Static task
static1
Behavioral task
behavioral1
Sample
1664-54-0x0000000000110000-0x0000000000147000-memory.dll
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
1664-54-0x0000000000110000-0x0000000000147000-memory.dll
Resource
win10v2004-20220414-en
General
-
Target
1664-54-0x0000000000110000-0x0000000000147000-memory.dmp
-
Size
220KB
-
MD5
fd272df98fe2ceec7a0d5d761572d7dc
-
SHA1
84c0d9faa87b3773a6d835257b09914b180e7a9b
-
SHA256
725bef1d64e9cc823c94255323b5c9461929aec4721ca87de5ec8626ff7e112d
-
SHA512
9261f3ea8d48eacd0de2128a9ab3346e7442b956b67b30ab623fbd990aca0a28cfb5adb67c1547763fdecc26248dff289903665210c696f22e0bdf57e650a155
-
SSDEEP
96:M8/vIkXIuabLwKgKGUzOVCWoUAxcbL2Rds65xBQrSAhSy:TgkPabMLUzG3bSRC6byrS8S
Malware Config
Extracted
icedid
3671205527
blackferrow.com
orangegrande.com
-
auth_var
1
-
url_path
/news/
Signatures
-
Icedid family
Files
-
1664-54-0x0000000000110000-0x0000000000147000-memory.dmp.dll windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 624B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 96B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ