General

  • Target

    17fc0a119eb3d564d86d9bb8d0c7bcaa_JaffaCakes118

  • Size

    3.1MB

  • MD5

    17fc0a119eb3d564d86d9bb8d0c7bcaa

  • SHA1

    f7e0decfd80b0e5e0e81796ca295881521d4b2b8

  • SHA256

    5461f011084aeea4aa20119b087a973d523209c952cefd8aea912c6942286b8b

  • SHA512

    94b43a6debf42de79a8df012827a959b3f3c64c70e905f4defce2430732434e8cb8acf64741be2bfec88600ccf5b6f06f4da7b5cd008353fbd46626000aa51d7

  • SSDEEP

    98304:xWqPJnGyRMjWr+QL2V2+5cJ5hMvOJuayAx7F:NG8Mjm+QiV2Skzt1bdF

Score
3/10

Malware Config

Signatures

  • Unsigned PE 15 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 5 IoCs

Files

  • 17fc0a119eb3d564d86d9bb8d0c7bcaa_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    099c0646ea7282d232219f8807883be0


    Headers

    Imports

    Sections

  • $1
    .exe windows:4 windows x86 arch:x86

    237a51742fed62d237b6f1b75452402f


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    57354bdeea3dfae6e948101add87501a


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/KillProcDLL.dll
    .dll windows:4 windows x86 arch:x86

    815c88741b87a0210c457b00b57bf9c6


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/KuWoNsis_new.dll
    .dll windows:5 windows x86 arch:x86

    ffd4412e307ea3d6ae2310c454bc8fc7


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    4ec328f99bdd944fc98d8a5cf11f7a62


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/inetc.dll
    .dll windows:4 windows x86 arch:x86

    5d31a4a9e83c0a8e38bab1f57d28402c


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $APPDATA/$APPDATA/kuwodata/KWMUSIC/Conf/p2pconf/setup.xml
    .xml
  • $APPDATA/kuwodata/KWMUSIC/Res/cache/DOWNLOAD_ARTISTPIC/49FF334D.dat
    .jpg
  • $PLUGINSDIR/Base64.dll
    .dll windows:4 windows x86 arch:x86

    472def3d6dc5d4ffe27376a831b4d49b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/KillProcDLL.dll
    .dll windows:4 windows x86 arch:x86

    153027ec3b10bcea606b777657dd3402


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/KuWoNsis_new.dll
    .dll windows:5 windows x86 arch:x86

    948b8bae60b459524040676d50b6a578


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/KwMusicNsis.dll
    .dll windows:5 windows x86 arch:x86

    6b2dd5935ded9a39799a9f6805af044f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/NSISArray.dll
    .dll windows:5 windows x86 arch:x86

    8772d66326aa6d7b2a9d5c4b0a7afb36


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ShellLink.dll
    .dll windows:5 windows x86 arch:x86

    50112fdd20200a51dbedeae8f1f33cdb


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/SimpleSC.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/inetc.dll
    .dll windows:4 windows x86 arch:x86

    5bdcdde5acd7b395f3f3d19ebbb8c6cd


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:4 windows x86 arch:x86

    1e2884056e655f2b7bc5a904e352fc80


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsisSlideshowx.dll
    .dll windows:5 windows x86 arch:x86

    d2325c6257e48d1bd19cd17c53b9f01d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $TEMP/KWMUSIC/BindConfig.ini
  • $TEMP/KWMUSIC/DownloadUpdate.exe
    .exe windows:4 windows x86 arch:x86

    099c0646ea7282d232219f8807883be0


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/Base64.dll
    .dll windows:4 windows x86 arch:x86

    472def3d6dc5d4ffe27376a831b4d49b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ExecWaitEx.dll
    .dll windows:5 windows x86 arch:x86

    54b9abc6c68871f258abd4b5591459db


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/KuWoNsis_new.dll
    .dll windows:5 windows x86 arch:x86

    948b8bae60b459524040676d50b6a578


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/inetc.dll
    .dll windows:4 windows x86 arch:x86

    5bdcdde5acd7b395f3f3d19ebbb8c6cd


    Headers

    Imports

    Exports

    Sections

  • $TEMP/KWMUSIC/mylk.dat
  • $WINDIR/KwYlx.dat
  • KwMusic.exe
    .exe windows:5 windows x86 arch:x86

    579eb69a9d42f824590130a37d3931e6


    Code Sign

    Headers

    Imports

    Sections

  • bin/AdbWinApi.dll
    .dll windows:6 windows x86 arch:x86

    c64cac39044626770353879245ea25e4


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/CKuwoPlayer.dll
    .dll windows:5 windows x86 arch:x86

    4fcf47d9e60560522bda703f8d19ae52


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/CWmpPlayer.dll
    .dll windows:5 windows x86 arch:x86

    45a38a9f4cf88d5fef40567da57cba67


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/CoreAVC0.ax
    .dll regsvr32 windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • bin/DshowPlayer.dll
    .dll windows:5 windows x86 arch:x86

    61d9f42845cb3ca2b168cd8c87458a92


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/DuiLib.dll
    .dll windows:5 windows x86 arch:x86

    013de4afd9839cc98c18533bb9c52f2b


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/DumpReport.exe
    .exe windows:5 windows x86 arch:x86

    abc0c305e58a249f638e52725a700105


    Code Sign

    Headers

    Imports

    Sections

  • bin/Encode.exe
    .exe windows:5 windows x86 arch:x86

    ca135ef683fd74cc8427303c3b7646e8


    Code Sign

    Headers

    Imports

    Sections

  • bin/IEProxy.dll
    .dll windows:5 windows x86 arch:x86

    bd99bff4efa8de34c3c8501e4abaaecd


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/IESandBox.exe
    .exe windows:5 windows x86 arch:x86

    e01559b79bc5473a4c38677bdc13b5b7


    Code Sign

    Headers

    Imports

    Sections

  • bin/KuwoDaemon.apk
    .apk android

    cn.kuwo.service


  • bin/KuwoSyncMobile.dll
    .dll windows:5 windows x86 arch:x86

    0eb21a2c4c96b992395ac3fc1f55c99b


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwConfig.exe
    .exe windows:5 windows x86 arch:x86

    297e09fdcff7fa05b9b9c2a26c0b0dca


    Code Sign

    Headers

    Imports

    Sections

  • bin/KwDPGame.exe
    .exe windows:5 windows x86 arch:x86

    3028465870c5f98fa086facbb6a57a64


    Code Sign

    Headers

    Imports

    Sections

  • bin/KwDataDef.dll
    .dll windows:5 windows x86 arch:x86

    803e420aeb07a995f5f3fab1f1485f70


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwHttp.dll
    .dll windows:5 windows x86 arch:x86

    1089746ef651a6850f1cfab916aae22d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwHttpRequestMgr.dll
    .dll windows:5 windows x86 arch:x86

    79a777c00a5666f12e3e54c20868f2a0


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwInfos.exe
    .exe windows:5 windows x86 arch:x86

    deb15741e8726d12107a7895c603acca


    Code Sign

    Headers

    Imports

    Sections

  • bin/KwLib.dll
    .dll windows:5 windows x86 arch:x86

    5a33c4a75585d56f74771d8ecb39a9c7


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwLog.dll
    .dll windows:5 windows x86 arch:x86

    1acc1595a7b8edc4c725b665c4d8f34b


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwMV.dll
    .dll windows:5 windows x86 arch:x86

    5770b38b33a8bded5df6945f4b12dcae


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwModAppStore.dll
    .dll windows:5 windows x86 arch:x86

    1eb692483cdb4e475c7fad23abe1cbcb


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwModConfig.dll
    .dll windows:5 windows x86 arch:x86

    ef68062927a4bc64df6a62b42e0d2be0


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwModDownload.dll
    .dll windows:5 windows x86 arch:x86

    3708b18a6a0d075c5a4c9a29993f810b


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwModGameEntry.dll
    .dll windows:5 windows x86 arch:x86

    eeb9d77441fcaefa6d977e27242e283d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwModLocalMusic.dll
    .dll windows:5 windows x86 arch:x86

    406ea77c8176fd87d03b34703f5b6e2d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwModLyric.dll
    .dll windows:5 windows x86 arch:x86

    2115f6bbfacdcfa03f4f4864c8fec5e5


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwModLyricShow.dll
    .dll windows:5 windows x86 arch:x86

    2e4b7d41f22a7f9ad7aa190e40687451


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwModNetSong.dll
    .dll windows:5 windows x86 arch:x86

    c089bbe1673e441e9b4a753cb868f69d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwModPlaylist.dll
    .dll windows:5 windows x86 arch:x86

    092e2422746fedb6b119dd33473cad51


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwModSayHello.dll
    .dll windows:5 windows x86 arch:x86

    ac6bbbb9a68840400e3a5fe504f05ec2


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwModSkinManage.dll
    .dll windows:5 windows x86 arch:x86

    777f43159b0e76661eab39924f3d9178


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwModSynList.dll
    .dll windows:5 windows x86 arch:x86

    e6e7b7241cc12919ed2984d90000cff9


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwModUpdateWeb.dll
    .dll windows:5 windows x86 arch:x86

    c779abf203ecb80319367532085bb6e1


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwModUser.dll
    .dll windows:5 windows x86 arch:x86

    3dc95ef022b6a9c09363c46ec6e712bd


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwMusic.exe
    .exe windows:5 windows x86 arch:x86

    ed1c3ae7e795061c5e94e4d162f4a385


    Code Sign

    Headers

    Imports

    Sections

  • bin/KwMusicCore.dll
    .dll windows:5 windows x86 arch:x86

    16463d765261280413b63566a81376ca


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwRecoSong.dll
    .dll windows:5 windows x86 arch:x86

    e96354da883300a3da83d70c47843823


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwService.exe
    .exe windows:5 windows x86 arch:x86

    a646e07b74960ce8efbda6546fe616e5


    Code Sign

    Headers

    Imports

    Sections

  • bin/KwServiceProxy.dll
    .dll windows:5 windows x86 arch:x86

    675be03048af7dec9c74fe459503da42


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwSongCache.dll
    .dll windows:5 windows x86 arch:x86

    11db4c24f962f1421fc670881266043a


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwTagLib.dll
    .dll windows:5 windows x86 arch:x86

    0f2b449cf73353cf77465d8a7aaf1eff


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwUpdate.dll
    .dll windows:5 windows x86 arch:x86

    489caecb67c857143e128cdf995f6b0f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/MatroskaSplitter.ax
    .dll windows:5 windows x86 arch:x86


    Headers

    Sections

  • bin/mylkx.dat
  • readme.txt