reimagerepair.exe

Reimage Repair

Reimage Limited

The application reimagerepair.exe, “Reimage Downloader” by Reimage Limited has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from cdnrep.reimage.com and multiple other hosts. While running, it connects to the Internet address vip080.ssl.hwcdn.net on port 80 using the HTTP protocol.
Publisher:
Reimage  (signed by Reimage Limited)

Product:
Reimage Repair

Description:
Reimage Downloader

Version:
1.529

MD5:
f29276aa323af1dcdc42ae193af3425a

SHA-1:
94a608cbd5fa6cf1ff45d1ebc7b69fafdfc5e8b6

SHA-256:
5fbfb7ddb426ead38f0e7b3920c36279285d5052cf905aa0ba4a58518e2cead8

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
12/25/2024 11:29:47 PM UTC  (a few moments ago)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Reimage.Installer.Meta (L)
16.6.17.16

File size:
750.4 KB (768,384 bytes)

Product version:
1.529

Copyright:
© Reimage 2016

Trademarks:
Reimage

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\reimagerepair.exe

Digital Signature
Signed by:

Authority:
Symantec Corporation

Valid from:
5/17/2016 3:00:00 AM

Valid to:
8/17/2019 2:59:59 AM

Subject:
CN=Reimage Limited, O=Reimage Limited, L=Dasoupoli, S=Nicosia, C=CY

Issuer:
CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:
4320101ADF7A07C7405BC4433AE31FFD

File PE Metadata
Compilation timestamp:
2/24/2012 10:20:04 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
12288:i0gk1D3TtoQ5xeABQ73RT7E9Yzewxnl/NTO0gcCre50ET3cfE/KyZowelOq8wpw:tJB3hIRbhE0pnlHX0EwfE/Pg8l

Entry address:
0x38AF

Entry point:
81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, 68, A2, 40, 00, 89, 6C, 24, 14, FF, 15, 30, 90, 40, 00, 68, 01, 80, 00, 00, FF, 15, B4, 90, 40, 00, 55, FF, 15, C0, 92, 40, 00, 6A, 08, A3, 98, EB, 47, 00, E8, 36, 2A, 00, 00, 55, 68, B4, 02, 00, 00, A3, B0, EA, 47, 00, 8D, 44, 24, 38, 50, 55, 68, 64, A2, 40, 00, FF, 15, 84, 91, 40, 00, 68, 4C, A2, 40, 00, 68, A0, 6A, 47, 00, E8, 18, 27, 00, 00, FF, 15, B0, 90, 40, 00, 50, BF, A0, F0, 4C, 00, 57, E8, 06, 27, 00, 00...
 
[+]

Entropy:
7.9129

Packer / compiler:
Nullsoft install system v2.x

Code size:
29 KB (29,696 bytes)

The file reimagerepair.exe has been seen being distributed by the following 12 URLs.

http://cdnrep.reimage.com/ins/.../ReimageRepair.exe

http://113.171.224.243/.../ReimageRepair.exe

http://41.223.201.246:801/.../ReimageRepair.exe

http://103.1.138.136/cdnrep.reimage.com/.../ReimageRepair.exe

http://cdnrep.reimage.com/.../ReimageRepair.exe

http://113.171.224.207/.../ReimageRepair.exe

http://113.171.224.166/.../ReimageRepair.exe

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):
Connects to vip080.ssl.hwcdn.net  (205.185.208.80:80)

Remove reimagerepair.exe - Powered by Reason Core Security