
RegEnumKeyA
RegQueryValueExA
RegSetValueExA
RegDeleteKeyA
RegOpenKeyExA
RegDeleteValueA
RegCreateKeyA
RegCloseKey

shell32

ShellExecuteA
SHBrowseForFolderA
SHGetPathFromIDListA
SHGetMalloc
SHGetSpecialFolderLocation
SHFileOperationA

ole32

OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 36KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
/tbu01932/accent.tlx
/tbu01932/autofill.cfg
/tbu01932/autofill_plugin.dll
.dll windows:4 windows x86 arch:x86

f0c2428dc65eae610d1aa03865d162de

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

OutputDebugStringW
FlushInstructionCache
GetCurrentProcess
InitializeCriticalSection
HeapDestroy
DeleteCriticalSection
GetModuleFileNameW
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoW
GetTimeZoneInformation
SetConsoleCtrlHandler
ReadFile
SetStdHandle
LoadLibraryA
DebugBreak
GetOEMCP
GetACP
GetStringTypeW
GetStringTypeA
UnhandledExceptionFilter
IsBadCodePtr
IsBadReadPtr
GetUserDefaultLCID
EnumSystemLocalesA
GetLocaleInfoA
IsValidCodePage
IsValidLocale
GetCPInfo
CloseHandle
FlushFileBuffers
SetFilePointer
WriteFile
GetEnvironmentStringsW
MultiByteToWideChar
lstrlenA
InterlockedDecrement
InterlockedIncrement
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
GetProcAddress
lstrlenW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
LCMapStringW
LCMapStringA
IsBadWritePtr
VirtualAlloc
Sleep
InterlockedExchange
GetLastError
WideCharToMultiByte
LocalFree
RtlUnwind
RaiseException
HeapFree
HeapAlloc
GetCommandLineA
GetVersion
ExitProcess
FatalAppExitA
TerminateProcess
HeapReAlloc
HeapSize
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetCurrentThread
SetUnhandledExceptionFilter
GetModuleHandleA
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapCreate
VirtualFree

user32

SetWindowLongW
LoadStringW
CharNextW
wvsprintfW
GetKeyState
GetWindowTextLengthW
GetWindowLongW
GetWindow
CharLowerW
SystemParametersInfoW
GetClientRect
MapWindowPoints
SetWindowPos
GetDlgItemTextW
GetParent
SetWindowTextW
EnableWindow
ShowWindow
GetWindowTextW
MessageBoxW
EndDialog
GetActiveWindow
DialogBoxParamW
SendMessageW
GetDlgItem
SetDlgItemTextW
GetWindowRect

advapi32

RegDeleteKeyW
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
RegEnumKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW

ole32

CoCreateInstance

oleaut32

CreateErrorInfo
SetErrorInfo
VariantInit
VariantClear
SysStringLen
SysAllocStringLen
SysFreeString
SysAllocString
VariantChangeType
GetErrorInfo

shlwapi

PathFileExistsW

Exports

Exports

IsUnicode
PlugCreate
PlugInit
PlugInvoke
PlugTerm

Sections

.text
Size: 156KB - Virtual size: 153KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/tbu01932/basis.xml
.xml
/tbu01932/communicomm.crc
/tbu01932/communicomm.dll
.dll regsvr32 windows:4 windows x86 arch:x86

9dac24c311ea8463e171232233e57e21

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\Projects\Softomate\Toolbar3\Release_bin\tbcore3U.pdb

Imports

wininet

FindNextUrlCacheEntryW
FindCloseUrlCache
DeleteUrlCacheEntryW
FindFirstUrlCacheEntryW

shlwapi

PathFileExistsW
PathFindExtensionW
PathRemoveFileSpecW

winmm

PlaySoundW

setupapi

SetupIterateCabinetW

dbghelp

SymGetModuleBase
SymGetSymFromAddr
StackWalk
SymFunctionTableAccess
SymGetLineFromAddr
SymSetOptions
SymGetOptions
SymCleanup
SymInitialize
SymLoadModule

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

kernel32

InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
SetLastError
GetLastError
OutputDebugStringA
LoadLibraryW
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetFileAttributesW
GetVersion
GetCurrentThreadId
RaiseException
InterlockedDecrement
InterlockedIncrement
lstrlenW
EnterCriticalSection
LeaveCriticalSection
HeapAlloc
GetProcessHeap
FlushInstructionCache
GetCurrentProcess
InitializeCriticalSection
DeleteCriticalSection
GetCurrentThread
CloseHandle
HeapFree
CreateDirectoryW
GetTempPathW
SetCurrentDirectoryW
LoadLibraryA
GlobalUnlock
GlobalLock
GlobalAlloc
DebugBreak
OutputDebugStringW
lstrlenA
lstrcmpW
lstrcpyW
MulDiv
IsBadCodePtr
SetUnhandledExceptionFilter
IsBadWritePtr
GetCurrentProcessId
lstrcpynW
FormatMessageW
IsBadReadPtr
ReadProcessMemory
GetVersionExW
OpenProcess
MultiByteToWideChar
WideCharToMultiByte
WinExec
VerLanguageNameW
RemoveDirectoryW
MoveFileExW
DeleteFileW
WriteFile
CreateFileA
GetTempPathA
CopyFileW
MoveFileW
GetTempFileNameW
FreeLibrary
lstrcatW
FindFirstFileW
FindNextFileW
FindClose
GlobalFree
Sleep
GetTickCount
DisableThreadLibraryCalls
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
lstrcmpiW
MapViewOfFile
CreateFileMappingW
OpenFileMappingW
UnmapViewOfFile
TerminateProcess
ReadFile
TlsSetValue
TlsFree
TlsAlloc
GetModuleFileNameA
QueryPerformanceCounter
GetCommandLineA
GetSystemTimeAsFileTime
GetFullPathNameW
GetCurrentDirectoryW
SetEnvironmentVariableW
CreateThread
ResumeThread
ExitThread
HeapReAlloc
RtlUnwind
ExitProcess
GetVersionExA
LocalFree
LocalAlloc
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
SetStdHandle
FlushFileBuffers
GetDriveTypeA
GetCurrentDirectoryA
GetFullPathNameA
SetConsoleCtrlHandler
SetEndOfFile
GetLocaleInfoW
TlsGetValue
VirtualQuery
CompareStringA
CompareStringW
FatalAppExitA
HeapDestroy
HeapCreate
VirtualFree
SetEnvironmentVariableA
VirtualAlloc
CreateFileW
VirtualProtect
GetSystemInfo
LCMapStringA
LCMapStringW
UnhandledExceptionFilter
GetTimeZoneInformation
SetHandleCount
GetStdHandle
GetFileType
GetStringTypeA
GetStartupInfoA
SetFilePointer
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetCPInfo
HeapSize

user32

SetWindowRgn
InflateRect
IsWindowEnabled
SystemParametersInfoW
GetCapture
GetDlgCtrlID
AdjustWindowRectEx
GetMenu
DrawFocusRect
DrawEdge
LoadBitmapW
GetCursorPos
PostMessageW
DrawTextW
CopyRect
KillTimer
UpdateWindow
LoadImageW
SetWindowsHookExW
TrackPopupMenu
UnhookWindowsHookEx
EndMenu
CharLowerW
RegisterHotKey
UnregisterHotKey
GetSystemMetrics
DialogBoxIndirectParamW
wsprintfA
IsWindowVisible
WindowFromPoint
CallNextHookEx
SetCursor
ScreenToClient
PtInRect
GetKeyState
DestroyCursor
SetDlgItemTextW
IsDlgButtonChecked
CheckDlgButton
GetAsyncKeyState
MapWindowPoints
ClientToScreen
OffsetRect
GetMenuItemInfoW
EnableMenuItem
CharUpperW
EndDialog
SetActiveWindow
GetWindowRect
TranslateMessage
LoadMenuW
CharUpperBuffW
DialogBoxParamW
GetActiveWindow
SetLastErrorEx
InvalidateRgn
InvalidateRect
SetCapture
ReleaseCapture
CreateAcceleratorTableW
GetDC
ReleaseDC
GetDesktopWindow
GetClassNameW
SetWindowPos
RedrawWindow
GetClientRect
BeginPaint
FillRect
EndPaint
IsChild
SetFocus
GetSysColor
DestroyAcceleratorTable
CallWindowProcW
CharNextW
wvsprintfW
GetWindowTextLengthW
GetWindowTextW
GetWindowLongW
DefWindowProcW
RegisterWindowMessageW
SetTimer
LoadCursorFromFileW
CharLowerBuffW
GetWindow
OpenClipboard
EmptyClipboard
CloseClipboard
MessageBoxW
UnregisterClassW
SetWindowLongW
RegisterClassExW
LoadCursorW
wsprintfW
GetClassInfoExW
LoadStringW
GetParent
ShowWindow
MoveWindow
SetWindowTextW
CreateWindowExW
SendMessageW
GetFocus
IsWindow
DestroyWindow
DestroyMenu
CreatePopupMenu
AppendMenuW
GetSubMenu
InsertMenuW
PeekMessageW
GetMessagePos
DispatchMessageW
DrawFrameControl
UnregisterClassA
GetDlgItem

gdi32

GetTextExtentPoint32W
SelectObject
ExtTextOutW
SetBkMode
CreateRectRgn
GetTextMetricsW
CreateBrushIndirect
CreateRectRgnIndirect
SetBkColor
SelectClipRgn
GetClipBox
RestoreDC
SaveDC
SetTextColor
GetTextExtentPointW
CreatePen
CreatePatternBrush
Rectangle
GetStockObject
GetObjectW
GetDeviceCaps
CreateSolidBrush
CreateCompatibleBitmap
CreateCompatibleDC
BitBlt
DeleteDC
DeleteObject
CreateFontW

shell32

ShellExecuteW
SHAddToRecentDocs
ShellExecuteA
SHEmptyRecycleBinW
DragQueryFileW
SHGetFolderPathW

ole32

OleLockRunning
CoTaskMemAlloc
CLSIDFromString
StringFromGUID2
CoUninitialize
CoInitialize
CoCreateInstance
OleUninitialize
CreateStreamOnHGlobal
OleInitialize
CoGetClassObject
CLSIDFromProgID
RegisterDragDrop
ReleaseStgMedium
CoCreateGuid
CoTaskMemFree
CoTaskMemRealloc

oleaut32

SysAllocString
SysFreeString
SysStringLen
VarBstrCmp
SysAllocStringByteLen
VariantInit
SysStringByteLen
VariantClear
SysAllocStringLen
OleCreateFontIndirect
LoadRegTypeLi
LoadTypeLi
UnRegisterTypeLi
SafeArrayDestroy
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreateVector
DispCallFunc
SafeArrayPutElement
SafeArrayCreate
VariantCopy
VariantChangeType
VarUI4FromStr
RegisterTypeLi
VarBstrCat
GetErrorInfo
SetErrorInfo
CreateErrorInfo

Exports

Exports

CanReload
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
TBStudioReg

Sections

.text
Size: 940KB - Virtual size: 938KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 188KB - Virtual size: 184KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.SHARED
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 48KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/tbu01932/correct.tlx
/tbu01932/descdb.bin
/tbu01932/fdb.bin
/tbu01932/icons.bmp
/tbu01932/regdb.bin
/tbu01932/scengine.dll
.dll windows:4 windows x86 arch:x86

5beaf43fd83e14a96d8bccb142e76263

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleFileNameA
GetPrivateProfileStringA
lstrcmpiA
GetShortPathNameA
GetProfileStringA
lstrlenA
_lread
_llseek
lstrcpyA
GlobalFree
GlobalUnlock
GlobalLock
_lclose
LeaveCriticalSection
InterlockedExchange
InitializeCriticalSection
_lcreat
_lopen
_lwrite
WritePrivateProfileStringA
GetVersion
lstrcmpA
Sleep
GetFileAttributesA
InterlockedDecrement
InterlockedIncrement
CompareStringA
SetEndOfFile
SetFilePointer
LoadLibraryA
GetProcAddress
ReadFile
GetStringTypeW
GetStringTypeA
RtlUnwind
GetOEMCP
GetACP
GetCPInfo
CreateFileA
FlushFileBuffers
SetStdHandle
WriteFile
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
TlsGetValue
SetLastError
TlsFree
TlsAlloc
TlsSetValue
SetEnvironmentVariableA
CompareStringW
GetTickCount
EnterCriticalSection
GetCommandLineA
HeapDestroy
LCMapStringW
LCMapStringA
HeapFree
HeapAlloc
GetTimeZoneInformation
GetSystemTime
GetLocalTime
GetLastError
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeA
FindFirstFileA
GetCurrentProcess
GetCurrentThreadId
VirtualAlloc
HeapReAlloc
TerminateProcess
HeapCreate
VirtualFree
DeleteCriticalSection
ExitProcess
WideCharToMultiByte
CloseHandle
GetFullPathNameA
GetCurrentDirectoryA
MultiByteToWideChar

user32

EnumChildWindows
MessageBoxA
ClientToScreen
GetWindowTextLengthA
TrackPopupMenu
RemoveMenu
ModifyMenuA
GetSubMenu
LoadMenuA
ShowCursor
SetCursor
LoadCursorA
KillTimer
ShowWindow
SetTimer
SetDlgItemTextA
GetSystemMetrics
SystemParametersInfoA
GetDesktopWindow
MoveWindow
SetRect
InflateRect
IntersectRect
OffsetRect
UnionRect
EqualRect
GetDlgItemTextA
GetWindowRect
EnableWindow
GetSysColor
GetWindowTextA
SetWindowTextA
GetDlgItem
EndDialog
WinHelpA
SetFocus
CallWindowProcA
DialogBoxParamA
GetParent
SetWindowLongA
GetClassNameA
SendMessageA
wsprintfA

gdi32

CreateSolidBrush
DeleteObject
GetObjectA
SetTextColor
SetBkColor
CreateFontIndirectA

comdlg32

GetSaveFileNameA
GetOpenFileNameA

advapi32

RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA

Exports

Exports

EditLexDlgProc
NewLexDlgProc
OptionsDlgProc
SSCE_AddToLex
SSCE_CheckBlock
SSCE_CheckBlockDlg
SSCE_CheckBlockDlgTmplt
SSCE_CheckCtrlBackground
SSCE_CheckCtrlDlg
SSCE_CheckCtrlDlgTmplt
SSCE_CheckString
SSCE_CheckWord
SSCE_ClearLex
SSCE_CloseBlock
SSCE_CloseLex
SSCE_CloseSession
SSCE_CompressLexAbort
SSCE_CompressLexEnd
SSCE_CompressLexFile
SSCE_CompressLexInit
SSCE_CountStringWords
SSCE_CreateLex
SSCE_DelBlockText
SSCE_DelBlockWord
SSCE_DelFromLex
SSCE_DelStringText
SSCE_DelStringWord
SSCE_EditLexDlg
SSCE_EditLexDlgTmplt
SSCE_FindLexWord
SSCE_GetAutoCorrect
SSCE_GetBlock
SSCE_GetBlockInfo
SSCE_GetBlockWord
SSCE_GetCharSet
SSCE_GetHelpFile
SSCE_GetIniFile
SSCE_GetLex
SSCE_GetLexId
SSCE_GetLexInfo
SSCE_GetMainLexFiles
SSCE_GetMainLexPath
SSCE_GetMinSuggestDepth
SSCE_GetOption
SSCE_GetRegTreeName
SSCE_GetSelUserLexFile
SSCE_GetSid
SSCE_GetStatistics
SSCE_GetStringTableName
SSCE_GetStringWord
SSCE_GetUserLexFiles
SSCE_GetUserLexPath
SSCE_InsertBlockText
SSCE_InsertStringText
SSCE_NextBlockWord
SSCE_OpenBlock
SSCE_OpenLex
SSCE_OpenSession
SSCE_OptionsDlg
SSCE_OptionsDlgTmplt
SSCE_ReplaceBlockWord
SSCE_ReplaceStringWord
SSCE_ResetLex
SSCE_SetAutoCorrect
SSCE_SetBlockCursor
SSCE_SetCharSet
SSCE_SetDebugFile
SSCE_SetDialogOrigin
SSCE_SetHelpFile
SSCE_SetIniFile
SSCE_SetKey
SSCE_SetMainLexFiles
SSCE_SetMainLexPath
SSCE_SetMinSuggestDepth
SSCE_SetOption
SSCE_SetRegTreeName
SSCE_SetSelUserLexFile
SSCE_SetStringTableName
SSCE_SetUserLexFiles
SSCE_SetUserLexPath
SSCE_Suggest
SSCE_SyncLex
SSCE_Version
SndMsgEnumCb
SpellCheckDlgProc

Sections

.text
Size: 128KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 40KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/tbu01932/spellchecker_plugin.dll
.dll windows:4 windows x86 arch:x86

e087188ae6e585d1c4ed6337e709d5ee

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

MultiByteToWideChar
FlushInstructionCache
GetCurrentProcess
HeapDestroy
DeleteCriticalSection
InitializeCriticalSection
lstrcpyA
lstrcmpiA
ReadFile
SetStdHandle
GetStringTypeW
GetStringTypeA
IsBadCodePtr
IsBadReadPtr
CloseHandle
WideCharToMultiByte
lstrlenW
SetUnhandledExceptionFilter
WriteFile
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
GetVersionExA
GetEnvironmentVariableA
GetModuleHandleA
HeapSize
HeapReAlloc
TerminateProcess
LCMapStringW
LCMapStringA
GetOEMCP
GetACP
GetCPInfo
TlsGetValue
SetLastError
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
InterlockedIncrement
GetModuleFileNameA
LoadLibraryA
FlushFileBuffers
GetProcAddress
FreeLibrary
InterlockedDecrement
lstrlenA
SetFilePointer
TlsFree
TlsAlloc
TlsSetValue
ExitProcess
RaiseException
GetVersion
GetLastError
LocalFree
Sleep
InterlockedExchange
RtlUnwind
HeapFree
HeapAlloc
GetCommandLineA

user32

GetFocus
DrawFocusRect
GetClassNameA
GetWindowTextLengthA
CharNextA
GetDC
GetWindowLongA
DrawTextA
OffsetRect
ReleaseDC
BeginPaint
EndPaint
GetClientRect
FillRect
GetClassInfoExA
LoadCursorA
wsprintfA
RegisterClassExA
CheckDlgButton
IsWindow
InvalidateRect
PtInRect
CreateWindowExA
SetFocus
SetCapture
GetCapture
ReleaseCapture
GetCursorPos
ScreenToClient
SendMessageA
SetWindowTextA
EnableWindow
ShowWindow
GetDlgItem
GetWindowTextA
EndDialog
SetRectEmpty
LoadStringA
SetWindowLongA
GetParent
GetActiveWindow
DialogBoxParamA
MessageBoxA
CharUpperA
IsDlgButtonChecked
SetCursor
CallWindowProcA
DefWindowProcA

gdi32

SetBkMode
SetTextColor
GetObjectA
CreateFontIndirectA
SelectObject
DeleteObject
DeleteDC

advapi32

RegCloseKey
RegOpenKeyExA
RegQueryValueExA

shell32

ShellExecuteA

oleaut32

SysAllocStringLen
VariantInit
SysFreeString
VariantClear
SysAllocString

Exports

Exports

IsUnicode
PlugCreate
PlugInit
PlugInvoke
PlugTerm

Sections

.text
Size: 76KB - Virtual size: 75KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/tbu01932/spyrem.exe
.exe windows:4 windows x86 arch:x86

d3a056f563856b2727bf0f245db3db45

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrlenA
lstrlenW
MultiByteToWideChar
GlobalUnlock
InterlockedIncrement
GlobalAlloc
DeleteCriticalSection
InitializeCriticalSection
Sleep
HeapDestroy
FlushInstructionCache
InterlockedDecrement
GetCurrentProcess
RemoveDirectoryA
lstrcpyA
SetLastError
FindClose
FindFirstFileA
FindNextFileA
GlobalLock
lstrcmpA
FindResourceA
SetEndOfFile
LoadLibraryA
GetProcAddress
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
IsBadCodePtr
IsBadReadPtr
CreateFileA
FlushFileBuffers
SetStdHandle
SetUnhandledExceptionFilter
WriteFile
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
GetVersionExA
GetEnvironmentVariableA
GetModuleFileNameA
GetCurrentDirectoryA
GetOEMCP
GetACP
GetCPInfo
TlsGetValue
TlsAlloc
TlsSetValue
HeapSize
TerminateProcess
ReadFile
SetFilePointer
CloseHandle
RaiseException
ExitProcess
GetVersion
GetCommandLineA
GetStartupInfoA
GetModuleHandleA
HeapAlloc
HeapReAlloc
HeapFree
GetFullPathNameA
RtlUnwind
LocalFree
WideCharToMultiByte
GetLastError
FreeResource
GetDriveTypeA
DeleteFileA
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
GetLogicalDriveStringsA
LoadResource
LockResource
GlobalFree
GlobalHandle

user32

DialogBoxIndirectParamA
GetActiveWindow
GetWindowRect
GetDlgItem
MoveWindow
GetClientRect
EndDialog
SetDlgItemTextA
GetDC
SendMessageA
EnableWindow
SetWindowLongA
SystemParametersInfoA
MapWindowPoints
SetTimer
MessageBoxA
KillTimer
DialogBoxParamA
GetSystemMetrics
LoadImageA
PostQuitMessage
IsDialogMessageA
CreateDialogParamA
ShowWindow
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
InvalidateRgn
InvalidateRect
SetCapture
ReleaseCapture
wsprintfA
CreateWindowExA
CreateAcceleratorTableA
GetDesktopWindow
RedrawWindow
DestroyWindow
IsWindow
GetParent
GetClassNameA
SetWindowPos
GetFocus
IsChild
SetFocus
ReleaseDC
BeginPaint
FillRect
EndPaint
GetSysColor
CallWindowProcA
GetWindowLongA
GetWindowTextLengthA
GetWindowTextA
SetWindowTextA
GetWindow
DefWindowProcA
RegisterWindowMessageA
GetClassInfoExA
LoadCursorA
RegisterClassExA
LoadStringA

gdi32

DeleteDC
BitBlt
GetTextExtentPoint32A
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
CreateSolidBrush
GetDeviceCaps
DeleteObject
GetStockObject
CreateFontIndirectA
GetObjectA

advapi32

RegCreateKeyExA
RegCloseKey
RegEnumValueA
RegEnumKeyExA
RegOpenKeyExA
RegDeleteValueA
RegDeleteKeyA

shell32

SHGetPathFromIDListA
SHGetSpecialFolderLocation

ole32

CoCreateInstance
CoUninitialize
OleLockRunning
CoTaskMemAlloc
StringFromCLSID
CoTaskMemFree
CLSIDFromString
CLSIDFromProgID
OleUninitialize
OleInitialize
CreateStreamOnHGlobal
CoInitialize

oleaut32

OleCreateFontIndirect
SysAllocStringByteLen
SysFreeString
SysAllocStringLen
SysAllocString
SysStringLen
LoadRegTypeLi
VariantClear

comctl32

InitCommonControlsEx

Sections

.text
Size: 88KB - Virtual size: 86KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 160KB - Virtual size: 159KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
/tbu01932/ssceam.tlx
.vbs
/tbu01932/ssceam2.clx
/tbu01932/sscebr.tlx
.vbs
/tbu01932/sscebr2.clx
/tbu01932/sengine.ini
/tbu01932/tbhelper.dll
.dll regsvr32 windows:4 windows x86 arch:x86

f3b44d83a715d490442d205ac4c434b1

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\Projects\Softomate\Toolbar3\Release_bin\tbhelperU.pdb

Imports

shlwapi

PathFindExtensionW
PathFileExistsW

wininet

InternetOpenW
InternetReadFile
InternetCloseHandle
HttpQueryInfoW
InternetOpenUrlW

rpcrt4

UuidFromStringA

urlmon

URLDownloadToFileW

kernel32

Sleep
CreateThread
CloseHandle
TerminateThread
WriteFile
CreateFileW
GetLastError
DeleteFileW
InterlockedIncrement
InterlockedDecrement
lstrlenW
IsBadStringPtrW
FindResourceW
DeleteCriticalSection
RaiseException
MultiByteToWideChar
GetVersionExW
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetTimeZoneInformation
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GetModuleHandleW
GetModuleFileNameW
lstrcpyW
FreeLibrary
SizeofResource
LoadResource
LoadLibraryExW
lstrcmpiW
lstrcpynW
lstrcatW
GlobalUnlock
GlobalLock
SetEndOfFile
LCMapStringW
LCMapStringA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidCodePage
IsValidLocale
GetStringTypeW
VirtualProtect
GetLocaleInfoW
CompareStringA
CompareStringW
SetEnvironmentVariableA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
DisableThreadLibraryCalls
OutputDebugStringA
GetStringTypeA
GetDateFormatA
GetTimeFormatA
FlushFileBuffers
SetStdHandle
GetCPInfo
GetOEMCP
IsBadCodePtr
UnhandledExceptionFilter
GetEnvironmentStrings
FreeEnvironmentStringsA
GetProcessHeap
VirtualQuery
SetFilePointer
GetStartupInfoA
GetFileType
SetHandleCount
ReadFile
SetConsoleCtrlHandler
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
VirtualFree
LocalFree
GetVersionExA
GetCurrentProcessId
SetEvent
OpenEventA
lstrlenA
lstrcpyA
HeapCreate
OutputDebugStringW
WaitForSingleObject
GetCurrentThreadId
VirtualAlloc
UnmapViewOfFile
IsBadReadPtr
GetSystemInfo
MapViewOfFile
CreateFileMappingA
GetCurrentThread
GetVersion
OpenFileMappingA
GetModuleFileNameA
RtlUnwind
ExitProcess
IsBadWritePtr
HeapValidate
GetSystemTimeAsFileTime
DebugBreak
GetStdHandle
GetProcAddress
LoadLibraryA
GetCommandLineA
TlsAlloc
TlsFree
TlsSetValue
TlsGetValue
GetModuleHandleA
SetLastError
QueryPerformanceCounter
GetTickCount
FatalAppExitA
HeapAlloc
HeapReAlloc
HeapFree
HeapDestroy

user32

IsWindowUnicode
GetMessageW
GetMessageA
CharLowerBuffW
PeekMessageA
GetClipboardData
CloseClipboard
CharNextW
UnregisterClassW
LoadStringW
TranslateMessage
DispatchMessageW
MsgWaitForMultipleObjects
OpenClipboard
DispatchMessageA
UnregisterClassA

advapi32

RegSetValueExW
RegEnumKeyExW
RegCreateKeyExW
OpenThreadToken
RevertToSelf
SetThreadToken
RegDeleteValueW
RegDeleteKeyW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegQueryInfoKeyW

ole32

CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
CLSIDFromProgID
CoInitialize
CoReleaseMarshalData
CoMarshalInterface
CreateStreamOnHGlobal
CoUnmarshalInterface
CoRevokeClassObject
CoRegisterClassObject
StringFromGUID2

oleaut32

CreateErrorInfo
VariantCopy
VarBstrCmp
UnRegisterTypeLi
RegisterTypeLi
SysStringLen
LoadTypeLi
LoadRegTypeLi
VarUI4FromStr
VariantInit
SysFreeString
VariantClear
SysStringByteLen
SysAllocStringByteLen
GetErrorInfo
VariantChangeType
SetErrorInfo
SysAllocString

Exports

Exports

CreateHelperObject
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IsUnicode

Sections

.text
Size: 256KB - Virtual size: 252KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 76KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.SHARED
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/tbu01932/tech.tlx
/tbu01932/userdic.tlx
/tbu01932/version.txt

Sharing

General

Malware Config

Signatures

Files

81c812ed76d4690c8678b3a4f0737a5f

Headers

File Characteristics

Imports

comctl32

kernel32

user32

gdi32

advapi32

shell32

ole32

version

Sections

.text Size: 23KB - Virtual size: 23KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 108KB

.ndata Size: - Virtual size: 36KB

.rsrc Size: 16KB - Virtual size: 20KB

f0c2428dc65eae610d1aa03865d162de

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

Exports

Exports

Sections

.text Size: 156KB - Virtual size: 153KB

.rdata Size: 32KB - Virtual size: 28KB

.data Size: 28KB - Virtual size: 35KB

.rsrc Size: 12KB - Virtual size: 9KB

.reloc Size: 12KB - Virtual size: 11KB

9dac24c311ea8463e171232233e57e21

Headers

File Characteristics

PDB Paths

Imports

wininet

shlwapi

winmm

setupapi

dbghelp

version

kernel32

user32

gdi32

shell32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 940KB - Virtual size: 938KB

.rdata Size: 188KB - Virtual size: 184KB

.data Size: 20KB - Virtual size: 30KB

.SHARED Size: 4KB - Virtual size: 2KB

.rsrc Size: 24KB - Virtual size: 22KB

.reloc Size: 48KB - Virtual size: 44KB

5beaf43fd83e14a96d8bccb142e76263

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

advapi32

Exports

Exports

Sections

.text Size: 128KB - Virtual size: 126KB

.text
Size: 23KB - Virtual size: 23KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 108KB

.ndata
Size: - Virtual size: 36KB

.rsrc
Size: 16KB - Virtual size: 20KB

.text
Size: 156KB - Virtual size: 153KB

.rdata
Size: 32KB - Virtual size: 28KB

.data
Size: 28KB - Virtual size: 35KB

.rsrc
Size: 12KB - Virtual size: 9KB

.reloc
Size: 12KB - Virtual size: 11KB

.text
Size: 940KB - Virtual size: 938KB

.rdata
Size: 188KB - Virtual size: 184KB

.data
Size: 20KB - Virtual size: 30KB

.SHARED
Size: 4KB - Virtual size: 2KB

.rsrc
Size: 24KB - Virtual size: 22KB

.reloc
Size: 48KB - Virtual size: 44KB

.text
Size: 128KB - Virtual size: 126KB

.rdata
Size: 16KB - Virtual size: 12KB

.data
Size: 40KB - Virtual size: 57KB

.rsrc
Size: 8KB - Virtual size: 5KB

.reloc
Size: 12KB - Virtual size: 8KB

.text
Size: 76KB - Virtual size: 75KB

.rdata
Size: 12KB - Virtual size: 10KB

.data
Size: 16KB - Virtual size: 20KB

.rsrc
Size: 4KB - Virtual size: 2KB

.reloc
Size: 8KB - Virtual size: 7KB

.text
Size: 88KB - Virtual size: 86KB

.rdata
Size: 12KB - Virtual size: 11KB

.data
Size: 16KB - Virtual size: 18KB

.rsrc
Size: 160KB - Virtual size: 159KB

.text
Size: 256KB - Virtual size: 252KB

.rdata
Size: 76KB - Virtual size: 72KB

.data
Size: 8KB - Virtual size: 15KB

.SHARED
Size: 8KB - Virtual size: 4KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 16KB - Virtual size: 13KB