2b44c533e3db7f1abce16a578ff617fe_icedid_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

2b44c533e3db7f1abce16a578ff617fe_icedid_JC.exe
Size

651KB
MD5

2b44c533e3db7f1abce16a578ff617fe
SHA1

94a1bfddad9a9b337ee1f842bc75c8783a8a10e8
SHA256

a141b8805606ea7cd7ebd2765cba702aaa556c60958bbae7dcf74b660d423ca2
SHA512

5022e872ff44770089417f3a44cf058c440fff0b8bb92590ba711dbbc3bac8e7f734a13da8a83e13df28641385a3db775d8772452d2503e6f03fba169d71c50d
SSDEEP

12288:+qGxftr9TsSrY+y/IX9K+Tqz3Rq4KKSW9ocDbWvj:+qCroVIX9KZlKKv9dH6j

Score

1^/10

Malware Config

Signatures

Files

2b44c533e3db7f1abce16a578ff617fe_icedid_JC.exe
.exe windows x86

2adc8aa1cd48fc5e8708144bcab958b6

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

58:41:07:27:95:e9:ef:2a:6e:fc:e6:68:4f:81:05:92
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

01/10/2009, 00:00

Not After

15/10/2012, 23:59

Subject

CN=Dritek System Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Dritek System Inc.,L=Taipei City,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

11:81:16:11:93:68:37:23:b3:06:a7:5f:62:bb:02:72:c3:68:34:fe
Signer

Actual PE Digest

11:81:16:11:93:68:37:23:b3:06:a7:5f:62:bb:02:72:c3:68:34:fe

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

kernel32

GetFileAttributesW
GetFileTime
GetFileSizeEx
SetErrorMode
GetStartupInfoW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
HeapFree
RtlUnwind
HeapReAlloc
RaiseException
ExitProcess
HeapSize
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetStartupInfoA
HeapCreate
VirtualFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetTimeZoneInformation
InitializeCriticalSectionAndSpinCount
GetConsoleCP
GetConsoleMode
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
GetCurrentDirectoryA
GetDriveTypeA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
SetEnvironmentVariableA
WritePrivateProfileStringW
CreateFileW
GetFullPathNameW
GetVolumeInformationW
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
InterlockedIncrement
GetThreadLocale
lstrlenA
GlobalFlags
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesW
lstrcmpA
GetLocaleInfoW
LoadLibraryExW
CompareStringA
InterlockedExchange
GetCurrentProcessId
GetModuleHandleA
GetProfileIntW
GetTickCount
FindFirstFileW
FileTimeToLocalFileTime
FileTimeToSystemTime
FindNextFileW
FindClose
GetCurrentThreadId
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
CompareStringW
LoadLibraryA
GetVersionExA
InterlockedDecrement
CopyFileW
GlobalSize
FormatMessageW
LocalFree
MulDiv
WideCharToMultiByte
CreateMutexW
Sleep
GetCommandLineW
CloseHandle
FreeResource
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
SetLastError
ExpandEnvironmentStringsW
GetVersionExW
lstrcmpW
lstrcpynW
GetCurrentProcess
GetPrivateProfileStringW
LoadLibraryW
FreeLibrary
MultiByteToWideChar
GetLastError
GetModuleFileNameW
GetProcAddress
GetModuleHandleW
WaitForSingleObject
CreateThread
lstrlenW
lstrcpyW
FindResourceW
LoadResource
LockResource
SizeofResource
GetFileType

user32

PostThreadMessageW
CharNextW
CopyAcceleratorTableW
IsRectEmpty
SetRect
InvalidateRgn
GetNextDlgGroupItem
MessageBeep
GetMessageW
TranslateMessage
ValidateRect
SetWindowContextHelpId
MapDialogRect
RegisterClipboardFormatW
PostQuitMessage
IsClipboardFormatAvailable
GetWindowThreadProcessId
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
InflateRect
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuW
EnableMenuItem
CheckMenuItem
RegisterWindowMessageW
SendDlgItemMessageA
WinHelpW
IsChild
GetCapture
SetWindowsHookExW
CallNextHookEx
GetClassLongW
GetClassNameW
RemovePropW
GetForegroundWindow
GetLastActivePopup
DispatchMessageW
GetTopWindow
GetMessageTime
GetMessagePos
PeekMessageW
MapWindowPoints
GetKeyState
SetMenu
SetForegroundWindow
MessageBoxW
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
ScreenToClient
EqualRect
DefWindowProcW
CallWindowProcW
GetMenu
OffsetRect
SystemParametersInfoA
GetWindowPlacement
GetFocus
ShowWindow
MoveWindow
GetDlgCtrlID
SetWindowTextW
IsDialogMessageW
IsDlgButtonChecked
SetDlgItemTextW
SendDlgItemMessageW
CheckRadioButton
UnhookWindowsHookEx
GetWindowTextLengthW
GetWindowTextW
GetWindow
SetFocus
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
GetDesktopWindow
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamW
DestroyWindow
GetDlgItem
IsWindowEnabled
GetParent
GetNextDlgTabItem
EndDialog
FindWindowW
SetCapture
CharUpperW
ReleaseCapture
DestroyMenu
UnregisterClassW
LoadCursorW
GetSysColorBrush
SetCursor
GetClipboardFormatNameW
EnumWindows
GetPropW
DestroyIcon
IntersectRect
ReleaseDC
GetSysColor
GetDC
UpdateWindow
SetRectEmpty
SetWindowPos
PtInRect
GetCursorPos
IsWindowVisible
CopyRect
DrawIcon
wsprintfW
GetSystemMetrics
GetClientRect
SendMessageW
PostMessageW
SetWindowLongW
GetWindowLongW
SetPropW
LoadIconW
EnableWindow
SetTimer
InvalidateRect
IsIconic
KillTimer
GetWindowRect
IsWindow
LoadStringW
AdjustWindowRectEx

gdi32

ExtSelectClipRgn
DeleteDC
GetStockObject
SetWindowExtEx
GetMapMode
GetBkColor
GetTextColor
GetRgnBox
ScaleWindowExtEx
GetWindowExtEx
GetViewportExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
GetDeviceCaps
CreateFontIndirectW
GetObjectW
DeleteObject
SetMapMode
SetBkMode
RestoreDC
SaveDC
CreateRectRgnIndirect
CreateBitmap
SetBkColor
SetTextColor
GetClipBox
CopyMetaFileW

comdlg32

GetOpenFileNameW
GetFileTitleW

winspool.drv

DocumentPropertiesW
ClosePrinter
OpenPrinterW

advapi32

RegQueryValueW
RegOpenKeyW
RegEnumKeyW
GetUserNameW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteKeyW

shell32

SHGetFolderPathW
SHGetPathFromIDListW
ord25
ord152
SHGetFileInfoW

shlwapi

PathAppendW
PathQuoteSpacesW
PathUnExpandEnvStringsW
SHStrDupW
PathRemoveFileSpecW
PathFindFileNameW
PathFindExtensionW
PathStripToRootW
PathFileExistsW
PathIsUNCW

oledlg

OleUIBusyW

ole32

RevokeDragDrop
CoLockObjectExternal
RegisterDragDrop
OleDuplicateData
CoTaskMemAlloc
ReleaseStgMedium
OleGetClipboard
PropVariantClear
CreateStreamOnHGlobal
CoUninitialize
CoInitialize
CoCreateInstance
CoTaskMemFree
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CLSIDFromProgID
CLSIDFromString
CoGetClassObject
CoRevokeClassObject
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter
StgOpenStorageOnILockBytes
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes

oleaut32

VariantClear
SysAllocString
OleCreateFontIndirect
SystemTimeToVariantTime
SysAllocStringLen
VariantTimeToSystemTime
SafeArrayDestroy
VariantCopy
VariantInit
VariantChangeType
SysFreeString
SysStringLen

gdiplus

GdipGetImageWidth
GdipSetInterpolationMode
GdipDeleteGraphics
GdipCreateFromHDC
GdipGetImageHeight
GdipCloneImage
GdipAlloc
GdipFree
GdipLoadImageFromFileICM
GdipLoadImageFromFile
GdipDrawImageRectI
GdipLoadImageFromStream
GdipDisposeImage
GdiplusStartup
GdiplusShutdown
GdipLoadImageFromStreamICM

Sections

.text
Size: 289KB - Virtual size: 289KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 70KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 11KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 272KB - Virtual size: 352KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

2adc8aa1cd48fc5e8708144bcab958b6

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

58:41:07:27:95:e9:ef:2a:6e:fc:e6:68:4f:81:05:92Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

61:0c:12:06:00:00:00:00:00:1bCertificate

Key Usages

11:81:16:11:93:68:37:23:b3:06:a7:5f:62:bb:02:72:c3:68:34:feSigner

Headers

DLL Characteristics

File Characteristics

Imports

version

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

shlwapi

oledlg

ole32

oleaut32

gdiplus

Sections

.text Size: 289KB - Virtual size: 289KB

.rdata Size: 70KB - Virtual size: 70KB

.data Size: 11KB - Virtual size: 26KB

.rsrc Size: 272KB - Virtual size: 352KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

58:41:07:27:95:e9:ef:2a:6e:fc:e6:68:4f:81:05:92
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

11:81:16:11:93:68:37:23:b3:06:a7:5f:62:bb:02:72:c3:68:34:fe
Signer

.text
Size: 289KB - Virtual size: 289KB

.rdata
Size: 70KB - Virtual size: 70KB

.data
Size: 11KB - Virtual size: 26KB

.rsrc
Size: 272KB - Virtual size: 352KB