11ecd437e5159751cd79b49eef1b3f61_icedid_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

11ecd437e5159751cd79b49eef1b3f61_icedid_JC.exe
Size

1.5MB
MD5

11ecd437e5159751cd79b49eef1b3f61
SHA1

2be477daed1e642185c43e1407a59c5cf18ceff1
SHA256

a446ef69c260673872f72a42dcd416533c321304c6b5b8156894c288a7e50669
SHA512

1f0ae531d31a562c0b188f222b77b916d1af7c26b0c1f8bc635a91ec140b249aa90c057f0e30de00b0caacfb7c77a8a6eba2c2fb29432b0bde1943cebf96d2cb
SSDEEP

24576:xvX20GIg6ZisicPJORRbxjbOjVA+ObgjZ22xL1OQ+GVWGe:x/GIg6EjhKC+J9XOhGEGe

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
11ecd437e5159751cd79b49eef1b3f61_icedid_JC.exe

Files

11ecd437e5159751cd79b49eef1b3f61_icedid_JC.exe
.exe windows x86

dc08620c54e6f083b0344387b146eae0

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

WSAStartup

winmm

sndPlaySoundA

ftms

?CMI_GetPlatVersion@@YAPADXZ
?CMI_GetMacProvider@@YAPADQAE@Z
?CMI_RegisterFlowCallBack@@YAHP6AXIPAXZZ@Z
?CMI_RegisterMsg@@YAHXZ
?CMI_ReleaseTable@@YAHXZ
?CMI_LockTable@@YAHXZ
?CMI_UnRegisterMsg@@YAHXZ
?pAdapterObject@@3PAU_FC_Card@@A
?CMI_DestroyDll@@YAHXZ
?CMI_InitDll@@YAHIPAD0@Z
?CMI_UnRegisterFlowCallBack@@YAHP6AXIPAXZZ@Z
?MACADDRESSTAG@@3JA
?IPADDRESSTAG@@3JA

mpr

WNetAddConnection2A
WNetCancelConnection2A

netapi32

NetRemoteTOD
NetSessionEnum
NetShareEnum
NetQueryDisplayInformation
NetServerTransportEnum
NetServerGetInfo
NetApiBufferFree

libexpat

ord52
ord21
ord25
ord31
ord18
ord16

kernel32

TlsFree
GlobalFlags
InterlockedIncrement
GetCPInfo
GetOEMCP
GetThreadLocale
FileTimeToSystemTime
FileTimeToLocalFileTime
ReadFile
WriteFile
SetFilePointer
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
GetFileSize
DuplicateHandle
GetCurrentProcess
FindClose
FindFirstFileA
GetVolumeInformationA
CreateFileA
LocalReAlloc
GetFileAttributesA
GetFileTime
WritePrivateProfileStringA
SetErrorMode
RtlUnwind
HeapFree
GetSystemTimeAsFileTime
HeapAlloc
HeapReAlloc
GetTimeFormatA
GetDateFormatA
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetCommandLineA
GetProcessHeap
GetStartupInfoA
RaiseException
ExitProcess
HeapSize
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetACP
HeapDestroy
HeapCreate
VirtualFree
GetStdHandle
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA
TlsSetValue
TlsAlloc
GlobalHandle
TlsGetValue
LocalAlloc
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
GlobalReAlloc
GetCurrentProcessId
lstrcmpA
GetProfileIntA
GetTickCount
InterlockedDecrement
GetModuleFileNameW
GlobalFree
CopyFileA
GlobalAlloc
FreeResource
GetCurrentThreadId
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
FreeLibrary
lstrcmpW
GetVersionExA
lstrlenA
CompareStringW
CompareStringA
lstrlenW
GetVersion
Sleep
GetModuleFileNameA
GetFullPathNameA
CreateProcessA
WaitForSingleObject
CloseHandle
MultiByteToWideChar
FormatMessageA
LocalFree
InitializeCriticalSection
MulDiv
InterlockedExchange
GlobalSize
GlobalLock
GlobalUnlock
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetLastError
SetLastError
GetProcAddress
GetModuleHandleA
LoadLibraryA
WideCharToMultiByte
FindResourceA
LoadResource
LockResource
SizeofResource

user32

ModifyMenuA
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
IsDialogMessageA
SetWindowTextA
MoveWindow
ShowWindow
IsWindowEnabled
IsRectEmpty
EndDialog
GetNextDlgTabItem
CreateDialogIndirectParamA
IsClipboardFormatAvailable
GetWindowThreadProcessId
RegisterClipboardFormatA
DestroyMenu
PostQuitMessage
ValidateRect
TranslateMessage
GetMessageA
MapDialogRect
SetWindowContextHelpId
GetSysColorBrush
UnregisterClassA
PostThreadMessageA
CharNextA
CopyAcceleratorTableA
InvalidateRgn
GetNextDlgGroupItem
MessageBeep
SendDlgItemMessageA
WinHelpA
IsChild
SetWindowsHookExA
CallNextHookEx
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
SetFocus
GetWindowTextLengthA
GetWindowTextA
GetForegroundWindow
GetLastActivePopup
SetActiveWindow
DispatchMessageA
GetDlgItem
GetTopWindow
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageA
MapWindowPoints
ScrollWindow
TrackPopupMenu
EnableMenuItem
GetScrollPos
SetForegroundWindow
IsWindowVisible
GetMenuItemID
GetMenuItemCount
MessageBoxA
CreateWindowExA
GetClassInfoExA
RegisterClassA
AdjustWindowRectEx
EqualRect
GetScrollInfo
SetScrollInfo
GetDlgCtrlID
CallWindowProcA
SetWindowLongA
SetWindowPos
GetWindowPlacement
GetWindow
IsZoomed
CharUpperA
LoadStringA
IsIconic
GetMenu
LoadMenuA
GetSubMenu
DeleteMenu
DrawIcon
wsprintfA
SystemParametersInfoA
GetCursorPos
ClipCursor
GetKeyState
GetSystemMetrics
IsWindow
GetClassInfoA
DefWindowProcA
SendNotifyMessageA
GetDesktopWindow
GetFocus
UpdateWindow
ScreenToClient
PostMessageA
DrawEdge
InvertRect
IntersectRect
SetRect
LoadIconA
LoadCursorA
KillTimer
SetTimer
ReleaseDC
GetDC
PtInRect
SetCursor
GetSysColor
ReleaseCapture
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
GetWindowLongA
EnableWindow
WindowFromPoint
GetParent
SetCapture
GetCapture
GetActiveWindow
RedrawWindow
InvalidateRect
ClientToScreen
GetClientRect
GetWindowRect
SendMessageA
LoadBitmapA
CheckMenuItem
EndPaint
BeginPaint
GetWindowDC
GetMenuState
SetScrollRange
RegisterWindowMessageA
OffsetRect
InflateRect
CopyRect
DrawMenuBar

gdi32

CreateFontA
GetDeviceCaps
Rectangle
GetTextMetricsA
CreateSolidBrush
GetClipBox
SetTextColor
SetBkColor
CopyMetaFileA
SaveDC
RestoreDC
SetBkMode
GetViewportExtEx
GetWindowExtEx
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
GetTextExtentPoint32A
ScaleWindowExtEx
ExtSelectClipRgn
DeleteDC
CreateBitmap
CreatePen
CreateRectRgnIndirect
GetMapMode
GetBkColor
GetTextColor
GetRgnBox
MoveToEx
LineTo
GetStockObject
GetCurrentObject
CreateFontIndirectA
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
StretchBlt
BitBlt
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
SetWindowExtEx
GetObjectA
SetMapMode
DeleteObject

comdlg32

GetFileTitleA

winspool.drv

ClosePrinter
DocumentPropertiesA
OpenPrinterA

advapi32

RegSetValueExA
RegCreateKeyExA
RegQueryValueA
RegEnumKeyA
RegDeleteKeyA
RegOpenKeyA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey

shlwapi

PathFindFileNameA
PathStripToRootA
PathFindExtensionA
PathIsUNCA

oledlg

ord8

ole32

CoTaskMemAlloc
CoTaskMemFree
ReleaseStgMedium
CoGetClassObject
CreateStreamOnHGlobal
CreateILockBytesOnHGlobal
CoRevokeClassObject
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoRegisterMessageFilter
CLSIDFromString
CLSIDFromProgID
RevokeDragDrop
CoLockObjectExternal
RegisterDragDrop
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
OleGetClipboard
OleFlushClipboard
OleIsCurrentClipboard
OleSetClipboard
DoDragDrop
OleDuplicateData

oleaut32

VariantChangeType
VariantInit
VariantCopy
SysAllocStringLen
SysStringLen
SysFreeString
SysAllocStringByteLen
VariantClear
SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
OleCreateFontIndirect
SysAllocString

Sections

.text
Size: 308KB - Virtual size: 306KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 76KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dc08620c54e6f083b0344387b146eae0

Headers

File Characteristics

Imports

ws2_32

winmm

ftms

mpr

netapi32

libexpat

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shlwapi

oledlg

ole32

oleaut32

Sections

.text Size: 308KB - Virtual size: 306KB

.rdata Size: 76KB - Virtual size: 75KB

.data Size: 12KB - Virtual size: 26KB

.rsrc Size: 1.2MB - Virtual size: 1.2MB

.text
Size: 308KB - Virtual size: 306KB

.rdata
Size: 76KB - Virtual size: 75KB

.data
Size: 12KB - Virtual size: 26KB

.rsrc
Size: 1.2MB - Virtual size: 1.2MB