General

  • Target

    3553e33ccb94ffb24092dd81bbd4f58713834d4a2e46ed67d001747516f71fee.exe

  • Size

    19.8MB

  • MD5

    65f370a52d9968e481fb843e12fc240e

  • SHA1

    2efaf848205e19ea599177ab99e7e674518ab053

  • SHA256

    3553e33ccb94ffb24092dd81bbd4f58713834d4a2e46ed67d001747516f71fee

  • SHA512

    af1b9d4a97347cd70986ca19bf9a8d2e9f760dddb2cc985c4b7f35520997490733c40b8118f3ba44b3b3ac49ced8f71dbf86e845e3c60e616d6f0081f374424b

  • SSDEEP

    393216:VySmvsZAIooVCfBWQfq3N99uBIMv+5x67+btjDHdbASBjQ6d1:VSsZADTpqd9+ICexY+hjBbpj31

Score
3/10

Malware Config

Signatures

  • Unsigned PE 4 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 1 IoCs

Files

  • 3553e33ccb94ffb24092dd81bbd4f58713834d4a2e46ed67d001747516f71fee.exe
    .exe windows:4 windows x86 arch:x86

    ee90b300161ad563b7387f4d64789dc2


    Headers

    Imports

    Sections

  • $APPDATA/$APPDATA/kuwodata/kwmusic2013/Conf/p2pconf/setup.xml
    .xml
  • $APPDATA/kuwodata/kwmusic2013/Res/cache/DOWNLOAD_ARTISTPIC/49FF334D.dat
    .jpg
  • $PLUGINSDIR/InstLancher.dll
    .dll windows:5 windows x86 arch:x86

    3509740b337b00c63de279fe136ea41e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/KuWoNsis_new.dll
    .dll windows:5 windows x86 arch:x86

    f7bdf84c2df6c97befad5bdb81175b23


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/KwBindApp.ini
  • $PLUGINSDIR/KwMusicNsis.dll
    .dll windows:5 windows x86 arch:x86

    d720c1fe9f9034edd57dcfc83df1eadf


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/KwUnzip.dll
    .dll windows:5 windows x86 arch:x86

    9d1e5b4c8eb7a3bc71de8787dc7cf677


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/KwVistaAssist.dll
    .dll windows:6 windows x86 arch:x86

    1107870b58f6f57cb18b2b2034cd590e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ShellLink.dll
    .dll windows:5 windows x86 arch:x86

    50112fdd20200a51dbedeae8f1f33cdb


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    039bcbc605477e8e87ec550c2e60e748


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/instAD/ad01.png
    .png
  • $PLUGINSDIR/instAD/ad02.png
    .png
  • $PLUGINSDIR/instAD/ad03.png
    .png
  • $PLUGINSDIR/instAD/ad04.png
    .png
  • $PLUGINSDIR/instAD/bk_install.png
    .png
  • $PLUGINSDIR/instAD/instAD.dat
  • $TEMP/KWMUSIC/channel.ini
  • $TEMP/KWMUSIC/duPlugab.exe
    .exe windows:4 windows x86 arch:x86

    ee90b300161ad563b7387f4d64789dc2


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/ExecWaitEx.dll
    .dll windows:5 windows x86 arch:x86

    3353e1f9f8993252a869f4e0fe9f5666


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/KuWoNsis_new.dll
    .dll windows:5 windows x86 arch:x86

    8cc197da719dfd6bd5e496af12ba45af


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    039bcbc605477e8e87ec550c2e60e748


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/inetc.dll
    .dll windows:6 windows x86 arch:x86

    3907333ed0258fd761f45695b76b5c4e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $TEMP/KWMUSIC/BindConfig.ini
  • $TEMP/KWMUSIC/mylk.dat
  • $TEMP/KwBindApp.exe
    .exe windows:5 windows x86 arch:x86

    36d2d79a6611b183022eb68ed45a3e1a


    Code Sign

    Headers

    Imports

    Sections

  • $TEMP/KwBindApp.ini
  • $TEMP/curl.exe
    .exe windows:5 windows x86 arch:x86

    8ade879b2aedf1dc1db682fd7ddf08f8


    Code Sign

    Headers

    Imports

    Sections

  • $TEMP/kwuninsthelper.exe
    .exe windows:4 windows x86 arch:x86

    ee90b300161ad563b7387f4d64789dc2


    Code Sign

    Headers

    Imports

    Sections

  • $WINDIR/KwYlx.dat
  • KwMusic.exe
    .exe windows:5 windows x86 arch:x86

    6289f52604730c650addf1b31e032785


    Code Sign

    Headers

    Imports

    Sections

  • bin/AdbWinApi.dll
    .dll windows:6 windows x86 arch:x86

    776334619bd19ec23e3a7a275473b5a7


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/AdbWinUsbApi.dll
    .dll windows:6 windows x86 arch:x86

    7a47d15cc64e5aab2606c46fd1fb8247


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/AudFprint.dll
    .dll windows:6 windows x86 arch:x86

    3db96d82ebae778f4b3714af73d057eb


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/AudioBuffer.dll
    .dll windows:5 windows x86 arch:x86

    2ea59a987a84ad1e5e11dde2542bc594


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/CKuwoPlayer.dll
    .dll windows:5 windows x86 arch:x86

    e2e27688989898c1655988e084bb39cd


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/CWmpPlayer.dll
    .dll windows:5 windows x86 arch:x86

    db5185d842767b66ec938a9743b66e72


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/CoreAVC0.ax
    .dll regsvr32 windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • bin/DshowPlayer.dll
    .dll windows:5 windows x86 arch:x86

    7665bc2c981c50f4d1c2e75e871e4a96


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/DuiLib.dll
    .dll windows:5 windows x86 arch:x86

    10fd4b02de2339625ece6e8be199f50c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/DumpReport.exe
    .exe windows:5 windows x86 arch:x86

    fa6f617e6ba0878bb1dd7bcbfb320456


    Code Sign

    Headers

    Imports

    Sections

  • bin/Encode.exe
    .exe windows:5 windows x86 arch:x86

    e616c2903083dd99b5ef8b8f99a8e9c4


    Code Sign

    Headers

    Imports

    Sections

  • bin/Gbradio/avresample-lav-3.dll
    .dll windows:6 windows x86 arch:x86

    a5cdc97db70199c720a114e314f24807


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/Gbradio/avutil-lav-55.dll
    .dll windows:6 windows x86 arch:x86

    b59f4a7c3d42cda15878f850be6353f1


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KWAudioEffx.dll
    .dll windows:5 windows x86 arch:x86

    387a425e8924b94dd7f6ab156a9d9c95


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KWUpdate.exe
    .exe windows:5 windows x86 arch:x86

    efa42bf976e54e5329c1dc8d94a697f2


    Code Sign

    Headers

    Imports

    Sections

  • bin/Kuwo.QuickLaunch.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    974468d78d2787fa743446f2afb8866d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KuwoSyncMobile.dll
    .dll windows:5 windows x86 arch:x86

    74f35f01d8646d64ff20c3c72dc9c3e0


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwAppTreasrue.dll
    .dll windows:5 windows x86 arch:x86

    55e1af6f9525a0cfaff92a5077cf38be


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwAudioEffect.ax
    .dll regsvr32 windows:5 windows x86 arch:x86

    6aa441a96078b7cfa3c1f6c1913ca1ec


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwConfig.exe
    .exe windows:5 windows x86 arch:x86

    6ed1d644dfe96cd6295967d290354cef


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwDPGame.exe
    .exe windows:5 windows x86 arch:x86

    3028465870c5f98fa086facbb6a57a64


    Code Sign

    Headers

    Imports

    Sections

  • bin/KwDataDef.dll
    .dll windows:5 windows x86 arch:x86

    816fa217204f9cccb686ec2b6fcc0e62


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwHttp.dll
    .dll windows:5 windows x86 arch:x86

    c079d35b955a4be42c2a9cdb21b8161b


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwHttpRequestMgr.dll
    .dll windows:5 windows x86 arch:x86

    0171dff2d9bfb68148170f8a21484dff


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwInfos.exe
    .exe windows:5 windows x86 arch:x86

    53a0762f2e8eb62478c917b79c8632c2


    Code Sign

    Headers

    Imports

    Sections

  • bin/KwKnowSong.exe
    .exe windows:5 windows x86 arch:x86

    aea9a28e65db8f0d3782ffcaba395c23


    Code Sign

    Headers

    Imports

    Sections

  • bin/KwLib.dll
    .dll windows:5 windows x86 arch:x86

    d163925d4704c92d43314d339102438a


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwLnkTipWnd.exe
    .exe windows:5 windows x86 arch:x86

    f7f8b793df08107bb07d567006b14847


    Code Sign

    Headers

    Imports

    Sections

  • bin/KwLog.dll
    .dll windows:5 windows x86 arch:x86

    52692d406826524bd36c98d4d2f0e1c4


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwMV.dll
    .dll windows:5 windows x86 arch:x86

    07cee0e096be54443e84b8efe61931b4


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwMiniSite.exe
    .exe windows:5 windows x86 arch:x86

    00ed5a957e63ff9a1ca8525a68e614e9


    Code Sign

    Headers

    Imports

    Sections

  • bin/KwModAndroidMgr.dll
    .dll windows:5 windows x86 arch:x86

    e2c05d0c9927524cbbe865e51a5f91d5


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwModAppStore.dll
    .dll windows:5 windows x86 arch:x86

    0dac20da2a4f2e1891824f792d59df4b


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwModConfig.dll
    .dll windows:5 windows x86 arch:x86

    d6449e6e6bf5823635a863cbf7d78230


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwModDownload.dll
    .dll windows:5 windows x86 arch:x86

    b63794b6f1a44b39478d1f04dc553e82


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwModGameEntry.dll
    .dll windows:5 windows x86 arch:x86

    1c7bc6f1829e71d66edc619ba7ee3c73


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwModLocalMusic.dll
    .dll windows:5 windows x86 arch:x86

    74f0b6c27dbcf7eb573afcf32da6dddb


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwModLyric.dll
    .dll windows:5 windows x86 arch:x86

    0f0a081817465c7ac36c2eae5f514157


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwModLyricShow.dll
    .dll windows:5 windows x86 arch:x86

    9583b992c765a84d914442aab990920c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwModSkinManage.dll
    .dll windows:5 windows x86 arch:x86

    eb768c0b63a3ff283f8f8bbe0f6321b6


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwModSynList.dll
    .dll windows:5 windows x86 arch:x86

    4ceacccd3d2f63132db82a751bf81922


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwModUpdateWeb.dll
    .dll windows:5 windows x86 arch:x86

    5414b47cddb324c49f3b5d19fffa717a


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwMusicCore.dll
    .dll windows:5 windows x86 arch:x86

    d20e59615a6509d5c4eebf89c993dd2b


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwMusicDLL.dll
    .dll windows:5 windows x86 arch:x86

    8c5d528b6a2f827c4c27175f0fefd754


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwPopupRbHost.exe
    .exe windows:5 windows x86 arch:x86

    24a514fa4431dad357cc6eea7abb4ddc


    Code Sign

    Headers

    Imports

    Sections

  • bin/KwRecoSong.dll
    .dll windows:5 windows x86 arch:x86

    33b8c42543989e9f7a3f3ced2b6a4446


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwReconEngine.exe
    .exe windows:5 windows x86 arch:x86

    61acc69b5777da48de024bc9d0aa6da0


    Code Sign

    Headers

    Imports

    Sections

  • bin/KwService.exe
    .exe windows:5 windows x86 arch:x86

    7e84d160f2b0b390c1f4f9cbe3fd8040


    Code Sign

    Headers

    Imports

    Sections

  • bin/KwShareMemMgr.dll
    .dll windows:5 windows x86 arch:x86

    b3aa55a1fafa091ad2315cce135fdc9c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwSongCache.dll
    .dll windows:5 windows x86 arch:x86

    c43d70d585ea334825aa3f29abbb4574


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwTagLib.dll
    .dll windows:5 windows x86 arch:x86

    f7069d23e58b42096e795c77ead8a402


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwTools.exe
    .exe windows:5 windows x86 arch:x86

    104cca75072386a9f87d62a9ae8fed44


    Code Sign

    Headers

    Imports

    Sections

  • bin/KwUACSet.exe
    .exe windows:5 windows x86 arch:x86

    053f4fba7040d17dce0d8f185ba487dd


    Code Sign

    Headers

    Imports

    Sections

  • bin/KwVirtualizer.dll
    .dll windows:5 windows x86 arch:x86

    996cf69fbb3d98f758d9c18284151d45


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwVistaAssist.dll
    .dll windows:6 windows x86 arch:x86

    82ba60dc1d296871688f565f5ae5113e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwWallpaper.exe
    .exe windows:5 windows x86 arch:x86

    6de911eed29289bce40755739b48b0e5


    Code Sign

    Headers

    Imports

    Sections

  • bin/KwWebKit.exe
    .exe windows:5 windows x86 arch:x86

    6631f17abf7622c80e6386a07d73a6f8


    Code Sign

    Headers

    Imports

    Sections

  • bin/KwWebKitDll.dll
    .dll windows:5 windows x86 arch:x86

    56a0c8e77e8777e4fe7a1e533bd0789c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/MP4Splitter.ax
    .dll regsvr32 windows:5 windows x86 arch:x86

    49e71171deaa08a317325913c493bc37


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/MatroskaSplitter.ax
    .dll regsvr32 windows:5 windows x86 arch:x86

    6db78c3f177f835025a5a9e59e4b3654


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/MediaInfo.dll
    .dll windows:5 windows x86 arch:x86

    d6b6a0b45e5f3902989f1fde3e84847f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/Module.xml
    .xml
  • bin/MpaDecFilter.ax
    .dll regsvr32 windows:4 windows x86 arch:x86

    49fe25334afea175223d3ae146a8e0b9


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/PlayerCore.dll
    .dll windows:5 windows x86 arch:x86

    8fe62c56c8b99f87c28eb4da1e5d1a1c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/QyCorpPlug.dll
    .dll windows:5 windows x86 arch:x86

    a0ad62e33c1a82afcffe1e8f3089ae9b


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/ReconEngine.exe
    .exe windows:5 windows x86 arch:x86

    a6a9a2f48a91f9dded77aa70517b89c7


    Code Sign

    Headers

    Imports

    Sections

  • bin/ShellDl.exe
    .exe windows:5 windows x86 arch:x86

    26dbc2bbe4171250f024c1db0f21e909


    Code Sign

    Headers

    Imports

    Sections

  • bin/UIAndroidUsbDevice.dll
    .dll windows:5 windows x86 arch:x86

    16486116cc5b08061cc5f1ed6ee7243a


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/UIAvMgr.dll
    .dll windows:5 windows x86 arch:x86

    191193e845d4e80be3fad5b2479a44e8


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/UIDeskLyric.dll
    .dll windows:5 windows x86 arch:x86

    a210a4db07c9f470de2bb05edb963918


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/UIDownload.dll
    .dll windows:5 windows x86 arch:x86

    b3480cad5f5733e9c186c177c58bdb7c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/UIMiniPanel.dll
    .dll windows:5 windows x86 arch:x86

    4e58b2d9963d10387a9f8a44421cd683


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/UIMusicTree.dll
    .dll windows:5 windows x86 arch:x86

    64569165f04692aace986f5a34e4d886


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/Vol.dll
    .dll windows:5 windows x86 arch:x86

    e2d9e4683490ac76e1de947836a330d9


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/WriteMbox.exe
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Code Sign

    Headers

    Imports

    Sections

  • bin/Zlib.dll
    .dll windows:5 windows x86 arch:x86

    4661a3332dc817fc2c6a2d783bb05054


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/avresample-lav-3.dll
    .dll windows:6 windows x86 arch:x86

    a5cdc97db70199c720a114e314f24807


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/avutil-lav-55.dll
    .dll windows:6 windows x86 arch:x86

    b59f4a7c3d42cda15878f850be6353f1


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/ccenter.dll
    .dll windows:5 windows x86 arch:x86

    89bb628c434b417b982be3967cb4a069


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/cef.pak
    .js
  • bin/cef_100_percent.pak
  • bin/cef_200_percent.pak
  • bin/desk_compositor_x64.dll
    .dll windows:5 windows x64 arch:x64

    e5e3b27ba340af46038cd9e8f29c2b63


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/desk_compositor_x86.dll
    .dll windows:5 windows x86 arch:x86

    a9ce8df9608cda33494edc87e62b9812


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/dns2.dll
    .dll windows:5 windows x86 arch:x86

    751017d3a5a3f6246b40326e9331944e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/hanzi_pinyin.dict
  • bin/icudtl.dat
  • bin/kwAdb.exe
    .exe windows:5 windows x86 arch:x86

    ef40f241302541b649f037c1fa3a5012


    Code Sign

    Headers

    Imports

    Sections

  • bin/kwmusic.exe
    .exe windows:5 windows x86 arch:x86

    bea5dc7c8ce8baa2afbd22fb40c6590c


    Code Sign

    Headers

    Imports

    Sections

  • bin/kwupdater.exe
    .exe windows:5 windows x86 arch:x86

    6aea1d168ae50129bda144d97a542882


    Code Sign

    Headers

    Imports

    Sections

  • bin/libcef.dll
    .dll windows:5 windows x86 arch:x86


    Headers

    Sections

  • bin/mylkx.dat
  • bin/plugin/avresample-lav-3.dll
    .dll windows:6 windows x86 arch:x86

    a5cdc97db70199c720a114e314f24807


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/plugin/avutil-lav-55.dll
    .dll windows:6 windows x86 arch:x86

    b59f4a7c3d42cda15878f850be6353f1


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • readme.txt