ice | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ice
Size

154KB
MD5

45dc71b96468e20b16c131c0cb8309a1
SHA1

888fa5c95bfd6858b1968b09166a6490780a42ef
SHA256

20f19bcf8067744d8d4bdd9c91130b074459e69afa6165d881d580ae34ec2adf
SHA512

805ebbcb1758a0763034047296198407d9909ca02c5fd8205d4017c45f5cb6318f370e8dbad82024a9d086d9bb99d5970b9d47024a68517b6c36dbad7e6662b7
SSDEEP

3072:Icr/FofJswK3occQ6FoqvjGMWtYdVU1WgKIKaqwHRULkolQB:N/FWBK3WVU1WgKIKaqwD0QB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ice

Files

ice
.dll windows x64

683d6b7c69e8049760f0793cb7a1e1a3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
RtlCaptureContext

Exports

Exports

tghttp2_check_header_name
tghttp2_check_header_value
tghttp2_hd_deflate_bound
tghttp2_hd_deflate_change_table_size
tghttp2_hd_deflate_del
tghttp2_hd_deflate_get_dynamic_table_size
tghttp2_hd_deflate_get_max_dynamic_table_size
tghttp2_hd_deflate_get_num_table_entries
tghttp2_hd_deflate_get_table_entry
tghttp2_hd_deflate_hd
tghttp2_hd_deflate_hd_vec
tghttp2_hd_deflate_new
tghttp2_hd_deflate_new2
tghttp2_hd_inflate_change_table_size
tghttp2_hd_inflate_del
tghttp2_hd_inflate_end_headers
tghttp2_hd_inflate_get_dynamic_table_size
tghttp2_hd_inflate_get_max_dynamic_table_size
tghttp2_hd_inflate_get_num_table_entries
tghttp2_hd_inflate_get_table_entry
tghttp2_hd_inflate_hd
tghttp2_hd_inflate_hd2
tghttp2_hd_inflate_new
tghttp2_hd_inflate_new2
tghttp2_http2_strerror
tghttp2_is_fatal
tghttp2_nv_compare_name
tghttp2_option_del
tghttp2_option_new
tghttp2_option_set_builtin_recv_extension_type
tghttp2_option_set_max_deflate_dynamic_table_size
tghttp2_option_set_max_reserved_remote_streams
tghttp2_option_set_max_send_header_block_length
tghttp2_option_set_no_auto_ping_ack
tghttp2_option_set_no_auto_window_update
tghttp2_option_set_no_closed_streams
tghttp2_option_set_no_http_messaging
tghttp2_option_set_no_recv_client_magic
tghttp2_option_set_peer_max_concurrent_streams
tghttp2_option_set_user_recv_extension_type
tghttp2_pack_settings_payload
tghttp2_priority_spec_check_default
tghttp2_priority_spec_default_init
tghttp2_priority_spec_init
tghttp2_rcbuf_decref
tghttp2_rcbuf_get_buf
tghttp2_rcbuf_incref
tghttp2_rcbuf_is_static
tghttp2_select_next_protocol
tghttp2_session_callbacks_del
tghttp2_session_callbacks_new
tghttp2_session_callbacks_set_before_frame_send_callback
tghttp2_session_callbacks_set_data_source_read_length_callback
tghttp2_session_callbacks_set_error_callback
tghttp2_session_callbacks_set_error_callback2
tghttp2_session_callbacks_set_on_begin_frame_callback
tghttp2_session_callbacks_set_on_begin_headers_callback
tghttp2_session_callbacks_set_on_data_chunk_recv_callback
tghttp2_session_callbacks_set_on_extension_chunk_recv_callback
tghttp2_session_callbacks_set_on_frame_not_send_callback
tghttp2_session_callbacks_set_on_frame_recv_callback
tghttp2_session_callbacks_set_on_frame_send_callback
tghttp2_session_callbacks_set_on_header_callback
tghttp2_session_callbacks_set_on_header_callback2
tghttp2_session_callbacks_set_on_invalid_frame_recv_callback
tghttp2_session_callbacks_set_on_invalid_header_callback
tghttp2_session_callbacks_set_on_invalid_header_callback2
tghttp2_session_callbacks_set_on_stream_close_callback
tghttp2_session_callbacks_set_pack_extension_callback
tghttp2_session_callbacks_set_recv_callback
tghttp2_session_callbacks_set_select_padding_callback
tghttp2_session_callbacks_set_send_callback
tghttp2_session_callbacks_set_send_data_callback
tghttp2_session_callbacks_set_unpack_extension_callback
tghttp2_session_change_stream_priority
tghttp2_session_check_request_allowed
tghttp2_session_check_server_session
tghttp2_session_client_new
tghttp2_session_client_new2
tghttp2_session_client_new3
tghttp2_session_consume
tghttp2_session_consume_connection
tghttp2_session_consume_stream
tghttp2_session_create_idle_stream
tghttp2_session_del
tghttp2_session_find_stream
tghttp2_session_get_effective_local_window_size
tghttp2_session_get_effective_recv_data_length
tghttp2_session_get_hd_deflate_dynamic_table_size
tghttp2_session_get_hd_inflate_dynamic_table_size
tghttp2_session_get_last_proc_stream_id
tghttp2_session_get_local_settings
tghttp2_session_get_local_window_size
tghttp2_session_get_next_stream_id
tghttp2_session_get_outbound_queue_size
tghttp2_session_get_remote_settings
tghttp2_session_get_remote_window_size
tghttp2_session_get_root_stream
tghttp2_session_get_stream_effective_local_window_size
tghttp2_session_get_stream_effective_recv_data_length
tghttp2_session_get_stream_local_close
tghttp2_session_get_stream_local_window_size
tghttp2_session_get_stream_remote_close
tghttp2_session_get_stream_remote_window_size
tghttp2_session_get_stream_user_data
tghttp2_session_mem_recv
tghttp2_session_mem_send
tghttp2_session_recv
tghttp2_session_resume_data
tghttp2_session_send
tghttp2_session_server_new
tghttp2_session_server_new2
tghttp2_session_server_new3
tghttp2_session_set_local_window_size
tghttp2_session_set_next_stream_id
tghttp2_session_set_stream_user_data
tghttp2_session_set_user_data
tghttp2_session_terminate_session
tghttp2_session_terminate_session2
tghttp2_session_upgrade
tghttp2_session_upgrade2
tghttp2_session_want_read
tghttp2_session_want_write
tghttp2_set_debug_vprintf_callback
tghttp2_stream_get_first_child
tghttp2_stream_get_next_sibling
tghttp2_stream_get_parent
tghttp2_stream_get_previous_sibling
tghttp2_stream_get_state
tghttp2_stream_get_stream_id
tghttp2_stream_get_sum_dependency_weight
tghttp2_stream_get_weight
tghttp2_strerror
tghttp2_submit_altsvc
tghttp2_submit_data
tghttp2_submit_extension
tghttp2_submit_goaway
tghttp2_submit_headers
tghttp2_submit_origin
tghttp2_submit_ping
tghttp2_submit_priority
tghttp2_submit_push_promise
tghttp2_submit_request
tghttp2_submit_response
tghttp2_submit_rst_stream
tghttp2_submit_settings
tghttp2_submit_shutdown_notice
tghttp2_submit_trailer
tghttp2_submit_window_update
vcab

Sections

.text
Size: 77KB - Virtual size: 77KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

683d6b7c69e8049760f0793cb7a1e1a3

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.text Size: 77KB - Virtual size: 77KB

.rdata Size: 48KB - Virtual size: 47KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 5KB - Virtual size: 5KB

.gfids Size: 512B - Virtual size: 16B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 20KB - Virtual size: 17KB

.text
Size: 77KB - Virtual size: 77KB

.rdata
Size: 48KB - Virtual size: 47KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 5KB - Virtual size: 5KB

.gfids
Size: 512B - Virtual size: 16B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 20KB - Virtual size: 17KB