Overview
overview
7Static
static
3PhotoRecov...up.exe
windows7-x64
3PhotoRecov...up.exe
windows10-2004-x64
7PhotoRecov...ch.exe
windows7-x64
7PhotoRecov...ch.exe
windows10-2004-x64
7PhotoRecov...��.htm
windows7-x64
3PhotoRecov...��.htm
windows10-2004-x64
3PhotoRecov...��.url
windows7-x64
1PhotoRecov...��.url
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
PhotoRecovery.For.Digital.Media/PR35-DEMO-Setup.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
PhotoRecovery.For.Digital.Media/PR35-DEMO-Setup.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
PhotoRecovery.For.Digital.Media/PhotoRecovery.For.Digital.Media.Patch/photorecovery.3.5.5.0-patch.exe
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
PhotoRecovery.For.Digital.Media/PhotoRecovery.For.Digital.Media.Patch/photorecovery.3.5.5.0-patch.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
PhotoRecovery.For.Digital.Media/下载说明.htm
Resource
win7-20240729-en
Behavioral task
behavioral6
Sample
PhotoRecovery.For.Digital.Media/下载说明.htm
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
PhotoRecovery.For.Digital.Media/飘down精品软件.url
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
PhotoRecovery.For.Digital.Media/飘down精品软件.url
Resource
win10v2004-20240802-en
General
-
Target
f0820a5eb96cd9d1cd752744ac2eb3a2_JaffaCakes118
-
Size
5.7MB
-
MD5
f0820a5eb96cd9d1cd752744ac2eb3a2
-
SHA1
485633dba1c85a6c65ee839c529214f0f7e23ba9
-
SHA256
92d3037001a280d711cbd6eaed05a03f08adbc6ef198fc37400b2db6cb276e68
-
SHA512
29813340f5d9f6526d38dbd14655e2ed9e689544af873a1fa4558dbc6d75f83b0d610b12383fce0a1ce901fcac7fba483ac6e3c82411bbff4d197bb8d605a9ab
-
SSDEEP
98304:y1L8N5EFhFkNWJ9oR3BLLsAm9RybDAmNCliJx4j7iLjKc8o59YBAB:KpFuWq3tLyLyQliJxUiLOm59YBAB
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/PhotoRecovery.For.Digital.Media/PR35-DEMO-Setup.exe unpack001/PhotoRecovery.For.Digital.Media/PhotoRecovery.For.Digital.Media.Patch/photorecovery.3.5.5.0-patch.exe
Files
-
f0820a5eb96cd9d1cd752744ac2eb3a2_JaffaCakes118.rar
-
PhotoRecovery.For.Digital.Media/PR35-DEMO-Setup.exe.exe windows:4 windows x86 arch:x86
e199ea066ab2c2908869e5544decaca5
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetTempPathA
GetModuleFileNameA
CloseHandle
CreateProcessA
WritePrivateProfileStringA
lstrcatA
GetDiskFreeSpaceA
CreateDirectoryA
SetCurrentDirectoryA
lstrcmpA
GetPrivateProfileStringA
_lread
_lwrite
_lcreat
_llseek
_lclose
_lopen
GetSystemDefaultLangID
DeleteFileA
lstrlenA
lstrcpyA
GetFileAttributesA
GetLastError
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
LoadLibraryA
GetProcAddress
GetOEMCP
GetACP
GetCPInfo
WriteFile
RtlUnwind
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
GetStringTypeW
GetModuleHandleA
UnhandledExceptionFilter
FreeEnvironmentStringsA
VirtualAlloc
HeapFree
HeapAlloc
ExitProcess
TerminateProcess
GetCurrentProcess
FreeEnvironmentStringsW
VirtualFree
HeapReAlloc
GetStartupInfoA
GetCommandLineA
GetVersion
HeapDestroy
HeapCreate
user32
RegisterClassA
RegisterClassExA
MsgWaitForMultipleObjects
DefWindowProcA
MessageBoxA
PeekMessageA
PostQuitMessage
BeginPaint
GetClientRect
DrawTextA
EndPaint
PostMessageA
GetMessageA
TranslateMessage
DispatchMessageA
GetDesktopWindow
GetWindowRect
CreateWindowExA
ShowWindow
UpdateWindow
LoadStringA
LoadIconA
LoadCursorA
wsprintfA
gdi32
SetBkMode
Sections
.text Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
PhotoRecovery.For.Digital.Media/PhotoRecovery.For.Digital.Media.Patch/photorecovery.3.5.5.0-patch.exe.exe windows:4 windows x86 arch:x86
09d0478591d4f788cb3e5ea416c25237
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
Sections
.edata Size: 124KB - Virtual size: 268KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
PhotoRecovery.For.Digital.Media/PhotoRecovery.For.Digital.Media.Patch/snd.nfo
-
PhotoRecovery.For.Digital.Media/下载说明.htm.html
-
PhotoRecovery.For.Digital.Media/飘down精品软件.url.url