home

leisure.dll

软媒时间休闲插件

Qingdao Ruanmei Network Technology Co.,Ltd.

The module leisure.dll by Qingdao Ruanmei Network Technology Co.,Ltd has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat.
Publisher:
青岛软媒网络科技有限公司  (signed by Qingdao Ruanmei Network Technology Co.,Ltd.)

Product:
软媒时间休闲插件

Version:
1.0.0.2

MD5:
ac77e87041f6e1e92a833acf32cb3f9a

SHA-1:
1533e33ec4985845f7e63fcf9069e62e10b8104f

SHA-256:
4d0f2bb7fe35cb4a11c7eefa3ef73d35c38ffb48c7018f3229ea90cae3832790

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
11/23/2024 10:24:10 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP (M)
16.11.4.21

File size:
412.2 KB (422,112 bytes)

Product version:
1.0.0.2

Copyright:
青岛软媒

Original file name:
leisure.dll

File type:
Dynamic link library (Win32 DLL)

Common path:
C:\Program Files\ruanmei\pcmaster\plugins\leisure.dll

Digital Signature
Signed by:
Qingdao Ruanmei Network Technology Co.,Ltd.

Authority:
VeriSign, Inc.

Valid from:
7/25/2014 8:00:00 AM

Valid to:
8/24/2017 7:59:59 AM

Subject:
CN="Qingdao Ruanmei Network Technology Co.,Ltd.", OU=IT, O="Qingdao Ruanmei Network Technology Co.,Ltd.", L=Qingdao, S=Shandong, C=CN

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
41E4F3478CEB8F3B8B87E0AB04A7ACCF

File PE Metadata
Compilation timestamp:
10/13/2014 3:04:15 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
12288:OVTq3zpIt9Hy5hrUBV/IKXb2M5sHxd9qKG9KtZ:eT6z09HoSvIOH5C7qt9KtZ

Entry address:
0xD6D00

Entry point:
80, 7C, 24, 08, 01, 0F, 85, E2, 01, 00, 00, 60, BE, 00, C0, 07, 10, 8D, BE, 00, 50, F8, FF, 57, EB, 10, 90, 90, 90, 90, 90, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46...
 
[+]

Entropy:
7.8178  (probably packed)

Code size:
364 KB (372,736 bytes)

Remove leisure.dll - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.