home

ttmcaplt.dll

Coffee and Comfort Apps, LLC

This is part of an adware program designed to inject advertising in the web browser (banners, text-links) as well as modify the normal behavior of the browser as well as modify the computer’s system settings that control applications to run on startup. Part of the Injekt brand of unwanted programs. The module ttmcaplt.dll by Coffee and Comfort Apps has been detected as adware by 3 anti-malware scanners.
Publisher:
Coffee and Comfort Apps, LLC  (signed and verified)

MD5:
8b83428144fc62f453eb3a08b8bb5f70

SHA-1:
ba09ef1d7127397dc11fdba2da49ca1de545aea3

SHA-256:
66616cd7539f86ab8f55d2de51dee11a1a1f52da7ef8157c9b5e27358f78f5d1

Scanner detections:
3 / 68

Status:
Adware

Explanation:
Injects display ads (banner ads), in-text ads, interstitial ads, or other types of ads in the web browser as well as alters the browsers settings (home page, search, DNS, and security protocols).

Analysis date:
4/23/2024 10:10:36 AM UTC  (today)

Scan engine
Detection
Engine version

AhnLab V3 Security
PUP/Win32.Meteroids
2014.12.01

Avira AntiVirus
ADWARE/Adware.Gen
7.11.189.158

Reason Heuristics
PUP.CoffeeandComfortApps.I
14.11.30.19

File size:
1.3 MB (1,391,992 bytes)

File type:
Dynamic link library (Win64 DLL)

Common path:
C:\ProgramData\dxdhdkww\dat\ttmcaplt.dll

Digital Signature
Signed by:
Coffee and Comfort Apps, LLC

Authority:
VeriSign, Inc.

Valid from:
3/22/2014 8:00:00 PM

Valid to:
6/22/2015 7:59:59 PM

Subject:
CN="Coffee and Comfort Apps, LLC", OU=Digital ID Class 3 - Microsoft Software Validation v2, O="Coffee and Comfort Apps, LLC", L=Grandville, S=Michigan, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
5E98B9455BCE81019FFCAF7FB2161D8B

File PE Metadata
Compilation timestamp:
10/1/2014 9:29:12 PM

OS version:
5.2

OS bitness:
Win64

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
24576:+mjggaRqwv1dwzwO2dlWRDqw5vc+A4vdzinwN1RrITj:rjggaRqS4d4WRDbdewN12Tj

Entry address:
0xC7260

Entry point:
48, 89, 5C, 24, 08, 48, 89, 74, 24, 10, 57, 48, 83, EC, 20, 49, 8B, F8, 8B, DA, 48, 8B, F1, 83, FA, 01, 75, 05, E8, 07, C6, 00, 00, 4C, 8B, C7, 8B, D3, 48, 8B, CE, 48, 8B, 5C, 24, 30, 48, 8B, 74, 24, 38, 48, 83, C4, 20, 5F, E9, A7, FE, FF, FF, CC, CC, CC, CC, CC, CC, CC, CC, CC, 66, 66, 0F, 1F, 84, 00, 00, 00, 00, 00, 48, 8B, C1, 49, 83, F8, 08, 72, 53, 0F, B6, D2, 49, B9, 01, 01, 01, 01, 01, 01, 01, 01, 49, 0F, AF, D1, 49, 83, F8, 40, 72, 1E, 48, F7, D9, 83, E1, 07, 74, 06, 4C, 2B, C1, 48, 89, 10, 48, 03...
 
[+]

Entropy:
6.0300

Code size:
903.5 KB (925,184 bytes)

Remove ttmcaplt.dll - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.