lowp[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
lowp.exe
Size 106KB
Sample240613-b5sksatcmp
SHA256 484e3663b6c2b8308695491a8772eb8ba49d619667dc29ef3361aa02c0effaf4
MD5 fbf8f9787bfbed20773bf07f47f800e8
SHA1 fab074d48e90f9485ab069df464adc86ea48fc9f
SHA512 c61fc6df9e3e856f0161c694206329ce428cfffd52e029e5080557a9ea51eba00069cd226bc065c05c12bc387d65747a7f3179cf2ee220d3ac73ccb22f0fc607
SSDEEP 3072:30Fd+PJhBHThE2dFoL999L/cuYpZNZT7PomGy5qfh5:EFdOPBHjov1cf5rqfh5
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
lowp.exe

File Explorer

lowp.exe

.exe 106KB

lowp.exe

IMPHASH 452e506d823b0e06a2a4f2fa05e69ef8
SHA256 484e3663b6c2b8308695491a8772eb8ba49d619667dc29ef3361aa02c0effaf4
MD5 fbf8f9787bfbed20773bf07f47f800e8
SHA1 fab074d48e90f9485ab069df464adc86ea48fc9f
SHA512 c61fc6df9e3e856f0161c694206329ce428cfffd52e029e5080557a9ea51eba00069cd226bc065c05c12bc387d65747a7f3179cf2ee220d3ac73ccb22f0fc607
SSDEEP 3072:30Fd+PJhBHThE2dFoL999L/cuYpZNZT7PomGy5qfh5:EFdOPBHjov1cf5rqfh5
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11661

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

user32

GetDesktopWindow GetDC MessageBoxW GetSystemMetrics ShowWindow ReleaseDC

gdi32

BitBlt SelectObject CreateFontW DeleteObject SetBkMode SetTextColor TextOutW GetStockObject

advapi32

AllocateAndInitializeSid FreeSid CheckTokenMembership

shell32

ShellExecuteExW

kernel32

HeapReAlloc HeapSize WriteConsoleW InitializeSListHead GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetCurrentProcess WriteFile DeviceIoControl GetModuleFileNameW SetFilePointer CreateFileW GetSystemDirectoryW Sleep CloseHandle LoadLibraryW GetProcAddress SetFilePointerEx FreeLibrary GetConsoleWindow GetTickCount CheckRemoteDebuggerPresent GetCurrentThreadId WaitForSingleObjectEx GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable QueryPerformanceCounter GetSystemTimeAsFileTime GetModuleHandleW GetCurrentProcessId DecodePointer IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent TerminateProcess GetProcessHeap RaiseException RtlUnwind GetLastError SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitProcess GetModuleHandleExW CreateThread ExitThread FreeLibraryAndExitThread GetStdHandle HeapAlloc HeapFree CompareStringW LCMapStringW WaitForSingleObject GetExitCodeProcess CreateProcessW GetFileAttributesExW GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW