General

  • Target

    e100dc472c8ca3cb0dc8ee2b4d9bf6e8_JaffaCakes118

  • Size

    4.3MB

  • MD5

    e100dc472c8ca3cb0dc8ee2b4d9bf6e8

  • SHA1

    1d29bc5613020ef2e16848e35c5af439719657b5

  • SHA256

    432b1351fc07722205c2657c07a6c3fa0cc22f6e6d145576ed45e71492fb1f35

  • SHA512

    f2bf7968242978b0eee17afdadfc1e790cf867590ccc544775e577e7862320b22df09324755e0ffe5b3d35426f0cf62c508b1eb0f34816f82be7ab0e9db8536e

  • SSDEEP

    98304:4kT3ul4fCdURd/WRO++Rn1mYCxyuHM1R0sV9UMEGwfT83UihjHJ2qLcsSvv3:4foIkWk++t1mbIusTtVmtIUihjHppSv/

Score
3/10

Malware Config

Signatures

  • Unsigned PE 7 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 1 IoCs

Files

  • e100dc472c8ca3cb0dc8ee2b4d9bf6e8_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    237a51742fed62d237b6f1b75452402f


    Headers

    Imports

    Sections

  • $PLUGINSDIR/AnimGif.dll
    .dll windows:4 windows x86 arch:x86

    b4b71331b921e2f441a2b05306cd7dae


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    57354bdeea3dfae6e948101add87501a


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/KillProcDLL.dll
    .dll windows:4 windows x86 arch:x86

    815c88741b87a0210c457b00b57bf9c6


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/KuWoNsis.dll
    .dll windows:4 windows x86 arch:x86

    d44c16403468dc57c73ebca319ddbe16


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    4ec328f99bdd944fc98d8a5cf11f7a62


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/messagebox.dll
    .dll windows:4 windows x86 arch:x86

    c3f3267799760b39c4e2763e70fc3909


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $SMSTARTUP/ֺ.exe
    .exe windows:4 windows x86 arch:x86

    6e9116e001ca2c00f3eb0d8a5dd299be


    Code Sign

    Headers

    Imports

    Sections

  • $TEMP/config.ini
  • $WINDIR/KwYl.dat
  • CM.dll
    .dll windows:4 windows x86 arch:x86

    ba6815b89931d7d7f1bab956c0c4e209


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Encode.exe
    .exe windows:4 windows x86 arch:x86

    152777a2577f448ba577c1c2ff3ad648


    Code Sign

    Headers

    Imports

    Sections

  • KwArd.ax
    .dll regsvr32 windows:4 windows x86 arch:x86

    77ac5a57c05d6f4e9bb8b2588db162e2


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • KwFlashHolder.exe
    .exe windows:4 windows x86 arch:x86

    72314eca20b8f52ae5af44c7368c4bf3


    Code Sign

    Headers

    Imports

    Sections

  • KwInfos.exe
    .exe windows:4 windows x86 arch:x86

    fa36e5cf9aa098f906c054395b464536


    Code Sign

    Headers

    Imports

    Sections

  • KwLogSvr.dll
    .dll windows:4 windows x86 arch:x86

    985fc5f29f81f6db29b579d5521f9989


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • KwMV.exe
    .exe windows:4 windows x86 arch:x86

    9d890373ab7a22a2c7a9624f85bd908b


    Code Sign

    Headers

    Imports

    Sections

  • KwMusic.exe
    .exe windows:4 windows x86 arch:x86

    49391c075a55cc874d392af879ae5db5


    Code Sign

    Headers

    Imports

    Sections

  • KwUpdate.dll
    .dll windows:4 windows x86 arch:x86

    f60429c8c7bb5579dedd7f600985727e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Local/FirstSearchPath
  • Local/LastSearchPath
  • Local/NotSearchPath
  • LocalServer.dll
    .dll windows:4 windows x86 arch:x86

    70f69bbcc99a96ca038b6edfac1edb8e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • MFC71.dll
    .dll windows:4 windows x86 arch:x86

    7397fb8b8633dd76aa9cbc7e2e0c24bd


    Code Sign

    Headers

    Imports

    Sections

  • MatroskaSplitter.ax
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • MediaInfo.dll
    .dll windows:5 windows x86 arch:x86

    ef965d0b249e0652567723f69751f7f7


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Mplayer.dll
    .dll windows:4 windows x86 arch:x86

    c8fd7e63fa6f103209ce64f8216035e1


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • NowPCfg.ini
  • Reco.dll
    .dll windows:4 windows x86 arch:x86

    3e8fc186be4f3ccf60dab8a4d9765b68


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Skin/SuperRap/skin.ini
  • Skin/SuperRap/small.jpg
    .jpg
  • Skin/ĬƤ/LoadingGif.gif
    .gif
  • Skin/ĬƤ/PNG/TopPanelBtnClose.png
    .png
  • Skin/ĬƤ/PNG/TopPanelBtnDownloadNormal-b.png
    .png
  • Skin/ĬƤ/PNG/TopPanelBtnDownloadNormal.png
    .png
  • Skin/ĬƤ/PNG/TopPanelBtnMax.png
    .png
  • Skin/ĬƤ/PNG/TopPanelBtnMin.png
    .png
  • Skin/ĬƤ/PNG/TopPanelBtnMini.png
    .png
  • Skin/ĬƤ/PNG/TopPanelBtnMusicSearchNormal-b.png
    .png
  • Skin/ĬƤ/PNG/TopPanelBtnMusicSearchNormal.png
    .png
  • Skin/ĬƤ/PNG/TopPanelBtnNowPlayNormal-b.png
    .png
  • Skin/ĬƤ/PNG/TopPanelBtnNowPlayNormal.png
    .png
  • Skin/ĬƤ/PNG/TopPanelBtnRestore.png
    .png
  • Skin/ĬƤ/PNG/TopPanelBtnSetting.png
    .png
  • Skin/ĬƤ/PNG/TopPanelBtnSkin.png
    .png
  • Skin/ĬƤ/PNG/TopPanelBtnWangWang.png
    .png
  • Skin/ĬƤ/PNG/TopPanelBtnWebCommendNormal-b.png
    .png
  • Skin/ĬƤ/PNG/TopPanelBtnWebCommendNormal.png
    .png
  • Skin/ĬƤ/PNG/TopPanelLog.png
    .png
  • Skin/ĬƤ/PNG/right.png
    .png
  • Skin/ĬƤ/PNG/yes.png
    .png
  • Skin/ĬƤ/SbujectSkin/1/TopPanelBKLeft.bmp
  • Skin/ĬƤ/SbujectSkin/1/TopPanelBKMid.bmp
  • Skin/ĬƤ/SbujectSkin/1/TopPanelBKRight.bmp
  • Skin/ĬƤ/SbujectSkin/1/conf.ini
  • Skin/ĬƤ/SbujectSkin/1/small.jpg
    .jpg
  • Skin/ĬƤ/SbujectSkin/10/conf.ini
  • Skin/ĬƤ/SbujectSkin/10/small.jpg
    .jpg
  • Skin/ĬƤ/SbujectSkin/11/conf.ini
  • Skin/ĬƤ/SbujectSkin/11/small.jpg
    .jpg
  • Skin/ĬƤ/SbujectSkin/12/conf.ini
  • Skin/ĬƤ/SbujectSkin/12/small.jpg
    .jpg
  • Skin/ĬƤ/SbujectSkin/13/conf.ini
  • Skin/ĬƤ/SbujectSkin/13/small.jpg
    .jpg
  • Skin/ĬƤ/SbujectSkin/14/conf.ini
  • Skin/ĬƤ/SbujectSkin/14/small.jpg
    .jpg
  • Skin/ĬƤ/SbujectSkin/15/conf.ini
  • Skin/ĬƤ/SbujectSkin/15/small.jpg
    .jpg
  • Skin/ĬƤ/SbujectSkin/16/conf.ini
  • Skin/ĬƤ/SbujectSkin/16/small.jpg
    .jpg
  • Skin/ĬƤ/SbujectSkin/17/conf.ini
  • Skin/ĬƤ/SbujectSkin/17/small.jpg
    .jpg
  • Skin/ĬƤ/SbujectSkin/18/conf.ini
  • Skin/ĬƤ/SbujectSkin/18/small.jpg
    .jpg
  • Skin/ĬƤ/SbujectSkin/19/conf.ini
  • Skin/ĬƤ/SbujectSkin/19/small.jpg
    .jpg
  • Skin/ĬƤ/SbujectSkin/2/conf.ini
  • Skin/ĬƤ/SbujectSkin/2/small.jpg
    .jpg
  • Skin/ĬƤ/SbujectSkin/20/conf.ini
  • Skin/ĬƤ/SbujectSkin/20/small.JPG
    .jpg
  • Skin/ĬƤ/SbujectSkin/21/conf.ini
  • Skin/ĬƤ/SbujectSkin/21/small.jpg
    .jpg
  • Skin/ĬƤ/SbujectSkin/22/conf.ini
  • Skin/ĬƤ/SbujectSkin/22/small.jpg
    .jpg
  • Skin/ĬƤ/SbujectSkin/23/conf.ini
  • Skin/ĬƤ/SbujectSkin/23/small.jpg
    .jpg
  • Skin/ĬƤ/SbujectSkin/24/conf.ini
  • Skin/ĬƤ/SbujectSkin/24/small.jpg
    .jpg
  • Skin/ĬƤ/SbujectSkin/25/conf.ini
  • Skin/ĬƤ/SbujectSkin/25/small.jpg
    .jpg
  • Skin/ĬƤ/SbujectSkin/26/conf.ini
  • Skin/ĬƤ/SbujectSkin/26/small.jpg
    .jpg
  • Skin/ĬƤ/SbujectSkin/27/conf.ini
  • Skin/ĬƤ/SbujectSkin/27/small.jpg
    .jpg
  • Skin/ĬƤ/SbujectSkin/28/conf.ini
  • Skin/ĬƤ/SbujectSkin/28/small.jpg
    .jpg
  • Skin/ĬƤ/SbujectSkin/29/conf.ini
  • Skin/ĬƤ/SbujectSkin/29/small.jpg
    .jpg
  • Skin/ĬƤ/SbujectSkin/3/conf.ini
  • Skin/ĬƤ/SbujectSkin/3/small.jpg
    .jpg
  • Skin/ĬƤ/SbujectSkin/30/conf.ini
  • Skin/ĬƤ/SbujectSkin/30/small.jpg
    .jpg
  • Skin/ĬƤ/SbujectSkin/31/conf.ini
  • Skin/ĬƤ/SbujectSkin/31/small.jpg
    .jpg
  • Skin/ĬƤ/SbujectSkin/33/TopPanelBKLeft.bmp
  • Skin/ĬƤ/SbujectSkin/33/TopPanelBKMid.bmp
  • Skin/ĬƤ/SbujectSkin/33/TopPanelBKRight.bmp
  • Skin/ĬƤ/SbujectSkin/33/conf.ini
  • Skin/ĬƤ/SbujectSkin/33/small.jpg
    .jpg
  • Skin/ĬƤ/SbujectSkin/33/topright.png
    .png
  • Skin/ĬƤ/SbujectSkin/34/conf.ini
  • Skin/ĬƤ/SbujectSkin/34/small.jpg
    .jpg
  • Skin/ĬƤ/SbujectSkin/35/conf.ini
  • Skin/ĬƤ/SbujectSkin/35/small.bmp
  • Skin/ĬƤ/SbujectSkin/4/conf.ini
  • Skin/ĬƤ/SbujectSkin/4/small.jpg
    .jpg
  • Skin/ĬƤ/SbujectSkin/5/conf.ini
  • Skin/ĬƤ/SbujectSkin/5/small.jpg
    .jpg
  • Skin/ĬƤ/SbujectSkin/6/conf.ini
  • Skin/ĬƤ/SbujectSkin/6/small.jpg
    .jpg
  • Skin/ĬƤ/SbujectSkin/7/conf.ini
  • Skin/ĬƤ/SbujectSkin/7/small.jpg
    .jpg
  • Skin/ĬƤ/SbujectSkin/8/conf.ini
  • Skin/ĬƤ/SbujectSkin/8/small.jpg
    .jpg
  • Skin/ĬƤ/SbujectSkin/9/conf.ini
  • Skin/ĬƤ/SbujectSkin/9/small.jpg
    .jpg
  • Skin/ĬƤ/SbujectSkin/ʥ/conf.ini
  • Skin/ĬƤ/SbujectSkin/ʥ/small.bmp
  • Skin/ĬƤ/SbujectSkin/Զ/conf.ini
  • Skin/ĬƤ/SbujectSkin/Զ/small.bmp
  • Skin/ĬƤ/SbujectSkin/ɰ/conf.ini
  • Skin/ĬƤ/SbujectSkin/ɰ/small.bmp
  • Skin/ĬƤ/VoteWait.gif
    .gif
  • Skin/ĬƤ/defaultRichInfoPic.JPG
    .jpg
  • Skin/ĬƤ/down-icon.gif
    .gif
  • Skin/ĬƤ/downnotice.gif
    .gif
  • Skin/ĬƤ/localnotice.gif
    .gif
  • Skin/ĬƤ/panel.xml
    .xml
  • Skin/ĬƤ/skin.ini
  • Skin/ĬƤ/skin.jpg
    .jpg
  • Skin/ĬƤ/skinpack.pkg
  • Skin/ĬƤ/small.jpg
    .jpg
  • Skin/ĬƤ/vis.cfg
  • Skin/ֲƤ/skin.ini
  • Skin/ֲƤ/small.jpg
    .jpg
  • Skin//skin.ini
  • Skin//small.jpg
    .jpg
  • Skin/_Ƥ/LoadingGif.gif
    .gif
  • Skin/_Ƥ/down-icon.gif
    .gif
  • Skin/_Ƥ/downnotice.gif
    .gif
  • Skin/_Ƥ/panel.xml
    .xml
  • Skin/_Ƥ/skinpack.pkg
  • UserMInfo.tem
  • appendDL.ini
  • config.ini
  • dotag.dll
    .dll windows:4 windows x86 arch:x86

    f9f8da243322a1364c8fe2e0e8e60d40


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • dump.ax
    .dll regsvr32 windows:4 windows x86 arch:x86

    43b351b97c09bced69fabc521570c7d9


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • exreco_dll.dll
    .dll windows:4 windows x86 arch:x86

    e7f0590d3ed4c680e7f66b95abb85d04


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • face/KuwoPngSkinMaker.ico
  • face/KwDownloadLnk.ico
  • face/KwGame.ico
  • face/ac3.ico
  • face/ape.ico
  • face/back.bmp
  • face/cda.ico
  • face/cue.ico
  • face/default.jpg
    .jpg
  • face/defaultbak/bk2_r1_c1.jpg
    .jpg
  • face/defaultbak/bk4_r1_c1.jpg
    .jpg
  • face/defaultbak/bkground1.jpg
    .jpg
  • face/flac.ico
  • face/font.bmp
  • face/hand-close.cur
  • face/hand-open.cur
  • face/kwc.img
  • face/kwpcmd.img
  • face/kwplog.img
  • face/left.bmp
  • face/m4a.ico
  • face/mid.ico
  • face/mp3.ico
  • face/ogg.ico
  • face/pub.img
  • face/rigt.bmp
  • face/tta.ico
  • face/wav.ico
  • face/wma.ico
  • font-bk/FengChe.jpg
    .jpg
  • font-bk/PuGongYing.jpg
    .jpg
  • font-bk/QingTing.jpg
    .jpg
  • font-bk/XuYuan.jpg
    .jpg
  • font-bk/dew.bmp
  • font-bk/flower.bmp
  • font-bk/flower2.bmp
  • font-bk/paw.bmp
  • font-bk/sand.bmp
  • font-bk/wheat.bmp
  • font-bk/.bmp
  • fzip.dll
    .dll windows:4 windows x86 arch:x86

    4451c2420522df3bf2a2b730398cb7f4


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • hanzi_pinyin.dict
  • html/404.gif
    .gif
  • html/nomv.htm
    .html
  • html/weberror.htm
    .html .js polyglot
  • http.dll
    .dll windows:4 windows x86 arch:x86

    b52750666170f2869a567dba4872ceb6


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • instpage.gif
    .gif
  • kuwo-bk/black-grey.jpg
    .jpg
  • kuwo-bk/blue-crystal.jpg
    .jpg
  • kuwo-bk/blue-red.jpg
    .jpg
  • kuwo-bk/green-crystal.jpg
    .jpg
  • kuwo-bk/green-yellow.jpg
    .jpg
  • kuwo-bk/green.jpg
    .jpg
  • kuwo-bk/orange-crystal.jpg
    .jpg
  • kuwo-bk/pink-crystal.jpg
    .jpg
  • kuwo-bk/red-yellow.jpg
    .jpg
  • kuwo-bk/red-yellow2.jpg
    .jpg
  • l3codecx.ax
    .dll regsvr32 windows:4 windows x86 arch:x86

    d7e8a0cc68dc418d56e7942bed824e2d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • lidx.dll
    .dll windows:4 windows x86 arch:x86

    8c845feab240c8462a132f7f50b13ee9


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • loading/ad/ad.ini
  • loading/ad/default_xjytualasfd001212123441lsfaoe.gif
    .gif
  • loading/ad/default_xjytualasfd001212123441lsfaoe.htm
    .html
  • loading/ad/index0_loading.htm
    .html .js polyglot
  • lrcCfg.ini
  • msvcp71.dll
    .dll windows:4 windows x86 arch:x86

    5e2398adb60a70c7ab04e7cba75a7983


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • msvcr71.dll
    .dll windows:4 windows x86 arch:x86

    7acc8c379c768a1ecd81ec502ff5f33e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • pd.dll
    .dll windows:4 windows x86 arch:x86

    9edee3d94c6960b410f3c6af06e34dca


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • player.dll
    .dll windows:4 windows x86 arch:x86

    8cfd50fcffbdf8858ad68d5a023ab813


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • plugin/EQ_KWEQ.dll
    .dll windows:4 windows x86 arch:x86

    5e99ac0b5f6a9ca09cf315796f21211b


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • plugin/in_mpg123.dll
    .dll windows:4 windows x86 arch:x86

    497d5e185b8a5c4c7a71b88974583455


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • plugin/in_wma.dll
    .dll windows:4 windows x86 arch:x86

    2a72791c1f9538bb8dcaf34e1b9ea9cf


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • plugin/out_kw_ds.dll
    .dll windows:4 windows x86 arch:x86

    c5e33814a6b18fcb8716feac2a04d2ba


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • plugin/vis_classic.dll
    .dll windows:4 windows x86 arch:x86

    8c498c89f71c634f98861724759e0efe


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • readme.txt
  • recoEngine.exe
    .exe windows:4 windows x86 arch:x86

    fd1d584fc1929266c74ad93b8a7fe33e


    Code Sign

    Headers

    Imports

    Sections

  • res/PanesData.xml
    .xml
  • res/WikiEntryDefault.html
    .html
  • res/artists.xml
  • res/coverflow/001.jpg
    .jpg
  • res/coverflow/1.JPG
    .jpg
  • res/coverflow/2.JPG
    .jpg
  • res/coverflow/3.JPG
    .jpg
  • res/coverflow/4.JPG
    .jpg
  • res/coverflow/5.JPG
    .jpg
  • res/coverflow/6.JPG
    .jpg
  • res/coverflow/7.JPG
    .jpg
  • res/coverflow/8.jpg
    .jpg
  • res/hot_singer.xml
  • res/mblistcount.xml
  • res/msg/bk.gif
    .gif
  • res/msg/bt1.gif
    .gif
  • res/msg/bt2.gif
    .gif
  • res/msg/msg.htm
    .html .js polyglot
  • res/oumei_singer.xml
  • res/ranks/ȸ.xml
  • res/rihan_singer.xml
  • res/search/11.sng
  • res/search/12.sng
  • res/starmenu2.0.xml
  • run.exe
    .exe windows:4 windows x86 arch:x86

    6e9116e001ca2c00f3eb0d8a5dd299be


    Code Sign

    Headers

    Imports

    Sections

  • setup.xml
    .xml
  • swf/MvComplete.swf
  • swf/MvMiniComplete.swf
  • swf/coverflow.swf
  • swf/directx.swf
  • swf/enjoy.swf
  • swf/initplay.swf
  • swf/load.swf
  • swf/mvstop.swf
  • swf/neterror.swf
  • swf/netload.swf
  • swf/no.swf
  • swf/nomtv.swf
  • swf/nomv.swf
  • swf/nores.swf
  • swf/picexception.swf
  • swf/serverbusy.swf
  • zlib.dll
    .dll windows:4 windows x86 arch:x86

    6ca5129cf676bf086156341822a28d95


    Code Sign

    Headers

    Imports

    Exports

    Sections