reimagerepair.exe

Reimage Repair

Reimage Limited

The application reimagerepair.exe, “Reimage Downloader” by Reimage Limited has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from cdnrep.reimage.com and multiple other hosts. While running, it connects to the Internet address vip080.ssl.hwcdn.net on port 80 using the HTTP protocol.
Publisher:
Reimage  (signed by Reimage Limited)

Product:
Reimage Repair

Description:
Reimage Downloader

Version:
1.539

MD5:
2e5d49928703ea786e5bf3e923cc83e3

SHA-1:
55eceb2d17dc4e95b501ea81f16c8c5e2c1bd754

SHA-256:
2103407036ca653414c3ed198477b1a43c9e4a25c0ed1941fc4bfc855bde54d0

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
1/19/2022 10:11:30 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Reimage (L)
16.9.13.19

File size:
590.9 KB (605,088 bytes)

Product version:
1.539

Copyright:
© Reimage 2016

Trademarks:
Reimage

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\reimagerepair.exe

Digital Signature
Signed by:

Authority:
Symantec Corporation

Valid from:
5/17/2016 2:00:00 AM

Valid to:
8/17/2019 1:59:59 AM

Subject:
CN=Reimage Limited, O=Reimage Limited, L=Dasoupoli, S=Nicosia, C=CY

Issuer:
CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:
4320101ADF7A07C7405BC4433AE31FFD

File PE Metadata
Compilation timestamp:
2/24/2012 8:19:59 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
12288:oEwBTXh82YiXZIspAqlei8QPaV84L+sy0IGSABeL4s9lPq:oLRx8T3s918F84CzXKBeLb

Entry address:
0x39E3

Entry point:
81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, D8, 91, 40, 00, 89, 6C, 24, 14, FF, 15, 30, 80, 40, 00, 68, 01, 80, 00, 00, FF, 15, B8, 80, 40, 00, 55, FF, 15, C0, 82, 40, 00, 6A, 08, A3, B8, 2E, 47, 00, E8, 37, 2A, 00, 00, 55, 68, B4, 02, 00, 00, A3, D0, 2D, 47, 00, 8D, 44, 24, 38, 50, 55, 68, 1C, 93, 40, 00, FF, 15, 84, 81, 40, 00, 68, 04, 93, 40, 00, 68, C0, AD, 46, 00, E8, 19, 27, 00, 00, FF, 15, B4, 80, 40, 00, 50, BF, A0, 30, 4C, 00, 57, E8, 07, 27, 00, 00...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
28 KB (28,672 bytes)

The file reimagerepair.exe has been seen being distributed by the following 21 URLs.

http://cdnrep.reimage.com/rpv/.../ReimageRepair.exe

http://cdnrep.reimage.com/install/.../ReimageRepair.exe

http://cdnrep.reimage.com/rpu/.../ReimageRepair.exe

http://cdnrep.reimage.com/rpz/.../ReimageRepair.exe

http://cdnrep.reimage.com/ins/.../ReimageRepair.exe

http://cdnrep.reimage.com/rpv/.../ReimageRepair.exe

http://cdnrep.reimage.com/rpz/.../ReimageRepair.exe

http://cdnrep.reimage.com/rpv/.../ReimageRepair.exe

https://cdnrep.reimage.com/rpz/.../ReimageRepair.exe

http://www.2-spyware.com/.../ReimageRepair

temp:ReimageRepair(2).exe

http://cdnrep.reimage.com/rpq/.../ReimageRepair.exe

http://cdnrep.reimage.com/rpu/.../ReimageRepair.exe

http://cdnrep.reimage.com/ins/.../ReimageRepair.exe

http://cdnrep.reimage.com/ins/.../ReimageRepair.exe

http://cdnrep.reimage.com/rpv/.../ReimageRepair.exe

http://cdnrep.reimage.com/rpv/.../ReimageRepair.exe

http://cdnrep.reimage.com/rpv/.../ReimageRepair.exe

http://cdnrep.reimage.com/rpw/.../ReimageRepair.exe

https://cdnrep.reimage.com/rpv/.../ReimageRepair.exe

http://cdnrep.reimage.com/rpv/.../ReimageRepair.exe

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):
Connects to vip080.ssl.hwcdn.net  (205.185.208.80:80)

Remove reimagerepair.exe - Powered by Reason Core Security