lowp[.]exe | Triage™

General

Target
lowp.exe
Size 110KB
Sample240612-m4ehbawblm
SHA256 5b1a83d7ed4db12af8673df9e980259aa291d9ae79255bf490fac34a3e54a080
MD5 242124db01f029f2b112de244b54667c
SHA1 4b0a030a739704c35b9b51d2e180d3bee138ec25
SHA512 75eb508792d1b344b611e44b05563aece859a8cc13068d2d026e5b5cbf7f70ebec21f776e92a6736aef802e53d698846994c8f163ad270bdada262150643beaf
SSDEEP 3072:4Cu6t5GYQiiri9Bi2fRWtbT9zjYomkNxzlz3f4/WZP:3HtsIirItRor93
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
lowp.exe

File Explorer

lowp.exe

.exe 110KB

lowp.exe

IMPHASH e6a6dabf4b3e12a6bccb9c2a188b0819
SHA256 5b1a83d7ed4db12af8673df9e980259aa291d9ae79255bf490fac34a3e54a080
MD5 242124db01f029f2b112de244b54667c
SHA1 4b0a030a739704c35b9b51d2e180d3bee138ec25
SHA512 75eb508792d1b344b611e44b05563aece859a8cc13068d2d026e5b5cbf7f70ebec21f776e92a6736aef802e53d698846994c8f163ad270bdada262150643beaf
SSDEEP 3072:4Cu6t5GYQiiri9Bi2fRWtbT9zjYomkNxzlz3f4/WZP:3HtsIirItRor93
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

15981

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

OpenProcessToken AdjustTokenPrivileges AllocateAndInitializeSid CheckTokenMembership FreeSid LookupPrivilegeValueA RegCloseKey RegOpenKeyExW RegSetValueExW

user32

ShowWindow MessageBoxW

shell32

ShellExecuteW

kernel32

WriteConsoleW HeapReAlloc HeapSize GetCommandLineW CreateFileW WriteFile CloseHandle GetCurrentProcess GetModuleHandleA GetProcAddress GetConsoleWindow WaitForSingleObjectEx GetCurrentThreadId GetExitCodeThread QueryPerformanceCounter ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable GetSystemTimeAsFileTime GetModuleHandleW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetCurrentProcessId InitializeSListHead IsDebuggerPresent GetStartupInfoW GetConsoleMode RaiseException RtlUnwind GetLastError SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW CreateThread ExitThread FreeLibraryAndExitThread GetStdHandle GetModuleFileNameW GetCommandLineA HeapFree WaitForSingleObject GetExitCodeProcess CreateProcessW GetFileAttributesExW HeapAlloc CompareStringW LCMapStringW GetFileType SetFilePointerEx FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW GetProcessHeap FlushFileBuffers GetConsoleOutputCP DecodePointer

Sharing