561c3d2c7b5528a5c92cfc535eb5d528_icedid_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

561c3d2c7b5528a5c92cfc535eb5d528_icedid_JC.exe
Size

1.5MB
MD5

561c3d2c7b5528a5c92cfc535eb5d528
SHA1

a29099006331cd634dedae900c0410195461b615
SHA256

16a41395f38cdb5191e2ebf00341c49f78606e2b5c073d616f9b55425f66f7c4
SHA512

d1f78e590156cbf648a5a6bf89db4d43d8c2246ce125e702bc6eaf05249432cb8b840bb4659eb682eff05beba4517eb27262c502c34d05c1bba72a2124b644ec
SSDEEP

24576:BguZ44GI3yONsqjnhMgeiCl7G0nehbGZpbD:BgwGIPDmg27RnWGj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
561c3d2c7b5528a5c92cfc535eb5d528_icedid_JC.exe

Files

561c3d2c7b5528a5c92cfc535eb5d528_icedid_JC.exe
.exe windows x86

a67a785bc1cec03a36396e875c296a1b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

tapi32

lineConfigDialogA
lineInitializeExA
lineNegotiateAPIVersion
lineAnswer
lineDrop
lineClose
lineShutdown
lineGetIDA
lineOpenA
lineGetDevCapsA

kernel32

TlsFree
GetModuleFileNameW
InterlockedDecrement
GetModuleHandleW
InterlockedIncrement
GlobalFlags
GetCPInfo
GetOEMCP
WritePrivateProfileStringA
FlushFileBuffers
SetEndOfFile
GetCurrentProcess
RtlUnwind
DeleteCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
GetStartupInfoA
VirtualAlloc
HeapReAlloc
ExitProcess
HeapSize
GetACP
IsValidCodePage
LCMapStringA
LCMapStringW
HeapCreate
VirtualFree
SetHandleCount
GetStdHandle
GetConsoleCP
GetConsoleMode
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
GetStringTypeA
GetStringTypeW
EnumSystemLocalesA
IsValidLocale
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
GetLocaleInfoW
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
SuspendThread
SetEvent
WaitForSingleObject
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
InterlockedExchange
GetCurrentProcessId
SetErrorMode
FreeResource
GetCurrentThreadId
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
CompareStringA
LoadLibraryA
FreeLibrary
lstrcmpW
GetProcAddress
GetVersionExA
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
FormatMessageA
LocalFree
MulDiv
SetLastError
CopyFileA
GetUserDefaultLCID
MultiByteToWideChar
GetPrivateProfileStringA
WinExec
CreateThread
SetThreadPriority
WaitForSingleObjectEx
ExitThread
GetModuleFileNameA
GetCommTimeouts
GetFileSize
CreateEventA
ResumeThread
lstrcmpA
lstrcpynA
CreateDirectoryA
lstrcatA
GetLocalTime
SetFileValidData
SetFilePointer
lstrcpyA
GetCurrentDirectoryA
SetCurrentDirectoryA
ReadFile
PurgeComm
GetTickCount
GetLastError
GetOverlappedResult
Sleep
HeapAlloc
GetProcessHeap
HeapFree
GetFileType
GetCommState
SetCommTimeouts
SetCommState
SetupComm
CreateFileA
lstrlenA
WriteFile
CloseHandle
FindFirstFileA
DeleteFileA
GetCommandLineA
GetModuleHandleA
WideCharToMultiByte
FindResourceA
LoadResource
LockResource
SizeofResource
TerminateProcess
CreateFileW

user32

SetCursor
EndPaint
BeginPaint
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
ClientToScreen
DestroyMenu
GetSysColorBrush
GetCursorPos
ValidateRect
GetWindowThreadProcessId
GetDesktopWindow
CreateDialogIndirectParamA
GetNextDlgTabItem
ReleaseDC
GetDC
IsWindowEnabled
IsDialogMessageA
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
ModifyMenuA
EnableMenuItem
CheckMenuItem
RegisterWindowMessageA
WinHelpA
GetCapture
SetWindowsHookExA
CallNextHookEx
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
IsWindow
GetWindowTextLengthA
GetWindowTextA
GetForegroundWindow
GetLastActivePopup
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageA
MapWindowPoints
SetMenu
SetForegroundWindow
GetClientRect
GetClassInfoExA
GetClassInfoA
GetSysColor
AdjustWindowRectEx
GetFocus
SendMessageA
EnableWindow
CopyRect
GetDlgCtrlID
CallWindowProcA
PtInRect
GetMenu
GetWindowLongA
SetWindowLongA
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
GetSystemMetrics
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
GetParent
LoadIconA
DestroyIcon
GetWindow
SetWindowPos
GetDlgItem
SetDlgItemInt
SetDlgItemTextA
CheckRadioButton
CheckDlgButton
SendDlgItemMessageA
SetWindowTextA
UpdateWindow
IsDlgButtonChecked
wsprintfA
SetTimer
KillTimer
MessageBoxA
GetActiveWindow
VkKeyScanA
ShowWindow
PostMessageA
EndDialog
GetDlgItemTextA
GetKeyState
LoadCursorA
RegisterClassA
CreateWindowExA
LoadAcceleratorsA
GetMessageA
TranslateAcceleratorA
TranslateMessage
DispatchMessageA
PostQuitMessage
DefWindowProcA
SetActiveWindow
CreateDialogParamA
DestroyWindow
GetDlgItemInt
SetFocus
IsWindowVisible
DialogBoxParamA
SendInput
MapVirtualKeyA
GetMessageExtraInfo

gdi32

CreateBitmap
GetObjectA
SetBkColor
SetTextColor
GetClipBox
GetDeviceCaps
GetStockObject
DeleteDC
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
TextOutA
RectVisible
PtVisible
SetMapMode
RestoreDC
SaveDC
DeleteObject
ExtTextOutA

comdlg32

GetSaveFileNameA

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter

advapi32

RegSetValueExA
RegEnumKeyA
RegDeleteKeyA
RegQueryValueA
RegOpenKeyA
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey

shell32

SHBrowseForFolderA
SHGetPathFromIDListA

shlwapi

PathRemoveFileSpecA
PathFindFileNameA
PathFindExtensionA
PathRemoveFileSpecW
PathAddBackslashA

ole32

CoInitializeEx
CoCreateInstance
CoUninitialize
CoTaskMemFree
CoTaskMemRealloc
CoInitialize

oleaut32

SysFreeString
VariantClear
SysAllocStringLen
GetErrorInfo
VariantInit
SafeArrayDestroy
VariantChangeType

Sections

.text
Size: 248KB - Virtual size: 248KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.2MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a67a785bc1cec03a36396e875c296a1b

Headers

DLL Characteristics

File Characteristics

Imports

tapi32

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

shlwapi

ole32

oleaut32

Sections

.text Size: 248KB - Virtual size: 248KB

.rdata Size: 52KB - Virtual size: 51KB

.data Size: 9KB - Virtual size: 66KB

.rsrc Size: 1.2MB - Virtual size: 1.8MB

.text
Size: 248KB - Virtual size: 248KB

.rdata
Size: 52KB - Virtual size: 51KB

.data
Size: 9KB - Virtual size: 66KB

.rsrc
Size: 1.2MB - Virtual size: 1.8MB