General

  • Target

    b4916e72b4576716a85df0e68f1ce674_JaffaCakes118

  • Size

    4.7MB

  • MD5

    b4916e72b4576716a85df0e68f1ce674

  • SHA1

    954092d5e6a0a79146756433ff6522f7327a0a3a

  • SHA256

    15855eb71ab14975030f8556e6f375d0dc1119d3c577f960d9cf74b8994a0ea1

  • SHA512

    8b563791ff77bd7d60587b0b1354efff4a250cadddfd2f6e227c4e7bad66514416ee0b27014a5dce94e942d9fdc0add48da1d54996d17634b3935eaa097dc6ee

  • SSDEEP

    98304:/eaW6gzbg4hUmOJTn0hpv86EFptzmihHip72w8zQB9jeH:/evzbhhUFOhpk6EPtzphYPeH

Score
3/10

Malware Config

Signatures

  • Unsigned PE 7 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs

Files

  • b4916e72b4576716a85df0e68f1ce674_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    1c042238f43557c055fca8642de8a074


    Code Sign

    Headers

    Imports

    Sections

  • $APPDATA/kuwodata/kwshow/Conf/User/licence.txt
  • $PLUGINSDIR/KWGameBox.dll
    .dll windows:5 windows x86 arch:x86

    0214c00ca345b4ffa8325c14eba9e8a7


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/KillProcDLL.dll
    .dll windows:4 windows x86 arch:x86

    153027ec3b10bcea606b777657dd3402


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/KuWoNsis_new.dll
    .dll windows:5 windows x86 arch:x86

    4ab986f64a1874664feabca76ad3c867


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/KuWoRes/ReadMe.txt
  • $PLUGINSDIR/KuWoRes/ad01.png
    .png
  • $PLUGINSDIR/KuWoRes/ad02.png
    .png
  • $PLUGINSDIR/KuWoRes/ad03.png
    .png
  • $PLUGINSDIR/KuWoRes/agree1.png
    .png
  • $PLUGINSDIR/KuWoRes/agree2.png
    .png
  • $PLUGINSDIR/KuWoRes/arrowd.png
    .png
  • $PLUGINSDIR/KuWoRes/arrows.png
    .png
  • $PLUGINSDIR/KuWoRes/bg.png
    .png
  • $PLUGINSDIR/KuWoRes/bg_repair.png
    .png
  • $PLUGINSDIR/KuWoRes/browsed.png
    .png
  • $PLUGINSDIR/KuWoRes/browseh.png
    .png
  • $PLUGINSDIR/KuWoRes/browsen.png
    .png
  • $PLUGINSDIR/KuWoRes/browsep.png
    .png
  • $PLUGINSDIR/KuWoRes/btins0.png
    .png
  • $PLUGINSDIR/KuWoRes/btins2.png
    .png
  • $PLUGINSDIR/KuWoRes/btins3.png
    .png
  • $PLUGINSDIR/KuWoRes/btinsl.png
    .png
  • $PLUGINSDIR/KuWoRes/btnd.png
    .png
  • $PLUGINSDIR/KuWoRes/btnh.png
    .png
  • $PLUGINSDIR/KuWoRes/btnn.png
    .png
  • $PLUGINSDIR/KuWoRes/btnn01.png
    .png
  • $PLUGINSDIR/KuWoRes/btnn02.png
    .png
  • $PLUGINSDIR/KuWoRes/btnn03.png
    .png
  • $PLUGINSDIR/KuWoRes/btnn1.png
    .png
  • $PLUGINSDIR/KuWoRes/btnn2.png
    .png
  • $PLUGINSDIR/KuWoRes/btnn3.png
    .png
  • $PLUGINSDIR/KuWoRes/btnp.png
    .png
  • $PLUGINSDIR/KuWoRes/btun1.png
    .png
  • $PLUGINSDIR/KuWoRes/btun2.png
    .png
  • $PLUGINSDIR/KuWoRes/btun3.png
    .png
  • $PLUGINSDIR/KuWoRes/check.bmp
  • $PLUGINSDIR/KuWoRes/checkc.png
    .png
  • $PLUGINSDIR/KuWoRes/checku.png
    .png
  • $PLUGINSDIR/KuWoRes/close0.png
    .png
  • $PLUGINSDIR/KuWoRes/close1.png
    .png
  • $PLUGINSDIR/KuWoRes/close2.png
    .png
  • $PLUGINSDIR/KuWoRes/complete.ini
  • $PLUGINSDIR/KuWoRes/complete1.png
    .png
  • $PLUGINSDIR/KuWoRes/complete2.png
    .png
  • $PLUGINSDIR/KuWoRes/complete3.png
    .png
  • $PLUGINSDIR/KuWoRes/directory.ini
  • $PLUGINSDIR/KuWoRes/edit.png
    .png
  • $PLUGINSDIR/KuWoRes/insl1.jpg
    .jpg
  • $PLUGINSDIR/KuWoRes/insl1.png
    .png
  • $PLUGINSDIR/KuWoRes/insl2.jpg
    .jpg
  • $PLUGINSDIR/KuWoRes/insl2.png
    .png
  • $PLUGINSDIR/KuWoRes/insl3.jpg
    .jpg
  • $PLUGINSDIR/KuWoRes/insl4.jpg
    .jpg
  • $PLUGINSDIR/KuWoRes/instfiles.ini
  • $PLUGINSDIR/KuWoRes/licence.ini
  • $PLUGINSDIR/KuWoRes/licence.txt
  • $PLUGINSDIR/KuWoRes/logo.png
    .png
  • $PLUGINSDIR/KuWoRes/main.ini
  • $PLUGINSDIR/KuWoRes/minimize0.png
    .png
  • $PLUGINSDIR/KuWoRes/minimize1.png
    .png
  • $PLUGINSDIR/KuWoRes/minimize2.png
    .png
  • $PLUGINSDIR/KuWoRes/prg_fill_l.png
    .png
  • $PLUGINSDIR/KuWoRes/prg_fill_m.png
    .png
  • $PLUGINSDIR/KuWoRes/prg_fill_r.png
    .png
  • $PLUGINSDIR/KuWoRes/prg_l.png
    .png
  • $PLUGINSDIR/KuWoRes/prg_m.png
    .png
  • $PLUGINSDIR/KuWoRes/prg_r.png
    .png
  • $PLUGINSDIR/KuWoRes/prog_fill_l.png
    .png
  • $PLUGINSDIR/KuWoRes/prog_fill_m.png
    .png
  • $PLUGINSDIR/KuWoRes/prog_fill_r.png
    .png
  • $PLUGINSDIR/KuWoRes/prog_l.png
    .png
  • $PLUGINSDIR/KuWoRes/prog_m.png
    .png
  • $PLUGINSDIR/KuWoRes/prog_r.png
    .png
  • $PLUGINSDIR/KuWoRes/radioc.png
    .png
  • $PLUGINSDIR/KuWoRes/radiou.png
    .png
  • $PLUGINSDIR/KuWoRes/reinstfiles.ini
  • $PLUGINSDIR/KuWoRes/reinstfiles_suc.ini
  • $PLUGINSDIR/KuWoRes/remain.ini
  • $PLUGINSDIR/KuWoRes/remain_suc.ini
  • $PLUGINSDIR/KuWoRes/repair_failed.png
    .png
  • $PLUGINSDIR/KuWoRes/repair_ing.png
    .png
  • $PLUGINSDIR/KuWoRes/repair_suc.png
    .png
  • $PLUGINSDIR/KuWoRes/unbg.png
    .png
  • $PLUGINSDIR/KuWoRes/unconfirm.ini
  • $PLUGINSDIR/KuWoRes/unfeedback.ini
  • $PLUGINSDIR/KuWoRes/uninstfiles.ini
  • $PLUGINSDIR/KuWoRes/unmain.ini
  • $PLUGINSDIR/KuWoRes/unrepair.ini
  • $PLUGINSDIR/KuWoRes/welcom2.png
    .png
  • $PLUGINSDIR/KuWoRes/welcome.ini
  • $PLUGINSDIR/KuWoRes/°²×°01-»¶Ó­.jpg
    .jpg
  • $PLUGINSDIR/KuWoRes/°²×°02-Ñ¡Ïî.jpg
    .jpg
  • $PLUGINSDIR/KuWoRes/°²×°03-°²×°.jpg
    .jpg
  • $PLUGINSDIR/KuWoRes/°²×°04-Íê³É.jpg
    .jpg
  • $PLUGINSDIR/KuWoRes/µÇ¼1.jpg
    .jpg
  • $PLUGINSDIR/KuWoRes/жÔØ1.jpg
    .jpg
  • $PLUGINSDIR/KuWoRes/жÔØ2.jpg
    .jpg
  • $PLUGINSDIR/KuWoRes/жÔØ3.jpg
    .jpg
  • $PLUGINSDIR/NsisCrypt.dll
    .dll windows:5 windows x86 arch:x86

    0f7c068976b63e2ce4d710bf595f48ea


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    4ec328f99bdd944fc98d8a5cf11f7a62


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/inetc.dll
    .dll windows:4 windows x86 arch:x86

    5bdcdde5acd7b395f3f3d19ebbb8c6cd


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:4 windows x86 arch:x86

    c193ea402999ea8ce8faa9fef22de03d


    Headers

    Imports

    Exports

    Sections

  • 185.png
    .png
  • Conf/Default/config.ini
  • DuiLib.dll
    .dll windows:5 windows x86 arch:x86

    5d6344c388d6efe9a05f627831a53640


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • DumpReport.exe
    .exe windows:5 windows x86 arch:x86

    b5ddeb63a8ecbb5d856ca812b71a6609


    Code Sign

    Headers

    Imports

    Sections

  • IEProxy.dll
    .dll windows:5 windows x86 arch:x86

    9a2cfe8eda271e05f189b0757c634bfa


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • KXShortcuts.exe
    .exe windows:4 windows x86 arch:x86

    ac59ef867b8a7b62b8b00a46504c7b8f


    Code Sign

    Headers

    Imports

    Sections

  • KwDataDef.dll
    .dll windows:5 windows x86 arch:x86

    aaac363926aa303ebf155c6cf50bf0b7


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • KwHttp.dll
    .dll windows:5 windows x86 arch:x86

    6e938c3f56ec0c41981c01bdb393412b


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • KwHttpRequestMgr.dll
    .dll windows:5 windows x86 arch:x86

    a75eb8f96d579241abae3a7402a37d6b


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • KwLib.dll
    .dll windows:5 windows x86 arch:x86

    618e173a211e19dd73a79c2e4de303d3


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • KwLog.dll
    .dll windows:5 windows x86 arch:x86

    06deae85d785dd1b360e9dc939ed6b53


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • KwModConfig.dll
    .dll windows:5 windows x86 arch:x86

    65f0d2ddf9dace4abd243e6d1a9f5a3b


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • KwModNotice.dll
    .dll windows:5 windows x86 arch:x86

    86a5e903ffaa524a6d8afa71a80aacb6


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • KwMusicCore.dll
    .dll windows:5 windows x86 arch:x86

    8b25d802bae4f96a896da9b24728f670


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • KwShow.exe
    .exe windows:5 windows x86 arch:x86

    4f6a5fab5eeb844cbcddb6e742f2d0a8


    Code Sign

    Headers

    Imports

    Sections

  • KwShowIE.exe
    .exe windows:5 windows x86 arch:x86

    b4ac6f9b5353d13b61245de826955157


    Code Sign

    Headers

    Imports

    Sections

  • KwUpdate.dll
    .dll windows:5 windows x86 arch:x86

    882181758b534028d4194a9414c66644


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Microsoft.VC90.CRT.manifest
  • Module.xml
    .xml
  • Zlib.dll
    .dll windows:5 windows x86 arch:x86

    8ddca4674f3eecfa1d4208e111de86fd


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ccenter.dll
    .dll windows:5 windows x86 arch:x86

    8f977c87c92b98ae85faabb8a2f5cdb8


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • html/errbtn.gif
    .gif
  • html/error.gif
    .gif
  • html/error.html
  • html/loading.html
    .html
  • html/loading.swf
  • licence.txt
  • msvcp90.dll
    .dll windows:5 windows x86 arch:x86

    c2219f463c61f3122c87331837e12c34


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • msvcr90.dll
    .dll windows:5 windows x86 arch:x86

    0fda4497453286b1daa098623dfc53ce


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • plugin.xml
  • skin/base/KwConfig.xml
    .xml
  • skin/base/KwExitConfigDlg.xml
    .xml
  • skin/base/KwShowDlg.xml
  • skin/base/ThirdLoginDlg.xml
  • skin/base/UpdateTipDialog.xml
    .xml
  • skin/base/cursor/hand-close.cur
  • skin/base/cursor/hand-open.cur
  • skin/base/logindlg.xml
  • skin/base/msgbox.xml
    .xml
  • skin/base/registerdlg.xml
  • skin/base/skin.dat
  • skin/base/skin.xml