CpuLeakFix312[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

CpuLeakFix312.exe
Size

3.8MB
MD5

80d109f543e8d82a74c94e904f5c5f8b
SHA1

c220ccd16abf6962ad0314f1193006322cea86c3
SHA256

492136ab9c9b387a8a888bbeaf98ad1d8024540a1ef8e70b50db7ba1145d557a
SHA512

e90395319bb70dbcbcdba499f20ba4888a96eda525edb7eedf8bf8d5d71366e1fdc0d63d3c1af109c9f5cf85d11682f4410f7a705818a4abd9f4a924223d0659
SSDEEP

98304:faOGHS9MRhaF1rGZ74FB0yMxlMHM31B4yQ7YbjUN1vvE:1GysaHGZ7Zyps31pQkbjU3vE

Score

1^/10

Malware Config

Signatures

Files

CpuLeakFix312.exe
.exe windows:4 windows x86 arch:x86

6392ed55e12e3a1db986cd9abbcacecc

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

52:04:8b:9c:8a:67:e2:8f:0c:c8:cc:75:81:3d:dc:5a
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

04/02/2016, 00:00

Not After

28/03/2019, 23:59

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0b:d5:15:37:03:d8:d5:f8:1f:ef:76:19:69:00:9a:14
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28/01/2016, 00:00

Not After

28/03/2019, 23:59

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:06:f1:0f:ce:68:f0:9b:fa:e5:5b:18:cd:8f:20:01:77
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for Advanced - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

29/03/2029, 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

a1:80:ee:ee:7e:c3:6e:b9:c3:99:8a:3b:cf:cc:d3:db:6f:a8:b1:c0:dc:f6:44:b3:92:1a:36:42:d4:7a:54:ee
Signer

Actual PE Digest

a1:80:ee:ee:7e:c3:6e:b9:c3:99:8a:3b:cf:cc:d3:db:6f:a8:b1:c0:dc:f6:44:b3:92:1a:36:42:d4:7a:54:ee

Digest Algorithm

sha256

PE Digest Matches

true

ac:55:79:6d:49:52:f5:a2:53:95:eb:f8:e7:98:13:68:ac:cd:0c:5a
Signer

Actual PE Digest

ac:55:79:6d:49:52:f5:a2:53:95:eb:f8:e7:98:13:68:ac:cd:0c:5a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\jenkins_Trunk\workspace\cpu_leak_repair\qqpcmgr_proj\bin\Shell\QuickFix.pdb

Imports

ws2_32

ntohl
htons
htonl
ntohs
inet_ntoa
inet_addr
connect
bind
recv
closesocket
sendto
__WSAFDIsSet
getpeername
setsockopt
WSAGetLastError
listen
send
accept
ioctlsocket
gethostbyname
socket
select
recvfrom
WSAStartup

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

kernel32

FindFirstFileW
FindNextFileW
FindClose
GetLocalTime
GetUserDefaultLangID
VirtualQuery
GetFullPathNameW
GetExitCodeProcess
CopyFileW
RemoveDirectoryW
GetSystemInfo
GetFileSize
ReadFile
InterlockedExchangeAdd
MoveFileW
SetFilePointer
OutputDebugStringW
GetFileAttributesExW
OpenFileMappingW
UnmapViewOfFile
DosDateTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
InterlockedCompareExchange
InterlockedExchange
GetSystemDefaultLangID
LoadLibraryA
UnhandledExceptionFilter
IsBadReadPtr
IsBadWritePtr
DuplicateHandle
InitializeCriticalSectionAndSpinCount
GlobalFree
IsDebuggerPresent
GetQueuedCompletionStatus
CreateIoCompletionPort
TlsFree
TlsGetValue
PostQueuedCompletionStatus
TlsAlloc
MapViewOfFile
OpenEventW
DeviceIoControl
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetStartupInfoW
GlobalAlloc
GlobalLock
GetTempFileNameW
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
GetThreadLocale
GetLocaleInfoA
GetACP
GetVersionExA
HeapSize
HeapReAlloc
HeapDestroy
CreateFileW
FreeResource
WriteFile
CreateDirectoryW
CloseHandle
lstrlenW
LockResource
SetFileAttributesW
GetTickCount
DeleteFileW
GetTempPathW
FindResourceExW
FindResourceW
SizeofResource
LoadResource
CreateEventW
lstrlenA
ResetEvent
MultiByteToWideChar
SetEvent
Sleep
MoveFileExW
WaitForSingleObject
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetLastError
InterlockedDecrement
GetProcAddress
GetModuleHandleW
GetCurrentProcess
CreateMutexW
FreeLibrary
WideCharToMultiByte
InterlockedIncrement
SetDllDirectoryW
GetVersion
GetModuleFileNameW
lstrcmpiW
RaiseException
LoadLibraryW
GetCurrentThreadId
ExpandEnvironmentStringsW
GetFileAttributesW
GetVersionExW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
WritePrivateProfileStringW
GetPrivateProfileStringW
GetCommandLineW
lstrcpynW
VirtualAllocEx
WriteProcessMemory
SetUnhandledExceptionFilter
TerminateProcess
WaitForMultipleObjects
CreateProcessW
OpenProcess
SearchPathW
HeapFree
SetErrorMode
GetCurrentProcessId
GetProcessHeap
HeapAlloc
GetSystemDirectoryW
SetLastError
FlushInstructionCache
TlsSetValue
LoadLibraryExW

user32

OffsetRect
SendMessageW
SetWindowRgn
InflateRect
ReleaseDC
GetDC
GetWindowRect
GetKeyState
CopyRect
CallWindowProcW
ClientToScreen
GetWindowLongW
GetMonitorInfoW
GetClientRect
SetWindowLongW
MonitorFromWindow
CharNextW
MoveWindow
ShowWindow
SetForegroundWindow
FindWindowW
ExitWindowsEx
DispatchMessageW
PeekMessageW
IsWindowEnabled
SetWindowPos
GetParent
GetDlgCtrlID
GetDlgItem
DestroyIcon
MessageBoxW
MapWindowPoints
GetClassInfoExW
LoadImageW
BeginPaint
GetDesktopWindow
LoadCursorW
MsgWaitForMultipleObjects
UnregisterClassA
CopyImage
LoadStringW
DefWindowProcW
FindWindowA
SendMessageTimeoutW
UnregisterClassW
WaitMessage
GetQueueStatus
PostQuitMessage
MsgWaitForMultipleObjectsEx
PostMessageW
GetActiveWindow
EqualRect
GetWindow
SetCapture
DrawIconEx
SystemParametersInfoW
SetCursor
SetActiveWindow
SetRect
EnableWindow
GetSystemMenu
PtInRect
KillTimer
SetTimer
TrackPopupMenu
IsWindow
SetWindowTextW
IsWindowVisible
PostThreadMessageW
ReleaseCapture
DestroyWindow
InvalidateRect
CreateWindowExW
LoadIconW
DrawFrameControl
TranslateMessage
DrawTextW
GetMessageW
RegisterClassExW
EndPaint

gdi32

DeleteObject
CreateFontIndirectW
CreateDIBSection
OffsetRgn
SetRectRgn
Rectangle
SetTextColor
GetObjectW
CreateBitmap
CombineRgn
GetStockObject
CreateRectRgn
StretchBlt
CreatePen
ExtTextOutW
SetBkColor
CreateCompatibleBitmap
CreateCompatibleDC
BitBlt
DeleteDC
SetBkMode
SaveDC
RestoreDC
GetClipRgn
SelectClipRgn
RoundRect
TextOutW
GetTextExtentPoint32W
CreateRectRgnIndirect
MoveToEx
RectInRegion
LineTo
SelectObject

advapi32

LookupPrivilegeValueW
RegOpenKeyExA
RegQueryValueExA
RegQueryValueExW
RegSetValueExW
RegOpenKeyExW
RegDeleteValueW
RegEnumKeyExW
RegCreateKeyExW
RegQueryInfoKeyW
RegCloseKey
RegDeleteKeyW
AdjustTokenPrivileges
OpenProcessToken

shell32

ShellExecuteW
SHGetSpecialFolderPathW
SHCreateDirectoryExW

ole32

CreateStreamOnHGlobal
CoInitializeEx
CoGetObject
CoInitialize
CoCreateGuid
CoUninitialize
CLSIDFromString
CoCreateInstance
CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc

oleaut32

SysFreeString
SysStringLen
VariantChangeType
OleLoadPicture
VariantInit
VariantCopy
SysAllocString
VariantClear
VarUI4FromStr

shlwapi

PathRemoveFileSpecW
PathIsRelativeW
PathFileExistsW
StrToIntA
PathAddBackslashW
PathAppendW
PathIsDirectoryW
PathFindFileNameW
StrStrW
PathIsRootW

comctl32

_TrackMouseEvent

gdiplus

GdipCreateFromHDC
GdipDeleteGraphics
GdiplusStartup
GdipCreateHBITMAPFromBitmap
GdiplusShutdown
GdipDrawImageI
GdipDisposeImageAttributes
GdipCloneImage
GdipCreateBitmapFromStream
GdipLoadImageFromStream
GdipAlloc
GdipFree
GdipDisposeImage
GdipSetImageAttributesColorMatrix
GdipCreateImageAttributes
GdipGetImageHeight
GdipDrawImageRectI
GdipDrawImageRectRectI
GdipGetImageWidth

iphlpapi

GetIpForwardTable

wininet

HttpQueryInfoW
InternetReadFile
InternetGetConnectedState
InternetCloseHandle
InternetOpenUrlW
InternetOpenW

msvcr80

_wfopen_s
fprintf
__CxxFrameHandler3
isspace
isalpha
isalnum
_CxxThrowException
___mb_cur_max_l_func
___lc_codepage_func
___lc_handle_func
setlocale
_create_locale
_ui64toa_s
_free_locale
_malloc_crt
__pctype_func
__uncaught_exception
__crtLCMapStringA
isupper
_calloc_crt
__crtLCMapStringW
__crtGetStringTypeW
_invoke_watson
islower
__iob_func
abort
_stricmp
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
?terminate@@YAXXZ
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
_except_handler4_common
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_controlfp_s
__p__fmode
_wstat64
_wmkdir
isprint
_mbsstr
_mbschr
memcmp
_memicmp
_vsnprintf_s
_snprintf_s
_errno
_endthreadex
_wfopen
wprintf
strncmp
strncpy_s
_beginthreadex
_time32
strstr
_waccess
srand
rand
ftell
ferror
fread
fopen
_fseeki64
_ftelli64
wcsncpy
strchr
strrchr
wcscpy_s
__set_app_type
memchr
strcspn
ungetc
localeconv
fputc
fgetc
sprintf_s
fflush
setvbuf
fsetpos
fgetpos
fseek
fclose
fwrite
tolower
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@PBD@Z
??0bad_cast@std@@QAE@ABV01@@Z
_wfullpath
swscanf_s
_snwprintf_s
_time64
_vsnwprintf_s
_wtoi
_wsplitpath_s
_wtoi64
_wtol
??3@YAXPAX@Z
wcsncpy_s
memcpy_s
memmove_s
wcsstr
wcslen
_wcsicmp
_wcslwr_s
_vscwprintf
vswprintf_s
iswspace
??0exception@std@@QAE@ABV01@@Z
_purecall
??2@YAPAXI@Z
memset
_recalloc
calloc
??0exception@std@@QAE@ABQBD@Z
_invalid_parameter_noinfo
?what@exception@std@@UBEPBDXZ
??_V@YAXPAX@Z
memmove
realloc
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
free
memcpy
strlen
atoi
malloc
wcscpy
strcmp
wcscmp
wcsrchr
_mbscmp
wcsncat_s
wcschr
_vscprintf
swprintf_s
vsprintf_s
_mbsicmp
_snwprintf

netapi32

NetWkstaTransportEnum
NetApiBufferFree
Netbios

Sections

.text
Size: 408KB - Virtual size: 406KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 120KB - Virtual size: 119KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

qmnet
Size: 4KB - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3.2MB - Virtual size: 3.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6392ed55e12e3a1db986cd9abbcacecc

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

52:04:8b:9c:8a:67:e2:8f:0c:c8:cc:75:81:3d:dc:5aCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

0b:d5:15:37:03:d8:d5:f8:1f:ef:76:19:69:00:9a:14Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

11:21:06:f1:0f:ce:68:f0:9b:fa:e5:5b:18:cd:8f:20:01:77Certificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:31:89:c6:50:04Certificate

Key Usages

a1:80:ee:ee:7e:c3:6e:b9:c3:99:8a:3b:cf:cc:d3:db:6f:a8:b1:c0:dc:f6:44:b3:92:1a:36:42:d4:7a:54:eeSigner

ac:55:79:6d:49:52:f5:a2:53:95:eb:f8:e7:98:13:68:ac:cd:0c:5aSigner

Headers

File Characteristics

PDB Paths

Imports

ws2_32

version

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

gdiplus

iphlpapi

wininet

msvcr80

netapi32

Sections

.text Size: 408KB - Virtual size: 406KB

.rdata Size: 120KB - Virtual size: 119KB

.data Size: 20KB - Virtual size: 85KB

qmnet Size: 4KB - Virtual size: 32B

.rsrc Size: 3.2MB - Virtual size: 3.2MB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

52:04:8b:9c:8a:67:e2:8f:0c:c8:cc:75:81:3d:dc:5a
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

0b:d5:15:37:03:d8:d5:f8:1f:ef:76:19:69:00:9a:14
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

11:21:06:f1:0f:ce:68:f0:9b:fa:e5:5b:18:cd:8f:20:01:77
Certificate

04:00:00:00:00:01:31:89:c6:50:04
Certificate

a1:80:ee:ee:7e:c3:6e:b9:c3:99:8a:3b:cf:cc:d3:db:6f:a8:b1:c0:dc:f6:44:b3:92:1a:36:42:d4:7a:54:ee
Signer

ac:55:79:6d:49:52:f5:a2:53:95:eb:f8:e7:98:13:68:ac:cd:0c:5a
Signer

.text
Size: 408KB - Virtual size: 406KB

.rdata
Size: 120KB - Virtual size: 119KB

.data
Size: 20KB - Virtual size: 85KB

qmnet
Size: 4KB - Virtual size: 32B

.rsrc
Size: 3.2MB - Virtual size: 3.2MB