MRH[.]exe | Triage™

General

Target
MRH.exe
Size 1.9MB
Sample221111-2ttltacc22
SHA256 e9c817d02acaf2fbb59a0a44be05dbb284ee622f50b2e2a598daac8bfb564672
MD5 18585735c8866b21e2723a6f020bafd0
SHA1 afb5b2c9d5ca57501835b0c56fd97b0641f01d88
SHA512 88516af4bbbd9562a9ae9840124c6f9f1402f9a15a0ace5e2413023bbd80c37aa441cc39b8b48f8ca58f4192273e16cd590cd2e9e9a4298f6ed5b0497d54e6b8
SSDEEP 49152:t82Cp8xP5AE/L4C0m9eKQr10XxpQQTf+4G7zsdtW:9E7eQqpIsG
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

MRH.exe

.exe 1.9MB

MRH.exe

IMPHASH a474abaebc5d0adef07154b9e44ae03b
SHA256 e9c817d02acaf2fbb59a0a44be05dbb284ee622f50b2e2a598daac8bfb564672
MD5 18585735c8866b21e2723a6f020bafd0
SHA1 afb5b2c9d5ca57501835b0c56fd97b0641f01d88
SHA512 88516af4bbbd9562a9ae9840124c6f9f1402f9a15a0ace5e2413023bbd80c37aa441cc39b8b48f8ca58f4192273e16cd590cd2e9e9a4298f6ed5b0497d54e6b8
SSDEEP 49152:t82Cp8xP5AE/L4C0m9eKQr10XxpQQTf+4G7zsdtW:9E7eQqpIsG
MD5 SHA1 SHA512 SSDEEP

windows x86

PE Signature issue

Digest

4b:ed:a3:e1:ce:c0:2b:97:65:08:08:f4:88:da:05:78:20:c3:a5:2e:86:ef:9a:56:b9:98:3a:6f:a5:4c:ac:18

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Minor OS version

Major OS version

Entry point

49632

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateMutexW GetDriveTypeW GetCurrentProcess SetHandleInformation GetTickCount GlobalAlloc LoadLibraryW Sleep GetStringTypeExW ReadFile CreateFileW GetStdHandle GetHandleInformation SetLastError GetProcAddress MoveFileW GlobalMemoryStatusEx DeviceIoControl CreatePipe DuplicateHandle ReleaseMutex GetDiskFreeSpaceExW CloseHandle DeleteFileW GetVolumeInformationW LCMapStringEx HeapSize OutputDebugStringW FlushFileBuffers GetLastError HeapFree EnterCriticalSection LeaveCriticalSection HeapAlloc EncodePointer DecodePointer InterlockedDecrement ExitProcess GetModuleHandleExW AreFileApisANSI MultiByteToWideChar HeapReAlloc GetCommandLineW IsDebuggerPresent IsProcessorFeaturePresent GetFileType InitializeCriticalSectionAndSpinCount DeleteCriticalSection InitOnceExecuteOnce GetStartupInfoW SetStdHandle WriteFile WideCharToMultiByte GetConsoleCP GetConsoleMode ReadConsoleW GetProcessHeap GetModuleFileNameW RtlUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter FlsAlloc FlsGetValue FlsSetValue FlsFree TerminateProcess GetModuleHandleW LoadLibraryExW InterlockedIncrement IsValidCodePage GetACP GetOEMCP GetCPInfo GetStringTypeW GetCurrentThreadId QueryPerformanceCounter GetSystemTimeAsFileTime GetTickCount64 GetEnvironmentStringsW FreeEnvironmentStringsW SetFilePointerEx WriteConsoleW SetEndOfFile

user32

DispatchMessageA RegisterClassExA wsprintfW MessageBoxA RemoveClipboardFormatListener CreateWindowExA SendDlgItemMessageW LoadStringW

ole32

CoCreateInstance

Name

.text

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.uteuay

Size

512B

Virtual Size

4B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.kilinte

Size

512B

Virtual Size

4B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

MRH.exe

PE Signature issue

kernel32

user32

ole32