Copy of Feud-PyrSoftware[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

Copy of Feud-PyrSoftware.zip
Size

18.1MB
MD5

a88ba92c69fb14377fa09a7585ae0575
SHA1

bc4d80e311e93828515895c74a86e29c27dadba0
SHA256

28b17803d85478ac7d444721a83abd8d8ede80add21e9b225ad9e4b9096d5e99
SHA512

623c3093240dbfa8ade38e780b782013848742f8a71bb9427ad344fc794910875774cf7461acab98ba41f92dfc4ae47f5f28c66b081f7d6f8dcf22dbe5c83f95
SSDEEP

393216:4ZUT5TR42ShVnRVpdOMN9xIpS+/4TddErpNwu95mTuIHkj9W:/N62mjOk9xm3/4JMnhaAZW

Score

3^/10

Malware Config

Signatures

Unsigned PE 6 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Family Feud Challenge/ffch10/FFChallenge 1.0a.exe
unpack001/Family Feud Challenge/ffch10/Family Feud Assistant 2.0.exe
unpack001/Family Feud/Family Feud 4.0.exe
unpack001/Family Feud/Family Feud Assistant.exe
unpack001/The $100,000 Pyramid/Pyramid Clue Editor v4.exe
unpack001/The $100,000 Pyramid/Pyramid RC3.exe

Files

Copy of Feud-PyrSoftware.zip
.zip

Password: infected
Family Feud Challenge/ffch10/FFChallenge 1.0a.exe
.exe windows:4 windows x86 arch:x86

Password: infected

1f54a79e6dfab96202140f8e5fc197f8

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wsock32

htonl
gethostbyname
htons
WSACleanup
WSAStartup
ioctlsocket
setsockopt

ole32

CoInitialize
CoUninitialize
CoCreateInstance
CoFreeUnusedLibraries
CoTaskMemAlloc
CoTaskMemFree

oleaut32

SysFreeString

kernel32

MultiByteToWideChar
lstrlenA
WideCharToMultiByte
GlobalLock
GlobalUnlock
SetFilePointer
ExitProcess
GetModuleHandleA
GetCommandLineA
GetProcessTimes
SetEndOfFile
CopyFileA
SetThreadPriority
CreateThread
ExitThread
InterlockedIncrement
InterlockedDecrement
ResetEvent
WaitForMultipleObjects
GetCurrentThreadId
GetThreadPriority
GetCurrentThread
Sleep
GetModuleFileNameA
WaitForSingleObject
GetTickCount
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
ReleaseMutex
CreateMutexA
SetErrorMode
LoadLibraryA
GetProcAddress
FindClose
FindNextFileA
FindFirstFileA
GetFileSize
WriteFile
ReadFile
CreateFileA
CreateDirectoryA
RemoveDirectoryA
MoveFileA
DeleteFileA
GetFileAttributesA
SystemTimeToFileTime
GetSystemTime
GetTimeZoneInformation
GetUserDefaultLangID
GetLastError
GetStartupInfoA
CreateProcessA
CloseHandle
QueryPerformanceCounter
QueryPerformanceFrequency
IsDBCSLeadByte
GetACP
GetCPInfo
GetVersionExA
GlobalFree
GlobalAlloc
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetEvent
GetCurrentProcess
FreeLibrary
CreateEventA

user32

DestroyWindow
SetClipboardData
EmptyClipboard
SetWindowPos
GetWindowRect
GetWindow
UnregisterClassA
DispatchMessageA
TranslateMessage
TranslateAcceleratorA
GetMessageA
LoadAcceleratorsA
RegisterClassA
LoadIconA
UpdateWindow
ShowWindow
PostQuitMessage
DialogBoxParamA
EndDialog
MoveWindow
GetDesktopWindow
SetDlgItemTextA
EnableWindow
GetDlgItemTextA
GetWindowTextLengthA
GetDlgItem
SetMenu
PostThreadMessageA
GetQueueStatus
PeekMessageA
MsgWaitForMultipleObjects
RegisterWindowMessageA
IsClipboardFormatAvailable
GetClipboardData
CloseClipboard
GetWindowLongA
DefWindowProcA
IsWindow
CreateWindowExA
OpenClipboard
GetMenu
BeginPaint
EndPaint
LoadCursorA
SetCursor
KillTimer
SetTimer
PostMessageA
FillRect
GetSubMenu
ReleaseCapture
GetCapture
LoadMenuA
GetMenuItemID
DeleteMenu
ClientToScreen
TrackPopupMenu
SetCapture
GetCursorPos
ScreenToClient
GetClientRect
LoadStringA
EnableMenuItem
CheckMenuItem
InvalidateRect
SetWindowLongA
WaitForInputIdle
MapVirtualKeyA
GetKeyState
MessageBoxA
GetSystemMetrics
DdeInitializeA
DdeCreateStringHandleA
DdeConnect
DdeClientTransaction
DdeDisconnect
DdeFreeStringHandle
DdeUninitialize
GetDC
ReleaseDC
GetDoubleClickTime
SetFocus
DestroyMenu
WindowFromPoint
GetFocus

gdi32

StartDocA
GetClipBox
CreateSolidBrush
BeginPath
FillPath
ExtCreatePen
StrokePath
EndPath
PolyBezierTo
SelectClipPath
RestoreDC
SaveDC
EndPage
StartPage
GdiFlush
DeleteObject
SelectObject
StretchDIBits
SetDIBitsToDevice
CreateCompatibleBitmap
GetObjectA
DeleteDC
CreateDIBSection
GetDeviceCaps
CreateCompatibleDC
BitBlt
RealizePalette
SelectPalette
MoveToEx
LineTo
EnumFontFamiliesA
SetBkMode
LPtoDP
SetTextAlign
IntersectClipRect
SelectClipRgn
ExtTextOutA
ExtTextOutW
SetTextColor
GetTextMetricsA
CreateFontIndirectA
CreatePen
GetClipRgn
CreateRectRgn
GetTextAlign
GetBkMode
GetTextColor
DPtoLP
GetTextExtentPoint32A
GetTextExtentPoint32W
GetCurrentObject
SetBkColor
GetBkColor
CreatePalette
SetPolyFillMode
EndDoc
GetSystemPaletteEntries

comdlg32

GetOpenFileNameA
GetSaveFileNameA
PrintDlgA

advapi32

RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegSetValueA
RegCreateKeyA
RegSetValueExA

shell32

DragQueryFileA
DragAcceptFiles

winmm

timeGetDevCaps
waveInGetDevCapsA
waveInReset
waveInUnprepareHeader
waveInClose
waveInOpen
waveInPrepareHeader
waveInStop
waveInAddBuffer
waveInStart
waveInGetNumDevs
timeBeginPeriod
waveOutGetNumDevs
waveOutReset
waveOutUnprepareHeader
waveOutPrepareHeader
waveOutWrite
timeSetEvent
timeGetTime
timeEndPeriod
waveOutOpen
waveOutGetDevCapsA
timeKillEvent
waveOutClose

Sections

.text
Size: 644KB - Virtual size: 642KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 48KB - Virtual size: 826KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data1
Size: 4KB - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 4KB - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 88KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Family Feud Challenge/ffch10/Family Feud Assistant 2.0.exe
.exe windows:4 windows x86 arch:x86

Password: infected

28a9fbb9e56d9fe0d5d915b02f78430b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

__vbaStrI2
_CIcos
_adj_fptan
__vbaStrI4
__vbaFreeVar
__vbaStrVarMove
__vbaLenBstr
__vbaFreeVarList
_adj_fdiv_m64
__vbaFreeObjList
ord516
_adj_fprem1
__vbaStrCat
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
__vbaExitProc
__vbaOnError
ord595
__vbaObjSet
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
ord522
_CIsin
ord524
ord632
__vbaChkstk
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaStrCmp
__vbaAryConstruct2
__vbaI2I4
DllFunctionCall
_adj_fpatan
EVENT_SINK_Release
ord600
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
__vbaStrToUnicode
__vbaPrintFile
ord606
_adj_fprem
_adj_fdivr_m64
__vbaFPException
__vbaStrVarVal
ord645
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaInStr
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
ord573
__vbaStrCopy
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord100
__vbaVarAdd
__vbaStrToAnsi
__vbaVarDup
ord617
_CIatan
__vbaStrMove
ord650
_allmul
_CItan
_CIexp
__vbaFreeStr
__vbaFreeObj

Sections

.text
Size: 368KB - Virtual size: 364KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Family Feud Challenge/ffch10/Family Feud Presentation Software Instructions.doc
.doc windows office2003
Family Feud Challenge/ffch10/Feud Rules.doc
.doc windows office2003
Family Feud Challenge/ffch10/Q1.txt
Family Feud Challenge/ffch10/Q2.txt
Family Feud Challenge/ffch10/Q3.txt
Family Feud Challenge/ffch10/Q4.txt
Family Feud Challenge/ffch10/Q5.txt
Family Feud Challenge/ffch10/Q6.txt
Family Feud Challenge/ffch10/Q7.txt
Family Feud Challenge/ffch10/be_game.txt
Family Feud Challenge/ffch10/fmoney.txt
Family Feud/Family Feud 4.0.exe
.exe windows:4 windows x86 arch:x86

Password: infected

1f54a79e6dfab96202140f8e5fc197f8

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wsock32

htonl
gethostbyname
htons
WSACleanup
WSAStartup
ioctlsocket
setsockopt

ole32

CoInitialize
CoUninitialize
CoCreateInstance
CoFreeUnusedLibraries
CoTaskMemAlloc
CoTaskMemFree

oleaut32

SysFreeString

kernel32

MultiByteToWideChar
lstrlenA
WideCharToMultiByte
GlobalLock
GlobalUnlock
SetFilePointer
ExitProcess
GetModuleHandleA
GetCommandLineA
GetProcessTimes
SetEndOfFile
CopyFileA
SetThreadPriority
CreateThread
ExitThread
InterlockedIncrement
InterlockedDecrement
ResetEvent
WaitForMultipleObjects
GetCurrentThreadId
GetThreadPriority
GetCurrentThread
Sleep
GetModuleFileNameA
WaitForSingleObject
GetTickCount
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
ReleaseMutex
CreateMutexA
SetErrorMode
LoadLibraryA
GetProcAddress
FindClose
FindNextFileA
FindFirstFileA
GetFileSize
WriteFile
ReadFile
CreateFileA
CreateDirectoryA
RemoveDirectoryA
MoveFileA
DeleteFileA
GetFileAttributesA
SystemTimeToFileTime
GetSystemTime
GetTimeZoneInformation
GetUserDefaultLangID
GetLastError
GetStartupInfoA
CreateProcessA
CloseHandle
QueryPerformanceCounter
QueryPerformanceFrequency
IsDBCSLeadByte
GetACP
GetCPInfo
GetVersionExA
GlobalFree
GlobalAlloc
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetEvent
GetCurrentProcess
FreeLibrary
CreateEventA

user32

DestroyWindow
SetClipboardData
EmptyClipboard
SetWindowPos
GetWindowRect
GetWindow
UnregisterClassA
DispatchMessageA
TranslateMessage
TranslateAcceleratorA
GetMessageA
LoadAcceleratorsA
RegisterClassA
LoadIconA
UpdateWindow
ShowWindow
PostQuitMessage
DialogBoxParamA
EndDialog
MoveWindow
GetDesktopWindow
SetDlgItemTextA
EnableWindow
GetDlgItemTextA
GetWindowTextLengthA
GetDlgItem
SetMenu
PostThreadMessageA
GetQueueStatus
PeekMessageA
MsgWaitForMultipleObjects
RegisterWindowMessageA
IsClipboardFormatAvailable
GetClipboardData
CloseClipboard
GetWindowLongA
DefWindowProcA
IsWindow
CreateWindowExA
OpenClipboard
GetMenu
BeginPaint
EndPaint
LoadCursorA
SetCursor
KillTimer
SetTimer
PostMessageA
FillRect
GetSubMenu
ReleaseCapture
GetCapture
LoadMenuA
GetMenuItemID
DeleteMenu
ClientToScreen
TrackPopupMenu
SetCapture
GetCursorPos
ScreenToClient
GetClientRect
LoadStringA
EnableMenuItem
CheckMenuItem
InvalidateRect
SetWindowLongA
WaitForInputIdle
MapVirtualKeyA
GetKeyState
MessageBoxA
GetSystemMetrics
DdeInitializeA
DdeCreateStringHandleA
DdeConnect
DdeClientTransaction
DdeDisconnect
DdeFreeStringHandle
DdeUninitialize
GetDC
ReleaseDC
GetDoubleClickTime
SetFocus
DestroyMenu
WindowFromPoint
GetFocus

gdi32

StartDocA
GetClipBox
CreateSolidBrush
BeginPath
FillPath
ExtCreatePen
StrokePath
EndPath
PolyBezierTo
SelectClipPath
RestoreDC
SaveDC
EndPage
StartPage
GdiFlush
DeleteObject
SelectObject
StretchDIBits
SetDIBitsToDevice
CreateCompatibleBitmap
GetObjectA
DeleteDC
CreateDIBSection
GetDeviceCaps
CreateCompatibleDC
BitBlt
RealizePalette
SelectPalette
MoveToEx
LineTo
EnumFontFamiliesA
SetBkMode
LPtoDP
SetTextAlign
IntersectClipRect
SelectClipRgn
ExtTextOutA
ExtTextOutW
SetTextColor
GetTextMetricsA
CreateFontIndirectA
CreatePen
GetClipRgn
CreateRectRgn
GetTextAlign
GetBkMode
GetTextColor
DPtoLP
GetTextExtentPoint32A
GetTextExtentPoint32W
GetCurrentObject
SetBkColor
GetBkColor
CreatePalette
SetPolyFillMode
EndDoc
GetSystemPaletteEntries

comdlg32

GetOpenFileNameA
GetSaveFileNameA
PrintDlgA

advapi32

RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegSetValueA
RegCreateKeyA
RegSetValueExA

shell32

DragQueryFileA
DragAcceptFiles

winmm

timeGetDevCaps
waveInGetDevCapsA
waveInReset
waveInUnprepareHeader
waveInClose
waveInOpen
waveInPrepareHeader
waveInStop
waveInAddBuffer
waveInStart
waveInGetNumDevs
timeBeginPeriod
waveOutGetNumDevs
waveOutReset
waveOutUnprepareHeader
waveOutPrepareHeader
waveOutWrite
timeSetEvent
timeGetTime
timeEndPeriod
waveOutOpen
waveOutGetDevCapsA
timeKillEvent
waveOutClose

Sections

.text
Size: 644KB - Virtual size: 642KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 48KB - Virtual size: 826KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data1
Size: 4KB - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 4KB - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 88KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Family Feud/Family Feud Assistant.exe
.exe windows:4 windows x86 arch:x86

Password: infected

e06cf301c7ee8771c10f7125b1e201f6

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

__vbaStrI2
_CIcos
_adj_fptan
__vbaFreeVar
__vbaStrVarMove
__vbaLenBstr
__vbaFreeVarList
_adj_fdiv_m64
__vbaFreeObjList
_adj_fprem1
__vbaStrCat
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
__vbaObjSet
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
ord522
_CIsin
ord524
ord632
__vbaChkstk
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaStrCmp
__vbaAryConstruct2
__vbaI2I4
_adj_fpatan
EVENT_SINK_Release
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
_adj_fprem
_adj_fdivr_m64
__vbaFPException
_CIlog
__vbaErrorOverflow
__vbaInStr
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord100
_CIatan
__vbaStrMove
_allmul
_CItan
_CIexp
__vbaFreeObj
__vbaFreeStr

Sections

.text
Size: 60KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Family Feud/Family Feud Presentation Software Instructions.doc
.doc windows office2003
Family Feud/FamilyFeud/BAN.CUT
Family Feud/FamilyFeud/BOARD.CUT
Family Feud/FamilyFeud/BROF.CUT
Family Feud/FamilyFeud/CHAMP.CUT
Family Feud/FamilyFeud/DADF.CUT
Family Feud/FamilyFeud/F1.CUT
Family Feud/FamilyFeud/F2.CUT
Family Feud/FamilyFeud/FQ1.FF
Family Feud/FamilyFeud/FQ10.FF
Family Feud/FamilyFeud/FQ11.FF
Family Feud/FamilyFeud/FQ12.FF
Family Feud/FamilyFeud/FQ13.FF
Family Feud/FamilyFeud/FQ14.FF
Family Feud/FamilyFeud/FQ15.FF
Family Feud/FamilyFeud/FQ16.FF
Family Feud/FamilyFeud/FQ17.FF
Family Feud/FamilyFeud/FQ18.FF
Family Feud/FamilyFeud/FQ19.FF
Family Feud/FamilyFeud/FQ2.FF
Family Feud/FamilyFeud/FQ20.FF
Family Feud/FamilyFeud/FQ21.FF
Family Feud/FamilyFeud/FQ22.FF
Family Feud/FamilyFeud/FQ23.FF
Family Feud/FamilyFeud/FQ24.FF
Family Feud/FamilyFeud/FQ25.FF
Family Feud/FamilyFeud/FQ26.FF
Family Feud/FamilyFeud/FQ27.FF
Family Feud/FamilyFeud/FQ28.FF
Family Feud/FamilyFeud/FQ29.FF
Family Feud/FamilyFeud/FQ3.FF
Family Feud/FamilyFeud/FQ30.FF
Family Feud/FamilyFeud/FQ4.FF
Family Feud/FamilyFeud/FQ5.FF
Family Feud/FamilyFeud/FQ6.FF
Family Feud/FamilyFeud/FQ7.FF
Family Feud/FamilyFeud/FQ8.FF
Family Feud/FamilyFeud/FQ9.FF
Family Feud/FamilyFeud/LOGO.CUT
Family Feud/FamilyFeud/MENU.EXE
Family Feud/FamilyFeud/MICPRINT.ESI
Family Feud/FamilyFeud/MOMF.CUT
Family Feud/FamilyFeud/MONO.ESI
Family Feud/FamilyFeud/MONOX.CUT
Family Feud/FamilyFeud/QS1.FF
Family Feud/FamilyFeud/QS10.FF
Family Feud/FamilyFeud/QS11.FF
Family Feud/FamilyFeud/QS12.FF
Family Feud/FamilyFeud/QS13.FF
Family Feud/FamilyFeud/QS14.FF
Family Feud/FamilyFeud/QS15.FF
Family Feud/FamilyFeud/QS16.FF
Family Feud/FamilyFeud/QS17.FF
Family Feud/FamilyFeud/QS18.FF
Family Feud/FamilyFeud/QS19.FF
Family Feud/FamilyFeud/QS2.FF
Family Feud/FamilyFeud/QS20.FF
Family Feud/FamilyFeud/QS21.FF
Family Feud/FamilyFeud/QS22.FF
Family Feud/FamilyFeud/QS23.FF
Family Feud/FamilyFeud/QS24.FF
Family Feud/FamilyFeud/QS25.FF
Family Feud/FamilyFeud/QS26.FF
Family Feud/FamilyFeud/QS27.FF
Family Feud/FamilyFeud/QS28.FF
Family Feud/FamilyFeud/QS29.FF
Family Feud/FamilyFeud/QS3.FF
Family Feud/FamilyFeud/QS30.FF
Family Feud/FamilyFeud/QS31.FF
Family Feud/FamilyFeud/QS32.FF
Family Feud/FamilyFeud/QS33.FF
Family Feud/FamilyFeud/QS34.FF
Family Feud/FamilyFeud/QS35.FF
Family Feud/FamilyFeud/QS36.FF
Family Feud/FamilyFeud/QS37.FF
Family Feud/FamilyFeud/QS38.FF
Family Feud/FamilyFeud/QS39.FF
Family Feud/FamilyFeud/QS4.FF
Family Feud/FamilyFeud/QS40.FF
Family Feud/FamilyFeud/QS41.FF
Family Feud/FamilyFeud/QS42.FF
Family Feud/FamilyFeud/QS43.FF
Family Feud/FamilyFeud/QS44.FF
Family Feud/FamilyFeud/QS45.FF
Family Feud/FamilyFeud/QS46.FF
Family Feud/FamilyFeud/QS5.FF
Family Feud/FamilyFeud/QS6.FF
Family Feud/FamilyFeud/QS7.FF
Family Feud/FamilyFeud/QS8.FF
Family Feud/FamilyFeud/QS9.FF
Family Feud/FamilyFeud/SISF.CUT
Family Feud/Feud Rules.doc
.doc windows office2003
Family Feud/Q1.txt
Family Feud/Q2.txt
Family Feud/Q3.txt
Family Feud/Q4.txt
Family Feud/Q5.txt
Family Feud/Q6.txt
Family Feud/Q7.txt
Family Feud/Q8.txt
Family Feud/Q9.txt
Family Feud/fmoney.txt
The $100,000 Pyramid/Pyramid Clue Editor v4.exe
.exe windows:4 windows x86 arch:x86

Password: infected

d5b067dce9ace07d04a02118738c6c91

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

__vbaVarSub
_CIcos
_adj_fptan
__vbaVarMove
__vbaFreeVar
__vbaStrVarMove
__vbaLenBstr
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
ord621
__vbaFreeObjList
ord516
_adj_fprem1
__vbaStrCat
ord660
__vbaHresultCheckObj
__vbaLenVar
_adj_fdiv_m32
__vbaVarForInit
__vbaExitProc
ord595
__vbaObjSet
__vbaOnError
_adj_fdiv_m16i
_adj_fdivr_m16i
ord599
ord520
__vbaVarTstLt
_CIsin
ord632
__vbaChkstk
__vbaFileClose
EVENT_SINK_AddRef
ord528
__vbaStrCmp
__vbaVarTstEq
__vbaI2I4
_adj_fpatan
EVENT_SINK_Release
_CIsqrt
EVENT_SINK_QueryInterface
__vbaVarMul
__vbaExceptHandler
__vbaPrintFile
_adj_fprem
_adj_fdivr_m64
ord607
ord608
__vbaFPException
__vbaInStrVar
__vbaStrVarVal
__vbaVarCat
__vbaI2Var
ord645
_CIlog
__vbaErrorOverflow
__vbaFileOpen
ord648
ord570
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
ord573
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord100
__vbaI4Var
__vbaVarAdd
__vbaVarDup
__vbaFpI2
__vbaFpI4
__vbaVarLateMemCallLd
_CIatan
__vbaStrMove
ord619
_allmul
_CItan
__vbaVarForNext
_CIexp
__vbaFreeStr
__vbaFreeObj
ord581

Sections

.text
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
The $100,000 Pyramid/Pyramid RC3.exe
.exe windows:4 windows x86 arch:x86

Password: infected

92cb5318d32dad0de9dc4601aacd5375

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wsock32

setsockopt
WSAStartup
WSACleanup
htons
htonl
gethostbyname
ioctlsocket

ole32

CoUninitialize
CoFreeUnusedLibraries
CoTaskMemAlloc
CoTaskMemFree
CoInitialize
CoCreateInstance

oleaut32

SysFreeString

wininet

InternetOpenA
InternetConnectA
HttpOpenRequestA
HttpSendRequestA
InternetReadFile
InternetCloseHandle

kernel32

FindClose
GetSystemDirectoryA
CreateMutexA
ReleaseMutex
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GetTickCount
WaitForSingleObject
WideCharToMultiByte
GetModuleFileNameA
FindNextFileA
CreateThread
ExitThread
GlobalUnlock
GlobalLock
IsDBCSLeadByteEx
lstrlenA
SetEndOfFile
CopyFileA
ExitProcess
GetModuleHandleA
GetCommandLineA
GetProcessTimes
GetCurrentProcess
SetThreadPriority
CreateEventA
SetEvent
InterlockedIncrement
InterlockedDecrement
ResetEvent
WaitForMultipleObjects
GetThreadPriority
GetCurrentThread
FindFirstFileA
GetFileSize
SetFilePointer
GetTempPathA
GetTempFileNameA
WriteFile
ReadFile
CreateFileA
CreateDirectoryA
RemoveDirectoryA
MoveFileA
DeleteFileA
GetFileAttributesA
SystemTimeToFileTime
GetSystemTime
LeaveCriticalSection
GetTimeZoneInformation
GetSystemDefaultLangID
FreeLibrary
GetUserDefaultLangID
GetLastError
GetStartupInfoA
CreateProcessA
CloseHandle
GetCurrentThreadId
SetErrorMode
LoadLibraryA
GetProcAddress
QueryPerformanceCounter
QueryPerformanceFrequency
IsDBCSLeadByte
GetACP
GetCPInfo
MultiByteToWideChar
GetVersionExA
GlobalFree
GlobalAlloc
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
Sleep

user32

EndPaint
BeginPaint
GetMenu
DestroyWindow
GetFocus
CreateWindowExA
IsWindow
DefWindowProcA
GetWindowLongA
CloseClipboard
GetClipboardData
IsClipboardFormatAvailable
OpenClipboard
SetClipboardData
EmptyClipboard
SetWindowPos
GetWindowRect
GetWindow
UnregisterClassA
DispatchMessageA
TranslateMessage
TranslateAcceleratorA
GetMessageA
LoadAcceleratorsA
RegisterClassA
LoadIconA
UpdateWindow
ShowWindow
PostQuitMessage
DialogBoxParamA
EndDialog
MoveWindow
GetDesktopWindow
SetDlgItemTextA
EnableWindow
GetDlgItemTextA
GetWindowTextLengthA
GetDlgItem
SetMenu
PostThreadMessageA
GetQueueStatus
PeekMessageA
MsgWaitForMultipleObjects
RegisterWindowMessageA
LoadCursorA
SetCursor
KillTimer
SetTimer
FillRect
GetSubMenu
ReleaseCapture
SystemParametersInfoA
ScreenToClient
LoadMenuA
GetMenuItemID
DeleteMenu
ClientToScreen
TrackPopupMenu
DestroyMenu
SetFocus
SetCapture
GetCapture
GetCursorPos
WindowFromPoint
GetClientRect
LoadStringA
EnableMenuItem
CheckMenuItem
InvalidateRect
SetWindowLongA
WaitForInputIdle
MapVirtualKeyA
GetKeyState
GetMenuItemCount
GetMenuItemInfoA
InsertMenuItemA
GetSystemMetrics
DdeInitializeA
DdeCreateStringHandleA
DdeConnect
DdeClientTransaction
DdeDisconnect
DdeFreeStringHandle
DdeUninitialize
GetKeyboardLayout
GetDC
ReleaseDC
GetDoubleClickTime
MessageBoxA
PostMessageA

gdi32

StartPage
GetCurrentObject
SelectClipPath
FillPath
ExtCreatePen
StrokePath
EndDoc
EndPath
SetBkColor
StartDocA
LPtoDP
GetClipBox
CreateSolidBrush
GetSystemPaletteEntries
CreatePalette
GetBkColor
PolyBezierTo
LineTo
MoveToEx
SetPolyFillMode
BeginPath
RestoreDC
SaveDC
GdiFlush
DeleteObject
SelectObject
StretchDIBits
SetDIBitsToDevice
CreateCompatibleBitmap
GetObjectA
DeleteDC
CreateDIBSection
GetDeviceCaps
CreateCompatibleDC
BitBlt
RealizePalette
SelectPalette
EnumFontFamiliesA
SetBkMode
SetTextAlign
IntersectClipRect
SelectClipRgn
ExtTextOutA
ExtTextOutW
SetTextColor
GetTextMetricsA
CreateFontIndirectA
CreatePen
GetClipRgn
CreateRectRgn
GetTextAlign
GetBkMode
GetTextColor
DPtoLP
GetTextExtentPoint32A
GetTextExtentPoint32W
EndPage

comdlg32

GetOpenFileNameA
GetSaveFileNameA
PrintDlgA

advapi32

RegCreateKeyA
RegQueryValueExA
RegOpenKeyExA
RegSetValueA
RegCloseKey
RegSetValueExA

shell32

DragQueryFileA
DragAcceptFiles

winmm

waveOutReset
waveOutWrite
waveOutPrepareHeader
waveInGetDevCapsA
waveOutGetNumDevs
waveOutUnprepareHeader
waveOutClose
waveOutOpen
waveOutGetDevCapsA
waveInGetNumDevs
waveInStart
waveInAddBuffer
waveInStop
waveInPrepareHeader
waveInOpen
waveInClose
waveInUnprepareHeader
waveInReset
timeGetTime
timeEndPeriod
timeBeginPeriod
timeGetDevCaps
timeSetEvent
timeKillEvent

Sections

.text
Size: 768KB - Virtual size: 766KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 52KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 52KB - Virtual size: 829KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data1
Size: 4KB - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 4KB - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
The $100,000 Pyramid/Pyrmid Instructions.doc
.doc windows office2003
The $100,000 Pyramid/Sample Categories.doc
.doc windows office2003
The $100,000 Pyramid/game1/assoc.txt
The $100,000 Pyramid/game1/bonus.txt
The $100,000 Pyramid/game1/categories.txt
The $100,000 Pyramid/game1/category1.txt
The $100,000 Pyramid/game1/category2.txt
The $100,000 Pyramid/game1/category3.txt
The $100,000 Pyramid/game1/category4.txt
The $100,000 Pyramid/game1/category5.txt
The $100,000 Pyramid/game1/category6.txt
The $100,000 Pyramid/game1/tie1.txt
The $100,000 Pyramid/game1/tie2.txt
The $100,000 Pyramid/game2/bonus.txt
The $100,000 Pyramid/game2/categories.txt
The $100,000 Pyramid/game2/category1.txt
The $100,000 Pyramid/game2/category2.txt
The $100,000 Pyramid/game2/category3.txt
The $100,000 Pyramid/game2/category4.txt
The $100,000 Pyramid/game2/category5.txt
The $100,000 Pyramid/game2/category6.txt
The $100,000 Pyramid/game2/tie1.txt
The $100,000 Pyramid/game2/tie2.txt
The $100,000 Pyramid/tie1.txt
The $100,000 Pyramid/tie2.txt

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

1f54a79e6dfab96202140f8e5fc197f8

Headers

File Characteristics

Imports

wsock32

ole32

oleaut32

kernel32

user32

gdi32

comdlg32

advapi32

shell32

winmm

Sections

.text Size: 644KB - Virtual size: 642KB

.rdata Size: 48KB - Virtual size: 47KB

.data Size: 48KB - Virtual size: 826KB

.data1 Size: 4KB - Virtual size: 912B

.CRT Size: 4KB - Virtual size: 4B

.rsrc Size: 88KB - Virtual size: 85KB

Password: infected

28a9fbb9e56d9fe0d5d915b02f78430b

Headers

File Characteristics

Imports

msvbvm60

Sections

.text Size: 368KB - Virtual size: 364KB

.data Size: 4KB - Virtual size: 15KB

.rsrc Size: 12KB - Virtual size: 11KB

Password: infected

1f54a79e6dfab96202140f8e5fc197f8

Headers

File Characteristics

Imports

wsock32

ole32

oleaut32

kernel32

user32

gdi32

comdlg32

advapi32

shell32

winmm

Sections

.text Size: 644KB - Virtual size: 642KB

.rdata Size: 48KB - Virtual size: 47KB

.data Size: 48KB - Virtual size: 826KB

.data1 Size: 4KB - Virtual size: 912B

.CRT Size: 4KB - Virtual size: 4B

.rsrc Size: 88KB - Virtual size: 85KB

Password: infected

e06cf301c7ee8771c10f7125b1e201f6

Headers

File Characteristics

Imports

msvbvm60

Sections

.text Size: 60KB - Virtual size: 57KB

.data Size: 4KB - Virtual size: 6KB

.rsrc Size: 4KB - Virtual size: 2KB

Password: infected

d5b067dce9ace07d04a02118738c6c91

Headers

File Characteristics

Imports

msvbvm60

Sections

.text Size: 52KB - Virtual size: 51KB

.data Size: 4KB - Virtual size: 2KB

.rsrc Size: 4KB - Virtual size: 2KB

.text
Size: 644KB - Virtual size: 642KB

.rdata
Size: 48KB - Virtual size: 47KB

.data
Size: 48KB - Virtual size: 826KB

.data1
Size: 4KB - Virtual size: 912B

.CRT
Size: 4KB - Virtual size: 4B

.rsrc
Size: 88KB - Virtual size: 85KB

.text
Size: 368KB - Virtual size: 364KB

.data
Size: 4KB - Virtual size: 15KB

.rsrc
Size: 12KB - Virtual size: 11KB

.text
Size: 644KB - Virtual size: 642KB

.rdata
Size: 48KB - Virtual size: 47KB

.data
Size: 48KB - Virtual size: 826KB

.data1
Size: 4KB - Virtual size: 912B

.CRT
Size: 4KB - Virtual size: 4B

.rsrc
Size: 88KB - Virtual size: 85KB

.text
Size: 60KB - Virtual size: 57KB

.data
Size: 4KB - Virtual size: 6KB

.rsrc
Size: 4KB - Virtual size: 2KB

.text
Size: 52KB - Virtual size: 51KB

.data
Size: 4KB - Virtual size: 2KB

.rsrc
Size: 4KB - Virtual size: 2KB

.text
Size: 768KB - Virtual size: 766KB

.rdata
Size: 52KB - Virtual size: 49KB

.data
Size: 52KB - Virtual size: 829KB

.data1
Size: 4KB - Virtual size: 960B

.CRT
Size: 4KB - Virtual size: 4B

.rsrc
Size: 80KB - Virtual size: 79KB