» ReimageRepair.exe
Overview
Analysis
File Details
Downloads (30)

ReimageRepair.exe

Reimage Repair

Reimage Limited

The application ReimageRepair.exe, “Reimage Downloader” by Reimage Limited has been detected as a potentially unwanted program by 3 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from cdnrep.reimage.com and multiple other hosts.

File name:

ReimageRepair.exe

Publisher:

Reimage® (signed by Reimage Limited)

Product:

Reimage Repair

Description:

Reimage Downloader

Version:

1.284

MD5:

e29b0f6f9bfb05513ad8b19d8745d72b

SHA-1:

de96028e4ae8f8d1418b8ea84999a8d63f40648a

SHA-256:

a47dd449988773a3ada9e7c0d00580eb64fe42a31cdd23a1b76187dbff97c147

Scanner detections:

3 / 68

Status:

Potentially unwanted

Analysis date:

4/25/2024 5:43:14 AM UTC (today)

Scan engine

Detection

Engine version

Dr.Web

Adware.Plugin.171

9.0.1.0137

G Data

Win32.Application.VMDetect

14.9.24

Reason Heuristics

PUP.Optional.ReimageLimited.N

14.9.12.17

File size:

778.9 KB (797,552 bytes)

Product version:

1.284

Original file name:

ReimageRepair.exe

File type:

Executable application (Win32 EXE)

Installer:

NSIS (Nullsoft Scriptable Install System)

Language:

English (United States)

Common path:

C:\users\{user}\downloads\reimagerepair.exe

Digital Signature

Signed by:

Reimage Limited

Authority:

VeriSign, Inc.

Valid from:

3/19/2014 1:00:00 AM

Valid to:

6/10/2016 1:59:59 AM

Subject:

CN=Reimage Limited, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Reimage Limited, L=Nicosia, S=Nicosia, C=CY

Issuer:

CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

3F75B6FA72B8CDE336A61550C70978D2

File PE Metadata

Compilation timestamp:

2/24/2012 8:20:04 PM

OS version:

5.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

12288:v0gYo6OnaR9yrLE9YzewxnK3RTo9+phNxO0gcCre50ET3cfE/KyZESelOq8:M//OaeXE0pnmq4X0EwfE/PC8

Entry address:

0x38AF

Entry point:

81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, 68, A2, 40, 00, 89, 6C, 24, 14, FF, 15, 30, 90, 40, 00, 68, 01, 80, 00, 00, FF, 15, B4, 90, 40, 00, 55, FF, 15, C0, 92, 40, 00, 6A, 08, A3, 98, EB, 47, 00, E8, 36, 2A, 00, 00, 55, 68, B4, 02, 00, 00, A3, B0, EA, 47, 00, 8D, 44, 24, 38, 50, 55, 68, 64, A2, 40, 00, FF, 15, 84, 91, 40, 00, 68, 4C, A2, 40, 00, 68, A0, 6A, 47, 00, E8, 18, 27, 00, 00, FF, 15, B0, 90, 40, 00, 50, BF, A0, F0, 4C, 00, 57, E8, 06, 27, 00, 00... 
[+]

Packer / compiler:

Nullsoft install system v2.x

Code size:

29 KB (29,696 bytes)

The file ReimageRepair.exe has been seen being distributed by the following 30 URLs.

http://cdnrep.reimage.com/reimagerepair.exe

http://clickus.admailtiser.com/st?cipid=418040&ttype=1&dast=Ym89NCZjaXBpZD00MTgwNDAmY2lzaWQ9NUZDQkY4N0RFMjE0NzQ5NTY0ODQwJmNpcmlkPTVGQ0JGODdERTIxNDc1MDE5NTQ3MzM3NTEmc2xpZD0xNzgmc3ViaWQ9MjE5MjI4JmNpdWlkPS00Nzg0MTY1Njc1MzE0MzgxMjYwJnNvPTQmY3JpZD0xNDc5OTM4JmV4Y2lkPTIyJm1tdD0tMSZjbnRyeT0yOSZjaWNtcD0xNTE3OTgmcHViaWQ9Mzc4&position=${POS}&ciecp=${DTYPE}&cirp=${LAG}&compid=${COMPID}&cmcv=${CMCV}&cipp=${PRICE}&excid=22&cisid=5FCBF87DE2147501954733751&pixels=31221769&pix=31221769&tgt=http://.../TrafficCop.aspx?CampaignUid=59e19b4a4c56c5bf&SourceId=773&CreativeId=1479938&adgroup=1479938&LineItemId=151798&PublisherId=378&SiteID=1353645003529687731&banner=1353645003529687731&partner_var=Ym89NCZjaXBpZD00MTgwNDAmY2lzaWQ9NUZDQkY4N0RFMjE0NzQ5NTY0ODQwJmNpcmlkPTVGQ0JGODdERTIxNDc1MDE5NTQ3MzM3NTEmc2xpZD0xNzgmc3ViaWQ9MjE5MjI4JmNpdWlkPS00Nzg0MTY1Njc1MzE0MzgxMjYwJnNvPTQmY3JpZD0xNDc5OTM4JmV4Y2lkPTIyJm1tdD0tMSZjbnRyeT0yOSZjaWNtcD0xNTE3OTgmcHViaWQ9Mzc4

http://clickus.admailtiser.com/st?cipid=418040&ttype=1&dast=Ym89NCZzbGlkPTM1OCZzdWJpZD0yMTg0MDgmc289NCZjaWNtcD0xNTE3OTgmcHViaWQ9MzM4JmNpcGlkPTQxODA0MCZjaXNpZD1BMDU5QzQ5NkVGMzc2MTExMjI3ODE3Njg0JmNpcmlkPUEwNTlDNDk2RUYzNzYxMjE0NTkwMDAyOTImY2l1aWQ9LTMxNDM5NzY4MjY3MjUxNDczNzYmY3JpZD0xNDgwMTg4JmV4Y2lkPTIyJm1tdD0tMSZjbnRyeT0yOQ==&position=${POS}&ciecp=${DTYPE}&cirp=${LAG}&compid=${COMPID}&cmcv=${CMCV}&cipp=${PRICE}&excid=22&cisid=A059C496EF376121459000292&pixels=31221794&pix=31221794&tgt=http://.../TrafficCop.aspx?CampaignUid=59e19b4a4c56c5bf&SourceId=773&CreativeId=1480188&adgroup=1480188&LineItemId=151798&PublisherId=338&SiteID=1353645003529687731&banner=1353645003529687731&partner_var=Ym89NCZzbGlkPTM1OCZzdWJpZD0yMTg0MDgmc289NCZjaWNtcD0xNTE3OTgmcHViaWQ9MzM4JmNpcGlkPTQxODA0MCZjaXNpZD1BMDU5QzQ5NkVGMzc2MTExMjI3ODE3Njg0JmNpcmlkPUEwNTlDNDk2RUYzNzYxMjE0NTkwMDAyOTImY2l1aWQ9LTMxNDM5NzY4MjY3MjUxNDczNzYmY3JpZD0xNDgwMTg4JmV4Y2lkPTIyJm1tdD0tMSZjbnRyeT0yOQ==

http://clkmon.com/.../sa?cid=CASTTOPOPCPM

http://clkmon.com/.../banners?action=r&pid=3936&cid=ZONPOP

http://clickus.admailtiser.com/st?cipid=418040&ttype=1&dast=Ym89NCZjaXBpZD00MTgwNDAmY2lzaWQ9RENGMTk5MjgxQzUyMDQ3MTA1MTE0MDYzNCZjaXJpZD1EQ0YxOTkyODFDNTIwNDgxMDYxOTQwOTU3JnNsaWQ9MTE3OCZzdWJpZD0yMjA3OTgmY2l1aWQ9LTQ0NDQ1MTk3NTc2NjI0MjQ5NDEmc289NCZjcmlkPTE0ODAxMDgmZXhjaWQ9MjImbW10PS0xJmNudHJ5PTI5JmNpY21wPTE1MTc5OCZwdWJpZD0zMjg=&position=${POS}&ciecp=${DTYPE}&cirp=${LAG}&compid=${COMPID}&cmcv=${CMCV}&cipp=${PRICE}&excid=22&cisid=DCF199281C520481061940957&pixels=31221786&pix=31221786&tgt=http://.../TrafficCop.aspx?CampaignUid=59e19b4a4c56c5bf&SourceId=773&CreativeId=1480108&adgroup=1480108&LineItemId=151798&PublisherId=328&SiteID=3842083366776165542&banner=3842083366776165542&partner_var=Ym89NCZjaXBpZD00MTgwNDAmY2lzaWQ9RENGMTk5MjgxQzUyMDQ3MTA1MTE0MDYzNCZjaXJpZD1EQ0YxOTkyODFDNTIwNDgxMDYxOTQwOTU3JnNsaWQ9MTE3OCZzdWJpZD0yMjA3OTgmY2l1aWQ9LTQ0NDQ1MTk3NTc2NjI0MjQ5NDEmc289NCZjcmlkPTE0ODAxMDgmZXhjaWQ9MjImbW10PS0xJmNudHJ5PTI5JmNpY21wPTE1MTc5OCZwdWJpZD0zMjg=

http://www.reimageplus.com/.../track.php?tracking=hits&campaign=004603402&adgroup=direct&ads_name=direct&keyword=direct&exec=run&context=0046034022096674168

http://www.reimageplus.com/.../router_land.php?tracking=hits&banner=004603402&context=0046034022096674168&exec=run

http://clkmon.com/.../banners?action=r&pid=tutu&cid=Source2

http://cdnrep.reimage.com/.../ReimageRepair.exe

http://www.verwijderenspywarevirus.com/gratisdownload

http://www.desinstalarvirusspyware.com/downloadgratuito

http://www.reimageplus.com/.../track.php?tracking=hits&campaign=007335228&adgroup=direct&ads_name=direct&keyword=direct&exec=run&context=0073352282099276035

http://www.reimageplus.com/.../router_land.php?tracking=hits&banner=007335228&context=0073352282099276035&exec=run

http://clkmon.com/.../sa?cid=CRSRDR-200124103800000000

http://www.reimageplus.com/.../track.php?tracking=Majorgeeks&campaign=336mlwgreen&adgroup=direct&ads_name=direct&keyword=direct&exec=run

http://www.reimageplus.com/.../router_land.php?tracking=Majorgeeks&banner=336mlwgreen&exec=run

http://www.reimage.com/.../router_land.php?tracking=Majorgeeks&banner=336mlwgreen&exec=run

http://ox-d.majorgeeks.com/w/.../rc?ts=1fHJpZD1kYjJlZDY1Zi0yMzIzLTQ4YWItYmVmMy1mODQ4NWI0YmY4M2R8cnQ9MTM5OTI2OTI5OHxhdWlkPTEyNjg5fGF1bT1ETUlELldFQnxzc2lkPTI0MDF8c2lkPTU1MXxwdWI9MTU4NXxwYz1VU0R8cmFpZD0yYjRjMjMwOC0xZDE2LTQyZTctYmY1Ni1hZWIwMTc4YWVmM2F8YWlkPTUzNzE2OTEzNXx0PTF8YXM9MzM2eDI4MHxsaWQ9NTM2OTA2MDkzfG9pZD03MzYyNnxwPTIwMDB8cHI9MjAwMHxhZHY9NDU5MXxhYz1VU0R8cG09UFJJQ0lORy5DUE18Ym09QlVZSU5HLk5PTkdVQVJBTlRFRUR8bGM9Mnxsdz0xNDQwfHVyPVhrT29Qc1YwWEU

http://www.reimage.us.com/downloadsoftware

http://www.reimageplus.com/.../track.php?tracking=PiyushSites&campaign=vir.us.com&adgroup=direct&ads_name=direct&keyword=direct&exec=run

http://www.reimageplus.com/.../router_land.php?tracking=PiyushSites&banner=vir.us.com&exec=run

http://www.reimage.com/.../router_land.php?tracking=PiyushSites&banner=vir.us.com&exec=run

http://cdnrep.reimage.com/download/.../ReimageRepair.exe

http://www.reimageplus.com/.../track.php?tracking=PiyushSites&campaign=reimage.us.com&adgroup=direct&ads_name=direct&keyword=direct&exec=run

http://www.reimageplus.com/.../router_land.php?tracking=PiyushSites&banner=reimage.us.com&exec=run

http://www.reimage.com/.../router_land.php?tracking=PiyushSites&banner=reimage.us.com&exec=run

http://www.desinstalarspywarevirus.com/descargagratuita

http://www.vir.us.com/downloadsoftware

http://www.odinstalowacspywarevirus.com/wolnypobierz

Latest 30 of 30 download URLs

Remove ReimageRepair.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.