ICEsoundService64[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

ICEsoundService64.exe
Size

788KB
MD5

f995f1cbf37bda0d5a5757d013b9b46b
SHA1

32224e5f68813b2fc22b921bf7cc1d581a8addc0
SHA256

f48705e9eb08682a1dc799552978088cfcf74afc1009d07c7a5592580615a5c7
SHA512

9cf884e074e154d31227bc3e112003890d755ce590ce685f575d9667e9f99d97f9abb5d06e15a521195481a6850f60a2738ad7336afbb04e3f3b48a999370078
SSDEEP

12288:WQK41FTnwK3ZFPCFMsvBB8riHoRc7sccNWCn3BdihXzfjdMfo2d3B:WQK4zTnwcZFaZYFRfxnRd6jfjd+xd3B

Score

1^/10

Malware Config

Signatures

Files

ICEsoundService64.exe
.exe windows x64

c50cf044757f34341f9ebc9832987e53

Code Sign

0f:5c:68:9d:c0:71:73:74:60:9e:20:ed:09:7b:19:d9
Certificate

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

12/12/2017, 00:00

Not After

31/12/2019, 12:00

Subject

SERIALNUMBER=25053591,CN=ICEpower a/s,O=ICEpower a/s,L=Soeborg,C=DK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302444b

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0b:9d:e2:34:3a:c1:3f:9f:df:2b:c2:d7:f3:a6:c2:00
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

08/01/2018, 00:00

Not After

09/12/2020, 12:00

Subject

SERIALNUMBER=25053591,CN=ICEpower a/s,O=ICEpower a/s,L=Soeborg,C=DK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302444b

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04/01/2017, 00:00

Not After

18/01/2028, 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:b5:f4:b0:da:0a:83:37:39:90:7c:df:cf:d8:55:0e:fa:83:d7:d8:5e:3d:72:85:fe:06:b3:88:43:1b:6e:bb
Signer

Actual PE Digest

62:b5:f4:b0:da:0a:83:37:39:90:7c:df:cf:d8:55:0e:fa:83:d7:d8:5e:3d:72:85:fe:06:b3:88:43:1b:6e:bb

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

SERIALNUMBER=25053591,CN=ICEpower a/s,O=ICEpower a/s,L=Soeborg,C=DK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302444b

09/03/2023, 18:59
Valid: false

11:1c:d3:df:a4:d5:de:15:08:e8:07:a5:b2:c7:85:52:62:2d:a5:18
Signer

Actual PE Digest

11:1c:d3:df:a4:d5:de:15:08:e8:07:a5:b2:c7:85:52:62:2d:a5:18

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

SERIALNUMBER=25053591,CN=ICEpower a/s,O=ICEpower a/s,L=Soeborg,C=DK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302444b

24/08/2018, 09:57
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

rpcrt4

UuidFromStringW
RpcServerUseProtseqEpW
RpcServerListen
RpcServerUnregisterIf
RpcServerRegisterIf3
RpcEpUnregister
NdrServerCall2
NdrServerCallAll
RpcBindingVectorFree
RpcServerInqBindings
RpcEpRegisterW

api-ms-win-core-heap-l1-1-0

HeapDestroy
GetProcessHeap
HeapReAlloc
HeapSize
HeapAlloc
HeapFree

api-ms-win-security-base-l1-1-0

GetSecurityDescriptorDacl
AllocateAndInitializeSid
InitializeSecurityDescriptor
FreeSid
SetSecurityDescriptorDacl

api-ms-win-core-synch-l1-1-0

WaitForSingleObject
OpenEventW
SetEvent
ResetEvent
DeleteCriticalSection
EnterCriticalSection
WaitForSingleObjectEx
InitializeCriticalSectionEx
LeaveCriticalSection
InitializeCriticalSection
TryEnterCriticalSection
ReleaseMutex
CreateEventW
CreateMutexW
ReleaseSemaphore
InitializeCriticalSectionAndSpinCount

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
SetLastError
SetUnhandledExceptionFilter
RaiseException

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW

api-ms-win-security-base-l1-2-2

DeriveCapabilitySidsFromName

api-ms-win-security-provider-l1-1-0

SetEntriesInAclW
SetSecurityInfo

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-registry-l1-1-0

RegDeleteKeyExW
RegOpenKeyExW
RegQueryValueExW
RegNotifyChangeKeyValue
RegGetValueW
RegCreateKeyExW
RegSetValueExW
RegCloseKey
RegEnumKeyExW

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
GetModuleFileNameW
FreeLibrary
GetModuleHandleW
GetModuleHandleA
FreeLibraryAndExitThread
LoadLibraryExW
GetProcAddress

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-com-l1-1-0

CoTaskMemFree
CoUninitialize
PropVariantClear
StringFromGUID2
CoInitializeEx
CoCreateInstance
CLSIDFromString

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-service-core-l1-1-0

SetServiceStatus
StartServiceCtrlDispatcherW

api-ms-win-core-memory-l1-1-0

VirtualAlloc
VirtualFree
VirtualProtect
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW

api-ms-win-core-synch-l1-2-0

Sleep
SignalObjectAndWait

api-ms-win-service-winsvc-l1-1-0

RegisterServiceCtrlHandlerW

api-ms-win-core-processthreads-l1-1-0

TlsAlloc
TlsFree
GetCurrentThread
GetCurrentThreadId
ExitProcess
SwitchToThread
TlsGetValue
CreateThread
GetThreadPriority
GetCurrentProcess
TerminateProcess
SetThreadPriority
TerminateThread
GetStartupInfoW
GetCurrentProcessId
TlsSetValue

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

oleaut32

SysAllocString
SysFreeString

api-ms-win-devices-config-l1-1-1

CM_Get_Device_Interface_List_SizeW
CM_Get_Device_Interface_ListW

shlwapi

PathAppendW
PathRemoveFileSpecW
PathAddBackslashW

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetVersionExW
GetLogicalProcessorInformation
GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-localization-l1-2-0

GetACP
LCMapStringW
IsValidCodePage
GetOEMCP
GetCPInfo

api-ms-win-core-string-l1-1-0

CompareStringW
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW

api-ms-win-core-rtlsupport-l1-1-0

RtlPcToFileHeader
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlUnwindEx

api-ms-win-core-processthreads-l1-1-1

GetThreadTimes
IsProcessorFeaturePresent

api-ms-win-core-interlocked-l1-1-0

InterlockedFlushSList
InterlockedPopEntrySList
InterlockedPushEntrySList
QueryDepthSList
InitializeSListHead

api-ms-win-core-threadpool-legacy-l1-1-0

CreateTimerQueue
UnregisterWaitEx
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer

api-ms-win-core-systemtopology-l1-1-0

GetNumaHighestNodeNumber

api-ms-win-core-processtopology-obsolete-l1-1-0

SetThreadAffinityMask
GetProcessAffinityMask

api-ms-win-core-kernel32-legacy-l1-1-0

RegisterWaitForSingleObject
UnregisterWait

api-ms-win-core-file-l1-1-0

ReadFile
WriteFile
GetFileType
SetFilePointerEx
SetEndOfFile
FlushFileBuffers
FindClose
FindFirstFileExW
CreateFileW
FindNextFileW

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetStdHandle
GetCommandLineW
SetEnvironmentVariableW

api-ms-win-core-console-l1-1-0

GetConsoleCP
ReadConsoleW
GetConsoleMode
WriteConsoleW

Sections

.text
Size: 547KB - Virtual size: 546KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 164KB - Virtual size: 164KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 268KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c50cf044757f34341f9ebc9832987e53

Code Sign

0f:5c:68:9d:c0:71:73:74:60:9e:20:ed:09:7b:19:d9Certificate

Extended Key Usages

Key Usages

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66Certificate

Extended Key Usages

Key Usages

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06Certificate

Extended Key Usages

Key Usages

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1bCertificate

Extended Key Usages

Key Usages

0b:9d:e2:34:3a:c1:3f:9f:df:2b:c2:d7:f3:a6:c2:00Certificate

Extended Key Usages

Key Usages

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5cCertificate

Extended Key Usages

Key Usages

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41Certificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

62:b5:f4:b0:da:0a:83:37:39:90:7c:df:cf:d8:55:0e:fa:83:d7:d8:5e:3d:72:85:fe:06:b3:88:43:1b:6e:bbSigner

Signature Validations

Verification

09/03/2023, 18:59 Valid: false

11:1c:d3:df:a4:d5:de:15:08:e8:07:a5:b2:c7:85:52:62:2d:a5:18Signer

Signature Validations

Verification

24/08/2018, 09:57 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

rpcrt4

api-ms-win-core-heap-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-security-base-l1-2-2

api-ms-win-security-provider-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-com-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-service-core-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-security-sddl-l1-1-0

oleaut32

api-ms-win-devices-config-l1-1-1

shlwapi

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-systemtopology-l1-1-0

api-ms-win-core-processtopology-obsolete-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-file-l1-1-0

0f:5c:68:9d:c0:71:73:74:60:9e:20:ed:09:7b:19:d9
Certificate

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

0b:9d:e2:34:3a:c1:3f:9f:df:2b:c2:d7:f3:a6:c2:00
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

62:b5:f4:b0:da:0a:83:37:39:90:7c:df:cf:d8:55:0e:fa:83:d7:d8:5e:3d:72:85:fe:06:b3:88:43:1b:6e:bb
Signer

09/03/2023, 18:59
Valid: false

11:1c:d3:df:a4:d5:de:15:08:e8:07:a5:b2:c7:85:52:62:2d:a5:18
Signer

24/08/2018, 09:57
Valid: false

.text
Size: 547KB - Virtual size: 546KB

.rdata
Size: 164KB - Virtual size: 164KB

.data
Size: 9KB - Virtual size: 268KB

.pdata
Size: 18KB - Virtual size: 18KB

_RDATA
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 3KB - Virtual size: 3KB