plants-vs-zombies-2-4.6.2.exe

Cagolig

Destiny Dream S.A.

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application plants-vs-zombies-2-4.6.2.exe, “Cagolig Setup ” by Destiny Dream S.A has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. It is also typically executed from the user's temporary directory. The file has been seen being downloaded from www.todaytowerschuckle.com and multiple other hosts.
Publisher:
Huful   (signed by Destiny Dream S.A.)

Product:
Cagolig

Description:
Cagolig Setup

Version:
3.6.3.0

MD5:
de0d8ffeb4af9979c79768a053cd16a5

SHA-1:
c8b4345d5b2a6362f48d0b2b726ac907802fa951

SHA-256:
b054980cdb9d84a85db9091605f59a8598a1426e8598d433157c941bcca2c33f

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
12/25/2024 12:00:16 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore.DestinyD.Installer (M)
16.4.10.13

File size:
989.7 KB (1,013,448 bytes)

Product version:
2.0

Copyright:
program

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\plants-vs-zombies-2-4.6.2.exe

Digital Signature
Authority:
GlobalSign nv-sa

Valid from:
12/17/2015 7:55:11 PM

Valid to:
10/2/2016 8:36:18 PM

Subject:
CN=Destiny Dream S.A., O=Destiny Dream S.A., L=Clarens, S=Vaud, C=CH

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
11217A75EB912AE2167326222C18D9E2357F

File PE Metadata
Compilation timestamp:
6/20/1992 5:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:Do9v/Sb8ISdMPNf/kLkfz8HF2+7jDBVCyP39KvlDVJx:D6SkaPNXkQfziF2sjL8l/x

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.9262

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file plants-vs-zombies-2-4.6.2.exe has been seen being distributed by the following 47 URLs.

http://www.todaytowerschuckle.com/c?x=H3hDyemCX6Nle65gXcNIcRXurrSQEewEkd2UhhHlqTA=&c=q3dAAENNMWANfn3rABuCUXYOH2MQzd/t159YxyI0q89mFmJIdb/BGOu/ZmIyrfd5y NQVQ uP/xkZpBnSyKe8NqWpGAjNe1AFSomrMon3HrZirB9j9UNshYm/iGLC/vvsXXUcPnsCyCjlvrUTE Llw==&e=0&downloadAs=plants-vs-zombies-2-4.6.2.exe&fallback_url=https://itunes.apple.com/app/.../id597986893?mt=8

http://www.presentgifttours.com/c?x=kgcLHPo1udjd 7J0JcwwM/RQe2T3oIhW lpVKl1Kf/U=&c=EFF7eFan9sfg5PlD GsHWVyBXDWNdQBHOnMZ8SIKEL nH0WkctvODgIxpPM87faZ1c0V0um3N5aWf9vR/Uu0Ujd0PfWz b5Gcc8tbrNFdkiT0puCRN72pqTOXWx2t4JbbePxfEVItUg5pgw/ks8zYg==&e=0&downloadAs=plants-vs-zombies-2-4.6.2.exe&fallback_url=https://itunes.apple.com/app/.../id597986893?mt=8

http://www.sendcurrentfarm.com/WVl6OTRQVTl0VFZvMk1VdGlOek5aWXpjNFdUVjVSRVZMVlVsMlZHWlJXbnAwYXpReVpuUXpaa1JJYVhsV09WRWxNMFFtWXoxalJuTTVjVVJzZDNWTFNUWnBjbFJsSlRKQ01EZHZVakJNZWprNFEwSjRaMHBEVGxOQ1EyY3hSMWRQT1ZFMVpUZDJVbm80V2xoeGFqUjZhVEZPTkV4aU9VSm5ZblJIVkRSc1NHRkNWR3cyVmpaVEpUSkdkMlZyV1VSbk9FUmpKVEpHSlRKQ2JsZzFkVW9sTWtaVGFXeE5WVnBsWWxNNFN6QkJVazkzWVhaaWR6WnVSMmMwVkhOb2RrVlJORGt4ZW05aVVISm1ZVlpUVEdjemRGUmphMHBCSlRORUpUTkVKbVU5TUNaa2IzZHViRzloWkVGelBYQnNZVzUwY3kxMmN5MTZiMjFpYVdWekxUSXROQzQyTGpJdVpYaGxKbVpoYkd4aVlXTnJYM1Z5YkQxb2RIUndjeVV6UVNVeVJpVXlSbWwwZFc1bGN5NWhjSEJzWlM1amIyMGxNa1poY0hBbE1rWndiR0Z1ZEhNdGRuTXVMWHB2YldKcFpYTXRNaVV5Um1sa05UazNPVGcyT0RrekpUTkdiWFFsTTBRNA==

http://www.sendcurrentfarm.com/c?x=RzXLtoxHNhzoCOKOMXcrQt19Ypa5cHSQczdDUKgNdfM=&c=kofOiookYrxpC5yIzlVclfccCmRHEr6QVpUaIN7LmNtFINPiiOGOqL3Gx1dYD 9o e /dH5NWJsw/W/qGHN8CALcxSeb80UcGjND1bFrQ77JtPzl1UJAxYGZMnIJuaz77gX4C8EqGv9bA7eRXy0MeCxDpARMFIPx9l1ALeZQejm1tBO1k6hmipkERfSjbkaC&e=0&downloadAs=plants-vs-zombies-2-4.6.2.exe&fallback_url=https://itunes.apple.com/app/.../id597986893?mt=8

http://www.hostnewbits.com/c?x=60Nk/KO4Bj5RCz 0KpmTvARTGMzPSMhrCvI6 6vmaXU=&c=N9ZUxZIuPNJP18drMO7YmbNpj/wKr002TYX7uQbbwOXAEuTMabXn6 tON5R6IYsoTt90FcqufnFa3utQJ9XSmWs7Xi n4fhURtJTflqjaZPJHX7vEL2/h59DUkZaWOtMCG5E560BQtCkJT7zyP3u9GtMpDtruTtDRQODCAeAuBM=&e=0&downloadAs=plants-vs-zombies-2-4.6.2.exe&fallback_url=https://itunes.apple.com/app/.../id597986893?mt=8

Latest 30 of 47 download URLs

Remove plants-vs-zombies-2-4.6.2.exe - Powered by Reason Core Security