General

  • Target

    2e751647ac118e6fe5cb4e7ce1556162_JaffaCakes118

  • Size

    2.4MB

  • MD5

    2e751647ac118e6fe5cb4e7ce1556162

  • SHA1

    f2483e64288d65470a9a122d71ae5960cde709ed

  • SHA256

    b1158004747ae951904fb703a8bd5bc869b641f4f960bed51e28f9eec4cc8e70

  • SHA512

    80b91e3d610cc62e02c16780e42e64ad22b48adf3dda1829d5094c92ae33fbc69da225aaede32c3d42c8e6cfb8c406aefbcae3e8c30e3011d899bc8bbb84f2a8

  • SSDEEP

    49152:LWqXzCBB4A1oqRdV8835lSgxv42OeiozIBm8GBzTUZQqI:yqXWBpNRr35Nv42QosBmJlTgM

Score
3/10

Malware Config

Signatures

  • Unsigned PE 10 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 3 IoCs

Files

  • 2e751647ac118e6fe5cb4e7ce1556162_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    237a51742fed62d237b6f1b75452402f


    Headers

    Imports

    Sections

  • $1
  • $APPDATA/kuwo/Conf/p2pconf/setup.xml
    .xml
  • $PLUGINSDIR/Base64.dll
    .dll windows:4 windows x86 arch:x86

    472def3d6dc5d4ffe27376a831b4d49b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    57354bdeea3dfae6e948101add87501a


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/KillProcDLL.dll
    .dll windows:4 windows x86 arch:x86

    815c88741b87a0210c457b00b57bf9c6


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/KuWoNsis_new.dll
    .dll windows:4 windows x86 arch:x86

    c1c7e2e49a726b988d79dc6456f258fb


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    4ec328f99bdd944fc98d8a5cf11f7a62


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/inetc.dll
    .dll windows:4 windows x86 arch:x86

    5d31a4a9e83c0a8e38bab1f57d28402c


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/kwsobar.bmp
  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/sobar/KwMusic_sobar.ini
  • $TEMP/KWMUSIC/BindConfig.ini
  • $TEMP/KWMUSIC/DownloadUpdate.exe
    .exe windows:4 windows x86 arch:x86

    237a51742fed62d237b6f1b75452402f


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/Base64.dll
    .dll windows:4 windows x86 arch:x86

    472def3d6dc5d4ffe27376a831b4d49b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/KuWoNsis_new.dll
    .dll windows:4 windows x86 arch:x86

    29fd838184a64d185951b6564c3a17b4


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    4ec328f99bdd944fc98d8a5cf11f7a62


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/inetc.dll
    .dll windows:4 windows x86 arch:x86

    5d31a4a9e83c0a8e38bab1f57d28402c


    Headers

    Imports

    Exports

    Sections

  • $TEMP/sobar/Baidu-TB-ASBar-Silent_kuwo.exe
    .exe windows:4 windows x86 arch:x86

    73b73e00f465fa1a2a3bf6377a40219b


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAM_FILES/Baidu/ASBarBroker.exe
    .exe windows:4 windows x86 arch:x86

    8cb73f23fc4ffce04345bba981c347fe


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAM_FILES/Baidu/AddressBar.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    c6079cff13dd538f8c2b93227d9d6d6c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PROGRAM_FILES/Baidu/Toolbar/BaiduBarX_Tmp/BaiduBarX.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    8468b88eb97c7ed8e903637ad8f51134


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PROGRAM_FILES/Baidu/Toolbar/BaiduBarX_Tmp/BarBroker.exe
    .exe windows:4 windows x86 arch:x86

    5b79acdd9738a352787f0a927feb114d


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAM_FILES/Baidu/Toolbar/BaiduBarX_Tmp/rc.dll
    .dll windows:4 windows x86 arch:x86

    d811d71710ad58776155b7a8da1fa9db


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAM_FILES/Baidu/conf.xml
    .xml
  • KwMusic.exe
    .exe windows:5 windows x86 arch:x86

    d37436deaf839aaae619193b8b8393aa


    Code Sign

    Headers

    Imports

    Sections

  • bin/CKuwoPlayer.dll
    .dll windows:5 windows x86 arch:x86

    8e4880f7ceeb969715f545f8789e05e6


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/CWmpPlayer.dll
    .dll windows:5 windows x86 arch:x86

    ffa030b08ed1f9b091f130d76d941a26


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/CoreAVC0.ax
    .dll regsvr32 windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • bin/DshowPlayer.dll
    .dll windows:5 windows x86 arch:x86

    51011157c8eff9ae62263977212e0b44


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/Encode.exe
    .exe windows:5 windows x86 arch:x86

    da51d131c2d14a263ced57385b829735


    Code Sign

    Headers

    Imports

    Sections

  • bin/KwAni.dll
    .dll windows:5 windows x86 arch:x86

    da76944fe7c41bfb041ed1007ab49887


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwCommonUI.dll
    .dll windows:5 windows x86 arch:x86

    5efdbcf7194ffc4408d5306ce0e7d69f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwDataDef.dll
    .dll windows:5 windows x86 arch:x86

    16bba5ccf54036ca4f864dc847e362c4


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwHttpRequestMgr.dll
    .dll windows:5 windows x86 arch:x86


    Headers

    Sections

  • readme.txt