dfe5fa227af53e0738fdcb50c1bec1de_icedid_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

dfe5fa227af53e0738fdcb50c1bec1de_icedid_JC.exe
Size

1.7MB
MD5

dfe5fa227af53e0738fdcb50c1bec1de
SHA1

f7b5fe6887c8969e3a919abf5fecef475714959d
SHA256

41b5296f56635fc8082cec29baf29677b28650fe1ac7d26108483ecd513ef07a
SHA512

187c1853d03600d7361622f0079f39b1e2d4636f556e705f0854eb1ff5b157bb5de0207b5d227592470d27854d727edd0b3be3322d4b668bd8676b6e08a6d929
SSDEEP

49152:p3nAAPESd7BVucIQiCTNYplJA0Jd1YZx4UzGJ800+HyVQZ23sj1tVeoduZ103G8r:RDPEQ7BVgQv4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dfe5fa227af53e0738fdcb50c1bec1de_icedid_JC.exe

Files

dfe5fa227af53e0738fdcb50c1bec1de_icedid_JC.exe
.exe windows x86

7f0ca728992b781ad28f286f0b178320

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

imm32

ImmDisableIME

ws2_32

htons
WSAStartup
WSACleanup
WSAWaitForMultipleEvents
WSAEnumNetworkEvents
socket
recv
send
WSACreateEvent
listen
bind
htonl
gethostbyname
gethostname
WSACloseEvent
WSAEventSelect
closesocket
accept
inet_addr
inet_ntoa
WSAGetLastError
shutdown
connect

winmm

timeGetTime

d3d9

Direct3DCreate9

ddraw

DirectDrawCreateEx

mss32

_AIL_set_named_sample_file@20
_AIL_last_error@0
_AIL_set_sample_loop_count@8
_AIL_init_sample@4
_AIL_shutdown@0
_AIL_file_read@8
_AIL_start_sample@4
_AIL_release_sample_handle@4
_AIL_mem_free_lock@4
_AIL_set_sample_volume_pan@12
_AIL_startup@0
_AIL_set_preference@8
_AIL_open_digital_driver@16
_AIL_close_digital_driver@4
_AIL_allocate_sample_handle@4
_AIL_stop_sample@4

kernel32

SetVolumeLabelA
GetTempFileNameA
GetTempPathA
MapViewOfFile
CreateFileMappingA
UnmapViewOfFile
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetLastError
FreeResource
GetModuleHandleA
lstrcmpW
GlobalDeleteAtom
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
GetCurrentThreadId
GetCurrentProcessId
InterlockedIncrement
GetModuleFileNameW
InterlockedDecrement
GetThreadLocale
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
GetFileSize
DuplicateHandle
GetCurrentProcess
GetVolumeInformationA
GetFullPathNameA
LocalAlloc
TlsGetValue
GlobalReAlloc
GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
lstrcmpA
GetLocaleInfoA
EnumResourceLanguagesA
ConvertDefaultLocale
GetCurrentThread
SetThreadPriority
SuspendThread
GlobalFlags
GetCPInfo
GetOEMCP
SetErrorMode
HeapAlloc
GetDiskFreeSpaceExA
HeapReAlloc
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
ExitThread
CreateThread
GetSystemTimeAsFileTime
GetLocalTime
GetConsoleCP
GetConsoleMode
ExitProcess
GetCommandLineA
GetProcessHeap
GetStartupInfoA
SetCurrentDirectoryA
HeapSize
VirtualFree
HeapDestroy
HeapCreate
GetStdHandle
GetACP
IsValidCodePage
LCMapStringA
LCMapStringW
SetHandleCount
GetFileType
GetTimeZoneInformation
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetStringTypeA
GetStringTypeW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
IsBadReadPtr
InterlockedExchange
GetDriveTypeA
LocalFree
QueryPerformanceCounter
GetSystemDirectoryA
QueryPerformanceFrequency
FormatMessageA
DosDateTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
RemoveDirectoryA
SystemTimeToFileTime
CompareFileTime
TerminateThread
CreateDirectoryA
MultiByteToWideChar
WideCharToMultiByte
GetLastError
SizeofResource
LockResource
LoadResource
FindResourceA
WriteFile
SetEnvironmentVariableA
CreateProcessA
SetFilePointer
ReadFile
GetFileTime
FileTimeToLocalFileTime
FileTimeToSystemTime
OutputDebugStringA
MoveFileA
GetProcAddress
GetPrivateProfileIntA
LoadLibraryA
FreeLibrary
WinExec
GlobalLock
GlobalUnlock
GlobalFree
CreateEventA
ResumeThread
GlobalAlloc
SetEvent
WaitForSingleObject
GetVersion
ResetEvent
GetModuleFileNameA
GetCurrentDirectoryA
GetTickCount
MulDiv
DeleteFileA
GetFileAttributesA
SetFileAttributesA
GetVersionExA
GetPrivateProfileStringA
WritePrivateProfileStringA
FindFirstFileA
FindNextFileA
FindClose
Sleep
CreateFileA
CloseHandle
GetEnvironmentVariableA
lstrlenA
CompareStringW
CompareStringA
HeapFree

user32

DrawTextA
DrawTextExA
GrayStringA
GetWindowDC
BeginPaint
EndPaint
CheckMenuItem
EnableMenuItem
ModifyMenuA
LoadBitmapA
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
CopyAcceleratorTableA
InvalidateRgn
MapDialogRect
SetWindowContextHelpId
GetNextDlgGroupItem
PostQuitMessage
ValidateRect
TranslateMessage
GetMessageA
CharNextA
GetSysColorBrush
DestroyMenu
RegisterClipboardFormatA
UnregisterClassA
PostThreadMessageA
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
MapWindowPoints
GetKeyState
GetScrollRange
SetForegroundWindow
UpdateWindow
GetMenu
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
EqualRect
GetScrollInfo
DefWindowProcA
CallWindowProcA
IntersectRect
SystemParametersInfoA
GetWindowPlacement
SetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
GetNextDlgTabItem
EndDialog
TabbedTextOutA
GetWindowTextLengthA
GetWindowTextA
SetWindowPos
SetFocus
IsWindowEnabled
ShowWindow
MoveWindow
GetDlgCtrlID
SetWindowTextA
IsDialogMessageA
SendDlgItemMessageA
GetDlgItem
GetWindow
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
wsprintfA
GetFocus
IsRectEmpty
MessageBeep
SetWindowLongA
IsWindow
GetMessagePos
ReleaseDC
GetDC
GetClassNameA
IsChild
GetIconInfo
GetSysColor
PeekMessageA
ReleaseCapture
DestroyCursor
GetWindowLongA
WindowFromPoint
GetParent
SetCapture
GetCapture
GetActiveWindow
RedrawWindow
ClientToScreen
GetWindowRect
DrawFocusRect
FrameRect
FillRect
InflateRect
CopyRect
DrawStateA
GetDesktopWindow
GetCursorPos
SetCursor
LoadCursorA
OffsetRect
FindWindowA
LoadImageA
LoadIconA
IsIconic
DrawIcon
IsWindowVisible
SetRect
MessageBoxA
SendMessageA
ScreenToClient
PtInRect
GetClientRect
SetWindowRgn
PostMessageA
GetSystemMetrics
KillTimer
SetTimer
InvalidateRect
EnableWindow
CharUpperA
GetWindowThreadProcessId
RegisterWindowMessageA
WinHelpA
SetWindowsHookExA
CallNextHookEx
GetClassLongA
SetPropA
GetPropA
RemovePropA
GetForegroundWindow
GetLastActivePopup
DispatchMessageA
GetScrollPos
GetAsyncKeyState

gdi32

CreatePalette
CreateCompatibleBitmap
GetStockObject
DeleteObject
DeleteDC
SetTextColor
SetBkColor
CreateBitmap
GetClipBox
SaveDC
RestoreDC
SetBkMode
SetStretchBltMode
SetDIBitsToDevice
SetMapMode
LineTo
MoveToEx
GetViewportExtEx
GetWindowExtEx
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
SelectPalette
CreateRectRgnIndirect
GetRgnBox
GetBkColor
GetTextColor
GetMapMode
StretchDIBits
GetDIBits
RealizePalette
GetObjectA
SelectObject
Rectangle
CreatePen
GetDeviceCaps
BitBlt
CreateCompatibleDC
CreateFontA
CreateSolidBrush
CreateRectRgn

comdlg32

GetFileTitleA

winspool.drv

ClosePrinter
DocumentPropertiesA
OpenPrinterA

advapi32

RegEnumKeyA
RegDeleteKeyA
RegCreateKeyExA
RegOpenKeyA
RegQueryValueExA
RegSetValueExA
RegOpenKeyExA
RegQueryValueA
RegCloseKey

shell32

ShellExecuteA

shlwapi

PathIsUNCA
PathFindExtensionA
PathStripToRootA
PathFindFileNameA

oledlg

ord8

ole32

CLSIDFromProgID
CoRegisterMessageFilter
OleFlushClipboard
OleIsCurrentClipboard
CoRevokeClassObject
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CLSIDFromString
CoTaskMemFree
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CoTaskMemAlloc

oleaut32

SysAllocStringLen
SysFreeString
VariantClear
VariantTimeToSystemTime
SystemTimeToVariantTime
SafeArrayDestroy
OleCreateFontIndirect
VariantChangeType
VariantCopy
SysAllocStringByteLen
SysStringLen
SysAllocString
VariantInit

urlmon

URLDownloadToFileA

wininet

InternetCloseHandle
FtpOpenFileA
InternetConnectA
InternetSetOptionA
InternetOpenA
InternetReadFile
InternetQueryDataAvailable
FtpGetFileSize
HttpQueryInfoA
InternetOpenUrlA

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 980KB - Virtual size: 979KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 264KB - Virtual size: 261KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 128KB - Virtual size: 242KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 368KB - Virtual size: 366KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7f0ca728992b781ad28f286f0b178320

Headers

File Characteristics

Imports

imm32

ws2_32

winmm

d3d9

ddraw

mss32

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

shlwapi

oledlg

ole32

oleaut32

urlmon

wininet

version

Sections

.text Size: 980KB - Virtual size: 979KB

.rdata Size: 264KB - Virtual size: 261KB

.data Size: 128KB - Virtual size: 242KB

.rsrc Size: 368KB - Virtual size: 366KB

.text
Size: 980KB - Virtual size: 979KB

.rdata
Size: 264KB - Virtual size: 261KB

.data
Size: 128KB - Virtual size: 242KB

.rsrc
Size: 368KB - Virtual size: 366KB