PlantsVsZombies[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

PlantsVsZombies.exe
Size

3.4MB
MD5

b7802469ce6090d81275aa8381cd5032
SHA1

d3b3e35f2196a82f9e60db146aa3ee87a183c54d
SHA256

173af1e1d6e8374d6d6071e79d2cde49b5f364fbb076cb82e5083a3d813408ea
SHA512

00442e12b35797e2b71f85ac17d44caa53e0abed867d7ad547136a8c8bfab1047f14d32fd97c0bb0f95d050ca78b38cd16f33ad1a32ea2126e453ec7be5dfa48
SSDEEP

98304:6aXTlsc2LPJ/9Cyq9JuSjUu941QD3WMGiPIc:6aac2LPJ1Cyq9JuSjUuu1QjWRiQc

Score

1^/10

Malware Config

Signatures

Files

PlantsVsZombies.exe
.exe windows x86

c1d9c77b7a5eed8862f5372a2f716bca

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

60:f0:be:25:f0:28:bf:ed:b5:bd:f0:ce:5c:7a:9e:26
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

23/09/2009, 00:00

Not After

20/09/2012, 23:59

Subject

CN=PopCap Games,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=PopCap Games,L=Seattle,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

88:ff:2d:42:42:af:b7:25:70:61:ab:46:1d:17:88:e0:91:bf:28:d4
Signer

Actual PE Digest

88:ff:2d:42:42:af:b7:25:70:61:ab:46:1d:17:88:e0:91:bf:28:d4

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=PopCap Games,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=PopCap Games,L=Seattle,ST=Washington,C=US

20/07/2010, 22:24
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

OutputDebugStringA
GetModuleFileNameA
WinExec
GetModuleHandleA
MapViewOfFile
CreateFileMappingA
GetCurrentProcessId
QueryPerformanceFrequency
QueryPerformanceCounter
GetTickCount
GetProcessHeap
SetEndOfFile
SetEnvironmentVariableA
CreateFileW
GetLocaleInfoW
FreeLibrary
InterlockedDecrement
GetProcAddress
LoadLibraryA
CreateFileA
LeaveCriticalSection
MulDiv
FileTimeToSystemTime
GetSystemDirectoryA
EnterCriticalSection
GetFileTime
CloseHandle
GlobalLock
WaitForSingleObject
GetCurrentThread
GetCommandLineA
GlobalAlloc
Sleep
MultiByteToWideChar
SetThreadPriority
GlobalUnlock
FindFirstFileA
GetLastError
GlobalFree
FindClose
FindNextFileA
CreateMutexA
GetCurrentThreadId
GetVersionExA
DeleteFileA
UnmapViewOfFile
VirtualQuery
SetErrorMode
SetUnhandledExceptionFilter
GetCurrentProcess
InitializeCriticalSection
IsBadWritePtr
GetThreadPriority
DeleteCriticalSection
OpenFileMappingA
CreateThread
InterlockedIncrement
LoadLibraryW
GetCurrentDirectoryW
GetWindowsDirectoryA
SetEvent
CreateEventA
GetFileSize
FindResourceA
LoadResource
SizeofResource
LockResource
WideCharToMultiByte
InterlockedCompareExchange
InterlockedExchange
GetLocaleInfoA
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
GetModuleHandleW
ExitProcess
GetStartupInfoA
HeapFree
ExitThread
ResumeThread
GetLocalTime
CreateDirectoryA
GetDriveTypeA
GetFullPathNameA
HeapReAlloc
HeapAlloc
RtlUnwind
RaiseException
GetCPInfo
LCMapStringA
LCMapStringW
GetTimeFormatA
GetDateFormatA
CompareStringA
CompareStringW
GetStringTypeW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetACP
GetOEMCP
IsValidCodePage
ReadFile
WriteFile
GetConsoleCP
GetConsoleMode
SetFilePointer
SetHandleCount
GetStdHandle
GetFileType
InitializeCriticalSectionAndSpinCount
HeapSize
GetTimeZoneInformation
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
VirtualFree
VirtualAlloc
FlushFileBuffers
GetCurrentDirectoryA
SetCurrentDirectoryA
GetStringTypeA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
RemoveDirectoryA

user32

HideCaret
MoveWindow
GetSystemMetrics
AdjustWindowRectEx
ReleaseDC
OffsetRect
GetDC
DrawTextExA
GetClientRect
GetWindowInfo
FillRect
ClientToScreen
RegisterClassA
DefWindowProcW
ChangeDisplaySettingsA
DialogBoxIndirectParamA
AdjustWindowRect
SetClipboardData
SetWindowTextA
IsWindowVisible
ReleaseCapture
SystemParametersInfoA
MessageBoxW
OpenClipboard
DispatchMessageA
PostMessageA
ShowWindow
GetCursorPos
DestroyCursor
DefWindowProcA
EndDialog
GetDlgItem
ShowCaret
PeekMessageA
CreateWindowExA
GetClipboardData
GetWindowLongA
InvalidateRect
SetWindowLongA
GetWindowTextA
GetWindowPlacement
TranslateMessage
EnumWindows
BeginPaint
RegisterWindowMessageA
SetFocus
WindowFromPoint
IsWindowEnabled
EnumDisplaySettingsA
LoadIconA
CreateCursor
SetForegroundWindow
SetCapture
IsIconic
SetActiveWindow
GetWindowRect
ScreenToClient
SetTimer
CloseClipboard
DestroyWindow
EndPaint
CreateWindowExW
GetSysColorBrush
GetSysColor
GetDesktopWindow
IsDialogMessageA
GetFocus
DrawTextA
GetMessageA
IsWindow
PostThreadMessageA
DestroyCaret
CreateCaret
SetCaretPos
EmptyClipboard
LoadCursorA
MessageBoxA
SendMessageA
SetCursor
GetActiveWindow

wininet

HttpQueryInfoA
InternetReadFile
HttpOpenRequestA
HttpSendRequestA
InternetOpenA
InternetCloseHandle
InternetConnectA

winmm

timeGetTime
timeBeginPeriod
mixerOpen
mixerGetLineControlsA
mixerGetLineInfoA
mixerClose
PlaySoundA
timeEndPeriod
mixerGetControlDetailsA
mixerSetControlDetails
mixerGetDevCapsA

wsock32

send
gethostbyname
closesocket
__WSAFDIsSet
socket
inet_ntoa
connect
WSAStartup
recv
WSACleanup
htons
WSAGetLastError
select
ioctlsocket

gdi32

CreateCompatibleDC
SetBkMode
GetTextMetricsA
IntersectClipRect
GetObjectA
GetStockObject
TextOutA
DeleteObject
SelectObject
CreateSolidBrush
GetTextExtentPoint32A
SetTextColor
DeleteDC
CreateDIBSection
CreateFontA
GetDeviceCaps
CreateFontIndirectA

advapi32

RegSetValueExA
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
RegDeleteValueA
RegOpenKeyA
RegQueryValueExA

shell32

ShellExecuteA

ole32

CoCreateInstance
CoInitialize

oleaut32

SysFreeString
SysAllocString
VariantClear

Sections

.text
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 288KB - Virtual size: 288KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 58KB - Virtual size: 794KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 217KB - Virtual size: 216KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c1d9c77b7a5eed8862f5372a2f716bca

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

60:f0:be:25:f0:28:bf:ed:b5:bd:f0:ce:5c:7a:9e:26Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

88:ff:2d:42:42:af:b7:25:70:61:ab:46:1d:17:88:e0:91:bf:28:d4Signer

Signature Validations

Verification

20/07/2010, 22:24 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

wininet

winmm

wsock32

gdi32

advapi32

shell32

ole32

oleaut32

Sections

.text Size: 2.8MB - Virtual size: 2.8MB

.rdata Size: 288KB - Virtual size: 288KB

.data Size: 58KB - Virtual size: 794KB

.rsrc Size: 217KB - Virtual size: 216KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

60:f0:be:25:f0:28:bf:ed:b5:bd:f0:ce:5c:7a:9e:26
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

88:ff:2d:42:42:af:b7:25:70:61:ab:46:1d:17:88:e0:91:bf:28:d4
Signer

20/07/2010, 22:24
Valid: false

.text
Size: 2.8MB - Virtual size: 2.8MB

.rdata
Size: 288KB - Virtual size: 288KB

.data
Size: 58KB - Virtual size: 794KB

.rsrc
Size: 217KB - Virtual size: 216KB