» reimagerepair.exe
Overview
Analysis
File Details
Downloads (101)
Network (2)

reimagerepair.exe

Reimage Repair

Reimage Limited

The application reimagerepair.exe, “Reimage Downloader” by Reimage Limited has been detected as a potentially unwanted program by 11 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. It is built using the Crossrider cross-browser extension platform. While the file utilizes the Crossrider framework and delivery services, it is not owned by Crossrider. The file has been seen being downloaded from RevenueWire's affiliate distribution platform dashwood.reimage.revenuewire.net and multiple other hosts. While running, it connects to the Internet address vip080.ssl.hwcdn.net on port 80 using the HTTP protocol.

File name:

reimagerepair.exe

Publisher:

Reimage® (signed by Reimage Limited)

Product:

Reimage Repair

Description:

Reimage Downloader

Version:

1.514

MD5:

d729e0726f77304b299085afba059b5f

SHA-1:

45e7449f1a82158b429be44611ae49bcefdab6e1

SHA-256:

ec67e8947166fd22f79c54588b11697513e9e0d79f42cf9f52b8e51ff8577f41

Scanner detections:

11 / 68

Status:

Potentially unwanted

Explanation:

The software may change the browser's home page and search provider settings as well as display advertisements.

Analysis date:

4/20/2024 2:05:50 AM UTC (today)

Scan engine

Detection

Engine version

Agnitum Outpost

Riskware.Agent

7.1.1

AVG

Adware Skodna.Generic

2016.0.3070

Baidu Antivirus

PUA.Win32.ReImageRepair

4.0.3.15316

Dr.Web

Trojan.Crossrider1.1621

9.0.1.075

ESET NOD32

Win32/ReImageRepair.F potentially unwanted

9.11552

Fortinet FortiGate

Riskware/ReImageRepair

3/16/2015

herdProtect (fuzzy)

variant of setup_product_26943.exe

2015.6.22.13

McAfee

Artemis!9B8D97161AE5

5600.6824

Reason Heuristics

PUP.Optional.Installer

15.3.16.16

Trend Micro House Call

Suspicious_GEN.F47V0429

7.2.173

Zillya! Antivirus

Downloader.Agent.Win32.241821

2.0.0.2159

File size:

750.5 KB (768,512 bytes)

Product version:

1.514

Trademarks:

Reimage

File type:

Executable application (Win32 EXE)

Installer:

NSIS (Nullsoft Scriptable Install System)

Language:

Language Neutral

Common path:

C:\users\{user}\downloads\reimagerepair.exe

Digital Signature

Signed by:

Reimage Limited

Authority:

VeriSign, Inc.

Valid from:

3/18/2014 8:00:00 PM

Valid to:

6/9/2016 7:59:59 PM

Subject:

CN=Reimage Limited, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Reimage Limited, L=Nicosia, S=Nicosia, C=CY

Issuer:

CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

3F75B6FA72B8CDE336A61550C70978D2

File PE Metadata

Compilation timestamp:

2/24/2012 2:20:04 PM

OS version:

5.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

12288:C0gAtLIDB0gPZb73RT7E9Yzewxnl9+pqNTO0gcCre50ET3cfE/KyZ2welOq8W:NztLcBNZbbhE0pnl/X0EwfE/P28W

Entry address:

0x38AF

Entry point:

81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, 68, A2, 40, 00, 89, 6C, 24, 14, FF, 15, 30, 90, 40, 00, 68, 01, 80, 00, 00, FF, 15, B4, 90, 40, 00, 55, FF, 15, C0, 92, 40, 00, 6A, 08, A3, 98, EB, 47, 00, E8, 36, 2A, 00, 00, 55, 68, B4, 02, 00, 00, A3, B0, EA, 47, 00, 8D, 44, 24, 38, 50, 55, 68, 64, A2, 40, 00, FF, 15, 84, 91, 40, 00, 68, 4C, A2, 40, 00, 68, A0, 6A, 47, 00, E8, 18, 27, 00, 00, FF, 15, B0, 90, 40, 00, 50, BF, A0, F0, 4C, 00, 57, E8, 06, 27, 00, 00... 
[+]

Entropy:

7.9168

Packer / compiler:

Nullsoft install system v2.x

Code size:

29 KB (29,696 bytes)

The file reimagerepair.exe has been seen being distributed by the following 50 URLs.

http://dashwood.reimage.revenuewire.net/reimage-pc-repair/.../

https://docs.google.com/uc?id=0B6pzrvqu1IeUWU1uRzRfRTBiejA&export=download

http://ads.adk2.com/event/click/0/1qjfoXwfP5GPH_eOpuu35wG4j1OdODv2k4jM9TIYx_5cdCgaavYp95sawk55rMZpC3ptxdpsBJKFfiDrAfyfr7Jn2J0IPHcdL7bIFIeCssFTVoYuyqHRHHwpMH3NC0uKkYcVya23UF6QQhoZnDLARFhIbjbSassKK1iwgDb8QdQiQ3fDXsWbl8v2m73vEj1WRFxZ9givommOBssREC_eKt_vUWZ1-1u3USp44Kz81oHQ6H9zFWCFpAS8L5Ojm8FJsJo7V7Dxn_JREoxV6xR4X5icGwu9rfOTOflcX_XtpR8P0blQXu9DZJ6m8NSFIBkNcq-Zs_hGnftVQLZx5WIRSh9kfIF_8ZcmtoRLm6VgvyM-O74Xn7kvfaMHItauoAv2TaDJPNVsbHKybLfH9SoK5ditnQ3OwczL-vf0ljedPDjizyG5gLM/.../

http://ox-d.majorgeeks.com/w/.../rc?ts=1fHJpZD0zYzQ3ODU4OS0yMTg1LTQxY2YtYjYzMC01ZWY2MmQ1N2RjYmF8cnQ9MTQyOTg2MTQ1N3xhdWlkPTExMTYwfGF1bT1ETUlELldFQnxzc2lkPTI0MDB8c2lkPTU1MXxwdWI9MTU4NXxwYz1VU0R8cmFpZD1mYzYxOGI1MC00YTQ1LTRjOGMtOWE2Yy02MzY3Y2QyNTc2ODJ8YWlkPTUzNzE2OTEzNXx0PTF8YXM9MzM2eDI4MHxsaWQ9NTM2OTA2MDkzfG9pZD03MzYyNnxwPTIwMDB8cHI9MjAwMHxhZHY9NDU5MXxhYz1VU0R8cG09UFJJQ0lORy5DUE18Ym09QlVZSU5HLk5PTkdVQVJBTlRFRUR8bGM9Mnxsdz0xNDQwfHVyPVFJNTFNMm9WZ0w

http://norassie.reimage.revenuewire.net/reimage-pc-repair/.../?msvcr110dll_1957_1904

http://ads.adsrvmedia.net/event/click/0/zdv3NXexNQ7xdYUuZLfSPzz-UfnvM5Bvs8r6_GMfgq3y3ynVZKiw6mKE_9ZacBpzFzGvXUqgY6-mw-Vmj5E19HCCP7s4MxV3pEMJ3Um13Y71WwzC-tY-M7_DF5MH8d2-gePZhXEsFKL19BUjg0hpxGjmACv7sWhqBjnL13dW06oVbDg7H9mCJQ-PkhqCRewoQ5Gf-qsT52wdEEWhELMtE6oTwjBiAMvHEOntGsrbAxW09bS-Aww0FvhA3J8m-9V5oSHGWipJXxUz5wrhxezfQZOHC5tI_INmpj_t-9jcAE5qiIe0cCriXaeVeOazz3g8Op0bnS_5ODW0dvVggJVyw75VPtTWCrAEHf5qV85siwxuvCCqqMKGS4Nw5yUauqEdsXbVYanxQZTXcSZtTH6FUiuZAjfh7rYNDmkRlXPQVjVkq8J5HxeTu5b5zEs/.../

http://files.myplaycity.com/.../afmissions_setup.exe

http://ads.adk2.com/event/click/0/elwyBnh10A7RCIadRqY7BRjslQnMJVb6BrTiHPv6y_KDeQ50UjtTO6NtT6MP-airRK7tUd1dVGVigQ6bnuCNuyUOkQIc5YZqub1UGIfXq3S9VzGLdIdPAlOB2iuPT142Tlr_3ka3ANdFKa76CeEuMBmwTUXV3UXMussLMOGNyCGjGNHjHNbbrJXS9VfC9d12ShhhuI-9aBSxDVYFhZ8JnWZjBOehbK2phO1RkJSgBYYnOgbnOMrEkhMAVy_UcUu9UikZMida9w8md3DQ6BGhxz9zMqE3Dy-JUCzbn8CSQyov_zYU_ZU-seMjP1zxSK8LPryWvrOtQyKJ_cgOI4Y48MjJpIyNzC8Q8q2rFhdtWw7RvGyXBfYuPKmKOokhe_4gCwRQ9MdaSCqc6BrNaPxyFFXBFopgzv_TkhOG9VpyY-6gUi-8LZM/.../

http://ads.reimagenetwork.com/imp4961?a=64221329&ci=17&context=c64271932&size=0x0&rt=lp&SourceID=322028;535256473189764114&r=http://.../rotator?id=0bbd719bb2927640ad04f710f4a8393a_link&s1=322028&s2=535256473189764114&u=http://.../rotator?id=0bbd719bb2927640ad04f710f4a8393a_link&s1=322028&s2=535256473189764114

http://ads.adsrvmedia.net/event/click/0/mm1Sg5Tfj0ukt8GFr-ZMlbXuHXZ_-cm9793oGj-JFZEWHshcj6mg8D_iF_8gKL0RPR2OB3LTBLnwQnTuYQpwLGn10Oe5LGb48wf6grYSuwKqM1SFPL0OKSaiNCOcLvUS4IlBBjO7iCPIe1XIs2fpxieCnaPJIo0WoiCQ6jRIqnw1s5ALqlhYXDxhyNsks55ldGsl0ZuNggM23l7UpxnE3IOnofPCD-ctN1sygXCcIYRAI-AbjiU3zmMIuZbFM_bkSVxZDdsQ2m006jQKlFFUJe0fHH_F86RHho0OfTH-IPfEVYAfARBcke-A2G7WeQFq28QXS4f5wO6Enuz_ZnLrIEbyTYeNnGzU60Gw73Ow0uKa-J1XE1TYWtxkZ-iN7UlS8wLER_g1R0ROjmgOLlVHUkhsGp070ILLOWreEVv6AeP35BOy/.../

http://ads.reimagenetwork.com/imp8565?a=64221329&ci=17&context=c64271932&size=0x0&rt=lp&SourceID=425636;797247381320099831&r=http://.../rotator?id=1ec41085144d294c52f2a79e3506266e_link&s1=425636&s2=797247381320099831&u=http://.../rotator?id=1ec41085144d294c52f2a79e3506266e_link&s1=425636&s2=797247381320099831

http://ads.reimagenetwork.com/imp3271?a=64221329&ci=17&context=c64271932&size=0x0&rt=lp&SourceID=425636;850539761373044209&r=http://.../rotator?id=abec03d1d4f7d0a3c196931aaba914ed_link&s1=425636&s2=850539761373044209&u=http://.../rotator?id=abec03d1d4f7d0a3c196931aaba914ed_link&s1=425636&s2=850539761373044209

http://ads.reimagenetwork.com/imp3349?a=64221329&ci=17&context=c64271932&size=0x0&rt=lp&SourceID=376975;950243133185140747&r=http://.../rotator?id=39088904_link&s1=376975&s2=950243133185140747&u=http://.../rotator?id=39088904_link&s1=376975&s2=950243133185140747

http://cdnrep.reimage.com/rpl/.../ReimageRepair.exe

http://ads.adk2.com/event/click/0/5KUvJqQpQMEg7yeMeXdDIRT8DSziN0PHhsK79KppfY9hu1jo5YRjuYKPWMvr_KxhJwhE9OWmWT75bvSdpwNmLy20e0cSg7Y7zND2U9kDJDDi9MsA5U0S7UFo447jNNPx0lFNkIFolzzqL8eGL9wcK19ohIHYAXBzx8VC8Yz2C-J0wlb5arnPgOM4WEmfeAnJ42bq0_zddJfabQn-RvbeWvH_XlYmiEnuc1c9l-zO_W63SOCygygnzia8APbGWVXmufSoeKk7R2pZJDKgntepBwMYQhYMomuDB8DV6uXJFLwL6RkQ104rqS9N1_ZK0rwrBWwizRyQPaZjfNIDitC728rAlc019N4fcqBt3jdQpKblgl-64LYA3E0_veQlQqh0dahg1cNixK_Urz_u84e5X1H9KlmUKUcPJ2hECunPp6jRFwDWYQ/.../

http://ads.reimagenetwork.com/imp8712?a=64221329&ci=17&context=c64271932&size=0x0&rt=lp&SourceID=322028;113419473132531982&r=http://.../rotator?id=ff55083f26e24a7fb2268a5371b2f2f3_link&s1=322028&s2=113419473132531982&u=http://.../rotator?id=ff55083f26e24a7fb2268a5371b2f2f3_link&s1=322028&s2=113419473132531982

https://32646f534f555fcb3a3e-f7c01b1940dbdf12c9bce919f1fb775e.ssl.cf2.rackcdn.com/install/.../ReimageRepair.exe

http://ads.reimagenetwork.com/imp5803?a=64221329&ci=17&context=c64271932&size=0x0&rt=lp&SourceID=395474;672594631449937340&r=http://.../rotator?id=39088904_link&s1=395474&s2=672594631449937340&u=http://.../rotator?id=39088904_link&s1=395474&s2=672594631449937340

http://www.fixanyfile.com/download_japanese_reimage.php

http://ads.reimagenetwork.com/imp5708?a=64221329&ci=17&context=c64271932&size=0x0&rt=lp&SourceID=300412;302355473124529436&r=http://.../rotator?id=ff55083f26e24a7fb2268a5371b2f2f3_link&s1=300412&s2=302355473124529436&u=http://.../rotator?id=ff55083f26e24a7fb2268a5371b2f2f3_link&s1=300412&s2=302355473124529436

http://ads.reimagenetwork.com/imp8000?a=64221329&ci=17&context=c64271932&size=0x0&rt=lp&SourceID=395474;38459836702209265&r=http://.../rotator?id=39088904_link&s1=395474&s2=38459836702209265&u=http://.../rotator?id=39088904_link&s1=395474&s2=38459836702209265

http://113.171.224.244/.../ReimageRepair.exe

http://ads.reimagenetwork.com/imp3920?a=64221329&ci=17&context=c64271932&size=0x0&rt=lp&SourceID=437929;551619023179520920&r=http://.../rotator?id=39088904_link&s1=437929&s2=551619023179520920&u=http://.../rotator?id=39088904_link&s1=437929&s2=551619023179520920

http://ads.reimagenetwork.com/imp4643?a=64221329&ci=17&context=c64271932&size=0x0&rt=lp&SourceID=383671;552197641209734981&r=http://.../rotator?id=1ec41085144d294c52f2a79e3506266e_link&s1=383671&s2=552197641209734981&u=http://.../rotator?id=1ec41085144d294c52f2a79e3506266e_link&s1=383671&s2=552197641209734981

http://a.allstate-final.xyz/hp/?q=BZ3ZVDxjnawWBCDWYSJSlyolzvSzVbxNA8vPqb8y3n/aoNMVhpOA5ADPg4H/jrQWcT0mCRSY/zrgxnynYAWLr9sPUOSq9NA gZy6ocSrQZt93xpLfAGUs4wWjxGra4Yrlt2j0zShGyRJQd28NfoeAVKXeZhJzlW1pL4k6UUviyeauRbYPTFQPh92imXyf8OQZnn9 JCz Mknv0fsqQbSDt9tOa09Jfdp8GR2Elz 6gvM PZg1JYdov3MAjMqbfhWTM6iTbAf90Kxzcl0Fp AgWXHIc2lJOFceTL9y8S0qYpbdy69sGnZvl1CV7IV3jsy2LSfnC44KflWT1UpvOXlSwaRNBb1Rhl8DAtP8L6ocKuG4EAyPpOjNAojBt8g4K022Rc1lUokWoXCO3Z6ile/9OokYegDdkok/pe bKfswmbfEzMKOUbRm3jCDAMz0v6ehps3WhcYWBDvL8GW5di6jgpcaZ8BDCSbIkBRqgGOxO9gS9Ef8Ei6QOALkxCbIFrwUMy ozgACYe85Vyo3NMiCI92twNLYVPjdIG/FDMnu/vIRs7SSVAoH3bbflVeWkMQL/JRS17SSf03/eloGUyr2cqNzPk/hB8mEVrm5esV4YeR dqHmGgUTWcAqjw53IduqWHIQoTD0IxxVbia5vFS0jm0qOMot/zBbkmMxMNl7lqdLoC303KOMkdVS18yboFN12MBKTTDaI8ZaWtbmQs1r/.../ZsDRYnGrAMhqz9SgjrQUPIBneSDxd7629d3JJR4Cp8U3CqOoGhsoLiBCwf2hvEiZ3QiBMXM9TbaXtPEBZeFBZ8wnfyRKChruMcv9RyPQKhykECXMAchBQLwNJbhj1mgYo&external_id=1429696274348868494&uuid=opFk20LuY8bFJPj2ZfnpvMCUaLQ0gGNvr89sE47BnEQLwzGwYckDPRFwTOWmihOhNtO

http://filewiki.org/.../download

http://ads.reimagenetwork.com/imp7536?a=64221329&ci=17&context=c64271932&size=0x0&rt=lp&SourceID=426876;457838023121414949&r=http://.../rotator?id=a71790f42f4b99704a8c31c11d83aa4c_link&s1=426876&s2=457838023121414949&u=http://.../rotator?id=a71790f42f4b99704a8c31c11d83aa4c_link&s1=426876&s2=457838023121414949

http://www.pcmmc.com/download-repair?Prism3d Engine

http://cdnrep.reimage.com/ins/.../ReimageRepair.exe

http://www.fixanyfile.com/download_portuguese_reimage.php

Latest 30 of 101 download URLs

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):

Connects to vip080.ssl.hwcdn.net (205.185.208.80:80)

TCP (HTTP):

Connects to hwcdn.net (69.16.175.10:80)

Remove reimagerepair.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.