b36ee1b6e62a6244e765fe39a06bd689_icedid_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

b36ee1b6e62a6244e765fe39a06bd689_icedid_JC.exe
Size

3.5MB
MD5

b36ee1b6e62a6244e765fe39a06bd689
SHA1

215f0590a874c386bd21ec7f590cdc3aa1e0c3e1
SHA256

ff080c70631de5c535d4694fc5251e4fa0d10e4e7210d1c0615810db3b398d1e
SHA512

21013e9c20f26b1402bad0df1a1b579181215441ac46390e2484d92bc513b57d09a9b455e3da97752cab564bbc309404cfadb4651a99b9037ab16e9c0ad12822
SSDEEP

49152:j2i/ASFEkcl6vCrS3aydfAQ+ENDbdkOh7YI:SkASFal6vBWuY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b36ee1b6e62a6244e765fe39a06bd689_icedid_JC.exe

Files

b36ee1b6e62a6244e765fe39a06bd689_icedid_JC.exe
.exe windows x86

d04389e9f14c6a172ec21b00746544a9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

psapi

GetModuleFileNameExA

kernel32

LockFile
UnlockFile
GetFullPathNameA
SetErrorMode
FileTimeToLocalFileTime
GetFileSizeEx
GetFileTime
RtlUnwind
HeapFree
HeapAlloc
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
GetCommandLineA
GetStartupInfoA
VirtualProtect
VirtualAlloc
GetSystemInfo
HeapReAlloc
HeapSize
GetACP
IsValidCodePage
LCMapStringA
HeapCreate
VirtualFree
GetStdHandle
GetTimeZoneInformation
InitializeCriticalSectionAndSpinCount
GetConsoleCP
GetConsoleMode
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetProcessHeap
CompareStringW
SetEnvironmentVariableA
GetCurrentDirectoryA
GetThreadLocale
GetModuleHandleW
GetOEMCP
GetCPInfo
InterlockedIncrement
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
GlobalFlags
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
InterlockedExchange
lstrcmpA
InterlockedDecrement
GetModuleFileNameW
MulDiv
lstrlenA
GetCurrentThreadId
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
CompareStringA
lstrcmpW
GlobalLock
GlobalUnlock
GetExitCodeThread
GetExitCodeProcess
SetEvent
OpenEventA
UnmapViewOfFile
CreateFileMappingA
MapViewOfFile
CreateEventA
QueryDosDeviceA
ConnectNamedPipe
DisconnectNamedPipe
LocalAlloc
CreateNamedPipeA
GetPrivateProfileIntA
FindNextFileA
GetVersion
SetLastError
FormatMessageA
WaitForSingleObject
TerminateProcess
IsBadReadPtr
DeviceIoControl
GlobalAlloc
GlobalFree
ProcessIdToSessionId
CreateMutexA
ReleaseMutex
GetCurrentProcessId
GetSystemDefaultLCID
VirtualQuery
MultiByteToWideChar
MoveFileExA
FindFirstFileA
FindClose
FileTimeToSystemTime
GetFileAttributesA
FlushFileBuffers
GetDiskFreeSpaceExA
ExitProcess
GetTickCount
CreateThread
LocalFree
GetDriveTypeA
SetEndOfFile
WriteFile
FreeResource
GetFileSize
GetLocalTime
Sleep
GetWindowsDirectoryA
GetSystemDirectoryA
GetModuleHandleA
GetCurrentProcess
DuplicateHandle
WritePrivateProfileStringA
GetVersionExA
Beep
ReadFile
SetFilePointer
DeleteFileA
CreateFileA
GetVolumeInformationA
SetVolumeLabelA
GetPrivateProfileStringA
WideCharToMultiByte
LoadResource
LockResource
SizeofResource
FindResourceA
CreateProcessA
GetLastError
OpenProcess
GetModuleFileNameA
CloseHandle
OutputDebugStringA
LoadLibraryA
GetProcAddress
QueryDosDeviceW
FreeLibrary
LCMapStringW

user32

CopyAcceleratorTableA
CharNextA
CharUpperA
ReleaseCapture
SetCapture
UnregisterClassA
GetSysColorBrush
SetWindowContextHelpId
MapDialogRect
GetMessageA
TranslateMessage
ValidateRect
PostQuitMessage
DestroyMenu
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
ShowWindow
MoveWindow
IsDialogMessageA
SetDlgItemTextA
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
ModifyMenuA
GetMenuState
EnableMenuItem
CheckMenuItem
SendDlgItemMessageA
WinHelpA
IsChild
GetCapture
CallNextHookEx
IsRectEmpty
SetPropA
GetPropA
RemovePropA
GetFocus
SetFocus
GetWindowTextLengthA
GetForegroundWindow
GetLastActivePopup
DispatchMessageA
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageA
MapWindowPoints
GetKeyState
SetMenu
RegisterClipboardFormatA
IsWindowVisible
UpdateWindow
GetMenuItemCount
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
GetSysColor
AdjustWindowRectEx
ScreenToClient
EqualRect
CopyRect
PtInRect
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
GetMenu
SetWindowPos
OffsetRect
IntersectRect
GetWindowPlacement
GetWindow
GetDesktopWindow
GetActiveWindow
SetRect
InvalidateRgn
GetNextDlgGroupItem
MessageBeep
SetActiveWindow
CreateDialogIndirectParamA
PostThreadMessageA
GetClassLongA
SetWindowsHookExA
GetWindowThreadProcessId
FindWindowA
EnableWindow
GetWindowRect
GetClientRect
SendMessageA
LoadBitmapA
GetSystemMetrics
SystemParametersInfoA
MessageBoxA
SendMessageTimeoutA
LoadIconA
SetWindowLongA
GetWindowLongA
AppendMenuA
GetSystemMenu
DrawIcon
IsIconic
InvalidateRect
SetCursor
LoadCursorA
GetClassNameA
RedrawWindow
PostMessageA
EnumWindows
EnumChildWindows
GetWindowTextA
RegisterWindowMessageA
wsprintfA
IsWindow
TrackPopupMenu
SetForegroundWindow
GetCursorPos
SetMenuDefaultItem
GetMenuItemID
GetSubMenu
DestroyWindow
GetDlgItem
IsWindowEnabled
GetParent
GetNextDlgTabItem
EndDialog
LoadMenuA
SetWindowTextA

gdi32

GetMapMode
GetBkColor
GetTextColor
GetRgnBox
CreateRectRgnIndirect
GetDeviceCaps
DeleteDC
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
Escape
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
CreateCompatibleDC
GetObjectA
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetWindowExtEx
GetViewportExtEx
DeleteObject
SetMapMode
SetBkMode
RestoreDC
SaveDC
BitBlt
CreateBitmap
SetBkColor
SetTextColor
GetClipBox
CreateFontA
GetStockObject
StretchBlt
SelectObject

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

OpenSCManagerA
RegSetValueExA
RegQueryValueA
RegOpenKeyA
RegEnumKeyA
RegDeleteKeyA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegCreateKeyExA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
CreateProcessAsUserA
DeleteService
ControlService
OpenServiceA
StartServiceA
CreateServiceA
CloseServiceHandle
AllocateAndInitializeSid
GetAclInformation
GetAce
EqualSid
FreeSid
RegOpenKeyExA
RegQueryValueExA
RegCloseKey

shell32

ShellExecuteA
SHGetFileInfoA
ShellExecuteExA
ord680
Shell_NotifyIconA
SHChangeNotify

comctl32

ord17

shlwapi

PathFindFileNameA
PathStripToRootA
PathIsUNCA
PathFindExtensionA

oledlg

ord8

ole32

StgOpenStorageOnILockBytes
CoGetClassObject
CLSIDFromString
CLSIDFromProgID
CoTaskMemAlloc
StgCreateDocfileOnILockBytes
CoTaskMemFree
CoCreateGuid
CreateILockBytesOnHGlobal
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CoRevokeClassObject
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter

oleaut32

VariantClear
VariantChangeType
VariantInit
SysAllocStringLen
SysStringLen
SysFreeString
SysAllocStringByteLen
VariantCopy
SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
OleCreateFontIndirect
SysAllocString

setupapi

SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsA
CM_Request_Device_EjectW
CM_Get_Parent
SetupDiGetDeviceInterfaceDetailA

ws2_32

connect
__WSAFDIsSet
recv
ioctlsocket
htons
inet_addr
select
send
socket
closesocket

Sections

.text
Size: 428KB - Virtual size: 427KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 89KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d04389e9f14c6a172ec21b00746544a9

Headers

DLL Characteristics

File Characteristics

Imports

psapi

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

setupapi

ws2_32

Sections

.text Size: 428KB - Virtual size: 427KB

.rdata Size: 89KB - Virtual size: 89KB

.data Size: 13KB - Virtual size: 46KB

.rsrc Size: 3.0MB - Virtual size: 3.0MB

.text
Size: 428KB - Virtual size: 427KB

.rdata
Size: 89KB - Virtual size: 89KB

.data
Size: 13KB - Virtual size: 46KB

.rsrc
Size: 3.0MB - Virtual size: 3.0MB