General

  • Target

    0de859f4b48c7c80a1ec1ddd3d331660_JaffaCakes118

  • Size

    3.7MB

  • MD5

    0de859f4b48c7c80a1ec1ddd3d331660

  • SHA1

    704e0894c9bffa72e9331931a15b962203fc025c

  • SHA256

    cedc53c36b7127f12e00e9d080f7936de43f06c93226c0d972ff6fc6710f4eb9

  • SHA512

    0c54a3ad210f8c1a9ad3e2de5bd7b56ee3efd4b74e5fdb6d48d919b2500038e70471a1181c0edd81c4ee9f9fc8fce185a8faf12c55184529ec3aeb30837eb9d2

  • SSDEEP

    98304:6GQMTptopOZQdcXGFJ5HkWP8xbjz5R90CZM6Oq3y7ZayPxw:6Gedd3FJ5HkbF9MbQy7Z1w

Score
3/10

Malware Config

Signatures

  • Unsigned PE 46 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 3 IoCs

Files

  • 0de859f4b48c7c80a1ec1ddd3d331660_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    237a51742fed62d237b6f1b75452402f


    Headers

    Imports

    Sections

  • $1
  • $APPDATA/kuwo/Conf/p2pconf/setup.xml
    .xml
  • $PLUGINSDIR/Base64.dll
    .dll windows:4 windows x86 arch:x86

    472def3d6dc5d4ffe27376a831b4d49b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    57354bdeea3dfae6e948101add87501a


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/KillProcDLL.dll
    .dll windows:4 windows x86 arch:x86

    815c88741b87a0210c457b00b57bf9c6


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/KuWoNsis_new.dll
    .dll windows:4 windows x86 arch:x86

    c1c7e2e49a726b988d79dc6456f258fb


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    4ec328f99bdd944fc98d8a5cf11f7a62


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/inetc.dll
    .dll windows:4 windows x86 arch:x86

    5d31a4a9e83c0a8e38bab1f57d28402c


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/kwsobar.bmp
  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/sobar/KwMusic_sobar.ini
  • $TEMP/KWMUSIC/BindConfig.ini
  • $TEMP/KWMUSIC/DownloadUpdate.exe
    .exe windows:4 windows x86 arch:x86

    237a51742fed62d237b6f1b75452402f


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/Base64.dll
    .dll windows:4 windows x86 arch:x86

    472def3d6dc5d4ffe27376a831b4d49b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/KuWoNsis_new.dll
    .dll windows:4 windows x86 arch:x86

    29fd838184a64d185951b6564c3a17b4


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    4ec328f99bdd944fc98d8a5cf11f7a62


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/inetc.dll
    .dll windows:4 windows x86 arch:x86

    5d31a4a9e83c0a8e38bab1f57d28402c


    Headers

    Imports

    Exports

    Sections

  • $TEMP/sobar/Baidu-TB-ASBar-Silent_kuwo.exe
    .exe windows:4 windows x86 arch:x86

    b711f65a9aff6a22fb2f57f0ac8bda33


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAM_FILES/Baidu/ASBarBroker.exe
    .exe windows:4 windows x86 arch:x86

    8cb73f23fc4ffce04345bba981c347fe


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAM_FILES/Baidu/AddressBar.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    c6079cff13dd538f8c2b93227d9d6d6c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PROGRAM_FILES/Baidu/Toolbar/BaiduBarX_Tmp/BaiduBarX.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    6f1baaeb9228dcc6d194c39af6ab9519


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PROGRAM_FILES/Baidu/Toolbar/BaiduBarX_Tmp/BarBroker.exe
    .exe windows:4 windows x86 arch:x86

    94f6cb58c75c90f3be7ae4e45c80a52d


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAM_FILES/Baidu/Toolbar/BaiduBarX_Tmp/rc.dll
    .dll windows:4 windows x86 arch:x86

    d811d71710ad58776155b7a8da1fa9db


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAM_FILES/Baidu/conf.xml
    .xml
  • KwMusic.exe
    .exe windows:5 windows x86 arch:x86

    d37436deaf839aaae619193b8b8393aa


    Code Sign

    Headers

    Imports

    Sections

  • bin/AdbWinApi.dll
    .dll windows:6 windows x86 arch:x86

    c64cac39044626770353879245ea25e4


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/CKuwoPlayer.dll
    .dll windows:5 windows x86 arch:x86

    8e4880f7ceeb969715f545f8789e05e6


    Headers

    Imports

    Exports

    Sections

  • bin/CWmpPlayer.dll
    .dll windows:5 windows x86 arch:x86

    ffa030b08ed1f9b091f130d76d941a26


    Headers

    Imports

    Exports

    Sections

  • bin/CoreAVC0.ax
    .dll regsvr32 windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • bin/DshowPlayer.dll
    .dll windows:5 windows x86 arch:x86

    51011157c8eff9ae62263977212e0b44


    Headers

    Imports

    Exports

    Sections

  • bin/Encode.exe
    .exe windows:5 windows x86 arch:x86

    da51d131c2d14a263ced57385b829735


    Code Sign

    Headers

    Imports

    Sections

  • bin/KuwoSyncMobile.dll
    .dll windows:5 windows x86 arch:x86

    9378ddfc64538dd57b7b67c7d3889d54


    Headers

    Imports

    Exports

    Sections

  • bin/KwAni.dll
    .dll windows:5 windows x86 arch:x86

    da76944fe7c41bfb041ed1007ab49887


    Headers

    Imports

    Exports

    Sections

  • bin/KwCommonUI.dll
    .dll windows:5 windows x86 arch:x86

    7d4645950b02b81d8ece8c29ef74f975


    Headers

    Imports

    Exports

    Sections

  • bin/KwDataDef.dll
    .dll windows:5 windows x86 arch:x86

    16bba5ccf54036ca4f864dc847e362c4


    Headers

    Imports

    Exports

    Sections

  • bin/KwHttpRequestMgr.dll
    .dll windows:5 windows x86 arch:x86

    ad594ec826926d69e57f260286f54364


    Headers

    Imports

    Exports

    Sections

  • bin/KwInfos.exe
    .exe windows:5 windows x86 arch:x86

    b19d01a4507760d99b71d57202310dd9


    Headers

    Imports

    Sections

  • bin/KwLayoutMgr.dll
    .dll windows:5 windows x86 arch:x86

    94918f7d606373aebf3e4300b702cedf


    Headers

    Imports

    Exports

    Sections

  • bin/KwLib.dll
    .dll windows:5 windows x86 arch:x86

    9332c498715fa3faa44e481db36e3345


    Headers

    Imports

    Exports

    Sections

  • bin/KwLog.dll
    .dll windows:5 windows x86 arch:x86

    7195839c82feba93093939896b39b663


    Headers

    Imports

    Exports

    Sections

  • bin/KwMV.exe
    .exe windows:5 windows x86 arch:x86

    32fc47166148239368673e083f1c57b2


    Headers

    Imports

    Sections

  • bin/KwModAppStore.dll
    .dll windows:5 windows x86 arch:x86

    23b5bf62c04b5952488c6d03bc637b8b


    Headers

    Imports

    Exports

    Sections

  • bin/KwModConfig.dll
    .dll windows:5 windows x86 arch:x86

    637ef37b6e0205cce5b8cddc72dc5a10


    Headers

    Imports

    Exports

    Sections

  • bin/KwModDownload.dll
    .dll windows:5 windows x86 arch:x86

    1630fd77e9c70f2e6f20cb9547ea7c68


    Headers

    Imports

    Exports

    Sections

  • bin/KwModGameEntry.dll
    .dll windows:5 windows x86 arch:x86

    4181c9cdc615ca2115ee5350cc276a18


    Headers

    Imports

    Exports

    Sections

  • bin/KwModHotKey.dll
    .dll windows:5 windows x86 arch:x86

    e4a7d279b921e2ccc73c424f05c23435


    Headers

    Imports

    Exports

    Sections

  • bin/KwModLocalMusic.dll
    .dll windows:5 windows x86 arch:x86

    339be849a5f26be420eb75cf083c8086


    Headers

    Imports

    Exports

    Sections

  • bin/KwModLyric.dll
    .dll windows:5 windows x86 arch:x86

    20d647a392334dd7ddaf68ae6e5695ba


    Headers

    Imports

    Exports

    Sections

  • bin/KwModLyricShow.dll
    .dll windows:5 windows x86 arch:x86

    046b55cc27f33b11acd50202413c7371


    Headers

    Imports

    Exports

    Sections

  • bin/KwModNetSong.dll
    .dll windows:5 windows x86 arch:x86

    72baada4d7fa57a293908283d92e605e


    Headers

    Imports

    Exports

    Sections

  • bin/KwModPicShow.dll
    .dll windows:5 windows x86 arch:x86

    5c7db7c47522648c1b37f6b3701198f4


    Headers

    Imports

    Exports

    Sections

  • bin/KwModPlaylist.dll
    .dll windows:5 windows x86 arch:x86

    2728fabc1f835a3fa61e88dfece888e1


    Headers

    Imports

    Exports

    Sections

  • bin/KwModSayHello.dll
    .dll windows:5 windows x86 arch:x86

    1c64e5207219932bc4fbe24746fa4175


    Headers

    Imports

    Exports

    Sections

  • bin/KwModSkinManager.dll
    .dll windows:5 windows x86 arch:x86

    415dfce658a107cf0225338d192fdbe3


    Headers

    Imports

    Exports

    Sections

  • bin/KwModSynList.dll
    .dll windows:5 windows x86 arch:x86

    163f6ab2555da87a49fa75758f8d1037


    Headers

    Imports

    Exports

    Sections

  • bin/KwModUpdateWeb.dll
    .dll windows:5 windows x86 arch:x86

    90d4ee239e39aab2339dea8057e211fd


    Headers

    Imports

    Exports

    Sections

  • bin/KwModWebRecommend.dll
    .dll windows:5 windows x86 arch:x86

    ee1baf81adbe1d34f4978616a3f57ba0


    Headers

    Imports

    Exports

    Sections

  • bin/KwMusic.exe
    .exe windows:5 windows x86 arch:x86

    d617efe871c8871c9678cbac11386775


    Headers

    Imports

    Sections

  • bin/KwMusicCore.dll
    .dll windows:5 windows x86 arch:x86

    69007de6b0e2b0e1e657c7a0879d1202


    Headers

    Imports

    Exports

    Sections

  • bin/KwPlayerConf.dll
    .dll windows:5 windows x86 arch:x86

    4182c2026f055e27af2856216afe02a7


    Headers

    Imports

    Exports

    Sections

  • bin/KwRecoSong.dll
    .dll windows:5 windows x86 arch:x86

    1004df9995516c708575c2e1703d6d8a


    Headers

    Imports

    Exports

    Sections

  • bin/KwTagLib.dll
    .dll windows:5 windows x86 arch:x86

    7415c99ece6ff715821d8e5ab4486bd5


    Headers

    Imports

    Exports

    Sections

  • bin/KwUpdate.dll
    .dll windows:5 windows x86 arch:x86

    e79343b94d30677484f647b6a4a775cb


    Headers

    Imports

    Exports

    Sections

  • bin/MatroskaSplitter.ax
    .dll regsvr32 windows:5 windows x86 arch:x86

    201800fb7a5c798ffd72fee7d23cc650


    Headers

    Imports

    Exports

    Sections

  • bin/MediaInfo.dll
    .dll windows:5 windows x86 arch:x86


    Headers

    Sections

  • readme.txt