Static task
static1
Behavioral task
behavioral1
Sample
da63fc14caf892be37b9707fd2187999_icedid_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
da63fc14caf892be37b9707fd2187999_icedid_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
da63fc14caf892be37b9707fd2187999_icedid_JC.exe
-
Size
676KB
-
MD5
da63fc14caf892be37b9707fd2187999
-
SHA1
396619b000e4035dc3edabf462b1126fd1f062bd
-
SHA256
ebbb8e0380649259961c15957d9951291e1a50e866b721676a4e777b109cdaf7
-
SHA512
13223394de1741bca2ccdf5d482e1f2d65136eb54fddf5350e8871d7f2954e601b023b271e8d7633f16bd70d7b0769df8cbedc4c5eb7c31aa5cde84e3f083711
-
SSDEEP
12288:g+3ULVaWCeyXMM4e43MYeTrnTzeRAjfKIpm53xUMWf:xWCeyXWCPeRAjfNpTMy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource da63fc14caf892be37b9707fd2187999_icedid_JC.exe
Files
-
da63fc14caf892be37b9707fd2187999_icedid_JC.exe.exe windows x86
5a88c54400459c148ffc4e8236068e06
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleFileNameA
GetFileAttributesA
GetSystemDirectoryA
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
CloseHandle
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileTime
CreateFileA
GetVersionExA
Sleep
GetFileSize
MultiByteToWideChar
GetLastError
SetLastError
GetModuleHandleA
GetCommandLineA
InterlockedDecrement
SetFileAttributesA
RemoveDirectoryA
GetPrivateProfileStringA
WritePrivateProfileStringA
GetCurrentThreadId
InterlockedExchange
GetVersion
CompareStringW
CompareStringA
CreateDirectoryA
CreateMailslotA
ReadFile
TerminateThread
GetQueuedCompletionStatus
CreateIoCompletionPort
CreateThread
GetProcessHeap
HeapAlloc
PostQueuedCompletionStatus
HeapFree
ReadDirectoryChangesW
TerminateProcess
OpenProcess
GetCurrentProcessId
WriteFile
CreateToolhelp32Snapshot
Process32First
Process32Next
GetSystemInfo
GetDiskFreeSpaceExA
GetVolumeInformationA
lstrlenA
SetEnvironmentVariableA
GetLocaleInfoW
CreateProcessA
GetExitCodeProcess
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
LoadResource
LockResource
SizeofResource
FindResourceA
WideCharToMultiByte
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
LocalFree
FormatMessageA
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalFree
LoadLibraryA
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
FreeLibrary
LocalAlloc
MoveFileA
SetFilePointer
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
GetThreadLocale
DuplicateHandle
GetCurrentProcess
GetFullPathNameA
GetProcAddress
SetErrorMode
GlobalDeleteAtom
lstrcmpA
GetLocaleInfoA
EnumResourceLanguagesA
ConvertDefaultLocale
GetCurrentThread
WaitForSingleObject
TlsGetValue
GlobalReAlloc
GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
GetModuleFileNameW
GlobalGetAtomNameA
InterlockedIncrement
lstrcmpW
GlobalFindAtomA
GlobalAddAtomA
GetCurrentDirectoryA
GlobalFlags
GetCPInfo
GetOEMCP
RtlUnwind
RaiseException
GetSystemTimeAsFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetDriveTypeA
VirtualAlloc
HeapReAlloc
SetStdHandle
GetFileType
ExitProcess
HeapSize
GetACP
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
SetHandleCount
GetStdHandle
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
FreeEnvironmentStringsA
CreateFileW
user32
GetWindow
GetWindowRect
GetWindowPlacement
IsIconic
SystemParametersInfoA
SetWindowPos
SetWindowLongA
CallWindowProcA
DefWindowProcA
GetDlgCtrlID
PtInRect
CopyRect
AdjustWindowRectEx
RegisterClassA
GetClassInfoA
GetClassInfoExA
CreateWindowExA
GetMenu
GetClientRect
SetForegroundWindow
MapWindowPoints
GetMessagePos
GetMessageTime
GetSysColor
GetTopWindow
GetDlgItem
GetForegroundWindow
IsWindow
RemovePropA
GetPropA
SetPropA
GetClassNameA
GetClassLongA
GetCapture
WinHelpA
LoadIconA
RegisterWindowMessageA
SetCursor
SetWindowTextA
ShowWindow
UnregisterClassA
DestroyMenu
GetSysColorBrush
GetWindowTextA
UnhookWindowsHookEx
GetWindowThreadProcessId
GetWindowLongA
GetLastActivePopup
IsWindowEnabled
EnableWindow
MessageBoxA
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
GetFocus
GetParent
ModifyMenuA
ClientToScreen
DispatchMessageA
TranslateMessage
PeekMessageA
CharUpperA
GrayStringA
DrawTextExA
EnableMenuItem
CheckMenuItem
SetWindowsHookExA
CallNextHookEx
GetMessageA
GetActiveWindow
IsWindowVisible
SendMessageA
GetKeyState
GetCursorPos
ValidateRect
PostMessageA
PostQuitMessage
GetSystemMetrics
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
DrawTextA
TabbedTextOutA
LoadCursorA
GetDC
ReleaseDC
wsprintfA
DestroyWindow
advapi32
ChangeServiceConfig2A
QueryServiceStatus
StartServiceA
ControlService
SetServiceStatus
RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA
RegisterEventSourceA
ReportEventA
DeleteService
CreateServiceA
RegCreateKeyA
OpenSCManagerA
OpenServiceA
CloseServiceHandle
DeregisterEventSource
RegCreateKeyExA
RegSetValueExA
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
RegOpenKeyA
RegDeleteKeyA
RegCloseKey
RegEnumKeyA
RegQueryValueA
shell32
SHFileOperationA
ShellExecuteA
ole32
CoInitialize
CoUninitialize
oleaut32
VariantChangeType
VarBstrCmp
SysAllocStringLen
VariantInit
VariantClear
SysAllocString
SysFreeString
shlwapi
PathFindExtensionA
PathFindFileNameA
PathIsUNCA
UrlUnescapeA
PathStripToRootA
netapi32
Netbios
NetLocalGroupDelMembers
NetLocalGroupGetMembers
NetUserDel
NetUserGetInfo
NetUserEnum
NetApiBufferFree
NetUserSetInfo
ws2_32
WSACleanup
gethostbyname
WSAStartup
inet_ntoa
gethostname
ntohs
iphlpapi
GetTcpTable
SetTcpEntry
wininet
HttpQueryInfoA
InternetGetLastResponseInfoA
InternetOpenA
InternetSetStatusCallback
InternetSetFilePointer
InternetWriteFile
InternetCrackUrlA
InternetCanonicalizeUrlA
InternetQueryOptionA
InternetReadFile
InternetQueryDataAvailable
InternetOpenUrlA
InternetCloseHandle
activeds
ord4
ord6
ord5
ord3
wtsapi32
WTSEnumerateSessionsA
WTSFreeMemory
WTSLogoffSession
WTSQuerySessionInformationA
gdi32
CreateBitmap
SaveDC
RestoreDC
SetBkColor
SetTextColor
SetMapMode
GetClipBox
DeleteObject
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
DeleteDC
GetStockObject
GetDeviceCaps
winspool.drv
OpenPrinterA
DocumentPropertiesA
ClosePrinter
comdlg32
GetFileTitleA
Sections
.text Size: 532KB - Virtual size: 530KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 88KB - Virtual size: 86KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 38.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 40KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ