1bedec45daa8fa805e194133be85d61c_icedid_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

1bedec45daa8fa805e194133be85d61c_icedid_JC.exe
Size

1.2MB
MD5

1bedec45daa8fa805e194133be85d61c
SHA1

fa5c6c2f8e264b43874282a336aab41d69a23405
SHA256

6fa0ce186452386d13db0f04073180abeb168ce9a3d404415ad09e04369ffc30
SHA512

cbdb116caabf6762452f456c4c1a43c79a960dc59c0463dc1ceda536f264d0c441eb2d7ec7fd4df5f4639df19310a9890971caa3b083bd5e2e5507580cfc337d
SSDEEP

24576:IrZghm2bMRNBMePzPfHGW67mvzt1vd4jD8GyRyXb4YCNaJxDVxagGnUsB9:4ZghZMRNBMePzPfHGW67mvztNdK3yYLO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1bedec45daa8fa805e194133be85d61c_icedid_JC.exe

Files

1bedec45daa8fa805e194133be85d61c_icedid_JC.exe
.exe windows x86

29181a293a59f627f1f58b9066dad8a3

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

winmm

waveInGetNumDevs
PlaySoundA

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

mpr

WNetGetUserA
WNetGetConnectionA

kernel32

TlsGetValue
GlobalFlags
GetProcessVersion
GetCPInfo
GetOEMCP
GetCurrentDirectoryA
RtlUnwind
HeapFree
HeapAlloc
HeapReAlloc
SetConsoleCtrlHandler
GetCommandLineA
GetTimeZoneInformation
GetLocalTime
RaiseException
GetACP
SetStdHandle
GetFileType
TerminateProcess
HeapSize
LocalReAlloc
LCMapStringW
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
GetStringTypeA
GetStringTypeW
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
CompareStringA
CompareStringW
SetEnvironmentVariableA
TlsSetValue
TlsFree
GlobalHandle
TlsAlloc
SetErrorMode
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
lstrcmpA
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
FileTimeToLocalFileTime
FileTimeToSystemTime
SetFileTime
SystemTimeToFileTime
LocalFileTimeToFileTime
GetFileTime
GetFileSize
GetFullPathNameA
lstrcpynA
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
ReadFile
DuplicateHandle
InterlockedDecrement
InterlockedIncrement
SetLastError
GetCurrentThreadId
GetSystemTime
SizeofResource
WaitForSingleObject
MoveFileExA
WideCharToMultiByte
lstrlenW
GlobalMemoryStatus
GetLogicalDrives
IsDBCSLeadByte
GetShortPathNameA
GetModuleHandleA
GetDiskFreeSpaceA
SetCurrentDirectoryA
FindNextFileA
CreateDirectoryA
RemoveDirectoryA
GetPrivateProfileStringA
WritePrivateProfileStringA
GetFileAttributesA
InterlockedExchange
FlushConsoleInputBuffer
SetFileAttributesA
GetLocaleInfoA
FindFirstFileA
FindClose
FormatMessageA
GetExitCodeProcess
GetSystemDirectoryA
GetTempPathA
ExitProcess
GetVersion
GetComputerNameA
Sleep
ExpandEnvironmentStringsA
GetCurrentProcessId
OpenProcess
GetVersionExA
GetTickCount
MulDiv
WinExec
GetStartupInfoA
CreateFileA
GetModuleFileNameA
WriteFile
CloseHandle
CreateProcessA
SetPriorityClass
ResumeThread
GetCurrentThread
GetThreadPriority
SetThreadPriority
QueryPerformanceFrequency
QueryPerformanceCounter
GetCurrentProcess
GetProcessAffinityMask
lstrcmpiA
DeleteFileA
MoveFileA
CopyFileA
GetDriveTypeA
GetProcAddress
MultiByteToWideChar
GetWindowsDirectoryA
GetTempFileNameA
GetVolumeInformationA
lstrcatA
GetProfileStringA
WriteProfileStringA
lstrlenA
GetLastError
OpenFile
_lread
_llseek
_lclose
LoadLibraryA
FindResourceA
LoadResource
LockResource
lstrcpyA
FreeResource
FreeLibrary
LocalAlloc
LocalFree
GlobalAlloc
GlobalReAlloc
GlobalLock
GlobalUnlock
GlobalFree
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
LCMapStringA

user32

ValidateRect
SetRectEmpty
LoadAcceleratorsA
TranslateAcceleratorA
ReleaseCapture
GetDesktopWindow
DestroyMenu
LoadMenuA
SetMenu
ReuseDDElParam
UnpackDDElParam
BringWindowToTop
GetClassNameA
GetSysColorBrush
GetCursorPos
SetCursor
ShowOwnedPopups
PtInRect
DrawFocusRect
GetMenuCheckMarkDimensions
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
ShowWindow
MoveWindow
SetWindowTextA
IsDialogMessageA
SetDlgItemTextA
GetDlgItemTextA
SendDlgItemMessageA
MapWindowPoints
GetSysColor
GetFocus
SetFocus
AdjustWindowRectEx
EqualRect
DeferWindowPos
BeginDeferWindowPos
CopyRect
EndDeferWindowPos
GetTopWindow
GetCapture
WinHelpA
GetClassInfoA
RegisterClassA
GetMenu
GetMenuItemCount
GetSubMenu
GetMenuItemID
GetWindowTextLengthA
GetWindowTextA
GetDlgCtrlID
GetKeyState
DefWindowProcA
CreateWindowExA
SetWindowsHookExA
CallNextHookEx
GetClassLongA
SetPropA
UnhookWindowsHookEx
GetPropA
CallWindowProcA
RemovePropA
GetMessageTime
GetMessagePos
GetForegroundWindow
SetForegroundWindow
GetWindow
SetWindowLongA
SetWindowPos
RegisterWindowMessageA
SystemParametersInfoA
GetWindowPlacement
GetLastActivePopup
GrayStringA
TabbedTextOutA
EndPaint
BeginPaint
ClientToScreen
ScreenToClient
LoadStringA
GetNextDlgTabItem
EndDialog
GetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
GetWindowLongA
GetDlgItem
IsWindowEnabled
CharUpperA
DdeUninitialize
LoadBitmapA
IsCharAlphaA
DrawTextA
IsIconic
GetSystemMenu
EnableMenuItem
LoadCursorA
LoadIconA
ExitWindowsEx
GetMessageA
PostQuitMessage
FindWindowA
GetWindowThreadProcessId
UnionRect
FillRect
GetParent
ReleaseDC
GetDC
GetClientRect
GetDialogBaseUnits
IsWindowVisible
DdeInitializeA
DdeCreateStringHandleA
DdeConnect
DdeClientTransaction
DdeGetData
DdeDisconnect
DdeFreeStringHandle
PeekMessageA
TranslateMessage
DispatchMessageA
WaitMessage
EnableWindow
SetActiveWindow
KillTimer
SetTimer
InvalidateRect
UpdateWindow
GetWindowRect
OffsetRect
InflateRect
SetRect
GetSystemMetrics
wsprintfA
MessageBeep
SendMessageA
PostMessageA
IsWindow
MessageBoxA
CharNextA
UnregisterClassA
GetWindowDC

gdi32

CreatePen
CreateSolidBrush
PtVisible
RealizePalette
RectVisible
ExtTextOutA
Escape
CreateCompatibleBitmap
SetDIBits
CreateCompatibleDC
SelectObject
LineTo
MoveToEx
GetClipBox
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetTextColor
SetBkMode
RestoreDC
SaveDC
CreateDCA
GetBitmapBits
CreateICA
PatBlt
GetTextColor
CreateFontA
GetTextCharset
GetTextMetricsA
TextOutA
GetDeviceCaps
SetBkColor
DeleteDC
CreatePalette
GetStockObject
CreateFontIndirectA
GetTextExtentPoint32A
AddFontResourceA
CreateScalableFontResourceA
StretchBlt
DeleteObject
GetPixel
GetObjectA
DPtoLP
CreateBitmap
GetMapMode
SetMapMode
BitBlt
SelectPalette

comdlg32

GetFileTitleA
GetOpenFileNameA
GetSaveFileNameA

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

AllocateAndInitializeSid
LookupAccountSidW
FreeSid
RegEnumKeyA
RegEnumValueA
RegDeleteKeyA
OpenThreadToken
LookupAccountNameA
RegGetKeySecurity
InitializeSecurityDescriptor
GetSecurityDescriptorDacl
GetAclInformation
GetLengthSid
InitializeAcl
GetAce
AddAce
AddAccessAllowedAce
SetSecurityDescriptorDacl
RegSetKeySecurity
RegQueryInfoKeyA
RegDeleteValueA
RegCreateKeyExA
RegSetValueExA
OpenSCManagerA
GetServiceKeyNameA
OpenServiceA
ControlService
QueryServiceStatus
StartServiceA
CloseServiceHandle
RegOpenKeyA
RegUnLoadKeyA
LookupPrivilegeValueA
AdjustTokenPrivileges
RegLoadKeyA
RegEnumKeyExA
OpenProcessToken
GetTokenInformation
LookupAccountSidA
RegQueryValueA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegCreateKeyA

shell32

SHChangeNotify
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetMalloc
ShellExecuteA
SHGetFileInfoA
DragFinish
DragQueryFileA

comctl32

ord17

wsock32

htons
WSAStartup
WSACleanup
WSACancelBlockingCall
shutdown
listen
bind
setsockopt
gethostbyaddr
accept
ntohs
getservbyname
gethostbyname
WSASetLastError
htonl
ioctlsocket
recv
send
WSAAsyncSelect
recvfrom
sendto
WSAGetLastError
WSAAsyncGetHostByName
inet_ntoa
WSACancelAsyncRequest
socket
closesocket
connect

ole32

CoInitialize
CoUninitialize
CoCreateInstance

oleaut32

VariantChangeType
VariantClear

Sections

.text
Size: 900KB - Virtual size: 898KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 136KB - Virtual size: 133KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 84KB - Virtual size: 122KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 152KB - Virtual size: 150KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

29181a293a59f627f1f58b9066dad8a3

Headers

File Characteristics

Imports

winmm

version

mpr

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

wsock32

ole32

oleaut32

Sections

.text Size: 900KB - Virtual size: 898KB

.rdata Size: 136KB - Virtual size: 133KB

.data Size: 84KB - Virtual size: 122KB

.rsrc Size: 152KB - Virtual size: 150KB

.text
Size: 900KB - Virtual size: 898KB

.rdata
Size: 136KB - Virtual size: 133KB

.data
Size: 84KB - Virtual size: 122KB

.rsrc
Size: 152KB - Virtual size: 150KB