Behavioral task
behavioral1
Sample
1964-54-0x0000000000020000-0x0000000000028000-memory.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
1964-54-0x0000000000020000-0x0000000000028000-memory.exe
Resource
win10v2004-20230703-en
General
-
Target
1964-54-0x0000000000020000-0x0000000000028000-memory.dmp
-
Size
32KB
-
MD5
5540d500e5c64ed058f6fe2266c205a8
-
SHA1
2983c7d22fa64b8ba426266348cb0e8631a00531
-
SHA256
855ec7b8f324269cd65f05c885c9d010b9556360b9b6b8307ccd2c61f367fbc1
-
SHA512
763b6d407fd1cd99a346d545416bd5f260c586910634b325f5f67eb6cf2c01d1ce9c94bfd4bbf9d91e58453284ba80f91b36e1ebf0f93f2cea0e291e80150261
-
SSDEEP
192:caBnU7ThdZzpk4EJmxQQTHGKZFTkUV2U+A5+ZrCi5hG8xf+rs8:caBUn3Zz6mxQNqNVH+A5+ZrCiff+rs
Malware Config
Extracted
icedid
3006582221
skayfingertawr.com
Signatures
-
Icedid family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1964-54-0x0000000000020000-0x0000000000028000-memory.dmp
Files
-
1964-54-0x0000000000020000-0x0000000000028000-memory.dmp.exe windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.c Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: 512B - Virtual size: 6B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: 512B - Virtual size: 420B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.r Size: 512B - Virtual size: 420B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.d Size: 512B - Virtual size: 128B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE