General

  • Target

    252605a3274b993f1b4a9c72b5735ba9_JaffaCakes118

  • Size

    4.8MB

  • MD5

    252605a3274b993f1b4a9c72b5735ba9

  • SHA1

    5446db3205396cf7c0069d5bc24fa2758bb449ab

  • SHA256

    91046a66176dee00005b82147720807382183951e331436558521585be338072

  • SHA512

    2eed3950efcba088f158301f3e1b3b99e1e5badef9f395f809a85e6573dd3b793564dc11e693c3f5b09eceb83175b1b8272edf3a4b42472632e55b334c8d1e0e

  • SSDEEP

    98304:e6FC8Fk926IawziAEcajQ4DdJj9Z4Tt8seoDufC7fjlZbDDB76/NFJh8MGBjVoMt:e6sE3tbiPjQ4DdJjz4feC7fLT1yNHKmq

Score
3/10

Malware Config

Signatures

  • Unsigned PE 12 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 3 IoCs

Files

  • 252605a3274b993f1b4a9c72b5735ba9_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    237a51742fed62d237b6f1b75452402f


    Headers

    Imports

    Sections

  • $1
  • $APPDATA/kuwo/Conf/p2pconf/setup.xml
    .xml
  • $PLUGINSDIR/Base64.dll
    .dll windows:4 windows x86 arch:x86

    472def3d6dc5d4ffe27376a831b4d49b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    57354bdeea3dfae6e948101add87501a


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/KillProcDLL.dll
    .dll windows:4 windows x86 arch:x86

    815c88741b87a0210c457b00b57bf9c6


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/KuWoNsis_new.dll
    .dll windows:5 windows x86 arch:x86

    4ab986f64a1874664feabca76ad3c867


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    4ec328f99bdd944fc98d8a5cf11f7a62


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/inetc.dll
    .dll windows:4 windows x86 arch:x86

    5d31a4a9e83c0a8e38bab1f57d28402c


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/kwsobar.bmp
  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/sobar/KwMusic_sobar.ini
  • $TEMP/KWMUSIC/BindConfig.ini
  • $TEMP/KWMUSIC/DownloadUpdate.exe
    .exe windows:4 windows x86 arch:x86

    237a51742fed62d237b6f1b75452402f


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/Base64.dll
    .dll windows:4 windows x86 arch:x86

    472def3d6dc5d4ffe27376a831b4d49b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/KuWoNsis_new.dll
    .dll windows:5 windows x86 arch:x86

    7666470595ee14366c90d3ea4ce2cc79


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    4ec328f99bdd944fc98d8a5cf11f7a62


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/inetc.dll
    .dll windows:4 windows x86 arch:x86

    5d31a4a9e83c0a8e38bab1f57d28402c


    Headers

    Imports

    Exports

    Sections

  • $TEMP/sobar/Baidu-TB-ASBar-Silent_kuwo.exe
    .exe windows:4 windows x86 arch:x86

    b711f65a9aff6a22fb2f57f0ac8bda33


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAM_FILES/Baidu/ASBarBroker.exe
    .exe windows:4 windows x86 arch:x86

    8cb73f23fc4ffce04345bba981c347fe


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAM_FILES/Baidu/AddressBar.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    c6079cff13dd538f8c2b93227d9d6d6c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PROGRAM_FILES/Baidu/Toolbar/BaiduBarX_Tmp/BaiduBarX.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    33a23b97aefe5d050829989e159851d0


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PROGRAM_FILES/Baidu/Toolbar/BaiduBarX_Tmp/BarBroker.exe
    .exe windows:4 windows x86 arch:x86

    118d99c3f6c480f98032ef338c8ef1ff


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAM_FILES/Baidu/Toolbar/BaiduBarX_Tmp/rc.dll
    .dll windows:4 windows x86 arch:x86

    d811d71710ad58776155b7a8da1fa9db


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAM_FILES/Baidu/conf.xml
    .xml
  • KwMusic.exe
    .exe windows:5 windows x86 arch:x86

    9547b090d1419a87e737bcbdaf9459ee


    Code Sign

    Headers

    Imports

    Sections

  • Microsoft.VC90.CRT.manifest
  • Microsoft.VC90.MFC.manifest
  • bin/AdbWinApi.dll
    .dll windows:6 windows x86 arch:x86

    c64cac39044626770353879245ea25e4


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/CKuwoPlayer.dll
    .dll windows:5 windows x86 arch:x86

    8e4880f7ceeb969715f545f8789e05e6


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/CWmpPlayer.dll
    .dll windows:5 windows x86 arch:x86

    ffa030b08ed1f9b091f130d76d941a26


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/CoreAVC0.ax
    .dll regsvr32 windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • bin/DshowPlayer.dll
    .dll windows:5 windows x86 arch:x86

    c2fc6c65c65dee68f090be73650dc20a


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/Encode.exe
    .exe windows:5 windows x86 arch:x86

    da51d131c2d14a263ced57385b829735


    Code Sign

    Headers

    Imports

    Sections

  • bin/KuwoDaemon.apk
    .apk android

    cn.kuwo.service


  • bin/KuwoSyncMobile.dll
    .dll windows:5 windows x86 arch:x86

    f5715e27935fa8d26da66f735b304257


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwAni.dll
    .dll windows:5 windows x86 arch:x86

    da76944fe7c41bfb041ed1007ab49887


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwCommonUI.dll
    .dll windows:5 windows x86 arch:x86

    b706ef542dd837f2c838a02a865914a5


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwDataDef.dll
    .dll windows:5 windows x86 arch:x86

    f61424874fa4f63b3494f7e7af4691ae


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwHttpRequestMgr.dll
    .dll windows:5 windows x86 arch:x86

    ad594ec826926d69e57f260286f54364


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwInfos.exe
    .exe windows:5 windows x86 arch:x86

    070fa26a8607adbba405b5c46456a213


    Code Sign

    Headers

    Imports

    Sections

  • bin/KwLayoutMgr.dll
    .dll windows:5 windows x86 arch:x86

    633774140475d79d39e9bb02b81bab78


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwLib.dll
    .dll windows:5 windows x86 arch:x86

    97777a26992f8d214f8d56108389f7a1


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwLog.dll
    .dll windows:5 windows x86 arch:x86

    7195839c82feba93093939896b39b663


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwMV.exe
    .exe windows:5 windows x86 arch:x86

    32fc47166148239368673e083f1c57b2


    Code Sign

    Headers

    Imports

    Sections

  • bin/KwModAppStore.dll
    .dll windows:5 windows x86 arch:x86

    9c61c6bf7f84b38c4ab7969815ba6e57


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwModConfig.dll
    .dll windows:5 windows x86 arch:x86

    637ef37b6e0205cce5b8cddc72dc5a10


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwModDownload.dll
    .dll windows:5 windows x86 arch:x86

    911ee83dc5176a4691144e4c725619be


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwModGameEntry.dll
    .dll windows:5 windows x86 arch:x86

    cc08f7561e6ff01decd4c1fe92d15ca1


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwModHotKey.dll
    .dll windows:5 windows x86 arch:x86

    e4a7d279b921e2ccc73c424f05c23435


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwModLocalMusic.dll
    .dll windows:5 windows x86 arch:x86

    fcdc4355c29fa9548189413e403bb07b


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwModLyric.dll
    .dll windows:5 windows x86 arch:x86

    99ccaf5729ccb0fc6a55568cf36e9b07


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwModLyricShow.dll
    .dll windows:5 windows x86 arch:x86

    d029c248fe3a894c6a9fa949e80b1dab


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwModNetSong.dll
    .dll windows:5 windows x86 arch:x86

    14ce443269b016082fee654a791bfbcd


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwModPicShow.dll
    .dll windows:5 windows x86 arch:x86

    5c7db7c47522648c1b37f6b3701198f4


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwModPlaylist.dll
    .dll windows:5 windows x86 arch:x86

    35bac0b26c9be7cbfb3c482467fdc0d8


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwModSayHello.dll
    .dll windows:5 windows x86 arch:x86

    1c64e5207219932bc4fbe24746fa4175


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwModSkinManager.dll
    .dll windows:5 windows x86 arch:x86

    415dfce658a107cf0225338d192fdbe3


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwModSynList.dll
    .dll windows:5 windows x86 arch:x86

    cf529cf1b2c68dfb8b4da3ef72c95aaf


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwModUpdateWeb.dll
    .dll windows:5 windows x86 arch:x86

    90d4ee239e39aab2339dea8057e211fd


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwModWebRecommend.dll
    .dll windows:5 windows x86 arch:x86

    ee1baf81adbe1d34f4978616a3f57ba0


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwMusic.exe
    .exe windows:5 windows x86 arch:x86

    cac6fef7e432c46c4714cd53150a8cb9


    Code Sign

    Headers

    Imports

    Sections

  • bin/KwMusicCore.dll
    .dll windows:5 windows x86 arch:x86

    69007de6b0e2b0e1e657c7a0879d1202


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwPlayerConf.dll
    .dll windows:5 windows x86 arch:x86

    4182c2026f055e27af2856216afe02a7


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwRecoSong.dll
    .dll windows:5 windows x86 arch:x86

    1004df9995516c708575c2e1703d6d8a


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwSongCache.dll
    .dll windows:5 windows x86 arch:x86

    5d9585b2039e21017c3d57ca5c3e3ebe


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwTagLib.dll
    .dll windows:5 windows x86 arch:x86

    7415c99ece6ff715821d8e5ab4486bd5


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwUpdate.dll
    .dll windows:5 windows x86 arch:x86

    e79343b94d30677484f647b6a4a775cb


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/MatroskaSplitter.ax
    .dll regsvr32 windows:5 windows x86 arch:x86

    201800fb7a5c798ffd72fee7d23cc650


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/MediaInfo.dll
    .dll windows:5 windows x86 arch:x86

    f94b2501cb412c90755b7f0be1dedd32


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/Microsoft.VC90.CRT.manifest
  • bin/Microsoft.VC90.MFC.manifest
  • bin/Module.xml
    .xml
  • bin/MpaDecFilter.ax
    .dll regsvr32 windows:4 windows x86 arch:x86

    49fe25334afea175223d3ae146a8e0b9


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/Pet.exe
    .exe windows:5 windows x86 arch:x86

    23a76947ec632acb9fe8805703b5491c


    Code Sign

    Headers

    Imports

    Sections

  • bin/PetD.dll
    .dll windows:5 windows x86 arch:x86

    a063581d4c724f9f78229e856ac14cc1


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/PetU.dll
    .dll windows:5 windows x86 arch:x86

    03ad75b9f5a4f3e6a378d27c591434d7


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/PlayerCore.dll
    .dll windows:5 windows x86 arch:x86

    8f54b4ff83a250ab29d14dc4ab225ae3


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/UIAvMgr.dll
    .dll windows:5 windows x86 arch:x86

    afdbaf59dbe30809de3d3d415cf3a581


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/UIConfig.dll
    .dll windows:5 windows x86 arch:x86

    2f24fec65ca218ad29d9ccc0cfb91e16


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/UIDownload.dll
    .dll windows:5 windows x86 arch:x86

    1247902371a87007655041eb3e80c087


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/UIDrawLyricMgr.dll
    .dll windows:5 windows x86 arch:x86

    cd6de210f9be47e2b5eb5bbf0cb29f86


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/UIEqualizer.dll
    .dll windows:5 windows x86 arch:x86

    8a5c9f1f7f628ac50a47f06a20cbd3fc


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/UILocalMusic.dll
    .dll windows:5 windows x86 arch:x86

    1e696743e066dcffe3910fb44ec255da


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/UILyricDesk.dll
    .dll windows:5 windows x86 arch:x86

    3a406aba51b0e6e450259ee8d431f2b4


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/UILyricNowPlay.dll
    .dll windows:5 windows x86 arch:x86

    1b53e19c8cde15432a8d5a76e22a8cf6


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/UIMVWnd.dll
    .dll windows:5 windows x86 arch:x86

    c6b4153f58cb5a7e7877e4113c3dc30f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/UIMiniPanel.dll
    .dll windows:5 windows x86 arch:x86

    4cfee4ab0c59c4515a35d3fcac5b59c7


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/UINetSongLib.dll
    .dll windows:5 windows x86 arch:x86


    Headers

    Sections

  • bin/plugin/Microsoft.VC90.CRT.manifest
  • bin/plugin/Microsoft.VC90.MFC.manifest
  • readme.txt