3378372386e3474b052a83550375df40_icedid_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

3378372386e3474b052a83550375df40_icedid_JC.exe
Size

20.1MB
MD5

3378372386e3474b052a83550375df40
SHA1

958231f6b453ccf75054310f682f0529b039b647
SHA256

c79d88edff751356501b1ab510ab03687c1b5df48e6bcdeb951ec7a89b4fb235
SHA512

4c4be638c23aa88343f9cdafa01c3ab484787f19c5f09400c81e51fdd6219772311a029fd937baa9855a1e629ca8a2797503d7e6d8a45441e0e6fb4dea9f735c
SSDEEP

393216:hdH/xizoMZWEQEP27kqKDHN4sqUKITrl2Alu3rg0M31:T/goW0kqKDthqUzlllu3rg0E1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3378372386e3474b052a83550375df40_icedid_JC.exe

Files

3378372386e3474b052a83550375df40_icedid_JC.exe
.exe windows x86

d86191600cb93f6900863aba9588fa3f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetConsoleMode
ReadConsoleA
SwitchToFiber
DeleteFiber
CreateFiber
ConvertFiberToThread
ConvertThreadToFiber
GetSystemTime
GetCommandLineW
DecodePointer
RaiseException
HeapReAlloc
HeapSize
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
LoadLibraryW
GetModuleFileNameW
GetCurrentProcess
GetCurrentThread
DeleteCriticalSection
InitializeCriticalSection
SetUnhandledExceptionFilter
IsBadReadPtr
GetEnvironmentVariableW
GetProcessHeap
HeapAlloc
GetNativeSystemInfo
LoadLibraryA
VirtualAlloc
VirtualFree
SetLastError
HeapFree
VirtualProtect
GetSystemTimeAsFileTime
GetModuleHandleA
IsBadWritePtr
WinExec
GetTempPathW
InitializeCriticalSectionAndSpinCount
SetEndOfFile
GetModuleHandleW
GetProcAddress
OutputDebugStringW
DeleteFileW
EnterCriticalSection
LeaveCriticalSection
QueryPerformanceFrequency
QueryPerformanceCounter
GetTickCount
GetLocalTime
FileTimeToSystemTime
lstrcpynW
LoadResource
FindResourceW
GlobalAlloc
GlobalSize
GlobalLock
GlobalUnlock
GlobalFree
LocalFree
MulDiv
FormatMessageW
CopyFileW
OutputDebugStringA
EncodePointer
GetSystemDirectoryW
FreeResource
LoadLibraryExW
GlobalDeleteAtom
lstrcmpW
GlobalAddAtomW
GlobalFindAtomW
CompareStringW
SetErrorMode
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GlobalReAlloc
GlobalHandle
LocalAlloc
LocalReAlloc
GlobalGetAtomNameW
SetEvent
WaitForSingleObject
CreateEventW
SetThreadPriority
ResumeThread
GetVersionExW
lstrcmpA
GetLocaleInfoW
GetUserDefaultUILanguage
GlobalFlags
FindClose
FindFirstFileW
FlushFileBuffers
GetFullPathNameW
GetVolumeInformationW
LockFile
UnlockFile
DuplicateHandle
lstrcmpiW
GetWindowsDirectoryW
FileTimeToLocalFileTime
GetFileAttributesExW
GetFileSizeEx
GetFileTime
SetFileAttributesW
SystemTimeToTzSpecificLocalTime
VerSetConditionMask
VerifyVersionInfoW
GetProfileIntW
SearchPathW
GetTempFileNameW
GetUserDefaultLCID
UnhandledExceptionFilter
IsProcessorFeaturePresent
ResetEvent
WaitForSingleObjectEx
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
GetStringTypeW
TryEnterCriticalSection
SwitchToThread
GetExitCodeThread
LCMapStringW
GetCPInfo
GetACP
InterlockedIncrement
InterlockedDecrement
ExitProcess
MoveFileExW
CompareFileTime
FindNextFileW
FileTimeToDosDateTime
DosDateTimeToFileTime
GetSystemInfo
ReleaseSemaphore
CreateSemaphoreW
WaitForMultipleObjects
SleepEx
GetSystemDirectoryA
MoveFileExA
GetEnvironmentVariableA
GetStdHandle
GetFileType
PeekNamedPipe
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
GetCommandLineA
HeapQueryInformation
VirtualQuery
SetStdHandle
GetModuleFileNameA
GetDriveTypeW
SetFilePointerEx
GetConsoleMode
ReadConsoleW
GetConsoleCP
GetDateFormatW
GetTimeFormatW
IsValidLocale
EnumSystemLocalesW
GetTimeZoneInformation
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetConsoleCtrlHandler
WriteConsoleW
CreateTimerQueue
SignalObjectAndWait
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
InterlockedPopEntrySList
QueryDepthSList
UnregisterWaitEx
Sleep
lstrcpyW
GetFileSize
FreeLibrary
lstrlenW
GetLastError
WideCharToMultiByte
SystemTimeToFileTime
GetCurrentDirectoryW
CloseHandle
LocalFileTimeToFileTime
MultiByteToWideChar
GetFileAttributesW
CreateFileW
SetFilePointer
SetFileTime
WriteFile
ReadFile
CreateDirectoryW
LockResource
FindResourceExW
SizeofResource

user32

GetWindowThreadProcessId
DrawTextW
DrawTextExW
GrayStringW
TabbedTextOutW
GetWindowDC
ClientToScreen
FillRect
DestroyMenu
GetMenuItemInfoW
InflateRect
SystemParametersInfoW
CopyImage
SendDlgItemMessageA
SetRectEmpty
OffsetRect
GetMessageW
TranslateMessage
GetCursorPos
RealChildWindowFromPoint
GetAsyncKeyState
MapDialogRect
DestroyIcon
CharUpperW
IntersectRect
TrackMouseEvent
InvalidateRect
LoadImageW
ShowOwnedPopups
SetCursor
DeleteMenu
SetTimer
KillTimer
CreatePopupMenu
GetMenuDefaultItem
GetNextDlgGroupItem
SetCapture
ReleaseCapture
WindowFromPoint
DrawFocusRect
IsRectEmpty
DrawIconEx
GetIconInfo
MessageBeep
EnableScrollBar
HideCaret
InvertRect
NotifyWinEvent
MapVirtualKeyW
GetKeyNameTextW
LoadMenuW
SetLayeredWindowAttributes
EnumDisplayMonitors
SetClassLongW
SetWindowRgn
SetParent
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
DrawStateW
DrawEdge
DrawFrameControl
IsZoomed
GetSystemMenu
BringWindowToTop
SetCursorPos
CopyIcon
FrameRect
DrawIcon
UnionRect
UpdateLayeredWindow
MonitorFromPoint
SetMenuItemBitmaps
TranslateAcceleratorW
InsertMenuItemW
UnpackDDElParam
ReuseDDElParam
GetComboBoxInfo
PostThreadMessageW
DestroyWindow
GetKeyboardLayout
IsCharLowerW
MapVirtualKeyExW
ToUnicodeEx
GetKeyboardState
CreateAcceleratorTableW
DestroyAcceleratorTable
CopyAcceleratorTableW
SetRect
LockWindowUpdate
SetMenuDefaultItem
GetDoubleClickTime
ModifyMenuW
RegisterClipboardFormatW
CharUpperBuffW
IsClipboardFormatAvailable
GetUpdateRect
DrawMenuBar
GetSysColorBrush
DefMDIChildProcW
TranslateMDISysAccel
SubtractRect
CreateMenu
GetWindowRgn
DestroyCursor
InvalidateRgn
GetCaretBlinkTime
GetGUIThreadInfo
RegisterClassExW
CreateCaret
ShowCaret
SetCaretPos
GetCaretPos
CharPrevW
wsprintfA
DrawTextA
CharPrevExA
IsMenu
IsWindow
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
CallWindowProcW
DefWindowProcW
GetMessageTime
GetMessagePos
PeekMessageW
DispatchMessageW
RegisterWindowMessageW
RemoveMenu
AppendMenuW
InsertMenuW
GetMenuItemCount
GetMenuItemID
GetSubMenu
GetMenuState
GetMenuStringW
EnableMenuItem
CheckMenuItem
IsWindowEnabled
GetActiveWindow
GetNextDlgTabItem
EndDialog
CreateDialogIndirectParamW
WinHelpW
GetScrollInfo
SetScrollInfo
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
GetWindow
GetLastActivePopup
GetTopWindow
GetClassNameW
GetParent
GetClassLongW
SetWindowLongW
GetWindowLongW
PtInRect
EqualRect
CopyRect
GetSysColor
MapWindowPoints
ScreenToClient
AdjustWindowRectEx
GetWindowRect
GetClientRect
GetWindowTextLengthW
GetWindowTextW
RemovePropW
GetPropW
SetPropW
ShowScrollBar
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
RedrawWindow
ValidateRect
EndPaint
BeginPaint
SetForegroundWindow
GetForegroundWindow
SetActiveWindow
UpdateWindow
TrackPopupMenu
SetMenu
GetMenu
GetCapture
GetKeyState
ReleaseDC
GetProcessWindowStation
GetUserObjectInformationW
LoadCursorW
GetDC
GetSystemMetrics
IsDialogMessageW
SetWindowTextW
CheckDlgButton
MoveWindow
LoadBitmapW
SetMenuItemInfoW
DefFrameProcW
GetFocus
SetFocus
GetDlgCtrlID
GetDlgItem
IsIconic
IsWindowVisible
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPlacement
GetMenuCheckMarkDimensions
GetWindowPlacement
LoadAcceleratorsW
SetWindowPos
PostQuitMessage
LoadIconW
EnableWindow
SendMessageW
ShowWindow
PostMessageW
MessageBoxW
MonitorFromWindow
GetMonitorInfoW
GetDesktopWindow
wsprintfW
CharNextW
WaitMessage
IsChild

advapi32

RegCreateKeyExW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptGenRandom
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptCreateHash
CryptDestroyHash
CryptSignHashW
CryptEnumProvidersW
RegCloseKey
RegDeleteValueW
RegSetValueExW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
OpenThreadToken
RegDeleteKeyW
RegEnumKeyExW
RegQueryValueExW
RegOpenKeyExW

shell32

SHGetSpecialFolderPathW
SHCreateDirectoryExW
SHFileOperationW
SHAppBarMessage
DragFinish
DragQueryFileW
SHBrowseForFolderW
ShellExecuteW
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetFileInfoW

ole32

OleLockRunning
CoTaskMemFree
CoCreateInstance
CoInitialize
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
OleTranslateAccelerator
CLSIDFromProgID
RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
OleGetClipboard
DoDragDrop
CreateStreamOnHGlobal
CLSIDFromString
CoInitializeEx
CoUninitialize
OleInitialize
CoDisconnectObject
ReleaseStgMedium
OleDuplicateData
CoTaskMemAlloc
IsAccelerator

oleaut32

SysAllocStringLen
SysFreeString
SysAllocString
VariantClear
VarBstrFromDate
VariantCopy
VariantTimeToSystemTime
SystemTimeToVariantTime
SysStringLen
VariantChangeType
LoadTypeLi
VariantInit

msimg32

AlphaBlend
TransparentBlt

shlwapi

wnsprintfA
SHSetValueW
SHGetValueW
StrChrA
StrCmpIW
PathFileExistsW
PathFindExtensionW
PathFindFileNameW
PathRemoveFileSpecW
PathIsUNCW
PathStripToRootW
StrFormatKBSizeW
SHCreateStreamOnFileEx
wnsprintfW

uxtheme

DrawThemeParentBackground
OpenThemeData
CloseThemeData
DrawThemeBackground
GetThemeColor
GetCurrentThemeName
GetWindowTheme
IsAppThemed
IsThemeBackgroundPartiallyTransparent
GetThemeSysColor
GetThemePartSize
DrawThemeText

winhttp

WinHttpSendRequest
WinHttpReadData
WinHttpWriteData
WinHttpSetCredentials
WinHttpQueryAuthSchemes
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpSetOption
WinHttpAddRequestHeaders
WinHttpOpenRequest
WinHttpConnect
WinHttpSetTimeouts
WinHttpCloseHandle
WinHttpSetStatusCallback
WinHttpOpen

gdiplus

GdipDrawLine
GdipSetPenEndCap
GdipSetPenStartCap
GdipCreatePen2
GdipRotateWorldTransform
GdipTranslateWorldTransform
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipSetStringFormatTrimming
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipSetStringFormatFlags
GdipCloneStringFormat
GdipDeleteStringFormat
GdipStringFormatGetGenericTypographic
GdipMeasureString
GdipDrawString
GdipDeleteFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipDrawImageRectRect
GdipFillPath
GdipFillRectangleI
GdipDrawPath
GdipDrawRectangleI
GdipResetWorldTransform
GdipSetWorldTransform
GdipSetTextRenderingHint
GdipSetSmoothingMode
GdipReleaseDC
GdipSetImageAttributesColorMatrix
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipLoadImageFromStreamICM
GdipLoadImageFromStream
GdipSetPenDashStyle
GdipSetPenMode
GdipDeletePen
GdipCreatePen1
GdipCreateSolidFill
GdipDeleteBrush
GdipDrawImageRectI
GdipSetInterpolationMode
GdipCreateFromHDC
GdipCreateBitmapFromHBITMAP
GdipDrawImageI
GdipDeleteGraphics
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdipFree
GdipAlloc
GdiplusShutdown
GdiplusStartup
GdipCloneBrush
GdipRotateMatrix
GdipTranslateMatrix
GdipDeleteMatrix
GdipCreatePath
GdipDeletePath
GdipAddPathLine
ord1
GdipCreateMatrix

imm32

ImmGetContext
ImmSetCompositionWindow
ImmReleaseContext
ImmGetOpenStatus

snmpapi

SnmpUtilOidCpy
SnmpUtilVarBindFree
SnmpUtilOidNCmp

oleacc

LresultFromObject
AccessibleObjectFromWindow
CreateStdAccessibleObject

ws2_32

WSAEnumNetworkEvents
WSAEventSelect
WSAResetEvent
WSAWaitForMultipleEvents
closesocket
WSAGetLastError
recv
bind
connect
getpeername
getsockname
getsockopt
ntohs
setsockopt
socket
WSASetLastError
WSAIoctl
WSACleanup
__WSAFDIsSet
select
accept
htonl
listen
getaddrinfo
getnameinfo
freeaddrinfo
recvfrom
sendto
ioctlsocket
htons
gethostbyname
gethostname
WSAStartup
send
WSACloseEvent
WSACreateEvent
shutdown

winmm

PlaySoundW

wldap32

ord217
ord46
ord211
ord60
ord45
ord50
ord143
ord41
ord22
ord26
ord27
ord32
ord33
ord35
ord79
ord30
ord200
ord301

crypt32

CertFindCertificateInStore
CertDuplicateCertificateContext
CertGetCertificateContextProperty
CertOpenStore
CertOpenSystemStoreA
CertGetIntendedKeyUsage
CertGetEnhancedKeyUsage
CertFreeCertificateContext
CertEnumCertificatesInStore
CertCloseStore

gdi32

GetTextExtentPointA
GetBitmapBits
SetBitmapBits
GetObjectA
GetObjectType
GetPixel
GetStockObject
GetViewportExtEx
GetWindowExtEx
IntersectClipRect
LineTo
GetViewportOrgEx
GetWindowOrgEx
SetPixelV
SetPaletteEntries
ExtFloodFill
PtInRegion
GetBoundsRect
GetCharABCWidthsW
FillRgn
RoundRect
OffsetRgn
CreatePenIndirect
PlayEnhMetaFile
GetEnhMetaFileHeader
CreateEnhMetaFileW
GdiFlush
GetClipBox
GetRgnBox
CloseEnhMetaFile
LPtoDP
CreateRoundRectRgn
Polyline
ExcludeClipRect
Escape
DeleteObject
DeleteDC
CreateSolidBrush
CreateRectRgn
Polygon
CreatePolygonRgn
GetTextColor
Ellipse
CreateEllipticRgn
SetDIBColorTable
CreateDIBSection
StretchBlt
SetPixel
GetTextCharsetInfo
EnumFontFamiliesW
CreateDIBitmap
CreateCompatibleBitmap
GetBkColor
RealizePalette
GetSystemPaletteEntries
GetPaletteEntries
GetNearestPaletteIndex
CreatePalette
EnumFontFamiliesExW
DPtoLP
SetRectRgn
PatBlt
CreateRectRgnIndirect
CreatePatternBrush
CreatePen
CreateHatchBrush
CreateCompatibleDC
BitBlt
CreateBitmap
GetObjectW
SetTextColor
SetBkColor
CombineRgn
GetTextMetricsW
PtVisible
RectVisible
RestoreDC
SaveDC
SelectClipRgn
ExtSelectClipRgn
SelectObject
SelectPalette
SetBkMode
RemoveFontMemResourceEx
AddFontMemResourceEx
GetTextFaceW
Rectangle
GetTextExtentPoint32W
GetDeviceCaps
CreateDCW
FrameRgn
CreateFontIndirectW
ScaleWindowExtEx
ScaleViewportExtEx
OffsetWindowOrgEx
OffsetViewportOrgEx
SetWindowOrgEx
SetWindowExtEx
SetViewportOrgEx
SetViewportExtEx
ExtTextOutW
TextOutW
MoveToEx
SetMapMode
SetLayout
GetLayout
SetPolyFillMode
SetTextAlign
SetStretchBltMode
SetROP2
CopyMetaFileW

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

comctl32

_TrackMouseEvent
InitCommonControlsEx
ord17

Sections

.text
Size: 4.2MB - Virtual size: 4.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1019KB - Virtual size: 1019KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14.8MB - Virtual size: 14.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 178KB - Virtual size: 178KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d86191600cb93f6900863aba9588fa3f

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

msimg32

shlwapi

uxtheme

winhttp

gdiplus

imm32

snmpapi

oleacc

ws2_32

winmm

wldap32

crypt32

gdi32

winspool.drv

comctl32

Sections

.text Size: 4.2MB - Virtual size: 4.2MB

.rdata Size: 1019KB - Virtual size: 1019KB

.data Size: 14.8MB - Virtual size: 14.9MB

.rsrc Size: 178KB - Virtual size: 178KB

.text
Size: 4.2MB - Virtual size: 4.2MB

.rdata
Size: 1019KB - Virtual size: 1019KB

.data
Size: 14.8MB - Virtual size: 14.9MB

.rsrc
Size: 178KB - Virtual size: 178KB