Reiz-portable-v21.zip
- SHA256 3c7fc3627fa4216c7f277f00451beadfa27e997c1f56e4cb627f94952a6e78de
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Diagnose.cmd
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
Diagnose.cmd
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
Reiz.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
Reiz.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target Reiz-portable-v21.zip
- Size 735KB
- Sample261026-q7ffkas16p
- SHA256 3c7fc3627fa4216c7f277f00451beadfa27e997c1f56e4cb627f94952a6e78de
- MD5 bb5ce6ebfffc029d3941b6df4a8f6b14
- SHA1 ecf96a3a5f9489d4fb2fd92f7fde5443a3213221
- SHA512 33b7c3cfc681c243c4c719f80e0f7de5f8dcfe23930a5bb80bab0fea57fb39062459b5b5b219a3c908a6b382af802690d6376be6c39a02b113eb7a7816067b0d
- SSDEEP 12288:/ml7ZmaYBIrZ4Kh3JoZChNM9ecRdVHx8xLVYsoTrNe3zkIhf92DGQT:/m2MrqhZONM9ecRdBx85VYsoT8KyI
- TLSH T130F423342F98FCE5F9153875D307011834349BE0AB1E589EAFB94A9E2B34F26948E31D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Reiz.exe
File Explorer
-
Reiz-portable-v21.zip.zip 735KB
-
Diagnose.cmd58B
-
FEATURES.md58KB
-
LICENSE-ImGui.txt1KB
-
LICENSE-MinHook.txt4KB
-
README.txt3KB
-
Reiz.exe.exe 1.4MB
-
configs/README.txt408B
Diagnose.cmd
- SHA256 0635d1f00e6f1a58be5e80ed58d0694498556ff849d06090ccaac55078a1d125
- MD5 488ce8a59053717b9a3128741f63218d
- SHA1 d75cb3237ee87f20c593438d5a21c3b50e29271c
- SHA512 706ccb629a32efd7b6cf65283b1984c4df784045525ae2a8df864f9c44764a206a35cca1a5e26f0419f4c1af35243e605034779c3a8eac1be75bbf418f6b64c2
- TLSH T1DBA022000203002308820C00E283080FB8AE00830000B8C0A08202000008002ACC8BC2
- MD5 SHA1 SHA512 TLSH
FEATURES.md
- SHA256 e90290f678711c7c634ed019bc02e0d5c0686e0a534d1ccc667fa18b7185a032
- MD5 77693653adcba533d856d462d6faf524
- SHA1 62b377bab10f1e6ad9fbdb3acdec19ab5418eb2d
- SHA512 05fd696e66229f6b089ed134a0dd4f9c3df019bead4a85ebae168ae73f7e73911a3aaa7b12c36b2db3d09c905e34ab191a8703fb8377644b44e39046aa33c1ef
- SSDEEP 1536:MwjT9K7XHcQLvhbHG370sVeXUSgwEH93gb3y7ML:Mw9K7XHcQLvhbHG370sVeXUSgwEH93gf
- TLSH T16843476156DE64DE1204B41BD908BE0D3DEB05FE3FAB932605A43C7F39E2028C67A759
- MD5 SHA1 SHA512 SSDEEP TLSH
LICENSE-ImGui.txt
- SHA256 173506a2d6f7fb67990d257fb2507f188690eca39060c39469ae7bef43aae2a3
- MD5 b8cd90c48092bf3bc38d9fc3dcf35180
- SHA1 e6d349c8fbac958171c32089f7d2dbf454c26290
- SHA512 fff7ca4d8984277931e6e377563e42441b252836a5a0d6ab60879db92d37202b20877fe3c3602e13938b1d40838a199133ad444959a9f58f54094001493877b4
- TLSH T15611861EB2510762189A13605578A8D4B23FB15F7A5F2A85146DF241232A06CC1FB840
- MD5 SHA1 SHA512 TLSH
LICENSE-MinHook.txt
- SHA256 d5c2224982b0b95a16b098a561335fa93f3eaf4d0aa964b7843edb986df78dc8
- MD5 5620d973e3f8da2318fc18a5cbc098c4
- SHA1 6c30d77b67f44704514f77c27fa93175b5370796
- SHA512 9db8569e94c43a9933ce6eac503d336f0bd3efab00fb5d36a55b770a35bd3591795c85c715d045ae67b829c39e3995920cbe400f587dad75fbccd7ba7513f65b
- SSDEEP 96:EKYrYJ0rYJ7N383d9uQ9nYrYJ0rYJ7N3V3d9ub4ZnYrYJ0rYJ7N3V3d9uP:RYrs0rs7N383buQ9nYrs0rs7N3V3bubL
- TLSH T1D29154971E444FA75AD2D7813652AA84E58E903E3F136D041C7AB3856B3B32EE4BF411
- MD5 SHA1 SHA512 SSDEEP TLSH
README.txt
- SHA256 e5814abfadb89c6d055a46a4f429a34f13d4dcce3c5313a5d762ecd4316e639b
- MD5 9bc5a2bb70bee80480d6ec670a00959a
- SHA1 6ded818b5e53cf6e4fe1abfbdeccacd82592093d
- SHA512 5cf56792966775feb97d7e83bed14e50b733793ecdab71e85831d9f28daccc0dc56845b58f867bd68261f09d9f3a4b390923d3cfec0603a0218e9a34406e7491
- TLSH T1B28128615AD978DD0700B54FDC08BE0D38EB04FE3FAB935616A42C6E34E2028863E75E
- MD5 SHA1 SHA512 TLSH
Reiz.exe
- IMPHASH 3ed95a31680282f8893eea53729a01b5
- SHA256 f280764a4632df6968030fccc874d181dfbf2b25b9bc9f8f1dfe7ba7eaefc3eb
- MD5 7e2b8d7baecf27652736b201f9a6967c
- SHA1 b6401fa1af0ba63f593729cbb36d36dae7df7611
- SHA512 e8d6114955713787eef7944b672c1aa8751c5e81767b772f14dad55eeaa431a779f8f3c0fb754157abf316c1da29caff636ccd92b1fbb2b03815a8d995e3791f
- SSDEEP 24576:HxSiJrUDWYiCg4ibUvXN55/+oxSiTpqKijnn:RSarynimXP5/+o3oTjn
- TLSH T15A659E45B2E940F9E17BA134D962661FEA72381507309ACF13D40A6D6F73BD087BB722
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
32064
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
MessageBoxW
shell32
SHGetKnownFolderPath
ole32
CoTaskMemFree
kernel32
FlsGetValue
WriteConsoleW
GetConsoleMode
GetConsoleOutputCP
CreateDirectoryW
CreateFileW
GetFileAttributesW
WriteFile
GetTempPathW
OutputDebugStringW
CloseHandle
GetLastError
SetLastError
WaitForSingleObject
GetCurrentProcessId
CreateRemoteThread
GetExitCodeThread
OpenProcess
GetLocalTime
GetSystemDirectoryW
VirtualAllocEx
WriteProcessMemory
VirtualFreeEx
IsWow64Process
FreeLibrary
GetModuleFileNameW
GetModuleHandleW
GetModuleHandleExW
GetProcAddress
LoadLibraryExW
LoadResource
LockResource
SizeofResource
FindResourceW
FormatMessageW
QueryFullProcessImageNameW
WideCharToMultiByte
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
Module32FirstW
Module32NextW
SetUnhandledExceptionFilter
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
FlushFileBuffers
RtlPcToFileHeader
RaiseException
RtlUnwindEx
RtlLookupFunctionEntry
FlsAlloc
FlsSetValue
FlsFree
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
GetCurrentProcess
ExitProcess
TerminateProcess
GetStdHandle
IsProcessorFeaturePresent
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
HeapFree
HeapAlloc
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
GetEnvironmentStringsW
FreeEnvironmentStringsW
VirtualProtect
LCMapStringW
GetProcessHeap
SetStdHandle
GetStringTypeW
SetFilePointerEx
HeapSize
HeapReAlloc
Name
.text
Size
114KB
Virtual Size
113KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
61KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=142, id=261, version=33145,
count=12, id=260, version=33145,
count=6, id=259, version=33145,
count=10, id=259, version=35721,
count=18, id=260, version=35721,
count=44, id=261, version=35721,
count=1, id=262, version=33145,
count=9, id=257, version=33145,
count=113, id=1, productName=Unmarked objects,
count=1, id=261, version=36256,
count=1, id=255, version=36256,
count=1, id=258, version=36256,
configs/README.txt
- SHA256 0220c3e8d4b5ef854b5b3d6110b73533465eb377f600b101d19da5e49c3f70fa
- MD5 cd099bfb036da4df5e970c3af1abe303
- SHA1 220060478e77b7155f9062d421f3c99339289825
- SHA512 8ef627ea6c35f7968a46f7459464b5e2a2a63e7ddd5009d9d90401840e9e91f5ff0240c6606e6233d9388925166c9fc0bdfdf3d77a1a84c37e87aa233b4732ea
- TLSH T166E022619256A4F92544F34ADC09274C7DA300BA7EFBA36186A43C5F3BF3128832D30D
- MD5 SHA1 SHA512 TLSH