PlantsVsZombies[.]exe

Resubmissions

16/05/2026, 08:32

260516-kfk9vae19n6

16/05/2026, 08:29

260516-kd2ttaby9s6

Sharing

Copy URL Twitter E-mail

General

Target
PlantsVsZombies.exe
Size 2.9MB
Sample260516-kd2ttaby9s
SHA256 3b314c04a40e85b72ea6075a6b1b6db74e97c6954fe3108b4886ccb3fbdd6b3d
MD5 9845c5c0abb5bcce4ba8b660cd04613a
SHA1 263c7d36fdca8041906db60f2dab7e99ff59df03
SHA512 1a8e3a4cb67ef606ac1bca646dc9ffc23917caeb1a1665da06bb70b90a5b33f9430c6327de1bd74621c91fac0ca5afe8a4bd3e1c98b8395b1fa23d1bd00fd15a
SSDEEP 49152:HkdRk1Osx3R+ijGgz4M//w1n0SmaeeDRgh2xOfpDyYJNo/xQAMighx96S7kfWPAg:Ysf6ijFUtXeeD2hnYjMibWIg
TLSH
T137D58C51F3DB90E2D91B1A7141B5A73B84315F611324A6E7FB943F2F98313E2E83A219
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
PlantsVsZombies.exe

File Explorer

PlantsVsZombies.exe

.exe 2.9MB

PlantsVsZombies.exe

IMPHASH 79e57618046f0692b4b4a6ce785b216a
SHA256 3b314c04a40e85b72ea6075a6b1b6db74e97c6954fe3108b4886ccb3fbdd6b3d
MD5 9845c5c0abb5bcce4ba8b660cd04613a
SHA1 263c7d36fdca8041906db60f2dab7e99ff59df03
SHA512 1a8e3a4cb67ef606ac1bca646dc9ffc23917caeb1a1665da06bb70b90a5b33f9430c6327de1bd74621c91fac0ca5afe8a4bd3e1c98b8395b1fa23d1bd00fd15a
SSDEEP 49152:HkdRk1Osx3R+ijGgz4M//w1n0SmaeeDRgh2xOfpDyYJNo/xQAMighx96S7kfWPAg:Ysf6ijFUtXeeD2hnYjMibWIg
TLSH
T137D58C51F3DB90E2D91B1A7141B5A73B84315F611324A6E7FB943F2F98313E2E83A219
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

3c:43:9a:60:2a:ff:81:2d:56:82:0d:3f:d4:d7:17:3a

Digest Algorithm

md5

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=PopCap Games,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=PopCap Games,L=Seattle,ST=Washington,C=US

Chains

Jan 1, 0001

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=PopCap Games,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=PopCap Games,L=Seattle,ST=Washington,C=US

Serial Number

3c:61:df:38:d5:bb:38:36:a8:b4:4b:98:5c:50:44:79

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 1, 2006 - Sep 21, 2009

Minor OS version

Major OS version

Entry point

2223090

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\Popcap\Lawn\releasefinal\PlantsVsZombies.pdb

kernel32

OutputDebugStringA GetModuleFileNameA GetModuleHandleA WinExec MapViewOfFile CreateFileMappingA GetCurrentProcessId QueryPerformanceFrequency QueryPerformanceCounter GetTickCount SetEndOfFile SetEnvironmentVariableA CreateFileW GetLocaleInfoW WriteConsoleW LoadLibraryA FreeLibrary GetProcAddress InterlockedDecrement GetLastError CloseHandle FindNextFileA Sleep SetThreadPriority GlobalFree GetCurrentThread GlobalLock WaitForSingleObject FindClose GlobalUnlock CreateMutexA GlobalAlloc GetCurrentThreadId LeaveCriticalSection GetVersionExA FindFirstFileA EnterCriticalSection GetCommandLineA MultiByteToWideChar DeleteFileA FileTimeToSystemTime GetFileTime GetSystemDirectoryA CreateFileA MulDiv SetUnhandledExceptionFilter GetCurrentProcess OpenFileMappingA IsBadWritePtr UnmapViewOfFile DeleteCriticalSection CreateThread GetThreadPriority VirtualQuery SetErrorMode InitializeCriticalSection InterlockedIncrement GetCurrentDirectoryW LoadLibraryW GetWindowsDirectoryA SetEvent CreateEventA LockResource SizeofResource LoadResource GetFileSize FindResourceA WideCharToMultiByte InterlockedExchange InterlockedCompareExchange GetLocaleInfoA TerminateProcess UnhandledExceptionFilter IsDebuggerPresent GetSystemTimeAsFileTime ExitProcess HeapFree HeapAlloc GetProcessHeap GetStartupInfoA GetLocalTime ExitThread ResumeThread GetDriveTypeA GetFullPathNameA CreateDirectoryA HeapReAlloc RtlUnwind RaiseException LCMapStringA LCMapStringW GetCPInfo GetTimeFormatA GetDateFormatA CompareStringA CompareStringW GetStringTypeA GetStringTypeW TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetACP GetOEMCP IsValidCodePage ReadFile WriteFile GetConsoleCP GetConsoleMode SetFilePointer SetHandleCount GetStdHandle GetFileType HeapSize GetTimeZoneInformation FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapDestroy HeapCreate VirtualFree VirtualAlloc FlushFileBuffers GetCurrentDirectoryA SetCurrentDirectoryA GetUserDefaultLCID EnumSystemLocalesA IsValidLocale SetStdHandle WriteConsoleA GetConsoleOutputCP RemoveDirectoryA

user32

ShowCaret CloseClipboard TranslateMessage DialogBoxIndirectParamA RegisterWindowMessageA DefWindowProcA AdjustWindowRect ShowWindow EndDialog GetDC IsWindowEnabled GetClipboardData SetClipboardData DispatchMessageA EnumDisplaySettingsA SetForegroundWindow GetWindowTextA IsIconic GetWindowLongA GetDlgItem SetFocus ChangeDisplaySettingsA GetClientRect GetWindowPlacement SetWindowTextA GetWindowRect ScreenToClient GetCursorPos PostMessageA EmptyClipboard SetTimer DestroyWindow SetCaretPos ReleaseDC GetSystemMetrics PeekMessageA InvalidateRect DefWindowProcW CreateWindowExA LoadIconA CreateCursor ReleaseCapture WindowFromPoint ClientToScreen MoveWindow EnumWindows SystemParametersInfoA MessageBoxW SetWindowLongA BeginPaint EndPaint OpenClipboard RegisterClassA DestroyCursor SetCapture SetActiveWindow AdjustWindowRectEx OffsetRect GetWindowInfo FillRect DrawTextExA GetSysColorBrush DrawTextA GetMessageA IsDialogMessageA GetFocus GetSysColor CreateWindowExW GetDesktopWindow IsWindow PostThreadMessageA HideCaret CreateCaret DestroyCaret IsWindowVisible SetCursor MessageBoxA SendMessageA LoadCursorA GetActiveWindow

wininet

InternetCloseHandle InternetConnectA HttpOpenRequestA HttpQueryInfoA InternetReadFile HttpSendRequestA InternetOpenA

winmm

timeGetTime timeBeginPeriod mixerGetLineControlsA mixerOpen mixerGetControlDetailsA mixerSetControlDetails timeEndPeriod PlaySoundA mixerGetDevCapsA mixerGetLineInfoA mixerClose

wsock32

inet_ntoa recv WSACleanup select htons WSAGetLastError socket gethostbyname ioctlsocket closesocket send WSAStartup __WSAFDIsSet connect

gdi32

CreateCompatibleDC GetObjectA GetStockObject GetTextExtentPoint32A GetTextMetricsA SelectObject DeleteObject IntersectClipRect CreateSolidBrush TextOutA SetBkMode SetTextColor DeleteDC CreateDIBSection CreateFontA GetDeviceCaps CreateFontIndirectA

advapi32

RegCloseKey RegCreateKeyExA RegDeleteValueA RegSetValueExA RegOpenKeyA RegOpenKeyExA RegQueryValueExA

shell32

ShellExecuteA

ole32

CoInitialize CoCreateInstance

oleaut32

SysFreeString SysAllocString VariantClear

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

PlantsVsZombies.exe

PE Signature issue

kernel32

user32

wininet

winmm

wsock32

gdi32

advapi32

shell32

ole32

oleaut32

generic