lowp[.]exe | Triage™

General

Target
lowp.exe
Size 145KB
Sample240613-dltd3swbnp
SHA256 ddd694fe7fb85692f2bb4d6ac2102dd8c84de91e8e108d0c9e454b8628c8e604
MD5 b29ca332442a713b736154f11cd3b04d
SHA1 8f76596c227afd46aa74ed74889eeae3811cd783
SHA512 0676aac42143987572184d3ce39144e52a90a94ef61c5ffa3da5383d3fecd469aac32a3ee1e1e76ed4bd82c1d2a4b3d658d1ac72522668dd936623412682d55b
SSDEEP 3072:cIl+HgRe/nVT4T9SsuGjOc1HsvIAIQrAWyic:cvARe/d4ssp6ctSI4X
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
lowp.exe

File Explorer

lowp.exe

.exe 145KB

lowp.exe

IMPHASH 9ba557a9b5974ce07a70190d7bd02206
SHA256 ddd694fe7fb85692f2bb4d6ac2102dd8c84de91e8e108d0c9e454b8628c8e604
MD5 b29ca332442a713b736154f11cd3b04d
SHA1 8f76596c227afd46aa74ed74889eeae3811cd783
SHA512 0676aac42143987572184d3ce39144e52a90a94ef61c5ffa3da5383d3fecd469aac32a3ee1e1e76ed4bd82c1d2a4b3d658d1ac72522668dd936623412682d55b
SSDEEP 3072:cIl+HgRe/nVT4T9SsuGjOc1HsvIAIQrAWyic:cvARe/d4ssp6ctSI4X
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

14220

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

GetDesktopWindow GetDC MessageBoxW GetSystemMetrics ShowWindow ReleaseDC

gdi32

BitBlt SelectObject CreateFontW GetStockObject TextOutW SetTextColor DeleteObject SetBkMode

shell32

ShellExecuteExW

kernel32

HeapSize HeapReAlloc WriteConsoleW IsProcessorFeaturePresent GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetCurrentProcess WriteFile DeviceIoControl GetModuleFileNameW SetFilePointer CreateFileW GetSystemDirectoryW Sleep CloseHandle GetProcAddress SetFilePointerEx GetModuleHandleW GetConsoleWindow GetTickCount GetCurrentThreadId WaitForSingleObjectEx GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable QueryPerformanceCounter GetSystemTimeAsFileTime GetCurrentProcessId InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW TerminateProcess GetProcessHeap RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW CreateThread ExitThread FreeLibraryAndExitThread GetStdHandle HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW WaitForSingleObject GetExitCodeProcess CreateProcessW GetFileAttributesExW GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW

Sharing