home

rs_file_repair.exe

The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from gsf-cf.softonic.com and multiple other hosts.
MD5:
80f07e1c7e86ccb16ba1ad47e965b093

SHA-1:
d49aa503097f62c2187e8157366c585e49e32215

SHA-256:
39b03e464bc0b15e98f56386bd60ce80c1b406cd27817f50d924279361e3a9f9

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/24/2024 9:53:04 PM UTC  (today)

File size:
3.5 MB (3,694,686 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\downloads\rs_file_repair.exe

File PE Metadata
Compilation timestamp:
12/5/2009 5:50:41 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
49152:sPBVfKVSaTJqULOTBwqQR21Xs+ipPTXPVhdX08dLoMB5lweLTwKX3ZJPhqLnIyM6:o4OVlBipjPVh9085z7lweLXXrPbyZfum

Entry address:
0x30CB

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 38, 3F, 42, 00, E8, F1, 2B, 00, 00, A3, 84, 3E, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 30, F4, 41, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 80, 36, 42, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 90, 42, 00, 50, 57, E8, 92, 28, 00, 00...
 
[+]

Entropy:
7.9936

Packer / compiler:
Nullsoft install system v2.x

Code size:
22.5 KB (23,040 bytes)

The file rs_file_repair.exe has been seen being distributed by the following 17 URLs.

http://gsf-cf.softonic.com/d49/aa5/.../file?SD_used=0&channel=WEB&fdh=no&id_file=3353746&instance=softonic_en&type=PROGRAM&Expires=1477475462&Signature=EpYIsMoPq3XoqigWn3LSGWRsr1CO0iaLbtupt2j6QmSGex8hkfIpWZbifOT4xE1Rj-Z9b8D3mPs31~HQAotMBgHJ~vpWG0BbuyY-g9yBciLuT~VY8r3UPVjuHGgTfFV7oqLakwmLlkw~RZtuJNXxZEH7HsyL8bjubabSlocqffQ_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=rs_file_repair.exe

http://gsf-cf.softonic.com/d49/aa5/.../file?SD_used=0&channel=WEB&fdh=no&id_file=3353746&instance=softonic_en&type=PROGRAM&Expires=1475954917&Signature=GGu2n1RIWC5wPs8OTIQEgl0abqhlyGD9H4WWqoKcEodOY95QXk62rx5MtcUAK6D51p0X6AUE7ahsi8owLSe4ugg7KNuaY6Pf~8zX~hih4v95P3~xY~shPFzvj48aoaIn1DgGtMByF9Mv5ZLHqT-DplRP5HP6UXc2~w1uBLBtMqQ_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=rs_file_repair.exe

https://recoverhdd.com/.../rs_file_repair.exe

http://gsf-cf.softonic.com/d49/aa5/.../file?SD_used=0&channel=WEB&fdh=no&id_file=3353746&instance=softonic_en&type=PROGRAM&Expires=1433049547&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=MlkKwEokfN-v-TrfEfRt89-r6JVEms7ZDuhGFeBQj3r-fXhKGzxefj8kh5tX3sPDd5DLMG2kjFam9ORxrKUB5JTt0QV64qHc2DjR-MHjKPi~oCCEEumLdQ-LsLJe-MOEQ14FYUHqXwQ1IhjNqlcFtz9GsdivDZjPN4GzqEhKqrg_&filename=rs_file_repair.exe

http://gsf-cf.softonic.com/d49/aa5/.../file?SD_used=0&channel=WEB&fdh=no&id_file=3353746&instance=softonic_en&type=PROGRAM&Expires=1465790346&Signature=Y4sXZ2fOevd4f9ax4zCVFW53CNRnRGcrodFSM-bucrEiHOb7~WBAp9vVEZrMOZqfLiZfEwfs~sA7nEp6r~oFoWkpRtdelVDEs6yAaUcrmhnpohrMeFnzFWGBKa5NC1vWtKTWbO9nOfwwgVwstGu2aMqdeTXgrmHapa793xVKqrg_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=rs_file_repair.exe

temp:rs_file_repair.exe

http://gsf-cf.softonic.com/d49/aa5/.../file?SD_used=0&channel=WEB&fdh=no&id_file=3353746&instance=softonic_en&type=PROGRAM&Expires=1445996188&Signature=echpyrVTQYgihxEJO0RyD6TlLAlCrRdQyunGwrE7Bf8MJObqoQuHr-7kD7I5RQ7MitBl5iAOzhhWNe7s~RkeJ2sJ5u2wcqguFPbVoZcZ3-yfsmCyuEkKyXOrxtIBGabrz3zxie6jBs2C5VAeIrVAnyqYmA5TURJb4TUMfXfZjII_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=rs_file_repair.exe

http://gsf-cf.softonic.com/d49/aa5/.../file?SD_used=0&channel=WEB&fdh=no&id_file=3353746&instance=softonic_en&type=PROGRAM&Expires=1454033199&Signature=cS0l1UwXn46wap7QeEIM1dbn5O6V5Kc~qYyc1Wlae0qBQcmIKJANN5GSJ8cSE8ibTeE7lsZ7esKD3RIOY7eTiOjn1NNkge7Vh4asMcLdLOsdLkr9d-7RdSNnX7m2KD1GGBZ~yc~-XSjwiliwTAMHgebS9mHp8QmEjGDdzTj8KRk_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=rs_file_repair.exe

http://gsf-cf.softonic.com/d49/aa5/.../file?SD_used=0&channel=WEB&fdh=no&id_file=3353746&instance=softonic_en&type=PROGRAM&Expires=1444603461&Signature=H1ToizZk~JBwMsj3MgLq51p38XFd6dRiHfeRQIKLdTmmo7xZrvz9KanvqMNHMKgH2G8fZGuTWONYj3CEPhyfp2Y0wuOG3wgCTbLHA0EMbdvxPihxH~AIeR8BlPhIooI7HvOSBF3EKUgFABAzP72xhAwffTyf50CcMl41PaFnoy8_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=rs_file_repair.exe

http://gsf-cf.softonic.com/d49/aa5/.../file?SD_used=0&channel=WEB&fdh=no&id_file=3353746&instance=softonic_en&type=PROGRAM&Expires=1435340924&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=MpXQhr74bKkU3slb3wJz~65JhiSU1oofrEUYmDybyX~Bxjn--PVFlOKQTtE2BBh-iGETGLfSNtusANd0jBzOROE73hPlBvKUycK~YuZHaZwLITr0G2tELrhafHiXq9-iJw6qhFqb1Eys0YbccduUYoMyCKIqG~ryyYW6djIbHto_&filename=rs_file_repair.exe

http://recoverhdd.com/.../rs_file_repair.exe

http://gsf-cf.softonic.com/d49/aa5/.../file?SD_used=0&channel=WEB&fdh=no&id_file=3353746&instance=softonic_en&type=PROGRAM&Expires=1438001647&Signature=dTiqMEne1HtEXM~TN9KImwD1rtbMOAxa~J0GOtSqOmSHJuZZklhrBIz2g~wpE4QS5oREsdBEnQQKI-1AvI5nsvZAiVgdjujywOiFyZN~ycf2j8EmI2IFiwCcL1KiNm2cAhwcNySX3yqcDcDkePh2MuyAipVs-zTk2rp3HxwV5yQ_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=rs_file_repair.exe

http://gsf-cf.softonic.com/d49/aa5/.../file?SD_used=0&channel=WEB&fdh=no&id_file=3353746&instance=softonic_en&type=PROGRAM&Expires=1454728377&Signature=ErwzGoRDRl8Pvh~UT0JfCt70zt~JunJegHy-BJbCtYEMiRaIY3hZxQdHcoKzXmMqEXv6I0eqD5dWR6UfKbj6Bszlgnv23r7s7T2Df7pTfCVxKXygloorZBxCQoXHTAo6om1NhMBQ9Top1i0j5ScqGAR7jqc7AGG9AwD4B8j9zrU_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=rs_file_repair.exe

http://gsf-cf.softonic.com/d49/aa5/.../file?SD_used=0&channel=WEB&fdh=no&id_file=3353746&instance=softonic_en&type=PROGRAM&Expires=1444351727&Signature=dk67jFIK83ihMSmC5BMmCYk26cpkVMqWgQ-TK1Fj2OTxhh3bYOXPO7CVm97WHQTQobg3biaEOPz4j9jRAJyYX6Uz88bVWOlZtHU-MuJ-gPLfLjyOiM7wjHAhtmnqv83t8I5Ft7GKXfpphpt8TGp9Q-4YraY3btWTbrwqdiPhWYI_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=rs_file_repair.exe

http://files.downloadnow.com/s/software/12/51/90/.../rs_file_repair.exe

http://gsf-cf.softonic.com/d49/aa5/.../file?SD_used=0&channel=WEB&fdh=no&id_file=3353746&instance=softonic_en&type=PROGRAM&Expires=1427709284&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=WzXrtbRHGPzaSh7pmutjOrBwAiM6YHozjeUrkHcGPgPF83USr4CZRG3-9aOHt9s6NMRJ5Vgn-f6sTthGytqgxW6K2mrHMySe3SBQJFJI4FkqmgSFXYGAg~cgHrcTILIZHZAhIWbMx9Wrvjthx10Ct2IBwNfbLybH0O4uBXpamaM_&filename=rs_file_repair.exe

http://rs-file-repair.en.softonic.com/download-tracker?th=1/6CH9aeXedl4L8u BHNJXWTW LP1LFlnGQpxqjlxAPSrYusXNoXmQc9Q4pHzEhsIv1rY9DnwGWoMMBNufET rn7Jrslediq/.../z8JUwp6IrpSd0GREme9EsFWfE3ND0lOq72xckSpBzfIU4NK1g=

Scan rs_file_repair.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.