reiboot[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
reiboot.exe
Size 1.4MB
Sample260620-wtppzagt9j
SHA256 55d5fe7ecaa472932ef4906f654fa0a808bf84982b9a5fd61b8d70f9ea0754c2
MD5 51e564fba1f7af20c991f1312f2a405b
SHA1 d41d3671b532211189cdcad7a9bdad92acc29999
SHA512 535f9027f9aa33fafc11aae12975e62790643a7b56f227d8c4fbf8b9e42496ef61a9cb50a6aba5e070e4004abe998d48bc34c69c7bb9db2c0d67ea3e60981f73
SSDEEP 24576:rYeCp4pUy/76wh3RurweoGxRzZmeYv+SqbCZAe5ElokEbAvg4c3kRiyMQVcyZtX3:MeCpkXhspoGLlfYnqbCZAPlozbAI4fia
TLSH
T1A86501D5586E67B2E8CD13B0DF3DBC53511A1C8B2D5EA9A82E40BAC112FD4C2E352D1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/out.upx

File Explorer

reiboot.exe

.exe 1.4MB
out.upx

.exe 2.3MB

reiboot.exe

SHA256 55d5fe7ecaa472932ef4906f654fa0a808bf84982b9a5fd61b8d70f9ea0754c2
MD5 51e564fba1f7af20c991f1312f2a405b
SHA1 d41d3671b532211189cdcad7a9bdad92acc29999
SHA512 535f9027f9aa33fafc11aae12975e62790643a7b56f227d8c4fbf8b9e42496ef61a9cb50a6aba5e070e4004abe998d48bc34c69c7bb9db2c0d67ea3e60981f73
SSDEEP 24576:rYeCp4pUy/76wh3RurweoGxRzZmeYv+SqbCZAe5ElokEbAvg4c3kRiyMQVcyZtX3:MeCpkXhspoGLlfYnqbCZAPlozbAI4fia
TLSH
T1A86501D5586E67B2E8CD13B0DF3DBC53511A1C8B2D5EA9A82E40BAC112FD4C2E352D1B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

Digest

d9:cf:58:5d:38:a3:4e:3f:a2:79:e1:07:82:0a:b2:2b:e1:6e:18:a2:54:dc:1e:14:15:19:e1:98:56:73:b2:b4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=3086133,CN=Tenorshare (Hongkong) Limited,O=Tenorshare (Hongkong) Limited,L=Sheung Wan,C=HK,2.5.4.15=#131450726976617465206f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

Chains

Mar 18, 2026

SERIALNUMBER=3086133,CN=Tenorshare (Hongkong) Limited,O=Tenorshare (Hongkong) Limited,L=Sheung Wan,C=HK,2.5.4.15=#131450726976617465206f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=3086133,CN=Tenorshare (Hongkong) Limited,O=Tenorshare (Hongkong) Limited,L=Sheung Wan,C=HK,2.5.4.15=#131450726976617465206f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

SERIALNUMBER=3086133,CN=Tenorshare (Hongkong) Limited,O=Tenorshare (Hongkong) Limited,L=Sheung Wan,C=HK,2.5.4.15=#131450726976617465206f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

Serial Number

04:58:65:49:c2:44:d5:21:ff:12:78:e8:9b:a2:3b:d3

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 13, 2023 - Sep 11, 2026

Minor OS version

Major OS version

Entry point

2462880

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

generic

count=24, id=241, version=40116,

count=196, id=243, version=40116,

count=31, id=242, version=40116,

count=7, id=199, version=41118,

count=26, id=259, version=24237,

count=121, id=260, version=24234,

count=1, id=260, version=27049,

count=43, id=261, version=27049,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=127, id=261, version=24237,

count=39, id=260, version=24237,

count=15, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=530, id=1, productName=Unmarked objects,

count=49, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=21, id=265, version=24247,

count=1, id=256, version=24247,

count=1, id=255, version=24247,

count=1, id=151,

count=1, id=258, version=24247,

out.upx

SHA256 e56b10f96314d4d15168270c37f8538477aab329a4ce79ea5819096528ebdb19
MD5 bdd8df2c41e8899fd97f321657ed52fd
SHA1 d7ad7a48c3a2b6e47189bc68cac2373585155923
SHA512 36ff28165f0154a6bef9686461b1cf79c57488846b97ff7c249a79d729f85c2dd02b405ed70073f52443c53f92a5a94cf677b2397e37df113fc8be6a7c5389e0
SSDEEP 49152:fxPFQRIJPtmdrrdTL0Ot8EkqLL8ZEzbMpLpKX51tq:jGIJPtmN50MLL8ZBD0g
TLSH
T1CAB5BE62B9418073E1AA0230DEBD5F7609BD6E343B3951DB73D43E191AF00D2A639B67
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

966367

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

CreateExportObj DestroyExportObj NSISLog curl_easy_cleanup curl_easy_duphandle curl_easy_escape curl_easy_getinfo curl_easy_header curl_easy_init curl_easy_nextheader curl_easy_pause curl_easy_perform curl_easy_recv curl_easy_reset curl_easy_send curl_easy_setopt curl_easy_strerror curl_easy_unescape curl_easy_upkeep curl_escape curl_formadd curl_formfree curl_formget curl_free curl_getdate curl_getenv curl_global_cleanup curl_global_init curl_global_init_mem curl_global_sslset curl_maprintf curl_mfprintf curl_mime_addpart curl_mime_data curl_mime_data_cb curl_mime_encoder curl_mime_filedata curl_mime_filename curl_mime_free curl_mime_headers curl_mime_init curl_mime_name curl_mime_subparts curl_mime_type curl_mprintf curl_msnprintf curl_msprintf curl_multi_add_handle curl_multi_assign curl_multi_cleanup curl_multi_fdset curl_multi_info_read curl_multi_init curl_multi_perform curl_multi_poll curl_multi_remove_handle curl_multi_setopt curl_multi_socket curl_multi_socket_action curl_multi_socket_all curl_multi_strerror curl_multi_timeout curl_multi_wait curl_multi_wakeup curl_mvaprintf curl_mvfprintf curl_mvprintf curl_mvsnprintf curl_mvsprintf curl_share_cleanup curl_share_init curl_share_setopt curl_share_strerror curl_slist_append curl_slist_free_all curl_strequal curl_strnequal curl_unescape curl_url curl_url_cleanup curl_url_dup curl_url_get curl_url_set curl_url_strerror

Name

.text

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

295KB

Virtual Size

294KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

687KB

Virtual Size

687KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

71KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=24, id=241, version=40116,

count=196, id=243, version=40116,

count=31, id=242, version=40116,

count=7, id=199, version=41118,

count=26, id=259, version=24237,

count=121, id=260, version=24234,

count=1, id=260, version=27049,

count=43, id=261, version=27049,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=127, id=261, version=24237,

count=39, id=260, version=24237,

count=15, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=530, id=1, productName=Unmarked objects,

count=49, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=21, id=265, version=24247,

count=1, id=256, version=24247,

count=1, id=255, version=24247,

count=1, id=151,

count=1, id=258, version=24247,