home

reimagerepairtemp.exe

Reimage Repair

Reimage Limited

The application reimagerepairtemp.exe, “Reimage Downloader” by Reimage Limited has been detected as a potentially unwanted program by 5 anti-malware scanners. The program is a setup application that uses the Nullsoft Scriptable Install System installer. This will display context specific advertisements in the browser as well as attempt to modify the browser's search provider. The file has been seen being downloaded from ukrep.reimage.com and multiple other hosts.
Publisher:
Reimage®  (signed by Reimage Limited)

Product:
Reimage Repair

Description:
Reimage Downloader

Version:
1.280

MD5:
0c70faec04e352b0ccd84aa975edf6a0

SHA-1:
6c14fb7a268d8941a092bdf2b17a563724454299

SHA-256:
b46f3d9ca26e4588f25df83d59fea8ad54fe99dbef7330adc44f2302aa58b3db

Scanner detections:
5 / 68

Status:
Potentially unwanted

Explanation:
The installer may include an offer for the Babylon Toolbar (a homepage/search hijacker), which is potentially installed with minimal user consent.

Analysis date:
5/21/2024 2:54:47 AM UTC  (today)

Scan engine
Detection
Engine version

ESET NOD32
Win32/Toolbar.Babylon
8.9427

McAfee
Artemis!0C70FAEC04E3
5600.7219

Reason Heuristics
PUP.Optional.ReimageLimited.R
14.9.12.17

Rising Antivirus
NS:PUF.SilenceInstaller!1.9DDF
23.00.65.14213

Trend Micro House Call
TROJ_GEN.F47V0214
7.2.46

File size:
712.9 KB (730,008 bytes)

Product version:
1.280

Copyright:
© Reimage 2014

Original file name:
ReimageRepair.exe

File type:
Executable application (Win32 EXE)

Installer:
Nullsoft Scriptable Install System

Common path:
C:\users\{user}\appdata\local\temp\reimagerepairtemp.exe

Digital Signature
Signed by:
Reimage Limited

Authority:
VeriSign, Inc.

Valid from:
4/11/2012 3:00:00 AM

Valid to:
5/4/2014 2:59:59 AM

Subject:
CN=Reimage Limited, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Reimage Limited, L=Nicosia, S=Nicosia, C=CY

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
08242D065B8CE1035215AAA943CF9166

File PE Metadata
Compilation timestamp:
12/6/2009 12:50:52 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
12288:y6zcciXy39lgVF+ZPPfnEUnsEWfXsbKZp0xBFpO0gcCre50ET3cfE/KyZFD:y6fiXy39l5lvANcNRX0EwfE/P

Entry address:
0x30FA

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 18, EC, 42, 00, E8, F1, 2B, 00, 00, A3, 64, EB, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 98, 8F, 42, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 60, E3, 42, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 40, 43, 00, 50, 57, E8, 92, 28, 00, 00...
 
[+]

Entropy:
7.9487  (probably packed)

Code size:
23.5 KB (24,064 bytes)

The file reimagerepairtemp.exe has been seen being distributed by the following 13 URLs.

http://ukrep.reimage.com/reimagerepair.exe

http://www.reimage.us.com/downloadsoftware

http://www.deinstallierenspywarevirus.com/kostenloserdownload

http://www.reimageplus.com/.../track.php?tracking=PiyushSites&campaign=reimage.us.com&adgroup=direct&ads_name=direct&keyword=direct&exec=run

http://www.reimageplus.com/.../router_land.php?tracking=PiyushSites&banner=reimage.us.com&exec=run

http://www.reimage.com/.../router_land.php?tracking=PiyushSites&banner=reimage.us.com&exec=run

http://www.verwijderenspywarevirus.com/gratisdownload

http://cdnrep.reimage.com/ReimageRepair.exe

http://www.reimageplus.com/.../track.php?tracking=PiyushSites&campaign=vir.us.com&adgroup=direct&ads_name=direct&keyword=direct&exec=run

http://www.reimageplus.com/.../router_land.php?tracking=PiyushSites&banner=vir.us.com&exec=run

http://www.reimage.com/.../router_land.php?tracking=PiyushSites&banner=vir.us.com&exec=run

http://www.vir.us.com/downloadsoftware

http://cdnrep.reimage.com/download/.../ReimageRepair.exe

Remove reimagerepairtemp.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.