home

bejeweledsetup.exe

PopCap Games

This is a setup and installation application. The file has been seen being downloaded from gsf-cf.softonic.com and multiple other hosts.
Publisher:
PopCap Games  (signed and verified)

MD5:
d2a4c15c248508030c305c51427e0919

SHA-1:
6157eac6d922429aa98c016439c17d7be4173508

SHA-256:
9cb0d51cc90e7bf4ac9e5fd556ad3fef87b2e116516ebc50a689c4e0f785f405

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
12/26/2024 12:06:14 PM UTC  (today)

File size:
3 MB (3,100,632 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\bejeweledsetup.exe

Digital Signature
Signed by:
PopCap Games

Authority:
VeriSign, Inc.

Valid from:
9/1/2006 3:00:00 AM

Valid to:
9/22/2009 2:59:59 AM

Subject:
CN=PopCap Games, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=PopCap Games, L=Seattle, S=Washington, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2004 CA, OU=Terms of use at https://www.verisign.com/rpa (c)04, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
3C61DF38D5BB3836A8B44B985C504479

File PE Metadata
Compilation timestamp:
11/8/2008 12:29:36 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
49152:iTPZ+WbgcWTKT/uc3oH1PAgKDvGZDgyX/qo533qWS+m8+TtWOt1acpiDcOM0z/Yz:OxLbbv7GUDvGNqo5HfmX18sijpUP

Entry address:
0x3241B

Entry point:
E8, 24, A2, 00, 00, E9, 16, FE, FF, FF, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, 55, 8B, EC, 57, 56, 8B, 75, 0C, 8B, 4D, 10, 8B, 7D, 08, 8B, C1, 8B, D1, 03, C6, 3B, FE, 76, 08, 3B, F8, 0F, 82, A4, 01, 00, 00, 81, F9, 00, 01, 00, 00, 72, 1F, 83, 3D, 88, B0, 45, 00, 00, 74, 16, 57, 56, 83, E7, 0F, 83, E6, 0F, 3B, FE, 5E, 5F, 75, 08, 5E, 5F, 5D, E9, A6, 7F, 00, 00, F7, C7, 03, 00, 00, 00, 75, 15, C1, E9, 02, 83, E2, 03, 83, F9, 08, 72, 2A, F3, A5, FF, 24, 95, A4, 25, 43, 00, 90, 8B, C7, BA, 03, 00, 00, 00...
 
[+]

Entropy:
7.9348  (probably packed)

Code size:
284 KB (290,816 bytes)

The file bejeweledsetup.exe has been seen being distributed by the following 7 URLs.

http://gsf-cf.softonic.com/615/7ea/.../file?SD_used=0&channel=WEB&fdh=no&id_file=16680&instance=softonic_br&type=PROGRAM&Expires=1478734944&Signature=bVrwAatirUGoiRr1P0~ldRZNfeafEkcqsmoAS7cu7mKV33iVMzcEEGeJjqa0PVhr5LiJizQ9fvq~zcI3FEXOu0ysgJbCjcDeiBtHoqyGHlIPQySf9cUzROmypDRyq2poxvVYVJDxU-NLBwl6qC2jszAqYMNIe5jR16snku1BZSA_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=Bejeweled1.exe

http://gsf-cf.softonic.com/615/7ea/.../file?SD_used=0&channel=WEB&fdh=no&id_file=16680&instance=softonic_es&type=PROGRAM&Expires=1475903201&Signature=d72YfzwCmoO2wdCJWIfQRrWXl-K1Mh6nudEGCd0K03Ir2RllpoeoCKNvfqWG65R-K324IO3cKAThZquCUBNQmUmOETopdiVNhLk6n6u~g86bAN7iz-koXBqBHBFpj7yMpBOJUJcu5tuwKGCVBZIDhRMavCFK6dRWgHO9cjsAbDc_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=Bejeweled1.exe

http://bejeweled.softonic.com/download-tracker?th=8yS3 KGEYLiw7GKMHzA/trmsvRChbxdrflJq3ZIylWsbyEqTBuiSORFslBr3P2PC02ZpQ8LL1Kx 6kvUv45eq1pLnuGGSZHtvukQ/fskSaYZCWpZQzuRMIaghpQGKKI9dhs/FCAAGH1O NNt52UVoQ61ZRIkvHzuoEcS11 B5/rYxTHJChnUO8s/.../GVG74t8YfMiwtNVrEwl847PedhfWQ x0hXv3Gaq30UjJw==

http://downloads.popcap.com/www/.../BejeweledSetup.exe

http://bejeweled1.softonic.com.br/download-tracker?th=1/6CH9aeXedl4L8u BHNJXWTW LP1LFlnGQpxqjlxAMApKuP Bh5RrZwn8iBjtR6QyCw9tmEjcXYZD5Rmw0ZPIFLmshwdjQFSMaBY7oDyZ5ANkKVXLeGmINvjh4wkSkLJ6G46oZZbzJy4yC8 gsH3Hrc0HkmuudySVot/H17ufjXrWn0sapHbJzOMkCZP/IQysPlBLflAy/lburnqGyyJfQBfnIcmi0/.../Dzu82NOg==

http://downloads.popcap.com/download/bejeweled/pc/.../latest

about:internet

Scan bejeweledsetup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.