home

im_fix.exe

IncrediMail, Inc.

The executable im_fix.exe has been detected as malware by 1 anti-virus scanner. This is a setup program which is used to install the application. The file has been seen being downloaded from trailer.web-view.net and multiple other hosts.
Publisher:
IncrediMail, Inc.  (signed and verified)

MD5:
43c816e02a249aa9fd239b7dd73ef938

SHA-1:
8dfeeb513a12aba538a186a3f4d3d89946b174b9

SHA-256:
cca8459012f7d3d6a0d31126f7850c8502ca2a76e644278af4130fa33e5d4056

Scanner detections:
1 / 68

Status:
Malware

Analysis date:
4/23/2024 1:41:05 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
Threat.Win.Reputation.IMP
16.1.13.17

File size:
846 KB (866,264 bytes)

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\im_fix.exe

Digital Signature
Signed by:
IncrediMail, Inc.

Authority:
Symantec Corporation

Valid from:
1/9/2016 10:00:00 PM

Valid to:
1/10/2018 9:59:59 PM

Subject:
CN="IncrediMail, Inc.", OU=IncrediMail2016, O="IncrediMail, Inc.", L=Redmond, S=Washington, C=US

Issuer:
CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:
1530D5A53D788F05F7FE4F109407DB21

File PE Metadata
Compilation timestamp:
1/6/2016 1:11:32 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

CTPH (ssdeep):
12288:oCdOy3vVrKxR5CXbNjAOxK/j2n+4YG/6c1mFFja3mXgcjfRlgsUBgavb6QlE:oCdxte/80jYLT3U1jfsWavb6QC

Entry address:
0x27F4A

Entry point:
E8, B8, D0, 00, 00, E9, 7F, FE, FF, FF, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, 57, 56, 8B, 74, 24, 10, 8B, 4C, 24, 14, 8B, 7C, 24, 0C, 8B, C1, 8B, D1, 03, C6, 3B, FE, 76, 08, 3B, F8, 0F, 82, 68, 03, 00, 00, 0F, BA, 25, FC, 31, 4C, 00, 01, 73, 07, F3, A4, E9, 17, 03, 00, 00, 81, F9, 80, 00, 00, 00, 0F, 82, CE, 01, 00, 00, 8B, C7, 33, C6, A9, 0F, 00, 00, 00, 75, 0E, 0F, BA, 25, 24, E3, 4B, 00, 01, 0F, 82, DA, 04, 00, 00, 0F, BA, 25, FC, 31, 4C, 00, 00, 0F, 83, A7, 01, 00, 00, F7, C7, 03, 00, 00, 00...
 
[+]

Code size:
567.5 KB (581,120 bytes)

The file im_fix.exe has been seen being distributed by the following 6 URLs.

http://trailer.web-view.net/.../0XD308F42DF79927948735499944653E7668953B376508634B82F3B10C9CEB0A414C2945ABD859E75EEF66DA6C49E9FAE4CD93F98E4CDBCD1B91F9282047B550E8BCFF4D13A167D936.htm

http://trailer.web-view.net/.../0X7050D056DF3097745E8D84D896596D4AE6317D30CAEA4B0287ABE76560D63257E7D7D784F1601929B405BD013C718A17CD93F98E4CDBCD1B91F9282047B550E8BCFF4D13A167D936.htm

http://trailer.web-view.net/.../0X1A0700F0E26F421699BAE4A57F723E7A4550A4DB53B4BB0C5EC6F64604A205F93F948FFE4B6D5FCBD61E10C8B671142A92E825D65DBEDCCF91F9282047B550E8BCFF4D13A167D936.htm

http://trailer.web-view.net/.../0X7050D056DF3097745E8D84D896596D4AE6317D30CAEA4B0287ABE76560D632578CCC736FD7923BF9D3A185F4DC35FA36CD93F98E4CDBCD1B91F9282047B550E8BCFF4D13A167D936.htm

http://www2l.incredimail.com/support/.../IM_fix.exe

http://www2l.incredimail.com/.../IM_fix.exe

Remove im_fix.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.