General

  • Target

    6c732210df904c6a5f77366e1be606c8_JaffaCakes118

  • Size

    8.0MB

  • MD5

    6c732210df904c6a5f77366e1be606c8

  • SHA1

    6dc33ee4ff4385ff871062281f7abc9850772d39

  • SHA256

    1193b07a40ddee8801bad7caaa19d4e373a454cbb9bfc50c51069f4e64b09010

  • SHA512

    13dacef2c8c73e9ce5e6f4f891c5a5a3caefa18572a1327844ef8ce5422d18c4d4c81c73ce0c788752d68fdef5b0b6de4a0866371cd403f8e7a544e6c95b2f81

  • SSDEEP

    196608:WQh8lR+sOM4tlEInk+2TzY6yFBEs1tZnDcxdP2QG:fhgR+hQI2zojzZI75G

Score
7/10

Malware Config

Signatures

  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Unsigned PE 41 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 6 IoCs

Files

  • 6c732210df904c6a5f77366e1be606c8_JaffaCakes118
    .rar
  • cfts0521syjs/data/d3dx9_37.dll
    .dll windows:6 windows x86 arch:x86

    ef2f5208fe9e5732aaa58d1e71a2f0cf


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • cfts0521syjs/使用说明.txt
  • cfts0521syjs/断网恢复工具/woniu.ini
  • cfts0521syjs/断网恢复工具/使用说明.txt
  • cfts0521syjs/断网恢复工具/瞬移加速.exe
    .exe windows:4 windows x86 arch:x86

    b5a6a25ad48910612c3a815d19d761e9


    Headers

    Imports

    Exports

    Sections

  • cfts0521syjs/查看最新版本.url
    .url
  • cfts0521syjs/穿越火线透视0521版瞬移加速.exe
    .exe windows:4 windows x86 arch:x86

    dfb06052e74b26a42b0e490bd1c07959


    Headers

    Imports

    Sections

  • $EXEDIR/Խ͸05.21˲Ƽ.exe
    .exe windows:4 windows x86 arch:x86

    9165ea3e914e03bda3346f13edbd6ccd


    Headers

    Imports

    Sections

  • $FAVORITES/.url
    .url
  • $FAVORITES/Ϸ.url
  • $FAVORITES/ȥ.url
    .url
  • $FAVORITES/뵼.url
    .url
  • $FAVORITES/뼼̳.url
    .url
  • $FAVORITES/Ӱ.url
  • $FAVORITES/.url
    .url
  • $FAVORITES/.url
    .url
  • $FAVORITES/.url
    .url
  • $PLUGINSDIR/nsExec.dll
    .dll windows:4 windows x86 arch:x86

    d83f71e61ee459ee63ca3e829966a9dc


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/dllcache/shdoclc.dll
    .dll windows:5 windows x86 arch:x86


    Headers

    Sections

  • $SYSDIR/shdoclc.dll
    .dll windows:5 windows x86 arch:x86


    Headers

    Sections

  • $SYSDIR/wfpdisable.exe
    .exe windows:4 windows x86 arch:x86

    da34fe388571b8c61ff2114f0a1dfd25


    Headers

    Imports

    Sections

  • $TEMP/d.exe
    .exe windows:4 windows x86 arch:x86

    7fa5ae915c7013c99ed84c42294afcc8


    Headers

    Imports

    Sections

  • $TEMP/mbox224.exe
    .exe windows:4 windows x86 arch:x86

    237a51742fed62d237b6f1b75452402f


    Headers

    Imports

    Sections

  • $PLUGINSDIR/AnimGif.dll
    .dll windows:4 windows x86 arch:x86

    b4b71331b921e2f441a2b05306cd7dae


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    57354bdeea3dfae6e948101add87501a


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/KillProcDLL.dll
    .dll windows:4 windows x86 arch:x86

    815c88741b87a0210c457b00b57bf9c6


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/KuWoNsis.dll
    .dll windows:4 windows x86 arch:x86

    de7c6ad5876b0334f431aa8a6de18cbf


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    4ec328f99bdd944fc98d8a5cf11f7a62


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $TEMP/config.ini
  • $WINDIR/KwYl.dat
  • CM.dll
    .dll windows:4 windows x86 arch:x86

    ba6815b89931d7d7f1bab956c0c4e209


    Headers

    Imports

    Exports

    Sections

  • Encode.exe
    .exe windows:4 windows x86 arch:x86

    2fb3a6de1549498f64413b2c61d554e2


    Headers

    Imports

    Sections

  • KwArd.ax
    .dll regsvr32 windows:4 windows x86 arch:x86

    b21440f286eda5d259606e7ea68416cc


    Headers

    Imports

    Exports

    Sections

  • KwFlashHolder.exe
    .exe windows:4 windows x86 arch:x86

    72314eca20b8f52ae5af44c7368c4bf3


    Headers

    Imports

    Sections

  • KwLogSvr.dll
    .dll windows:4 windows x86 arch:x86

    4e585b844e08a79fb85c64b039d3e166


    Headers

    Imports

    Exports

    Sections

  • KwMV.exe
    .exe windows:4 windows x86 arch:x86

    9b1335938ada8bfa2dfde0b7b113e4f4


    Headers

    Imports

    Sections

  • KwMusic.exe
    .exe windows:4 windows x86 arch:x86

    bdcd9029572cb138ceb892ee778f57c3


    Headers

    Imports

    Sections

  • KwUpdate.dll
    .dll windows:4 windows x86 arch:x86

    297f431c49b78083517c711c81b4ed93


    Headers

    Imports

    Exports

    Sections

  • Local/FirstSearchPath
  • Local/LastSearchPath
  • Local/NotSearchPath
  • LocalServer.dll
    .dll windows:4 windows x86 arch:x86

    70f69bbcc99a96ca038b6edfac1edb8e


    Headers

    Imports

    Exports

    Sections

  • Mplayer.dll
    .dll windows:4 windows x86 arch:x86

    d689b92a4a7bb0fad48d808f11ed2f00


    Headers

    Imports

    Exports

    Sections

  • Reco.dll
    .dll windows:4 windows x86 arch:x86

    08bbe9199493b3276d620adfbed8a8ca


    Headers

    Imports

    Exports

    Sections

  • Skin/ĬƤ/LoadingGif.gif
    .gif
  • Skin/ĬƤ/VoteWait.gif
    .gif
  • Skin/ĬƤ/defaultRichInfoPic.JPG
    .jpg
  • Skin/ĬƤ/down-icon.gif
    .gif
  • Skin/ĬƤ/downnotice.gif
    .gif
  • Skin/ĬƤ/localnotice.gif
    .gif
  • Skin/ĬƤ/panel.xml
    .xml
  • Skin/ĬƤ/skin.ini
  • Skin/ĬƤ/skin.jpg
    .jpg
  • Skin/ĬƤ/skinpack.pkg
  • Skin/ĬƤ/small.bmp
  • Skin/ֲģʽ/LoadingGif.gif
    .gif
  • Skin/ֲģʽ/VoteWait.gif
    .gif
  • Skin/ֲģʽ/defaultRichInfoPic.JPG
    .jpg
  • Skin/ֲģʽ/down-icon.gif
    .gif
  • Skin/ֲģʽ/downnotice.gif
    .gif
  • Skin/ֲģʽ/localnotice.gif
    .gif
  • Skin/ֲģʽ/panel.xml
  • Skin/ֲģʽ/skin.ini
  • Skin/ֲģʽ/skin.jpg
    .jpg
  • Skin/ֲģʽ/skinpack.pkg
  • Skin/ֲģʽ/small.bmp
  • Skin/_Ƥ/LoadingGif.gif
    .gif
  • Skin/_Ƥ/down-icon.gif
    .gif
  • Skin/_Ƥ/downnotice.gif
    .gif
  • Skin/_Ƥ/panel.xml
    .xml
  • Skin/_Ƥ/skinpack.pkg
  • Uninstall.exe
    .exe windows:4 windows x86 arch:x86

    237a51742fed62d237b6f1b75452402f


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    57354bdeea3dfae6e948101add87501a


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/KillProcDLL.dll
    .dll windows:4 windows x86 arch:x86

    815c88741b87a0210c457b00b57bf9c6


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    4ec328f99bdd944fc98d8a5cf11f7a62


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • appendDL.ini
  • config.ini
  • dotag.dll
    .dll windows:4 windows x86 arch:x86

    f9f8da243322a1364c8fe2e0e8e60d40


    Headers

    Imports

    Exports

    Sections

  • dump.ax
    .dll regsvr32 windows:4 windows x86 arch:x86

    43b351b97c09bced69fabc521570c7d9


    Headers

    Imports

    Exports

    Sections

  • face/KwDownloadLnk.ico
  • face/back.bmp
  • face/default.jpg
    .jpg
  • face/defaultbak/bk2_r1_c1.jpg
    .jpg
  • face/defaultbak/bk3_r1_c1.jpg
    .jpg
  • face/defaultbak/bk4_r1_c1.jpg
    .jpg
  • face/defaultbak/bk5_r1_c1.jpg
    .jpg
  • face/defaultbak/bkground1.jpg
    .jpg
  • face/defaultbak/bkground2.jpg
    .jpg
  • face/font.bmp
  • face/hand-close.cur
  • face/hand-open.cur
  • face/kwc.img
  • face/kwpcmd.img
  • face/kwplog.img
  • face/left.bmp
  • face/mp3.ico
  • face/pub.img
  • face/rigt.bmp
  • face/wma.ico
  • font-bk/dew.bmp
  • font-bk/flower.bmp
  • font-bk/flower2.bmp
  • font-bk/paw.bmp
  • font-bk/sand.bmp
  • font-bk/wheat.bmp
  • font-bk/.bmp
  • fzip.dll
    .dll windows:4 windows x86 arch:x86

    a5aa49288c0a7c3de2afdec329b50e5e


    Headers

    Imports

    Exports

    Sections

  • html/404.gif
    .gif
  • html/img/pass-mv.jpg
    .jpg
  • html/nomv.htm
    .html
  • html/weberror.htm
    .html .js polyglot
  • http.dll
    .dll windows:4 windows x86 arch:x86

    1228ab6b98f61aa3ee4d2af557b9aae0


    Headers

    Imports

    Exports

    Sections

  • instpage.gif
    .gif
  • kuwo-bk/black-grey.jpg
    .jpg
  • kuwo-bk/blue-crystal.jpg
    .jpg
  • kuwo-bk/blue-red.jpg
    .jpg
  • kuwo-bk/green-crystal.jpg
    .jpg
  • kuwo-bk/green-yellow.jpg
    .jpg
  • kuwo-bk/green.jpg
    .jpg
  • kuwo-bk/orange-crystal.jpg
    .jpg
  • kuwo-bk/pink-crystal.jpg
    .jpg
  • kuwo-bk/red-yellow.jpg
    .jpg
  • kuwo-bk/red-yellow2.jpg
    .jpg
  • lidx.dll
    .dll windows:4 windows x86 arch:x86

    8c845feab240c8462a132f7f50b13ee9


    Headers

    Imports

    Exports

    Sections

  • loading/ad/0.gif
    .gif
  • loading/ad/ad.ini
  • loading/ad/default_xjytualasfd001212123441lsfaoe.gif
    .gif
  • loading/ad/index0_loading.htm
    .html .js polyglot
  • lrcCfg.ini
  • mfc71.dll
    .dll windows:4 windows x86 arch:x86

    7397fb8b8633dd76aa9cbc7e2e0c24bd


    Headers

    Imports

    Sections

  • msvcp71.dll
    .dll windows:4 windows x86 arch:x86

    5e2398adb60a70c7ab04e7cba75a7983


    Headers

    Imports

    Exports

    Sections

  • msvcr71.dll
    .dll windows:4 windows x86 arch:x86

    7acc8c379c768a1ecd81ec502ff5f33e


    Headers

    Imports

    Exports

    Sections

  • pd.dll
    .dll windows:4 windows x86 arch:x86

    6c9f3ae4d33784c3595edf64284eae0c


    Headers

    Imports

    Exports

    Sections

  • player.dll
    .dll windows:4 windows x86 arch:x86

    77ee9f0fd5ebfd2ec3b3234db76d0413


    Headers

    Imports

    Exports

    Sections

  • readme.txt
  • recoEngine.exe
    .exe windows:4 windows x86 arch:x86

    9b5bd048e227b27db38a62425209dd20


    Headers

    Imports

    Sections

  • res/PanesData.xml
    .xml
  • res/artists.xml
  • res/coverflow/001.jpg
    .jpg
  • res/coverflow/1.JPG
    .jpg
  • res/coverflow/2.JPG
    .jpg
  • res/coverflow/3.JPG
    .jpg
  • res/coverflow/4.JPG
    .jpg
  • res/coverflow/5.JPG
    .jpg
  • res/coverflow/6.JPG
    .jpg
  • res/coverflow/7.JPG
    .jpg
  • res/coverflow/8.jpg
    .jpg
  • res/hot_singer.xml
  • res/mblistcount.xml
  • res/msg/bk.gif
    .gif
  • res/msg/bt1.gif
    .gif
  • res/msg/bt2.gif
    .gif
  • res/msg/msg.htm
    .html .js polyglot
  • res/oumei_singer.xml
  • res/ranks/ٶȸ.xml
  • res/ranks/ٶ¸.xml
  • res/ranks/ͯ.xml
  • res/ranks/DJ.xml
  • res/ranks/Ц.xml
  • res/ranks/ר.xml
  • res/ranks/仳.xml
  • res/ranks/OK.xml
  • res/ranks/ȸ.xml
  • res/ranks/¸.xml
  • res/ranks/.xml
  • res/ranks/СƷ.xml
  • res/rihan_singer.xml
  • res/starmenu2.0.xml
  • swf/MvComplete.swf
  • swf/MvMiniComplete.swf
  • swf/coverflow.swf
  • swf/directx.swf
  • swf/enjoy.swf
  • swf/load.swf
  • swf/mvstop.swf
  • swf/neterror.swf
  • swf/no.swf
  • swf/nomtv.swf
  • swf/nomv.swf
  • swf/nores.swf
  • swf/picexception.swf
  • swf/serverbusy.swf
  • zlib.dll
    .dll windows:4 windows x86 arch:x86

    6ca5129cf676bf086156341822a28d95


    Headers

    Imports

    Exports

    Sections

  • cfts0521syjs/飘荡精品软件.url
    .url