LowKey Loader[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

LowKey Loader.exe
Size

40.6MB
MD5

0563249dac5412bb223ee649c4fd19df
SHA1

f67b6dbfa806e20dc3fcdb9bbb2429ae3df27eea
SHA256

e693004438d90becd458821eb4b3f69e599742c798cfa700e90548aa38cab005
SHA512

be0be69168bab3c3fb0ce2a521a756aa922d765c636dbbb5c2218a0b5037e7ce84e455015f038e91e2fe12c76b4f39858e53c3ae9abb721fc1db07c0cabf5231
SSDEEP

786432:Ny7pzOM3vPcBg42VNX1/HVK3/EG4cthW:Ny7ROM/0Bb2hdQ44A

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
LowKey Loader.exe

Files

LowKey Loader.exe
.exe windows:6 windows x64 arch:x64

13f3bf2389703a16c5683fb659037e4d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

kernel32

PeekNamedPipe

user32

ClientToScreen

advapi32

RegOpenKeyExA

shell32

ShellExecuteA

ole32

CoUninitialize

oleaut32

SysFreeString

secureenginesdk64

ord503

winmm

waveOutSetVolume

msvcp140

?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z

imm32

ImmReleaseContext

dwmapi

DwmExtendFrameIntoClientArea

shlwapi

PathFindFileNameW

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

ntdll

RtlCaptureContext

wlanapi

WlanEnumInterfaces

bthprops.cpl

BluetoothFindFirstRadio

iphlpapi

GetAdaptersInfo

urlmon

URLDownloadToFileA

normaliz

IdnToAscii

wldap32

ord217

crypt32

CertAddCertificateContextToStore

ws2_32

getsockopt

rpcrt4

UuidToStringA

psapi

GetModuleInformation

vcruntime140_1

__CxxFrameHandler4

vcruntime140

strchr

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsscanf

api-ms-win-crt-utility-l1-1-0

srand

api-ms-win-crt-string-l1-1-0

strcpy_s

api-ms-win-crt-heap-l1-1-0

free

api-ms-win-crt-runtime-l1-1-0

_beginthreadex

api-ms-win-crt-convert-l1-1-0

strtoul

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-filesystem-l1-1-0

remove

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func

api-ms-win-crt-math-l1-1-0

_dclass

Sections

.text
Size: - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 331KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 931KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

./Mi
Size: - Virtual size: 24.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.u1>
Size: 1024B - Virtual size: 680B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ILP
Size: 40.6MB - Virtual size: 40.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 284B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

13f3bf2389703a16c5683fb659037e4d

Headers

DLL Characteristics

File Characteristics

Imports

d3d11

d3dcompiler_43

kernel32

user32

advapi32

shell32

ole32

oleaut32

secureenginesdk64

winmm

msvcp140

imm32

dwmapi

shlwapi

d3dx11_43

ntdll

wlanapi

bthprops.cpl

iphlpapi

urlmon

normaliz

wldap32

crypt32

ws2_32

rpcrt4

psapi

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

Sections

.text Size: - Virtual size: 1.2MB

.rdata Size: - Virtual size: 331KB

.data Size: - Virtual size: 931KB

.pdata Size: - Virtual size: 53KB

./Mi Size: - Virtual size: 24.6MB

.u1> Size: 1024B - Virtual size: 680B

.ILP Size: 40.6MB - Virtual size: 40.6MB

.rsrc Size: 10KB - Virtual size: 10KB

.reloc Size: 512B - Virtual size: 284B

.text
Size: - Virtual size: 1.2MB

.rdata
Size: - Virtual size: 331KB

.data
Size: - Virtual size: 931KB

.pdata
Size: - Virtual size: 53KB

./Mi
Size: - Virtual size: 24.6MB

.u1>
Size: 1024B - Virtual size: 680B

.ILP
Size: 40.6MB - Virtual size: 40.6MB

.rsrc
Size: 10KB - Virtual size: 10KB

.reloc
Size: 512B - Virtual size: 284B