Should I block it?
Yes, 98% block recommendation.
Possible reasons:
Multiple malware detections
Performance resource utilization
Additional versions
Relationships
Parent process
Related files
 PE file structure
|
Show functions |
Import table
mscoree.dll
DllMain
updateluckyleap.exe
By lucky leap (Signed)
| Version: | 1.0.4980.4753 |
| MD5: | 9069ad8b5821339419a5843db04b7f92 |
| SHA1: | 59c23fb9682e81aa630c5296cff4b33caf415bef |
| SHA256: | d28702b589417c0970529a80b6773f80a0693b78ee6792941a150832ce601c6b |
Warning 8 antivirus scanners has detected malware.
Overview
updateluckyleap.exe is malware that runs as a service under the name Update lucky leap with extensive SYSTEM privileges (full administrator access). It is installed with a couple of know programs including lucky leap 3.0.0 published by Yontoo Technology, Inc. and lucky leap 1.0.0 published by Yontoo Technology, Inc.. The assembly utilizes the .NET run-time framework (which is required to be installed on the PC). The file is digitally signed by lucky leap which was issued by the VeriSign certificate authority (CA).
Details
| File name: | updateluckyleap.exe |
| Publisher: | lucky leap |
| Description: | luckyleap |
| Typical file path: | C:\Program Files\lucky leap\updateluckyleap.exe |
| Original name: | luckyleap.exe |
| File version: | 1.0.4980.4753 |
| Size: | 201.78 KB (206,624 bytes) |
| Build date: | 8/20/2013 6:38 AM |
| Certificate |
| Issued to: | lucky leap |
| Authority (CA): | VeriSign |
| Effective date: | Monday, August 12, 2013 |
| Expiration date: | Thursday, August 13, 2015 |
| Digital DNA |
| File packed: | No |
| Code language: | Microsoft Visual C# / Basic .NET |
| .NET CLR: | Yes |
| .NET NGENed: | No |
More details
Programs
The following programs will install this file
From the privacy policy - "We use the information we collect from and receive about users to provide the Software to you, to measure and improve the Software, to personalize your experience by delivering relevant content, advertising, and marketing messages, and to provide you with customer support and respond to inquiries. We may use aggregated, anonymous data about use of and activity on the Software to assist us in this regard and su...
Behaviors
Service
Runs under 'SYSTEM\CurrentControlSet\Services' by the Service Controller (services.exe)
Malware detections
Based on 40+ industry antivirus scanners, 8 of them detected the following malware.
| Antivirus engine | Engine version | Detection |
| BitDefender |
7.2 |
Adware.MultiPlug.A |
| Dr.Web |
8.13.10.10 |
Adware.Plugin.100 |
| Emsisoft Anti-Malware |
3.0.0.589 |
Adware.MultiPlug.A (B) |
| ESET NOD32 |
7.8888 |
a variant of MSIL/BrowseFox.A |
| G Data |
13.10.22 |
Adware.MultiPlug.A |
| Malwarebytes |
1.75.0.1 |
PUP.Optional.LuckyLeap.A |
| eScan by MicroWorld |
12.0.250.0 |
Adware.MultiPlug.A |
| VIPRE Antivirus |
22178 |
Yontoo (fs) |
Resource utilization
(Note: statistics below are averages based on a minimum sample size of 200 unique participants)
Averages
| CPU |
| Total CPU: | 0.00011220% | |
| Kernel CPU: | 0.00005108% | |
| User CPU: | 0.00006112% | |
| Kernel CPU time: | 234 ms/min | |
| CPU cycles: | 136,729/sec | |
| Memory |
| Private memory: | 26.81 MB | |
| Private (maximum): | 23.73 MB | |
| Private (minimum): | 15.09 MB | |
| Non-paged memory: | 26.81 MB | |
| Virtual memory: | 515.48 MB | |
| Virtual memory (peak): | 519.93 MB | |
| Working set: | 16.4 MB | |
| Working set (peak): | 24.15 MB | |
| Page faults: | 12,066/min | |
| I/O |
| I/O read transfer: | 20 Bytes/sec | |
| I/O read operations: | 1/sec | |
| I/O write transfer: | 49 Bytes/sec | |
| I/O write operations: | 1/sec | |
| I/O other transfer: | 61 Bytes/sec | |
| I/O other operations: | 2/sec | |
| Resource allocations |
| Threads: | 11 | |
| Handles: | 495 | |
Process properties
Threads
Averages
| updateluckyleap.exe (main module) |
| Total CPU: | 0.00004767% | |
| Kernel CPU: | 0.00002724% | |
| User CPU: | 0.00002043% | |
| CPU cycles: | 992/sec | |
| Memory: | 224 KB | |
| ntdll.dll |
| Total CPU: | 0.00002724% | |
| Kernel CPU: | 0.00000681% | |
| User CPU: | 0.00002043% | |
| CPU cycles: | 59,810/sec | |
| Context switches: | 1/sec | |
| Memory: | 1.66 MB | |
Common loaded modules
These are modules that are typiclaly loaded within the context of this process.
Distribution by Windows OS
| OS version | distribution |
| Windows 7 Ultimate |
32.43% |
|
| Windows 7 Home Premium |
27.03% |
|
| Windows 7 Professional |
21.62% |
|
| Microsoft Windows XP |
10.81% |
|
| Windows 8 Enterprise |
5.41% |
|
| Windows 8.1 Pro |
2.70% |
|
Distribution by country
United States installs about 28.57% of updateluckyleap.exe.
Distribution by PC manufacturer
| PC Manufacturer | distribution |
| Hewlett-Packard |
27.66% |
|
| Dell |
21.28% |
|
| Compaq |
17.02% |
|
| ASUS |
17.02% |
|
| Acer |
8.51% |
|
| Sony |
4.26% |
|
| American Megatrends |
4.26% |
|
