Behavioral task
behavioral1
Sample
140000000.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
140000000.exe
Resource
win10v2004-20230220-en
General
-
Target
140000000.exe
-
Size
13KB
-
MD5
e62d2deda98e1d6f04b4ccb8a80c3979
-
SHA1
d572985cb5d663d2ae584dfce80db6b46ebadc7e
-
SHA256
1cada6c3166a8db10461cc53ac55985d646422a4c69665c2b6952719b4fc4a7f
-
SHA512
f93acceb8fff928c2263e702d5fdf12e1fba38d62e6e6c83eb2ba22ef8dcf07d7575e1aa3cbbc40a77cc650c37bd6d403a4c5d1d673836a3c464f5debd302248
-
SSDEEP
192:7BnU7ThdZzpk4EJmxQQTHGKZFTkUV2U+A5+ZrCi55+mY8xf+rs:7BUn3Zz6mxQNqNVH+A5+ZrCi/fdf+rs
Malware Config
Extracted
icedid
2611621973
aproillionsgif.com
Signatures
-
Icedid family
Files
-
140000000.exe.exe windows x64
7da7944dd09a50ac9764ef71fea6691a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
shell32
SHGetFolderPathA
msvcrt
memset
winhttp
WinHttpOpenRequest
WinHttpSetOption
WinHttpQueryDataAvailable
WinHttpSendRequest
WinHttpConnect
WinHttpCloseHandle
WinHttpOpen
WinHttpSetStatusCallback
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpReadData
kernel32
HeapReAlloc
WideCharToMultiByte
lstrlenW
VirtualProtect
VirtualAlloc
lstrcatA
lstrcpyA
CreateDirectoryA
LoadLibraryA
GetProcAddress
GetComputerNameExW
GetTickCount64
SwitchToThread
CreateFileA
ReadFile
GetTempPathA
CloseHandle
WaitForSingleObject
Sleep
ExitProcess
CreateThread
GetTickCount
WriteFile
HeapAlloc
HeapFree
GetProcessHeap
GetLastError
advapi32
GetUserNameW
LookupAccountNameW
user32
wsprintfW
wsprintfA
Sections
.c Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: 512B - Virtual size: 6B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: 512B - Virtual size: 420B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.r Size: 512B - Virtual size: 420B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.d Size: 512B - Virtual size: 128B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE