General

  • Target

    454b81e2db5fb5cfcd2771fe2fc88aa9_JaffaCakes118

  • Size

    2.2MB

  • MD5

    454b81e2db5fb5cfcd2771fe2fc88aa9

  • SHA1

    d91b536c4127a455d3eb8f4905f4a8c9000a4159

  • SHA256

    2e63a34e42b526e022095fa671f5f255cc0683905e7733c4f68a46a735dc9a28

  • SHA512

    066fc1dd37b97d8035763ffc92a7d3e0769e772baf9938709d5f003e64deabe236e28377e0c0d49a4e54ef04e0b047cb478c9f373b83cee3bb002ced264002ca

  • SSDEEP

    49152:XB+xvizr1zySNzlcDeWTuL7aDerD3VQ5R2AF2ASEWGt7/aSFV:R+xSRzXkeiuuUD2CVAf2s

Score
3/10

Malware Config

Signatures

  • Unsigned PE 7 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 1 IoCs

Files

  • 454b81e2db5fb5cfcd2771fe2fc88aa9_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    237a51742fed62d237b6f1b75452402f


    Headers

    Imports

    Sections

  • $LOCALAPPDATA/Google/Custom Buttons/kuwo_music.xml
    .xml
  • $PLUGINSDIR/AnimGif.dll
    .dll windows:4 windows x86 arch:x86

    b4b71331b921e2f441a2b05306cd7dae


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    57354bdeea3dfae6e948101add87501a


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/KillProcDLL.dll
    .dll windows:4 windows x86 arch:x86

    815c88741b87a0210c457b00b57bf9c6


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/KuWoNsis.dll
    .dll windows:4 windows x86 arch:x86

    d44c16403468dc57c73ebca319ddbe16


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/KwMusic_google.ini
  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    4ec328f99bdd944fc98d8a5cf11f7a62


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/gtapi_signed.dll
    .dll windows:4 windows x86 arch:x86

    a1cddef184beba696e690091795eacfd


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/messagebox.dll
    .dll windows:4 windows x86 arch:x86

    c3f3267799760b39c4e2763e70fc3909


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/t4_zh_cn.bmp
  • $SMSTARTUP/ֺ.exe
    .exe windows:4 windows x86 arch:x86

    6e9116e001ca2c00f3eb0d8a5dd299be


    Code Sign

    Headers

    Imports

    Sections

  • $TEMP/GoogleToolbarInstaller_download_signed.exe
    .exe windows:4 windows x86 arch:x86

    1c1b680f2976066a0001a6e1b41dd5db


    Code Sign

    Headers

    Imports

    Sections

  • $TEMP/PluginNotifier.exe
    .exe windows:4 windows x86 arch:x86

    4036c10534cc95f45603952e069d8abe


    Code Sign

    Headers

    Imports

    Sections

  • $TEMP/config.ini
  • 360Inst-kuwo.exe
    .exe windows:4 windows x86 arch:x86

    3c91adf9dbf078f266cd8079d7d3ccf9


    Code Sign

    Headers

    Imports

    Sections

  • Encode.exe
    .exe windows:4 windows x86 arch:x86

    f2a5894770097fd9c56cb5ca9d67b4f8


    Code Sign

    Headers

    Imports

    Sections

  • EncodeBnd.exe
    .exe windows:4 windows x86 arch:x86

    78f160eb7866ebc0f1481a827449de0a


    Code Sign

    Headers

    Imports

    Sections

  • KwMusic.exe
    .exe windows:4 windows x86 arch:x86

    01bc3ba5a7201e6120ddfd9619d2f1d8


    Code Sign

    Headers

    Imports

    Sections

  • NowPCfg.ini
  • appendDL.ini
  • config.ini
  • face/KuwoPngSkinMaker.ico
  • face/KwDownloadLnk.ico
  • face/KwGame.ico
  • face/ac3.ico
  • face/ape.ico
  • face/back.bmp
  • face/cda.ico
  • face/cue.ico
  • face/default.jpg
    .jpg
  • face/defaultbak/bk2_r1_c1.jpg
    .jpg
  • face/defaultbak/bk4_r1_c1.jpg
    .jpg
  • face/defaultbak/bkground1.jpg
    .jpg
  • face/flac.ico
  • face/font.bmp
  • face/hand-close.cur
  • face/hand-open.cur
  • face/kwc.img
  • face/kwpcmd.img
  • face/kwplog.img
  • face/left.bmp
  • face/lrcx.ico
  • face/m4a.ico
  • face/mid.ico
  • face/mp3.ico
  • face/ogg.ico
  • face/pub.img
  • face/rigt.bmp
  • face/tta.ico
  • face/wav.ico
  • face/wma.ico
  • hanzi_pinyin.dict
  • highlight.jpg
    .jpg
  • instpage.gif
    .gif
  • lrcCfg.ini
  • nomal.jpg
    .jpg
  • readme.txt
  • recoEngine.exe
    .exe windows:4 windows x86 arch:x86

    cd6dee777e3a74d660504498cb1aa380


    Code Sign

    Headers

    Imports

    Sections

  • res/PanesData.xml
    .xml
  • res/SayHello/SayHelloFrame.png
    .png
  • res/WikiEntryDefault.html
    .html
  • res/artists.xml
  • res/coverflow/001.jpg
    .jpg
  • res/coverflow/1.JPG
    .jpg
  • res/coverflow/2.JPG
    .jpg
  • res/coverflow/3.JPG
    .jpg
  • res/coverflow/4.JPG
    .jpg
  • res/coverflow/5.JPG
    .jpg
  • res/coverflow/6.JPG
    .jpg
  • res/coverflow/7.JPG
    .jpg
  • res/coverflow/8.jpg
    .jpg
  • res/hot_singer.xml
  • res/mblistcount.xml
  • res/msg/bk.gif
    .gif
  • res/msg/bt1.gif
    .gif
  • res/msg/bt2.gif
    .gif
  • res/msg/msg.htm
    .html .js polyglot
  • res/oumei_singer.xml
  • res/ranks/ȸ.xml
  • res/rihan_singer.xml
  • res/search/11.sng
  • res/starmenu2.0.xml
  • run.exe
    .exe windows:4 windows x86 arch:x86

    6e9116e001ca2c00f3eb0d8a5dd299be


    Code Sign

    Headers

    Imports

    Sections

  • swf/MvComplete.swf
  • swf/MvMiniComplete.swf
  • swf/coverflow.swf
  • swf/directx.swf
  • swf/enjoy.swf
  • swf/initplay.swf
  • swf/load.swf
  • swf/mvstop.swf
  • swf/neterror.swf
  • swf/netload.swf
  • swf/no.swf
  • swf/nomtv.swf
  • swf/nomv.swf
  • swf/nores.swf
  • swf/picexception.swf
  • swf/serverbusy.swf