Juniorer[.]exe | Triage™

resource
Juniorer.exe
unpack001/$PLUGINSDIR/System.dll

Juniorer.exe

IMPHASH 573bb7b41bc641bd95c0f5eec13c233b
SHA256 ce1285f6f87bfc3c2a7f51f1f9f4829d94fed5504f9b892f7e2a62b6b4acf4bc
MD5 938db4df6a0e927f4f41b0a31217581c
SHA1 2f35709941e29f6f40605634b2fcfc54d3cc95f6
SHA512 c5b80505411125289e81a8b5aae25b59067916146e79c214b0774979361c5b2b33e4f29c924f8ef78179b781fcadb420d083d197d1f4125cc03aeba9f6652f3d
SSDEEP 12288:5TA+Q4NwA7qpMVZhWCxScT+6Vt0SGZNu49ezMgIz:5TAP4Nwvojx7T+kuu8eAgIz
TLSH
T1EBA4231023E6F852ED6306751B3B6AF766B978605179470F23957EAF39B0B80E02EF11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13709

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

lstrcmpiA CreateFileW GetTempFileNameW RemoveDirectoryW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW WriteFile ExitProcess GetCurrentProcess GetModuleFileNameW GetLastError GetFileSize GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject CopyFileW

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Bursati/skakker.txt

SHA256 dbf3999dd964e08ef75065ebd8143eb68de49178cd3f20e5a296864d68f1b801
MD5 30bd590294717b55bac748b9135b4fe4
SHA1 73134900f11d40039e441fed8097df90ca2aede7
SHA512 e8272c6dc43030efb31b1a2ae6e4f841b76cb1ce70fbe76785326e6d101ff796476de47c789c0e4c9a2a9157259a8636ea120e79204edf84e399d23c8ec7a50b
TLSH
T176016520AEC6015F07CB4B437EA3D4F9A52A4A06E57B45D1E6DB1F98B88623603F611B
MD5 SHA1 SHA512 TLSH

Bursati/storkeredes.txt

SHA256 a67b0ee66d49c7daca4cf76068a86880587036a7b8eb04201fe1b518f7df824c
MD5 73768f4e116b09029d43e52c018814dc
SHA1 e14b1e805f16659801259c40f311fe7694ead169
SHA512 9f92472d5540c49bb233763abeaf42971a6ca7d82559607d6bdd75406a7679c74f680221c70c016ad01356ea12b97e509495eb189e59b07feee9952f3c4c91d4
TLSH
T106F0A3198D183D6B9D4B1FEE1C025CBE55470E2A057B8CA5CF81070C5021C71D6ADD61
MD5 SHA1 SHA512 TLSH

Bursati/xylocarps.jpg

SHA256 08a4a66f31d414d12ce16a3b0c1199daf6f457b3faefd76370d9b01a849156b5
MD5 2d05147eada1255a65ac4930d3be5a24
SHA1 0babe9a7833ab05c5d755cc69a502cc3afaf0bff
SHA512 78849b7bca229c5cc942c622e0ffada4f6da6e82f2da06c9ae2ecfc5f80c35fe5153a791c454f0e59d2b58ae317d865f6c4520e32d44908bcb668bf5a8dcccd4
SSDEEP 768:+5OLPgpjnAGOeW7uDzbaMNdimX68J13aDccMufgpMdBrebHQ:+5klGw7W7ziCJYhMuPmQ
TLSH
T185F2E1086EEE2D5DDB46BDF5C2C618A79130298DCB6503B0BDD68697E3C6DB884924C0
MD5 SHA1 SHA512 SSDEEP TLSH

foderal/Haman

SHA256 55adba592c3472e3f717e6c476531d61cf13e662c31aeaf721e2f4f44bf3a5f5
MD5 ad520bdc88dedcf6954e77e2d6d37f0e
SHA1 ae1cfcff2dba3e84b6484a4bde3ad2ef35435fef
SHA512 f1755d0904b2277f2ca46877cf8ebe3e4b88e87f98dbef70e3bab4a052ea5bdbd424c752a11bd8ed718942d63e6a861e72d5b4cc76548e6d9d2161ad162602e7
SSDEEP 3072:r1NrA8j0ORJGNnGXngph+tG8+zu+Ux6F1GIDlAK8oOaEDrDmnqBLDRT1QP:P0O782nm+tG8+zuecIAK8JaED3mnQ1QP
TLSH
T1C804E069348740EBC1911BBACA3A1A8D0B0C7D5FA3EEFD9F5B8D903B1916E5040B7749
MD5 SHA1 SHA512 SSDEEP TLSH

foderal/Hvirvlernes.txt

SHA256 f6f7d3114b82b298f3a682554e98dc055cbb4170d107e516a6e0487bc74f8544
MD5 371843f9fbd635d6c3ed743614fe828b
SHA1 b4223203201d89acc810a8829b52fa73c7bff568
SHA512 8ca4b43b04793f8467701455be78c1f99e1850f58791c9fb3e5f5a75e2b784710fe38ebb0f7feb638e7d560296e154f4aa426ebf2f7f64d06e537c99ef96117d
TLSH
T133D0E79DCF53340302E219D1CC0040433497875551175DD076160F2DA063276839780D
MD5 SHA1 SHA512 TLSH

foderal/Unupbraiding

SHA256 4daa350b75eebe969a512f75b18134ede331d49277c0c26943b2761b81ba7bf7
MD5 5895876c626545350db5b3d727c4246c
SHA1 a3332dd9a6b9a82cc448ab9d8a14b4e4afe2566c
SHA512 0688066dd15816a051a1835ab07083601e2115fe0047585446b900193e5329048a8da94412cb22d2ce43aa2115924b4fd29ea1511852e587100a2577f11b46de
SSDEEP 1536:aSFtmfd80lzBPjLwISMHCT1y/fYUSM1K+Cou7ah93cRiX9gbI:a2tileItHCxyo9MgxS
TLSH
T100C3B057CB15CDBBDD0B813CD45A70EA48A870145B0FD0FDA2B6AD14C19B3E36724AAB
MD5 SHA1 SHA512 SSDEEP TLSH

guying.ini

SHA256 64fa7fc713725c08e8db6dcb529959267c71f56bc4c4c322ab40be78723056d7
MD5 518b22538ac9de2a8ace8e7a80623a4d
SHA1 2bdeea3e235ac7803803504f1e83d46c3eaf544d
SHA512 fc6f2a946141a14e5a30b0b53b1da2a6097f6f6842edf0bf47ee875450a1ef70a39aa77ba16ad64e25302d2f0f1a82f3065ef372d9f1f13103a3163fcf0d956f
TLSH
T1CDF0E132868C215A8D9A0EA6BCE05C6205DD4318C643603AE3760B4D2406DACC23B616
MD5 SHA1 SHA512 TLSH

helsebringende.txt

SHA256 ce2a4e3bcee27ca41701e929c9e81ec623d7f7f635b9852f1e6981859d0e49b8
MD5 3620bb6dd9a35523886ec9becca1168d
SHA1 e38f6654193f3e25d8f90e6ce0dae443dbdafc55
SHA512 09be81a2647fc4de50b98fc7aa87f05b85f3b2e177c6e0eed9a9584a8a3dac5378945aef4f2bcaad36aeb342c33ab846b8da93cc36175fe2ad53780e4783e32b
TLSH
T168D02E09D5022A6523AA11CB08FAAE8882C8C221C530D810BB9B6380012786CF63E88D
MD5 SHA1 SHA512 TLSH

incoming.sti

SHA256 9365a2f0a70073483480bd752b2d37314e8c897d1f07f79eea51995a70f1b675
MD5 d071f064bda2f90a612a6c365b71ed28
SHA1 c144aed44a3e0a5d1e3a5ba58e1ae691b6783ed3
SHA512 4dc5015ffd7730d97c24451863ac1c34786e56d063c2b2c0084d885d9ca36334f284d15d3f5ce090e0b6b4ccbae7e816ecd9b4f81c5e7acd890ff6750d1d398c
SSDEEP 1536:giHDObCMgw9ni7+8fT2XNSKK9Pa0wp9LiYr738YDKnMLj4aWcQbZfi/ndqIhs6R2:p9
TLSH
T1261612F74F8EA9C2C7D20ED0B0F28D95657344A7BD826509673112EA6BCC789277E40D
MD5 SHA1 SHA512 SSDEEP TLSH

okkerfarvet.jpg

SHA256 ed6b8ff57d344b103d0cf64ebb0e4c758c7a24dc77b7493b15af118718340dcc
MD5 0398e1344f0c5ebe0219bfe6409da76d
SHA1 53e15588ed05e030478aa2f720d140210683e594
SHA512 1c44c29ff8ae337bc80c172411bbbdcddf0ed8f54769da5d7f8cb75e8b180a159ce71bba69463038e761a089818cc17a6931263e8bfd736d87210b093e13dd5b
TLSH
T10141D8A9A39424E8CF1656F2166A2565E20AA4DB39443F30253171E9CB64DFA1289B3C
MD5 SHA1 SHA512 TLSH

posrens.txt

SHA256 1ba934c2d42b013b82df7d0663f0926e04da4e2389d66ababd30e2efc2ac99e5
MD5 8ab73fa7743f46f2659c19562bbce7c8
SHA1 bd4078ed05646021072d77d7712de35056af8316
SHA512 afdf0b50ae104cfed47e88f12db70a863546e2639dd57736b1f8a3f253ceb5e91b38cc7d87c1f1643f62245e03b1a42c20d9ba6f5f1e8cc1347d7a63e80da4de
TLSH
T1C5F05434556B3168184F8EAB0CC2A481882DC773098718B17F52230D5EC5821B33F6DB
MD5 SHA1 SHA512 TLSH

Juniorer.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Bursati/skakker.txt

Bursati/storkeredes.txt

Bursati/xylocarps.jpg

foderal/Haman

foderal/Hvirvlernes.txt

foderal/Unupbraiding

guying.ini

helsebringende.txt

incoming.sti

okkerfarvet.jpg

posrens.txt

Sharing

General

Malware Config

Signatures

File Explorer

Juniorer.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Bursati/skakker.txt

Bursati/storkeredes.txt

Bursati/xylocarps.jpg

foderal/Haman

foderal/Hvirvlernes.txt

foderal/Unupbraiding

guying.ini

helsebringende.txt

incoming.sti

okkerfarvet.jpg

posrens.txt