Overview
overview
7Static
static
3PhotoSecti...na.htm
windows7-x64
3PhotoSecti...na.htm
windows10-2004-x64
3PhotoSecti...HB.htm
windows7-x64
3PhotoSecti...HB.htm
windows10-2004-x64
3PhotoSecti...GB.dll
windows7-x64
1PhotoSecti...GB.dll
windows10-2004-x64
1PhotoSecti...er.exe
windows7-x64
3PhotoSecti...er.exe
windows10-2004-x64
7PhotoSecti...ro.exe
windows7-x64
6PhotoSecti...ro.exe
windows10-2004-x64
6PhotoSecti...CI.exe
windows7-x64
3PhotoSecti...CI.exe
windows10-2004-x64
3PhotoSecti...��.url
windows7-x64
1PhotoSecti...��.url
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
PhotoSectionMaster/Language/LoveChina.htm
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
PhotoSectionMaster/Language/LoveChina.htm
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
PhotoSectionMaster/Language/ShTianHB.htm
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
PhotoSectionMaster/Language/ShTianHB.htm
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
PhotoSectionMaster/Language/SheTianIntro_GB.dll
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
PhotoSectionMaster/Language/SheTianIntro_GB.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
PhotoSectionMaster/PhotoSectionMaster.exe
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
PhotoSectionMaster/PhotoSectionMaster.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
PhotoSectionMaster/SheTianIntro.exe
Resource
win7-20240729-en
Behavioral task
behavioral10
Sample
PhotoSectionMaster/SheTianIntro.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
PhotoSectionMaster/Tools/TeacherPCI.exe
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
PhotoSectionMaster/Tools/TeacherPCI.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
PhotoSectionMaster/新云软件.url
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
PhotoSectionMaster/新云软件.url
Resource
win10v2004-20240802-en
General
-
Target
a2bf42968b6681474d93bab9f4d3d907_JaffaCakes118
-
Size
1.1MB
-
MD5
a2bf42968b6681474d93bab9f4d3d907
-
SHA1
7e408ffca7edf7ee09a31b66d91d9b980095e959
-
SHA256
af893c460ca946021d56852fecb12cee55748b4e6c1ddc8b157d21a4f50107f5
-
SHA512
645d8ccc0594ef0d4ea4cf209be47367115dbf04f9e1bf43dad2f7ede244a846bcc61f8a4c1522745bc582c7403fcedb7baf609f2c7ad29549dd680e53151afb
-
SSDEEP
24576:9L1HtRVy4TW+wU3zgHD9OTK9VPk32qWeTVbppq8ZflAbAX:9ZHty4K+wc8HDY+/iWexSA9Ag
Malware Config
Signatures
-
Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/PhotoSectionMaster/PhotoSectionMaster.exe unpack001/PhotoSectionMaster/SheTianIntro.exe unpack001/PhotoSectionMaster/Tools/TeacherPCI.exe
Files
-
a2bf42968b6681474d93bab9f4d3d907_JaffaCakes118.rar
-
PhotoSectionMaster/Language/A00000001.JPG.jpg
-
PhotoSectionMaster/Language/BJ.jpg.jpg
-
PhotoSectionMaster/Language/LoveChina.htm.html
-
PhotoSectionMaster/Language/ShTianHB.htm.html
-
PhotoSectionMaster/Language/ShTianHB.jpg.jpg
-
PhotoSectionMaster/Language/SheTianIntro_GB.DLL
-
PhotoSectionMaster/PhotoSectionMaster.exe.exe windows:4 windows x86 arch:x86
4809859e22ca135e4510f5d4baab5ae9
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
advapi32
RegCloseKey
version
GetFileVersionInfoA
comctl32
ImageList_Add
comdlg32
ChooseColorA
gdi32
BitBlt
shell32
ShellExecuteA
user32
ActivateKeyboardLayout
winmm
PlaySoundA
ole32
CoCreateInstance
oleaut32
GetActiveObject
gdiplus
ord1
Sections
.text Size: 411KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 14KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
PhotoSectionMaster/Readme.txt
-
PhotoSectionMaster/SheTianIntro.exe.exe windows:4 windows x86 arch:x86
80227774171fa585993d22e18bd79a81
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
advapi32
RegCloseKey
version
GetFileVersionInfoA
winspool.drv
ClosePrinter
comctl32
ImageList_Add
gdi32
BitBlt
shell32
ShellExecuteA
user32
ActivateKeyboardLayout
ole32
CoCreateInstance
oleaut32
GetActiveObject
Sections
.text Size: 375KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
PhotoSectionMaster/Tools/SY1.WAV
-
PhotoSectionMaster/Tools/TeacherPCI.exe.exe windows:4 windows x86 arch:x86
818dda5e06d1f17841afedce9b705888
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
advapi32
RegCloseKey
mpr
WNetGetConnectionA
version
GetFileVersionInfoA
comctl32
ImageList_Add
comdlg32
GetOpenFileNameA
gdi32
BitBlt
shell32
ShellExecuteA
user32
ActivateKeyboardLayout
oleaut32
SafeArrayCreate
Sections
.text Size: 265KB - Virtual size: 796KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
PhotoSectionMaster/新云软件.url.url