General

  • Target

    bfd0a8e5e7e08e2daa71cb8461fa94a6_JaffaCakes118

  • Size

    6.5MB

  • MD5

    bfd0a8e5e7e08e2daa71cb8461fa94a6

  • SHA1

    e7d0932b659315625c19a3ce5b1132ee94972774

  • SHA256

    02462e32923606d518b01e3ac33a67cc04521efbe4f8c6e930659e086e76ddd4

  • SHA512

    b04f8316932966606be572afccb54a8a4a670e0532ee1787d20fb3e85ca9a12215fa36066ec2928c7ef703f79eae6896e6a60641e320c2e11034c0a4f055c4b7

  • SSDEEP

    196608:Sn1PVGwmVYYD/SwYuHyHekJHpLIwTkwEvptfMgh:Sqw6ha4PCOwTkJph

Score
3/10

Malware Config

Signatures

  • Unsigned PE 41 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 6 IoCs

Files

  • bfd0a8e5e7e08e2daa71cb8461fa94a6_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    099c0646ea7282d232219f8807883be0


    Headers

    Imports

    Sections

  • $EXEDIR/Խ͸ӰV3.6.exe
    .exe windows:4 windows x86 arch:x86

    9165ea3e914e03bda3346f13edbd6ccd


    Headers

    Imports

    Sections

  • $FAVORITES/.url
    .url
  • $FAVORITES/Ϸ.url
  • $FAVORITES/ȥ.url
    .url
  • $FAVORITES/뵼.url
    .url
  • $FAVORITES/뼼̳.url
    .url
  • $FAVORITES/Ӱ.url
  • $FAVORITES/.url
    .url
  • $FAVORITES/.url
    .url
  • $FAVORITES/.url
    .url
  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    295fc8c35dee88b924b0f6bafc807c6c


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/io.ini
  • $PLUGINSDIR/nsExec.dll
    .dll windows:4 windows x86 arch:x86

    d83f71e61ee459ee63ca3e829966a9dc


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/sobar.bmp
  • $SYSDIR/Drivers/etc/hosts
  • $SYSDIR/dllcache/shdoclc.dll
    .dll windows:5 windows x86 arch:x86


    Headers

    Sections

  • $SYSDIR/shdoclc.dll
    .dll windows:5 windows x86 arch:x86


    Headers

    Sections

  • $SYSDIR/wfpdisable.exe
    .exe windows:4 windows x86 arch:x86

    da34fe388571b8c61ff2114f0a1dfd25


    Headers

    Imports

    Sections

  • $TEMP/d.exe
    .exe windows:4 windows x86 arch:x86

    7fa5ae915c7013c99ed84c42294afcc8


    Headers

    Imports

    Sections

  • $TEMP/mbox224.exe
    .exe windows:4 windows x86 arch:x86

    237a51742fed62d237b6f1b75452402f


    Headers

    Imports

    Sections

  • $PLUGINSDIR/AnimGif.dll
    .dll windows:4 windows x86 arch:x86

    b4b71331b921e2f441a2b05306cd7dae


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    57354bdeea3dfae6e948101add87501a


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/KillProcDLL.dll
    .dll windows:4 windows x86 arch:x86

    815c88741b87a0210c457b00b57bf9c6


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/KuWoNsis.dll
    .dll windows:4 windows x86 arch:x86

    de7c6ad5876b0334f431aa8a6de18cbf


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    4ec328f99bdd944fc98d8a5cf11f7a62


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $TEMP/config.ini
  • $WINDIR/KwYl.dat
  • CM.dll
    .dll windows:4 windows x86 arch:x86

    ba6815b89931d7d7f1bab956c0c4e209


    Headers

    Imports

    Exports

    Sections

  • Encode.exe
    .exe windows:4 windows x86 arch:x86

    2fb3a6de1549498f64413b2c61d554e2


    Headers

    Imports

    Sections

  • KwArd.ax
    .dll regsvr32 windows:4 windows x86 arch:x86

    b21440f286eda5d259606e7ea68416cc


    Headers

    Imports

    Exports

    Sections

  • KwFlashHolder.exe
    .exe windows:4 windows x86 arch:x86

    72314eca20b8f52ae5af44c7368c4bf3


    Headers

    Imports

    Sections

  • KwLogSvr.dll
    .dll windows:4 windows x86 arch:x86

    4e585b844e08a79fb85c64b039d3e166


    Headers

    Imports

    Exports

    Sections

  • KwMV.exe
    .exe windows:4 windows x86 arch:x86

    9b1335938ada8bfa2dfde0b7b113e4f4


    Headers

    Imports

    Sections

  • KwMusic.exe
    .exe windows:4 windows x86 arch:x86

    bdcd9029572cb138ceb892ee778f57c3


    Headers

    Imports

    Sections

  • KwUpdate.dll
    .dll windows:4 windows x86 arch:x86

    297f431c49b78083517c711c81b4ed93


    Headers

    Imports

    Exports

    Sections

  • Local/FirstSearchPath
  • Local/LastSearchPath
  • Local/NotSearchPath
  • LocalServer.dll
    .dll windows:4 windows x86 arch:x86

    70f69bbcc99a96ca038b6edfac1edb8e


    Headers

    Imports

    Exports

    Sections

  • Mplayer.dll
    .dll windows:4 windows x86 arch:x86

    d689b92a4a7bb0fad48d808f11ed2f00


    Headers

    Imports

    Exports

    Sections

  • Reco.dll
    .dll windows:4 windows x86 arch:x86

    08bbe9199493b3276d620adfbed8a8ca


    Headers

    Imports

    Exports

    Sections

  • Skin/ĬƤ/LoadingGif.gif
    .gif
  • Skin/ĬƤ/VoteWait.gif
    .gif
  • Skin/ĬƤ/defaultRichInfoPic.JPG
    .jpg
  • Skin/ĬƤ/down-icon.gif
    .gif
  • Skin/ĬƤ/downnotice.gif
    .gif
  • Skin/ĬƤ/localnotice.gif
    .gif
  • Skin/ĬƤ/panel.xml
    .xml
  • Skin/ĬƤ/skin.ini
  • Skin/ĬƤ/skin.jpg
    .jpg
  • Skin/ĬƤ/skinpack.pkg
  • Skin/ĬƤ/small.bmp
  • Skin/ֲģʽ/LoadingGif.gif
    .gif
  • Skin/ֲģʽ/VoteWait.gif
    .gif
  • Skin/ֲģʽ/defaultRichInfoPic.JPG
    .jpg
  • Skin/ֲģʽ/down-icon.gif
    .gif
  • Skin/ֲģʽ/downnotice.gif
    .gif
  • Skin/ֲģʽ/localnotice.gif
    .gif
  • Skin/ֲģʽ/panel.xml
  • Skin/ֲģʽ/skin.ini
  • Skin/ֲģʽ/skin.jpg
    .jpg
  • Skin/ֲģʽ/skinpack.pkg
  • Skin/ֲģʽ/small.bmp
  • Skin/_Ƥ/LoadingGif.gif
    .gif
  • Skin/_Ƥ/down-icon.gif
    .gif
  • Skin/_Ƥ/downnotice.gif
    .gif
  • Skin/_Ƥ/panel.xml
    .xml
  • Skin/_Ƥ/skinpack.pkg
  • Uninstall.exe
    .exe windows:4 windows x86 arch:x86

    237a51742fed62d237b6f1b75452402f


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    57354bdeea3dfae6e948101add87501a


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/KillProcDLL.dll
    .dll windows:4 windows x86 arch:x86

    815c88741b87a0210c457b00b57bf9c6


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    4ec328f99bdd944fc98d8a5cf11f7a62


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • appendDL.ini
  • config.ini
  • dotag.dll
    .dll windows:4 windows x86 arch:x86

    f9f8da243322a1364c8fe2e0e8e60d40


    Headers

    Imports

    Exports

    Sections

  • dump.ax
    .dll regsvr32 windows:4 windows x86 arch:x86

    43b351b97c09bced69fabc521570c7d9


    Headers

    Imports

    Exports

    Sections

  • face/KwDownloadLnk.ico
  • face/back.bmp
  • face/default.jpg
    .jpg
  • face/defaultbak/bk2_r1_c1.jpg
    .jpg
  • face/defaultbak/bk3_r1_c1.jpg
    .jpg
  • face/defaultbak/bk4_r1_c1.jpg
    .jpg
  • face/defaultbak/bk5_r1_c1.jpg
    .jpg
  • face/defaultbak/bkground1.jpg
    .jpg
  • face/defaultbak/bkground2.jpg
    .jpg
  • face/font.bmp
  • face/hand-close.cur
  • face/hand-open.cur
  • face/kwc.img
  • face/kwpcmd.img
  • face/kwplog.img
  • face/left.bmp
  • face/mp3.ico
  • face/pub.img
  • face/rigt.bmp
  • face/wma.ico
  • font-bk/dew.bmp
  • font-bk/flower.bmp
  • font-bk/flower2.bmp
  • font-bk/paw.bmp
  • font-bk/sand.bmp
  • font-bk/wheat.bmp
  • font-bk/.bmp
  • fzip.dll
    .dll windows:4 windows x86 arch:x86

    a5aa49288c0a7c3de2afdec329b50e5e


    Headers

    Imports

    Exports

    Sections

  • html/404.gif
    .gif
  • html/img/pass-mv.jpg
    .jpg
  • html/nomv.htm
    .html
  • html/weberror.htm
    .html .js polyglot
  • http.dll
    .dll windows:4 windows x86 arch:x86

    1228ab6b98f61aa3ee4d2af557b9aae0


    Headers

    Imports

    Exports

    Sections

  • instpage.gif
    .gif
  • kuwo-bk/black-grey.jpg
    .jpg
  • kuwo-bk/blue-crystal.jpg
    .jpg
  • kuwo-bk/blue-red.jpg
    .jpg
  • kuwo-bk/green-crystal.jpg
    .jpg
  • kuwo-bk/green-yellow.jpg
    .jpg
  • kuwo-bk/green.jpg
    .jpg
  • kuwo-bk/orange-crystal.jpg
    .jpg
  • kuwo-bk/pink-crystal.jpg
    .jpg
  • kuwo-bk/red-yellow.jpg
    .jpg
  • kuwo-bk/red-yellow2.jpg
    .jpg
  • lidx.dll
    .dll windows:4 windows x86 arch:x86

    8c845feab240c8462a132f7f50b13ee9


    Headers

    Imports

    Exports

    Sections

  • loading/ad/0.gif
    .gif
  • loading/ad/ad.ini
  • loading/ad/default_xjytualasfd001212123441lsfaoe.gif
    .gif
  • loading/ad/index0_loading.htm
    .html .js polyglot
  • lrcCfg.ini
  • mfc71.dll
    .dll windows:4 windows x86 arch:x86

    7397fb8b8633dd76aa9cbc7e2e0c24bd


    Headers

    Imports

    Sections

  • msvcp71.dll
    .dll windows:4 windows x86 arch:x86

    5e2398adb60a70c7ab04e7cba75a7983


    Headers

    Imports

    Exports

    Sections

  • msvcr71.dll
    .dll windows:4 windows x86 arch:x86

    7acc8c379c768a1ecd81ec502ff5f33e


    Headers

    Imports

    Exports

    Sections

  • pd.dll
    .dll windows:4 windows x86 arch:x86

    6c9f3ae4d33784c3595edf64284eae0c


    Headers

    Imports

    Exports

    Sections

  • player.dll
    .dll windows:4 windows x86 arch:x86

    77ee9f0fd5ebfd2ec3b3234db76d0413


    Headers

    Imports

    Exports

    Sections

  • readme.txt
  • recoEngine.exe
    .exe windows:4 windows x86 arch:x86

    9b5bd048e227b27db38a62425209dd20


    Headers

    Imports

    Sections

  • res/PanesData.xml
    .xml
  • res/artists.xml
  • res/coverflow/001.jpg
    .jpg
  • res/coverflow/1.JPG
    .jpg
  • res/coverflow/2.JPG
    .jpg
  • res/coverflow/3.JPG
    .jpg
  • res/coverflow/4.JPG
    .jpg
  • res/coverflow/5.JPG
    .jpg
  • res/coverflow/6.JPG
    .jpg
  • res/coverflow/7.JPG
    .jpg
  • res/coverflow/8.jpg
    .jpg
  • res/hot_singer.xml
  • res/mblistcount.xml
  • res/msg/bk.gif
    .gif
  • res/msg/bt1.gif
    .gif
  • res/msg/bt2.gif
    .gif
  • res/msg/msg.htm
    .html .js polyglot
  • res/oumei_singer.xml
  • res/ranks/ٶȸ.xml
  • res/ranks/ٶ¸.xml
  • res/ranks/ͯ.xml
  • res/ranks/DJ.xml
  • res/ranks/Ц.xml
  • res/ranks/ר.xml
  • res/ranks/仳.xml
  • res/ranks/OK.xml
  • res/ranks/ȸ.xml
  • res/ranks/¸.xml
  • res/ranks/.xml
  • res/ranks/СƷ.xml
  • res/rihan_singer.xml
  • res/starmenu2.0.xml
  • swf/MvComplete.swf
  • swf/MvMiniComplete.swf
  • swf/coverflow.swf
  • swf/directx.swf
  • swf/enjoy.swf
  • swf/load.swf
  • swf/mvstop.swf
  • swf/neterror.swf
  • swf/no.swf
  • swf/nomtv.swf
  • swf/nomv.swf
  • swf/nores.swf
  • swf/picexception.swf
  • swf/serverbusy.swf
  • zlib.dll
    .dll windows:4 windows x86 arch:x86

    6ca5129cf676bf086156341822a28d95


    Headers

    Imports

    Exports

    Sections