lowp[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
lowp.exe
Size 145KB
Sample240613-st2sraydjj
SHA256 e2bb1cb67c01e4743d557f35f03d3256e739c32546873d6841b5c17d52a46f5a
MD5 d3b14200cc23581135f1b3ff7b04d1b4
SHA1 c113b665e3992a40e2993a5d37a0f6dd74f7228a
SHA512 da146fa68b2b725495624105dc3aa6cb5865c7ef62cb648486b298f1fb717d71319972e4773e32c82c38c6d68403ad8738c76ff89b65d647ba1ad718ef48f739
SSDEEP 3072:4RoehnyJB1e74nZkTtzButyfclmxX7I856KJmPRJ:4LyD1e74ZkBBCcclmxroJJ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
lowp.exe

File Explorer

lowp.exe

.exe 145KB

lowp.exe

IMPHASH 86a203696a24d663345e7d9f7b621634
SHA256 e2bb1cb67c01e4743d557f35f03d3256e739c32546873d6841b5c17d52a46f5a
MD5 d3b14200cc23581135f1b3ff7b04d1b4
SHA1 c113b665e3992a40e2993a5d37a0f6dd74f7228a
SHA512 da146fa68b2b725495624105dc3aa6cb5865c7ef62cb648486b298f1fb717d71319972e4773e32c82c38c6d68403ad8738c76ff89b65d647ba1ad718ef48f739
SSDEEP 3072:4RoehnyJB1e74nZkTtzButyfclmxX7I856KJmPRJ:4LyD1e74ZkBBCcclmxroJJ
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13924

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

GetDesktopWindow GetDC MessageBoxW GetSystemMetrics ShowWindow ReleaseDC

gdi32

BitBlt SelectObject CreateFontW DeleteObject SetBkMode SetTextColor TextOutW GetStockObject

advapi32

AllocateAndInitializeSid FreeSid CheckTokenMembership

shell32

ShellExecuteExW

kernel32

HeapReAlloc HeapSize WriteConsoleW IsDebuggerPresent GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetCurrentProcess WriteFile DeviceIoControl GetModuleFileNameW SetFilePointer CreateFileW GetSystemDirectoryW Sleep CloseHandle LoadLibraryW GetProcAddress SetFilePointerEx FreeLibrary GetConsoleWindow GetTickCount CheckRemoteDebuggerPresent GetCurrentThreadId WaitForSingleObjectEx GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable QueryPerformanceCounter GetSystemTimeAsFileTime GetModuleHandleW GetCurrentProcessId InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent TerminateProcess GetProcessHeap RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitProcess GetModuleHandleExW CreateThread ExitThread FreeLibraryAndExitThread GetStdHandle HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW WaitForSingleObject GetExitCodeProcess CreateProcessW GetFileAttributesExW GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW