9397ca2dc3a4560eba5f87aef40fd800786ba0312716729ccbdbda185abee27d

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2008-Dec-05 23:33:05
Detected languages English - United States
Debug artifacts c:\rmtest\pc\_base\util\FnFProtectRun2.pdb
FileDescription Plants vs. Zombies
FileVersion 1.0.0.1051
InternalName Plants vs. Zombies
LegalCopyright Copyright (C) 2009
OriginalFilename PlantsVsZombies.exe
ProductName Plants vs. Zombies
ProductVersion 1.0.0.1051

Plugin Output

Info Matching compiler(s): Microsoft Visual C++ 6.0 - 8.0
Microsoft Visual C++ 8
Microsoft Visual C++ 8.0
MSVC++ v.8 (procedure 1 recognized - h)
Suspicious PEiD Signature: Crunch 4
Suspicious Strings found in the binary may indicate undesirable behavior: Miscellaneous malware strings:
  • cmd.exe
 Contains domain names:
  • command.com
  • http://updates.popcap.com
  • http://updates.popcap.com/updates/
  • http://www.popcap.com
  • popcap.com
  • updates.popcap.com
  • www.lua.org
  • www.popcap.com
Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Uses constants related to MD5
Uses constants related to SHA256
Uses constants related to SHA512
Uses known Mersenne Twister constants
Suspicious The PE contains functions most legitimate programs don't use. Functions which can be used for anti-debugging purposes:
  • CreateToolhelp32Snapshot
 Can access the registry:
  • RegQueryValueExA
  • RegSetValueExA
  • RegCloseKey
  • RegOpenKeyExA
  • RegEnumValueA
  • RegCreateKeyExA
 Possibly launches other programs:
  • CreateProcessA
  • ShellExecuteA
 Memory manipulation functions often used by packers:
  • VirtualAlloc
  • VirtualProtect
 Has Internet access capabilities:
  • InternetReadFile
  • InternetConnectA
  • InternetCloseHandle
  • InternetOpenA
 Enumerates local disk drives:
  • GetVolumeInformationA
  • GetDriveTypeA
 Manipulates other processes:
  • Process32First
  • OpenProcess
  • Process32Next
 Can take screenshots:
  • GetDC
  • CreateCompatibleDC
  • BitBlt
Info The PE is digitally signed. Signer: PopCap Games
Issuer: VeriSign Class 3 Code Signing 2004 CA
Suspicious VirusTotal score: 1/69 (Scanned on 2026-09-05 16:16:26) MaxSecure: Trojan.Malware.9567875.susgen

Hashes

MD5 3c8876147c84735ca540dda5be3c6451 🔍
SHA1 bf5c51304b1bade29ba4988cc96bf9c35780793c 🔍
SHA256 9397ca2dc3a4560eba5f87aef40fd800786ba0312716729ccbdbda185abee27d 🔍
SHA3 9b8e0cbdc93a6ee4d128e517a02d1bdd9c290420155ca4c49031d925a74e5727 🔍
SSDeep 24576:cf8hAXlD2FNTPaPhpWTEDl6ufr+4ArTEJe/MTny14rR+6PMBquI+7yN2PAvp:WDAFS2TExeTD/M7U4rQaMvI+7yQPAR 🔍
Imports Hash 1830114513f6f597435f788e3b228d52 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xf8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 4
TimeDateStamp 2008-Dec-05 23:33:05
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 8.0
SizeOfCode 0x13c000
SizeOfInitializedData 0x8e000
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0010D751 (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x13d000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x1000
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x228000
SizeOfHeaders 0x1000
Checksum 0x1dc1f4
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 5de944ee513a317347c6128010e69f6b 🔍
SHA1 275241200b3bbfec065460f6cc2f115570223af0 🔍
SHA256 86324bdd431e1695c18b53fba93041ec016ba95a3ba1cc50a072f0f0a0a4353c 🔍
SHA3 3d4db2faa962b2aab8fc201ed05f76bb118dbf18271268ff34381fac70c4bb0a 🔍
VirtualSize 0x13ba11
VirtualAddress 0x1000
SizeOfRawData 0x13c000
PointerToRawData 0x1000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.68976

.rdata

MD5 fe40b5190390152925ca62bedf808ffd 🔍
SHA1 175f23a1180d8ff4edee682cad66082ca59fc307 🔍
SHA256 114f7d29b88ff02b66fb6d20eac5f57323367c70856b5554319f8169527f5b06 🔍
SHA3 28dc98cd0b4e2ada8fdeb32de985c50188e3f9b84251fdebf798965149a8c730 🔍
VirtualSize 0x48794
VirtualAddress 0x13d000
SizeOfRawData 0x49000
PointerToRawData 0x13d000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.8607

.data

MD5 72ad1db85aaf4b5431a5adf43493a07a 🔍
SHA1 db07ab08c41f1ab521e5ddd5f25bca4b19d4df39 🔍
SHA256 9db9460d7c9d6af7d940b0cc8359b6c64038ace68af557837cfc6257d7dffe23 🔍
SHA3 a26393a002c8bf3cd96bbf6adb7c9767234aa69ce77e041d3c3a7c8d2ce045bd 🔍
VirtualSize 0x6a460
VirtualAddress 0x186000
SizeOfRawData 0xe000
PointerToRawData 0x186000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 5.00083

.rsrc

MD5 92f8477b61018c9a5f9d616add63f434 🔍
SHA1 b0865081165914e2ba1edfe6cbf09d211131b24e 🔍
SHA256 68cb8d9bbd8226a7e20487c22fe278ce67d838e47932d45bfb3d60afd96f4db1 🔍
SHA3 c0a71a5e97c6586abc01a079db65fe4cc1b9142e08ca34daf71a0715071ef9b3 🔍
VirtualSize 0x360a8
VirtualAddress 0x1f1000
SizeOfRawData 0x37000
PointerToRawData 0x194000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.98297

Imports

WSOCK32.dll WSAStartup
WSACleanup
KERNEL32.dll CreateFileA
TerminateProcess
MoveFileExA
GetCurrentThread
MapViewOfFile
CreateEventA
UnmapViewOfFile
LeaveCriticalSection
CreateFileMappingA
CreateThread
InitializeCriticalSection
WaitForSingleObject
DeleteCriticalSection
EnterCriticalSection
SetEvent
GetModuleHandleA
QueryPerformanceCounter
QueryPerformanceFrequency
GetCurrentProcessId
VirtualFree
VirtualAlloc
MoveFileExW
CompareStringA
InterlockedExchange
SetLastError
GetVolumeInformationA
CreateProcessA
SetEnvironmentVariableA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
CreatePipe
GetFileAttributesA
GetConsoleOutputCP
WriteConsoleA
SetCurrentDirectoryA
GetCurrentDirectoryA
GetEnvironmentStrings
FreeEnvironmentStringsA
HeapCreate
HeapDestroy
FlushFileBuffers
GetTickCount
SetHandleCount
SetFilePointer
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetOEMCP
GetACP
GetConsoleMode
GetConsoleCP
WriteFile
ReadFile
GetStringTypeA
LCMapStringA
MoveFileA
DuplicateHandle
GetFileType
SetStdHandle
ExitThread
GetFullPathNameA
GetDriveTypeA
RtlUnwind
RaiseException
GetStartupInfoA
GetCommandLineA
ExitProcess
HeapReAlloc
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
GetSystemTimeAsFileTime
GetProcessHeap
HeapAlloc
HeapFree
SetEndOfFile
SetFileAttributesA
GlobalLock
EnumResourceNamesA
OutputDebugStringA
Process32First
CreateMutexA
OpenProcess
Sleep
GetWindowsDirectoryA
FreeLibrary
DeleteFileA
GlobalUnlock
Process32Next
GetExitCodeProcess
InterlockedCompareExchange
InterlockedDecrement
InterlockedIncrement
ResumeThread
CloseHandle
LoadLibraryA
GetLastError
SetThreadPriority
CreateDirectoryA
GetThreadPriority
VirtualQuery
VirtualProtect
GlobalAlloc
CopyFileA
OpenMutexA
OpenFileMappingA
WaitForMultipleObjects
ReleaseMutex
OpenEventA
CreateToolhelp32Snapshot
GetModuleFileNameA
GetCommandLineW
HeapSize
GetVersionExA
FindClose
FindFirstFileA
SetFileTime
FindNextFileA
GetTimeZoneInformation
ReadConsoleInputA
GetConsoleCursorInfo
FreeConsole
SetConsoleTextAttribute
PeekConsoleInputA
GetCurrentThreadId
SetConsoleTitleA
SetConsoleCursorInfo
GetConsoleScreenBufferInfo
SetConsoleCursorPosition
AllocConsole
MulDiv
GetStdHandle
SetConsoleCtrlHandler
GetFileTime
USER32.dll WindowFromPoint
CreateCursor
FillRect
DestroyWindow
CreateWindowExA
GetQueueStatus
DestroyCursor
SetFocus
PostThreadMessageA
AdjustWindowRect
GetWindowTextA
GetSystemMetrics
PeekMessageA
IsWindowVisible
ReleaseDC
ShowWindow
SetCaretPos
CreatePopupMenu
LoadCursorA
SetTimer
DestroyCaret
HideCaret
GetClientRect
GetMessageA
GetDesktopWindow
GetForegroundWindow
PostQuitMessage
EnumDisplayMonitors
DispatchMessageA
GetWindowTextLengthA
TrackPopupMenu
SendMessageA
IntersectRect
GetCursor
SetWindowTextA
GetWindowRect
IsIconic
OpenIcon
LoadImageA
ShowCaret
GetWindowThreadProcessId
MessageBoxA
GetCursorPos
RegisterClassA
AppendMenuA
ClientToScreen
RegisterWindowMessageA
CreateCaret
CloseClipboard
GetDC
OpenClipboard
IsWindow
GetWindowPlacement
PostMessageA
MoveWindow
SetForegroundWindow
TranslateMessage
GetClassNameA
DefWindowProcA
EnumWindows
BringWindowToTop
UnregisterClassA
GetSystemMenu
FlashWindowEx
GetParent
GetFocus
DeleteMenu
DrawMenuBar
SetCursor
ReleaseCapture
SetCapture
EndPaint
BeginPaint
SetClipboardData
ScreenToClient
GDI32.dll SetTextColor
SelectClipRgn
SetBkMode
StretchBlt
GdiFlush
GetStockObject
GetDeviceCaps
SetDIBitsToDevice
GetTextMetricsA
IntersectClipRect
GetObjectA
DeleteDC
DeleteObject
CreateDIBSection
SelectObject
CreateCompatibleDC
BitBlt
GetCharABCWidthsA
CreateFontA
CreateFontIndirectA
ADVAPI32.dll RegQueryValueExA
RegSetValueExA
RegCloseKey
RegOpenKeyExA
RegEnumValueA
RegCreateKeyExA
SHELL32.dll ShellExecuteA
ole32.dll CoInitializeSecurity
CoUninitialize
CoCreateInstance
CoInitialize
OLEAUT32.dll SysFreeString
SysAllocStringByteLen
WININET.dll InternetReadFile
InternetConnectA
HttpSendRequestA
InternetCloseHandle
InternetOpenA
HttpOpenRequestA
HttpQueryInfoA
WINMM.dll timeBeginPeriod
PlaySoundA
timeEndPeriod
timeGetTime

Delayed Imports

__GDF_XML

Type DATA
Language English - United States
Codepage Latin 1 / Western European
Size 0x7fe
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.52539
MD5 dedba7c07d55dd6a9e1ca3ca1b17d01c 🔍
SHA1 558a55972f60a1bbf20e56c92c11ed70745eac92 🔍
SHA256 b0e7082b1a53b38362a63e4932b3f597d3470827fbbf8c23e7f1f17b24a3c11e 🔍
SHA3 7f0331206e25f42e39b571fd1bb48dba7438f2fd48b2bbdf94073af709b4d668 🔍

13

Type RT_CURSOR
Language English - United States
Codepage Latin 1 / Western European
Size 0x2ec
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.15815
MD5 c30790791d6c1968110a14cbde4eb2be 🔍
SHA1 b637b9b67a085c37c69430d95a35865ed8a4704a 🔍
SHA256 763dfba44c82e7889bf49b03c5021e210b543166071e2a2d011d97942752dc7b 🔍
SHA3 63bd72cd74bfe62ce1aea7965ad8f6463f808accdf281b9c85071030d99deafe 🔍

105

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x128
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.3246
MD5 b6e7f3d302b2cf5d8f6ea451a0efa5f1 🔍
SHA1 fb891a5c72d67f7bbc55523ea7fd09abc175e792 🔍
SHA256 8ac51aca452cea2ff2768555ea7deecd7a6c80d89727972a430290d81fc37d3a 🔍
SHA3 3967370869f5ee74a4cc1b95b8dff5932dfde1abddd3f2663d331f54115b503f 🔍

106

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x568
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.28767
MD5 12cf09c6a9577730b8f1f4148e9ee463 🔍
SHA1 2a81e1441ae430ea5f380f8a12d934d2ac348bcc 🔍
SHA256 4ec9b63b1db61bc0bee5a4baaf205cc29723235cc6cf4573eb19d376c447292b 🔍
SHA3 d5c354726e3b3a695f4baecac0be1e587dc22a83df52bad309e70230e6b776f0 🔍

107

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x2e8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.7457
MD5 6e35b912cfe52d3df960df7f13a2c3fd 🔍
SHA1 6c79a70235978010617cd397532a9c88a5559548 🔍
SHA256 57f65209e4c30005747baf6b1e512053719915e97d562dce676783cbf698c4fb 🔍
SHA3 d67111787fa83f3ac23588b76cfbca0bcfeb18604c89a446f64c3d761a48a1cf 🔍

108

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x8a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.8441
MD5 a6281a08cbd4c2e1be9482dc3902704c 🔍
SHA1 e3c1aa93c263d62466de411c66e4b5cd8a537069 🔍
SHA256 d824aa1ae1200e8bed14ea030d01da5be44246a86dcc0b275555972cdf901230 🔍
SHA3 ddc530df017f0c29ab43af532240dc32ef8f5a92820e623d53491aaa56e2b002 🔍

109

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x668
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.53396
MD5 b0bf6fa46034f256a5d7a4cd04674960 🔍
SHA1 2ea03ca2204eca7c3b0e0382fdfbdeebe9d814af 🔍
SHA256 f3e041431a43c2e21ad3527ec7f60d5860dd90ee3b5919495f1849bc253b044e 🔍
SHA3 736555f0bb44f7ab2d089ab8dd1f81e5a5b2618d6acc9a5b708cd502ae21dfa1 🔍

110

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0xea8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.71516
MD5 3d15920e0747127d2639bbd9233797ef 🔍
SHA1 357279e7f7f49a7c817b617cccb00ac624fa7f3e 🔍
SHA256 307a2b3160c3c7587a7afd52a4bcc64464f26edb326f007aa14aeb344ee58d83 🔍
SHA3 3fae77acdab762adfa85ece5bc4730c5c12aac6317308fa9284f6c8348ef0cc0 🔍

111

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0xa068
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.59044
MD5 e2a9888b3d6908b7b8b1994ccb888022 🔍
SHA1 3f3929f243281a00277d606a3b010dbf9478b99d 🔍
SHA256 5b61e1f9afcc874137e13026c560fa3752f3255c0db3d25abb2958254b5d7670 🔍
SHA3 30f0bef06d88068a9a326dad5e65b6615966e7bb964d9cfa0efc9165b615f550 🔍

112

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x12428
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.64123
MD5 927bae69fa1c93ae12edcb8d80a59ba3 🔍
SHA1 310b0757572930129ebdcaaa2a29b580ce55d09c 🔍
SHA256 1d16411afce51532d566b786249728084d75e0f1a17543a7593fd4157ab51c2b 🔍
SHA3 ff8bb5c8c677b0e797da357b5da8e289a1c44f762f2504452558e67f7cac2d49 🔍

113

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x12400
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.99354
Detected Filetype PNG graphic file
MD5 260ea90a4027e309a6a12d8f67846323 🔍
SHA1 ef34226ed7dabc93e8584c13e622f01a88e1b0a7 🔍
SHA256 587b75e352d410e334125e7995aa77c1e84f63e76f17ca0e5052b8021cd8a964 🔍
SHA3 090260ea174eb183be76843f0353a3d5b823879f02f61470e6c472df90c1f534 🔍

114

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.84443
MD5 d99a876ec0e1c3952a1578b5c95dcd51 🔍
SHA1 3d895c618e6bbeb6ece3778e5aad18396fdd0374 🔍
SHA256 cae198591e6f46dbce1f23a5b08d47dab027fd62ed8665284d2f8a2fd7bf2017 🔍
SHA3 343d1681d4eaec2c6c7ad532294af12a6ea5e524765277953404f01f9dd6f7b0 🔍

115

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.65746
MD5 095bd9d1de877e8607cdad961e5a6199 🔍
SHA1 7c513e90823d6b9245f63a2341840ab171375415 🔍
SHA256 2c509f47875a9e3b738f74840d052a4fa7a8f90aa66f37682a3a325594b1b013 🔍
SHA3 f56e432a6614a1227bb058e73cab80af08616c55a5cf243374c16db4fb10f1c5 🔍

116

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.13062
MD5 7210e1b98847d4c3675d389b1aca6cec 🔍
SHA1 b416214d4e7fcd6e952e9b9605bc0dd7772c00fa 🔍
SHA256 1e32e7680910e068609d73e7da485e0dd36ccb3b3f36a25d364213df21140fcc 🔍
SHA3 23aed9f48007bd15df21db51858260f6cc59756e4a195066b18644cd4ad3774b 🔍

102

Type RT_MENU
Language English - United States
Codepage Latin 1 / Western European
Size 0x20
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.23629
MD5 1551b413f781b3b40fdfaddbc25196c8 🔍
SHA1 9d2ea25cddfeb254b8271b275929ff926a6f5bc2 🔍
SHA256 6cded6cd7bd52dfde065dc3696cd5f9f07df121f76091a47fde4df1f2d7b6203 🔍
SHA3 87aa37682c88c306ada8220fafb9925ebdce133ded845cf0b3cfaf4882efe1e7 🔍

107 (#2)

Type RT_DIALOG
Language English - United States
Codepage Latin 1 / Western European
Size 0x11c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.99296
MD5 a4954216820a5a5ac36e6e3c1e0cf3da 🔍
SHA1 3e1d3a809a940d280a31745f379bf10632f7369c 🔍
SHA256 186de7659f15775e4cb5d2e0f77d4bfb372cd97e16143964b8d9449de6c86932 🔍
SHA3 11a92a187755751b55b33c845a18c2f55bc681acaf3a4df97722559979e1a221 🔍

104

Type RT_GROUP_CURSOR
Language English - United States
Codepage Latin 1 / Western European
Size 0x14
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.21924
Detected Filetype Cursor file
MD5 31b566f4eeab4fa25918aa5088c08484 🔍
SHA1 74d628b12a4baa5b15ce431eef71c59aaa1a72ba 🔍
SHA256 8499abc7a709e75f79b1ca1e09d3d8b9c74a7701b70f466ae79385068e5ce875 🔍
SHA3 53215a342cdbe0826ff6266e1ffc9d4df886f1443d031ef874d8a86ad9ae3a7f 🔍
Preview

IDI_MAIN_ICON

Type RT_GROUP_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0xae
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.83603
Detected Filetype Icon file
MD5 fb303fa28f36317055b1f7e356c86563 🔍
SHA1 85b377c3c45ea57a4ddde63d803f535d9875d93d 🔍
SHA256 00589a04ec3737df143010246a04338db5b7ca2bfa45c752592f37efc9103dd5 🔍
SHA3 d87e1743c2dd10bac8279a1bf236acad4279f2b0df670e6916071b62adfde926 🔍

1

Type RT_VERSION
Language English - United States
Codepage Latin 1 / Western European
Size 0x2cc
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.36287
MD5 9d29e446375828fe442339ec7259b5a2 🔍
SHA1 6aefe9a01d137da61d9401e0423aa37a90cb1c5c 🔍
SHA256 c3c89ee6b3ecc0b86a51adc425f00feefc02bbc88e2ebe3b383aa6897a59c405 🔍
SHA3 59c52266021cff2806ba79345a8910b83296f9d80c1964d932a5c561c26d8663 🔍

1 (#2)

Type RT_MANIFEST
Language English - United States
Codepage Latin 1 / Western European
Size 0x192
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.84915
MD5 850259469c6edd54afd1be91fe9dfd47 🔍
SHA1 9c3a37987c6071023cd1cd57b0e638b03be21958 🔍
SHA256 9f4b418013f868597243471be8da0cef6b5fc276177112b0b076326359452ac0 🔍
SHA3 1d6a3cb40df2c60e6a1a8084a699e2f2ec45c5cb539f8e6d477c6a1e7d61d3e8 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 1.0.0.1051
ProductVersion 1.0.0.1051
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language English - United States
FileDescription Plants vs. Zombies
FileVersion (#2) 1.0.0.1051
InternalName Plants vs. Zombies
LegalCopyright Copyright (C) 2009
OriginalFilename PlantsVsZombies.exe
ProductName Plants vs. Zombies
ProductVersion (#2) 1.0.0.1051
Resource LangID English - United States

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2008-Dec-05 23:33:05
Version 0.0
SizeofData 67
AddressOfRawData 0x16f338
PointerToRawData 0x16f338
Referenced File c:\rmtest\pc\_base\util\FnFProtectRun2.pdb

TLS Callbacks

Load Configuration

Size 0x48
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x59099c
SEHandlerTable 0x577520
SEHandlerCount 607

RICH Header

XOR Key 0x78f3a65b
Unmarked objects 0
126 (50327) 7
ASM objects (VS2012 build 50727 / VS2005 build 50727) 64
C++ objects (VS2012 build 50727 / VS2005 build 50727) 141
Imports (VS2012 build 50727 / VS2005 build 50727) 21
Total imports 271
126 (VS2012 build 50727 / VS2005 build 50727) 41
C objects (VS2012 build 50727 / VS2005 build 50727) 372
114 (VS2012 build 50727 / VS2005 build 50727) 51
Resource objects (VS2012 build 50727 / VS2005 build 50727) 1
Linker (VS2012 build 50727 / VS2005 build 50727) 1

Errors

[*] Warning: [plugin_authenticode] Hashing algorithm 1.2.840.1015.13.2.5 is not supported.
Leave a comment

No comments yet.