CreateInterface
Static task
static1
Behavioral task
behavioral1
Sample
rehlds.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
rehlds.exe
Resource
win10v2004-20230220-en
General
-
Target
rehlds.exe
-
Size
279KB
-
MD5
26ca49827cb25aa1d2a8eeec32b5de9f
-
SHA1
b460edc0660da6f820905894706dbdcbc31cc986
-
SHA256
c38e97f13ab5e0b95c5a7cfffc42f8dbcae387e78295171aaad26a08927f46cd
-
SHA512
f0fe2b9c8640a38cdbf44e23d24813daac5781529208b7a7aabc6c5cd1447c7b90d66f47d57caa8b756a99d3db60466cdbe0d17a3f4f6fd555808960d9f5d663
-
SSDEEP
3072:xqnN3NPUwA/cvVGFTKuxxFb5HbRuzuB2KfZy0um+sIvSK:SN3NcwA/D5Kwx5jQGIx3/t
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource rehlds.exe
Files
-
rehlds.exe.exe windows x86
7d4ab0d2762e62471e04427f37310cd5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
WSACleanup
WSAStartup
winmm
timeGetTime
timeEndPeriod
timeBeginPeriod
kernel32
HeapSize
GetConsoleCP
GetLastError
LoadLibraryW
GetProcAddress
SetLastError
GetModuleFileNameW
CreateFileW
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
CloseHandle
FreeLibrary
IsDebuggerPresent
GetModuleFileNameA
GetModuleHandleA
GetCurrentDirectoryA
GetConsoleTitleA
GetTickCount
SetConsoleTitleA
Sleep
AllocConsole
GetStdHandle
SetConsoleCtrlHandler
FreeConsole
GetNumberOfConsoleInputEvents
ReadConsoleInputA
MultiByteToWideChar
SetEndOfFile
WriteFile
GetConsoleScreenBufferInfo
WriteConsoleOutputAttribute
WriteConsoleOutputCharacterA
GetLargestConsoleWindowSize
SetConsoleWindowInfo
SetConsoleScreenBufferSize
MapViewOfFile
UnmapViewOfFile
ReadConsoleOutputCharacterA
WriteConsoleInputA
WaitForMultipleObjects
SetEvent
CreateEventA
LoadLibraryA
FlushFileBuffers
ReadConsoleW
GetConsoleMode
ReadFile
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
SetFilePointerEx
WriteConsoleW
DecodePointer
WideCharToMultiByte
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
TerminateProcess
EncodePointer
VirtualQuery
RaiseException
RtlUnwind
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetDriveTypeW
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SetEnvironmentVariableA
SetCurrentDirectoryA
GetCurrentDirectoryW
WaitForSingleObject
GetExitCodeProcess
CreateProcessA
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetACP
HeapFree
HeapAlloc
CompareStringW
LCMapStringW
GetTimeZoneInformation
GetFullPathNameW
SetStdHandle
GetFileAttributesExW
HeapReAlloc
GetStringTypeW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
user32
DispatchMessageA
TranslateMessage
GetMessageA
PeekMessageA
PostQuitMessage
ShowWindow
SetWindowPos
wsprintfA
MessageBoxA
PostMessageA
FindWindowA
advapi32
RegCloseKey
RegSetValueExA
RegOpenKeyA
RegQueryValueExA
Exports
Exports
Sections
.text Size: 112KB - Virtual size: 112KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 116KB - Virtual size: 115KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ