64d0e5d4c288ee64077f3cc13b6871d6_icedid_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

64d0e5d4c288ee64077f3cc13b6871d6_icedid_JC.exe
Size

1.8MB
MD5

64d0e5d4c288ee64077f3cc13b6871d6
SHA1

4a48bc19e185fd898b9e8ba727e4799c4f45a9dc
SHA256

12d250733105bc15dfc83a918ea81a3d98fb59781152b527cc1ee4c082ae7a6e
SHA512

030edc1fb9cb69aee956843274883a90d9b08feeccebc4b5c10f65f8ddf36e3caf67bd8502d605fda074b468f5f59e895c483e73f1905700889689dce0917a60
SSDEEP

12288:Ql4OMr1kQFO1zCT499ZWkDTOsmb6Ot5ei3ng+HKApkiaxaLs9KlbLkuQ7Jd9lTHl:WnXGkOzgiXgaKAsxaIKmuIvDBAglgTY

Score

1^/10

Malware Config

Signatures

Files

64d0e5d4c288ee64077f3cc13b6871d6_icedid_JC.exe
.exe windows x86

302c61d4a25e222ca4c3079310d682a9

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2a:6a:d4:4a:46:42:fb:73:94:2c:a2:b9:2d:eb:3d:34
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

20/04/2006, 00:00

Not After

22/06/2009, 23:59

Subject

CN=Nero AG,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=LEGAL DEPARTMENT,O=Nero AG,L=Karlsbad,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

ee:ec:8e:1c:dd:d6:9e:3f:99:71:a6:c8:61:df:26:f7:91:53:9c:c7
Signer

Actual PE Digest

ee:ec:8e:1c:dd:d6:9e:3f:99:71:a6:c8:61:df:26:f7:91:53:9c:c7

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

TlsFree
GlobalFlags
InterlockedIncrement
GetCPInfo
GetOEMCP
SetErrorMode
GetTickCount
HeapFree
HeapAlloc
VirtualAlloc
GetSystemInfo
VirtualQuery
GetStartupInfoA
ExitProcess
RtlUnwind
HeapReAlloc
GetTimeFormatA
GetDateFormatA
GetSystemTimeAsFileTime
TerminateProcess
SetStdHandle
GetFileType
LocalReAlloc
LCMapStringA
LCMapStringW
HeapDestroy
HeapCreate
VirtualFree
IsBadWritePtr
GetStringTypeA
GetStringTypeW
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
QueryPerformanceCounter
GetCurrentProcessId
SetUnhandledExceptionFilter
GetTimeZoneInformation
IsBadCodePtr
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
SetEnvironmentVariableA
GetLocaleInfoW
TlsSetValue
TlsAlloc
TlsGetValue
GlobalHandle
GlobalReAlloc
GetFullPathNameA
GetVolumeInformationA
DuplicateHandle
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
LocalAlloc
GetFileSize
FileTimeToLocalFileTime
FileTimeToSystemTime
VirtualProtect
GlobalGetAtomNameA
lstrcmpW
InterlockedDecrement
WritePrivateProfileStringA
GetCurrentThread
lstrcmpA
ConvertDefaultLocale
EnumResourceLanguagesA
MulDiv
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
lstrcpynA
GetCurrentThreadId
GlobalDeleteAtom
GlobalAddAtomA
GlobalFindAtomA
GetCurrentDirectoryA
GetDriveTypeA
GetCommandLineA
GetExitCodeProcess
CreateProcessA
GetFileTime
CreateFileA
GetCurrentProcess
GetTempPathA
SetFileAttributesA
CreateDirectoryA
GetSystemDirectoryA
SetLastError
FindClose
GetUserDefaultLCID
GetSystemDefaultLangID
FreeResource
lstrcatA
WinExec
GetFileAttributesA
GetUserDefaultLangID
GetWindowsDirectoryA
lstrcpyA
LeaveCriticalSection
EnterCriticalSection
IsBadReadPtr
FormatMessageA
LocalFree
GetLongPathNameA
SetThreadLocale
GetModuleFileNameA
GetModuleHandleA
GetVersion
DeleteCriticalSection
CompareStringA
lstrcmpiA
RaiseException
lstrlenW
CompareStringW
GetEnvironmentVariableA
InitializeCriticalSection
lstrlenA
MultiByteToWideChar
CopyFileA
MoveFileA
WaitForSingleObject
DeleteFileA
OutputDebugStringA
Sleep
CloseHandle
GetLastError
CreateMutexA
FindFirstFileA
FreeLibrary
GetProcAddress
FindResourceA
LoadResource
LockResource
SizeofResource
WideCharToMultiByte
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
HeapSize
LoadLibraryA

user32

GetNextDlgGroupItem
InvalidateRgn
CopyAcceleratorTableA
IsRectEmpty
CharNextA
WindowFromPoint
MoveWindow
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
RegisterWindowMessageA
GetCapture
GetClassLongA
SetPropA
GetPropA
RemovePropA
SendDlgItemMessageA
GetForegroundWindow
GetMessageTime
GetMessagePos
MapWindowPoints
GetMenu
AdjustWindowRectEx
EqualRect
GetClassInfoA
RegisterClassA
CallWindowProcA
IntersectRect
GetWindowPlacement
CopyRect
GetLastActivePopup
UnhookWindowsHookEx
SetWindowsHookExA
CallNextHookEx
PeekMessageA
DestroyMenu
ModifyMenuA
EnableMenuItem
CheckMenuItem
GetMenuCheckMarkDimensions
LoadBitmapA
SetWindowContextHelpId
SetWindowPos
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamA
GetDlgItem
GetNextDlgTabItem
EndDialog
DispatchMessageA
TranslateMessage
GetWindowTextLengthA
GetMessageA
UpdateWindow
ShowWindow
DefWindowProcA
PostQuitMessage
SetFocus
CreateWindowExA
GetClassInfoExA
SetForegroundWindow
BringWindowToTop
DrawIcon
IsIconic
wsprintfA
LoadIconA
ExitWindowsEx
FindWindowA
GetTopWindow
SetWindowTextA
WaitForInputIdle
GetDesktopWindow
GetDlgCtrlID
GetWindowLongA
GetClassNameA
GetWindowTextA
IsWindowEnabled
IsDialogMessageA
IsWindowVisible
MapDialogRect
GetWindow
KillTimer
GetCursorPos
SetWindowLongA
PostThreadMessageA
SetTimer
MessageBeep
CopyIcon
DestroyCursor
SetCursor
RedrawWindow
GetWindowRect
DrawFocusRect
InflateRect
SetRectEmpty
PtInRect
GetKeyState
WinHelpA
GetParent
IsChild
RegisterClipboardFormatA
ValidateRect
GetFocus
ScreenToClient
PostMessageA
SendMessageA
MessageBoxA
GetSystemMetrics
SystemParametersInfoA
GetSysColor
EnableWindow
ReleaseCapture
GetSysColorBrush
LoadCursorA
IsWindow
DestroyWindow
SetCapture
InvalidateRect
ReleaseDC
GetDC
GetClientRect
OffsetRect
SetRect
CharUpperA
UnregisterClassA
SetMenuItemBitmaps

gdi32

GetRgnBox
GetMapMode
CreateRectRgnIndirect
GetWindowExtEx
GetViewportExtEx
GetTextColor
GetBkColor
CreateSolidBrush
DeleteDC
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
Escape
ExtTextOutA
RectVisible
PtVisible
CreateFontIndirectA
SetMapMode
SetBkMode
RestoreDC
SaveDC
SetBkColor
SetTextColor
GetClipBox
CreateBitmap
GetDeviceCaps
DeleteObject
SelectObject
GetTextExtentPointA
SetTextJustification
TextOutA
GetStockObject
GetObjectA
GetTextExtentPoint32A
CreateFontA

comdlg32

GetFileTitleA

winspool.drv

ClosePrinter
OpenPrinterA
DocumentPropertiesA

advapi32

RegEnumKeyA
RegQueryValueExA
RegOpenKeyExA
RegQueryValueA
RegCreateKeyExA
RegSetValueExA
RegDeleteValueA
RegEnumKeyExA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyA
RegCloseKey
RegQueryInfoKeyA
RegDeleteKeyA
RegEnumValueA

shell32

ord680
SHFileOperationA
ShellExecuteA

comctl32

ord17

shlwapi

PathFileExistsA
PathIsDirectoryA
SHCopyKeyA
SHDeleteKeyA
PathFindExtensionA
PathFindFileNameA
PathStripToRootA
PathIsUNCA

oledlg

ord8

ole32

CoFreeUnusedLibraries
CoInitialize
CoCreateInstance
CoUninitialize
CoTaskMemFree
CoTaskMemAlloc
OleUninitialize
CLSIDFromProgID
CLSIDFromString
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
CoRegisterMessageFilter
OleFlushClipboard
OleIsCurrentClipboard
CoRevokeClassObject
OleInitialize

oleaut32

OleCreateFontIndirect
SafeArrayDestroy
VariantCopy
VariantInit
VariantChangeType
SysAllocStringByteLen
SysStringLen
SystemTimeToVariantTime
VarBstrFromDate
SysAllocStringLen
SysFreeString
VariantClear
SysAllocString

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

msi

ord17
ord124
ord103
ord8

Sections

.text
Size: 348KB - Virtual size: 346KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 92KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

302c61d4a25e222ca4c3079310d682a9

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

2a:6a:d4:4a:46:42:fb:73:94:2c:a2:b9:2d:eb:3d:34Certificate

Extended Key Usages

Key Usages

ee:ec:8e:1c:dd:d6:9e:3f:99:71:a6:c8:61:df:26:f7:91:53:9c:c7Signer

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

version

msi

Sections

.text Size: 348KB - Virtual size: 346KB

.rdata Size: 92KB - Virtual size: 89KB

.data Size: 12KB - Virtual size: 25KB

.rsrc Size: 1.3MB - Virtual size: 1.3MB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

2a:6a:d4:4a:46:42:fb:73:94:2c:a2:b9:2d:eb:3d:34
Certificate

ee:ec:8e:1c:dd:d6:9e:3f:99:71:a6:c8:61:df:26:f7:91:53:9c:c7
Signer

.text
Size: 348KB - Virtual size: 346KB

.rdata
Size: 92KB - Virtual size: 89KB

.data
Size: 12KB - Virtual size: 25KB

.rsrc
Size: 1.3MB - Virtual size: 1.3MB