reiboot[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
reiboot.exe
Size 1.4MB
Sample260930-apajlaaf75
SHA256 54ab8acf3d868c58b4e20a7ff9f0974e015953751e82bc66237507f32c5a6f4b
MD5 db005ffd3b7dfa236f8ccba13399d4b6
SHA1 5e04ec53bfdec35e54aec4cef9c0a2b1e0369d8b
SHA512 a8f0ec5862b60e1b365f300dfee6f039aa4aff6765ab47880d9618e2ac5eb86219c6a7af8ac5e9aa28534c9808f0080c9d0bc9a9ee08516c5ccd24dee35ddbe5
SSDEEP 24576:2YeCp4pUy/76wh3RurweoGxRzZmeYv+Sq9XimtOpP3WhkjG5ExGVaRKW8Mz7thjy:NeCpkXhspoGLlfYnq9XimtOF3Whky5E+
TLSH
T1806512E6486E57B7E8CD13B0DF3DBD53516A0D87396E69A82E40B6C012F94C2D312E4B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/out.upx

File Explorer

reiboot.exe

.exe 1.4MB
out.upx

.exe 2.3MB

reiboot.exe

SHA256 54ab8acf3d868c58b4e20a7ff9f0974e015953751e82bc66237507f32c5a6f4b
MD5 db005ffd3b7dfa236f8ccba13399d4b6
SHA1 5e04ec53bfdec35e54aec4cef9c0a2b1e0369d8b
SHA512 a8f0ec5862b60e1b365f300dfee6f039aa4aff6765ab47880d9618e2ac5eb86219c6a7af8ac5e9aa28534c9808f0080c9d0bc9a9ee08516c5ccd24dee35ddbe5
SSDEEP 24576:2YeCp4pUy/76wh3RurweoGxRzZmeYv+Sq9XimtOpP3WhkjG5ExGVaRKW8Mz7thjy:NeCpkXhspoGLlfYnq9XimtOF3Whky5E+
TLSH
T1806512E6486E57B7E8CD13B0DF3DBD53516A0D87396E69A82E40B6C012F94C2D312E4B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

Digest

64:08:3f:75:ec:34:28:56:ff:c1:86:eb:54:60:5c:01:62:01:2d:96:29:20:82:44:ab:57:bd:f8:d2:d8:05:03

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=76216665,CN=AFIRSTSOFT CO.\, LIMITED,O=AFIRSTSOFT CO.\, LIMITED,L=Hong Kong Island,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

Chains

Aug 3, 2026

SERIALNUMBER=76216665,CN=AFIRSTSOFT CO.\, LIMITED,O=AFIRSTSOFT CO.\, LIMITED,L=Hong Kong Island,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=76216665,CN=AFIRSTSOFT CO.\, LIMITED,O=AFIRSTSOFT CO.\, LIMITED,L=Hong Kong Island,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

SERIALNUMBER=76216665,CN=AFIRSTSOFT CO.\, LIMITED,O=AFIRSTSOFT CO.\, LIMITED,L=Hong Kong Island,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

Serial Number

05:3a:29:24:75:97:4f:0c:7f:e9:7c:4a:a1:82:67:2a

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 24, 2024 - Apr 25, 2027

Minor OS version

Major OS version

Entry point

2527072

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

generic

count=24, id=241, version=40116,

count=196, id=243, version=40116,

count=31, id=242, version=40116,

count=7, id=199, version=41118,

count=26, id=259, version=24237,

count=121, id=260, version=24234,

count=1, id=260, version=27049,

count=43, id=261, version=27049,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=127, id=261, version=24237,

count=39, id=260, version=24237,

count=15, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=530, id=1, productName=Unmarked objects,

count=49, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=21, id=265, version=24247,

count=1, id=256, version=24247,

count=1, id=255, version=24247,

count=1, id=151,

count=1, id=258, version=24247,

out.upx

SHA256 da5ebd9e2177f31c2ff1409fd4b5c57a70b485a4b05b6abdb934ded07a165e9b
MD5 19af093d1c486f9702dca13a3fe1ca02
SHA1 7b3a6684ec37c10365084e6add65438ff1feb24d
SHA512 e58b6ed47f17745291e5024b025afa9535ebacc9251ae2a556d6635693e43e602b2873f4e1230589dc4b25815f84764552edc679efd335b9e846780bfba7e2b6
SSDEEP 49152:9xPFQRIJPtmdrrdTL0Ot8EkJLLSZEzbr/pLpKX51tq:9GIJPtmN50bLLSZe/D0g
TLSH
T12FB5BF62B9418073E1AA0230DEBD5F6609BD6E343B3951DB73D43E1D1AF00D2A639B67
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

966367

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

CreateExportObj DestroyExportObj NSISLog curl_easy_cleanup curl_easy_duphandle curl_easy_escape curl_easy_getinfo curl_easy_header curl_easy_init curl_easy_nextheader curl_easy_pause curl_easy_perform curl_easy_recv curl_easy_reset curl_easy_send curl_easy_setopt curl_easy_strerror curl_easy_unescape curl_easy_upkeep curl_escape curl_formadd curl_formfree curl_formget curl_free curl_getdate curl_getenv curl_global_cleanup curl_global_init curl_global_init_mem curl_global_sslset curl_maprintf curl_mfprintf curl_mime_addpart curl_mime_data curl_mime_data_cb curl_mime_encoder curl_mime_filedata curl_mime_filename curl_mime_free curl_mime_headers curl_mime_init curl_mime_name curl_mime_subparts curl_mime_type curl_mprintf curl_msnprintf curl_msprintf curl_multi_add_handle curl_multi_assign curl_multi_cleanup curl_multi_fdset curl_multi_info_read curl_multi_init curl_multi_perform curl_multi_poll curl_multi_remove_handle curl_multi_setopt curl_multi_socket curl_multi_socket_action curl_multi_socket_all curl_multi_strerror curl_multi_timeout curl_multi_wait curl_multi_wakeup curl_mvaprintf curl_mvfprintf curl_mvprintf curl_mvsnprintf curl_mvsprintf curl_share_cleanup curl_share_init curl_share_setopt curl_share_strerror curl_slist_append curl_slist_free_all curl_strequal curl_strnequal curl_unescape curl_url curl_url_cleanup curl_url_dup curl_url_get curl_url_set curl_url_strerror

Name

.text

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

295KB

Virtual Size

294KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

745KB

Virtual Size

744KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

71KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=24, id=241, version=40116,

count=196, id=243, version=40116,

count=31, id=242, version=40116,

count=7, id=199, version=41118,

count=26, id=259, version=24237,

count=121, id=260, version=24234,

count=1, id=260, version=27049,

count=43, id=261, version=27049,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=127, id=261, version=24237,

count=39, id=260, version=24237,

count=15, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=530, id=1, productName=Unmarked objects,

count=49, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=21, id=265, version=24247,

count=1, id=256, version=24247,

count=1, id=255, version=24247,

count=1, id=151,

count=1, id=258, version=24247,