da63fc14caf892be37b9707fd2187999_icedid_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

da63fc14caf892be37b9707fd2187999_icedid_JC.exe
Size

676KB
MD5

da63fc14caf892be37b9707fd2187999
SHA1

396619b000e4035dc3edabf462b1126fd1f062bd
SHA256

ebbb8e0380649259961c15957d9951291e1a50e866b721676a4e777b109cdaf7
SHA512

13223394de1741bca2ccdf5d482e1f2d65136eb54fddf5350e8871d7f2954e601b023b271e8d7633f16bd70d7b0769df8cbedc4c5eb7c31aa5cde84e3f083711
SSDEEP

12288:g+3ULVaWCeyXMM4e43MYeTrnTzeRAjfKIpm53xUMWf:xWCeyXWCPeRAjfNpTMy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
da63fc14caf892be37b9707fd2187999_icedid_JC.exe

Files

da63fc14caf892be37b9707fd2187999_icedid_JC.exe
.exe windows x86

5a88c54400459c148ffc4e8236068e06

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameA
GetFileAttributesA
GetSystemDirectoryA
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
CloseHandle
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileTime
CreateFileA
GetVersionExA
Sleep
GetFileSize
MultiByteToWideChar
GetLastError
SetLastError
GetModuleHandleA
GetCommandLineA
InterlockedDecrement
SetFileAttributesA
RemoveDirectoryA
GetPrivateProfileStringA
WritePrivateProfileStringA
GetCurrentThreadId
InterlockedExchange
GetVersion
CompareStringW
CompareStringA
CreateDirectoryA
CreateMailslotA
ReadFile
TerminateThread
GetQueuedCompletionStatus
CreateIoCompletionPort
CreateThread
GetProcessHeap
HeapAlloc
PostQueuedCompletionStatus
HeapFree
ReadDirectoryChangesW
TerminateProcess
OpenProcess
GetCurrentProcessId
WriteFile
CreateToolhelp32Snapshot
Process32First
Process32Next
GetSystemInfo
GetDiskFreeSpaceExA
GetVolumeInformationA
lstrlenA
SetEnvironmentVariableA
GetLocaleInfoW
CreateProcessA
GetExitCodeProcess
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
LoadResource
LockResource
SizeofResource
FindResourceA
WideCharToMultiByte
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
LocalFree
FormatMessageA
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalFree
LoadLibraryA
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
FreeLibrary
LocalAlloc
MoveFileA
SetFilePointer
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
GetThreadLocale
DuplicateHandle
GetCurrentProcess
GetFullPathNameA
GetProcAddress
SetErrorMode
GlobalDeleteAtom
lstrcmpA
GetLocaleInfoA
EnumResourceLanguagesA
ConvertDefaultLocale
GetCurrentThread
WaitForSingleObject
TlsGetValue
GlobalReAlloc
GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
GetModuleFileNameW
GlobalGetAtomNameA
InterlockedIncrement
lstrcmpW
GlobalFindAtomA
GlobalAddAtomA
GetCurrentDirectoryA
GlobalFlags
GetCPInfo
GetOEMCP
RtlUnwind
RaiseException
GetSystemTimeAsFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetDriveTypeA
VirtualAlloc
HeapReAlloc
SetStdHandle
GetFileType
ExitProcess
HeapSize
GetACP
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
SetHandleCount
GetStdHandle
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
FreeEnvironmentStringsA
CreateFileW

user32

GetWindow
GetWindowRect
GetWindowPlacement
IsIconic
SystemParametersInfoA
SetWindowPos
SetWindowLongA
CallWindowProcA
DefWindowProcA
GetDlgCtrlID
PtInRect
CopyRect
AdjustWindowRectEx
RegisterClassA
GetClassInfoA
GetClassInfoExA
CreateWindowExA
GetMenu
GetClientRect
SetForegroundWindow
MapWindowPoints
GetMessagePos
GetMessageTime
GetSysColor
GetTopWindow
GetDlgItem
GetForegroundWindow
IsWindow
RemovePropA
GetPropA
SetPropA
GetClassNameA
GetClassLongA
GetCapture
WinHelpA
LoadIconA
RegisterWindowMessageA
SetCursor
SetWindowTextA
ShowWindow
UnregisterClassA
DestroyMenu
GetSysColorBrush
GetWindowTextA
UnhookWindowsHookEx
GetWindowThreadProcessId
GetWindowLongA
GetLastActivePopup
IsWindowEnabled
EnableWindow
MessageBoxA
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
GetFocus
GetParent
ModifyMenuA
ClientToScreen
DispatchMessageA
TranslateMessage
PeekMessageA
CharUpperA
GrayStringA
DrawTextExA
EnableMenuItem
CheckMenuItem
SetWindowsHookExA
CallNextHookEx
GetMessageA
GetActiveWindow
IsWindowVisible
SendMessageA
GetKeyState
GetCursorPos
ValidateRect
PostMessageA
PostQuitMessage
GetSystemMetrics
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
DrawTextA
TabbedTextOutA
LoadCursorA
GetDC
ReleaseDC
wsprintfA
DestroyWindow

advapi32

ChangeServiceConfig2A
QueryServiceStatus
StartServiceA
ControlService
SetServiceStatus
RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA
RegisterEventSourceA
ReportEventA
DeleteService
CreateServiceA
RegCreateKeyA
OpenSCManagerA
OpenServiceA
CloseServiceHandle
DeregisterEventSource
RegCreateKeyExA
RegSetValueExA
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
RegOpenKeyA
RegDeleteKeyA
RegCloseKey
RegEnumKeyA
RegQueryValueA

shell32

SHFileOperationA
ShellExecuteA

ole32

CoInitialize
CoUninitialize

oleaut32

VariantChangeType
VarBstrCmp
SysAllocStringLen
VariantInit
VariantClear
SysAllocString
SysFreeString

shlwapi

PathFindExtensionA
PathFindFileNameA
PathIsUNCA
UrlUnescapeA
PathStripToRootA

netapi32

Netbios
NetLocalGroupDelMembers
NetLocalGroupGetMembers
NetUserDel
NetUserGetInfo
NetUserEnum
NetApiBufferFree
NetUserSetInfo

ws2_32

WSACleanup
gethostbyname
WSAStartup
inet_ntoa
gethostname
ntohs

iphlpapi

GetTcpTable
SetTcpEntry

wininet

HttpQueryInfoA
InternetGetLastResponseInfoA
InternetOpenA
InternetSetStatusCallback
InternetSetFilePointer
InternetWriteFile
InternetCrackUrlA
InternetCanonicalizeUrlA
InternetQueryOptionA
InternetReadFile
InternetQueryDataAvailable
InternetOpenUrlA
InternetCloseHandle

activeds

ord4
ord6
ord5
ord3

wtsapi32

WTSEnumerateSessionsA
WTSFreeMemory
WTSLogoffSession
WTSQuerySessionInformationA

gdi32

CreateBitmap
SaveDC
RestoreDC
SetBkColor
SetTextColor
SetMapMode
GetClipBox
DeleteObject
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
DeleteDC
GetStockObject
GetDeviceCaps

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

comdlg32

GetFileTitleA

Sections

.text
Size: 532KB - Virtual size: 530KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 88KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 38.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 40KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5a88c54400459c148ffc4e8236068e06

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

netapi32

ws2_32

iphlpapi

wininet

activeds

wtsapi32

gdi32

winspool.drv

comdlg32

Sections

.text Size: 532KB - Virtual size: 530KB

.rdata Size: 88KB - Virtual size: 86KB

.data Size: 12KB - Virtual size: 38.1MB

.rsrc Size: 40KB - Virtual size: 36KB

.text
Size: 532KB - Virtual size: 530KB

.rdata
Size: 88KB - Virtual size: 86KB

.data
Size: 12KB - Virtual size: 38.1MB

.rsrc
Size: 40KB - Virtual size: 36KB