home

reimagerepair.exe

Reimage Limited

The application reimagerepair.exe by Reimage Limited has been detected as a potentially unwanted program by 5 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from ads.adsrvmedia.net and multiple other hosts.
Publisher:
Reimage Limited  (signed and verified)

MD5:
92ebabff9759b5545ad7206447819edd

SHA-1:
f968b45e8e7cfa26d8f1aa01bfc7209bb070bf0b

SHA-256:
30546f3e0772ba43287bfa03c40bbf692785c3c4d66c5907f4768625a269dbb1

Scanner detections:
5 / 68

Status:
Potentially unwanted

Analysis date:
11/27/2024 3:38:09 PM UTC  (today)

Scan engine
Detection
Engine version

Dr.Web
Adware.Plugin.171
9.0.1.0327

ESET NOD32
Win32/ReImageRepair (variant)
8.10769

Fortinet FortiGate
Riskware/ReImageRepair
11/23/2014

Reason Heuristics
PUP.Optional.ReimageLimited.N
14.11.23.18

Trend Micro House Call
Suspicious_GEN.F47V1123
7.2.327

File size:
738.3 KB (756,040 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\downloads\reimagerepair.exe

Digital Signature
Signed by:
Reimage Limited

Authority:
VeriSign, Inc.

Valid from:
3/18/2014 8:00:00 PM

Valid to:
6/9/2016 7:59:59 PM

Subject:
CN=Reimage Limited, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Reimage Limited, L=Nicosia, S=Nicosia, C=CY

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
3F75B6FA72B8CDE336A61550C70978D2

File PE Metadata
Compilation timestamp:
2/24/2012 2:20:04 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
12288:70gsl89mRE9YzewxnK3RTo9+pqNTO0gcCre50ET3cfE/KyZ2welOq8:4LpRE0pnmq/X0EwfE/P28

Entry address:
0x38AF

Entry point:
81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, 68, A2, 40, 00, 89, 6C, 24, 14, FF, 15, 30, 90, 40, 00, 68, 01, 80, 00, 00, FF, 15, B4, 90, 40, 00, 55, FF, 15, C0, 92, 40, 00, 6A, 08, A3, 98, EB, 47, 00, E8, 36, 2A, 00, 00, 55, 68, B4, 02, 00, 00, A3, B0, EA, 47, 00, 8D, 44, 24, 38, 50, 55, 68, 64, A2, 40, 00, FF, 15, 84, 91, 40, 00, 68, 4C, A2, 40, 00, 68, A0, 6A, 47, 00, E8, 18, 27, 00, 00, FF, 15, B0, 90, 40, 00, 50, BF, A0, F0, 4C, 00, 57, E8, 06, 27, 00, 00...
 
[+]

Entropy:
7.9262

Packer / compiler:
Nullsoft install system v2.x

Code size:
29 KB (29,696 bytes)

The file reimagerepair.exe has been seen being distributed by the following 6 URLs.

http://ads.adsrvmedia.net/event/click/0/nhD88XffBSQscfExepBiGYOKDXIkjHDPw6Q6CiiUiD8SPeBeeQgM2ZJTmm5m79kD5OKsX2zx_gEvIAK987JBYBlfemc-HwS5uRDX_ha-pD0TNOGRZFRaT9ygs9IIr2BjIQvz4ofV8_XWsnTUTHdxrERPmeG-wgdsRiCux5IQWX_ujOZwZM8JegtBezpN8blW-vD9v6NYUN23E-X9DDWDdkaGYHDTe6cFFDWZyta6aucYk5Jmq0Y3pR9XAWVMLpD2Ljrm5QtA1wB_UVVvgINnDgwfVDwrPGfPr19-qO6ulYmNmTjvKeUD9SmPI-KmsXyxFJVYQ5fEtrtFLCUSZDag6EW-iyacW9XXzoaheH13n-86BjWkY84vlWRA5NoS2mbvXVea-18clgDGOky6ueuoNnBT0aMRMsO5ER-74KA9vyKuVBrnWXwy3q-6IW5gzuHO_T8HDuKuFYiEgifIRg/.../

http://seotrader.reimage.revenuewire.net/reimage-pc-repair/.../?272905

http://www.openfilesnow.com/.../download_Reimage.php

http://ads.adsrvmedia.net/event/click/0/pXykNEt07qVQtsLMGycJ5rP46Wrn4FqlFp98V1u2IMGpXUXeFGYMAx-RtZKxR68crwHkeKto2W4U3wPCq3CyShbQjyN8bNz64wn-ElWnURDCSs_7Db_iet5LcotIQvUupN6NQdYE19xHJSabDp8Z4SRjQ-zkPTn_gedwvZj9xtAM-ck4VexBf8uFrVw9lfCcuionsxnMcWlUjtIC4JMKnz6183ju6ZnaG6Xzz8umI5Q7reDaSh_STYj8Yfda38yjwDTEJoyAKAy4Bp6V7BmpO4dcoCeOfZpMfFeog0N_Q6NNEW8qzCJlnfAnGoq2Z5q4BvuWL71yxSHa4ixVih61-VMzriu7Z8O1ly7aoyHQpyY0HJuvQ10I61iDBz-7JkD9eY90lf7wfABFttkdrj263G8eOnfKrUtwANFCeWq56A/.../

http://www.filedocs.net/download_Reimage.php

http://cdnrep.reimage.com/install/.../ReimageRepair.exe

Remove reimagerepair.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.