2023-08-22_0224bae20bc6d75932bdb3bf7b3776b6_icedid_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

2023-08-22_0224bae20bc6d75932bdb3bf7b3776b6_icedid_JC.exe
Size

2.3MB
MD5

0224bae20bc6d75932bdb3bf7b3776b6
SHA1

46605a3d3eda19050e14ae64712541e18fe63793
SHA256

78dd1431b58d8e99214c024f47ee71a337bc4d07bef54a1521a45d32320f3cce
SHA512

561e1c3a2a74a05950127ca5440d22131b3290610d9eaf0c67e67a813ef6b2800e5e20a98b707014df2e88184e18ef03a6ed5a2688916732c9b994c8cd3a4fb4
SSDEEP

49152:UmKqPcpESG01zGso8oi2BuTE4WtwzkXwwXyUZKNk:dZcu0xsAoizkXngNk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2023-08-22_0224bae20bc6d75932bdb3bf7b3776b6_icedid_JC.exe

Files

2023-08-22_0224bae20bc6d75932bdb3bf7b3776b6_icedid_JC.exe
.exe windows x86

ee12693235e5234aff5553108c6b156d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GlobalFindAtomA
LockFile
UnlockFile
SetEndOfFile
DuplicateHandle
GetFullPathNameA
FileTimeToLocalFileTime
GetCPInfo
GetOEMCP
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
VirtualAlloc
GetSystemTimeAsFileTime
GetCommandLineA
GetStartupInfoA
ExitProcess
ExitThread
HeapSize
lstrcmpW
IsValidCodePage
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
VirtualFree
HeapDestroy
HeapCreate
GetTimeZoneInformation
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetConsoleCP
GetConsoleMode
SetStdHandle
SetEnvironmentVariableA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GlobalFlags
GetThreadLocale
GlobalGetAtomNameA
GetModuleFileNameW
LocalReAlloc
GlobalHandle
WritePrivateProfileStringA
GlobalAddAtomA
SuspendThread
SetEvent
SetThreadPriority
GlobalDeleteAtom
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
LoadLibraryExA
lstrcmpA
HeapAlloc
TlsSetValue
HeapReAlloc
GetFileSize
ReleaseSemaphore
SetErrorMode
FindNextFileA
OpenSemaphoreA
GetProcessHeap
InterlockedDecrement
InterlockedCompareExchange
FindClose
TlsAlloc
InterlockedIncrement
TlsGetValue
SearchPathA
HeapFree
CreateSemaphoreA
LocalAlloc
TlsFree
FindFirstFileA
GetTickCount
QueryPerformanceCounter
GetCurrentProcessId
FormatMessageA
CreateThread
WaitForSingleObject
TerminateThread
GetExitCodeThread
GetStdHandle
GetFileType
GetCurrentThreadId
GetSystemInfo
GetCurrentThread
SetLastError
GetComputerNameA
CreateEventA
DeviceIoControl
GetOverlappedResult
CreateProcessA
GetVolumeInformationA
GetWindowsDirectoryA
GetFileInformationByHandle
GlobalReAlloc
SystemTimeToFileTime
SetFileTime
GetFileTime
FileTimeToSystemTime
SetFileAttributesA
GetSystemDirectoryA
GetCurrentDirectoryA
GetCurrentProcess
DeleteFileA
WriteFile
ReadFile
SetFilePointer
GetFileAttributesA
GlobalMemoryStatus
GetSystemTime
GetLocalTime
GlobalAlloc
FlushFileBuffers
CreateFileA
CloseHandle
LoadLibraryA
FreeLibrary
LocalFree
GetVersionExA
GetModuleHandleA
GetProcAddress
GlobalLock
GlobalUnlock
GlobalFree
GetModuleFileNameA
ResumeThread
FindResourceA
LoadResource
LockResource
SizeofResource
GetEnvironmentVariableA
lstrlenA
CompareStringW
CompareStringA
GetVersion
GetLastError
WideCharToMultiByte
MultiByteToWideChar
InterlockedExchange
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetACP
Sleep

user32

DestroyMenu
RegisterWindowMessageA
LoadIconA
WinHelpA
GetClassLongA
SetPropA
GetPropA
RemovePropA
IsWindow
GetForegroundWindow
GetDlgItem
GetTopWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetForegroundWindow
GetClientRect
GetMenu
GetClassInfoExA
GetClassInfoA
AdjustWindowRectEx
CopyRect
CallWindowProcA
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetCapture
GetWindow
GetDlgCtrlID
GetClassNameA
PtInRect
SetWindowTextA
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
GetDC
ReleaseDC
GetSysColorBrush
UnhookWindowsHookEx
WaitMessage
GetWindowThreadProcessId
GetWindowLongA
GetLastActivePopup
IsWindowEnabled
EnableWindow
SetCursor
SetWindowsHookExA
CallNextHookEx
GetActiveWindow
IsWindowVisible
GetKeyState
GetCursorPos
ValidateRect
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
GetFocus
GetParent
ModifyMenuA
EnableMenuItem
CheckMenuItem
PostMessageA
PostQuitMessage
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
UpdateWindow
GetSysColor
LoadCursorA
RegisterClassExA
GetWindowRect
SetWindowPos
SetWindowLongA
ShowWindow
InvalidateRect
BeginPaint
EndPaint
EndDialog
GetDesktopWindow
GetProcessWindowStation
GetUserObjectInformationW
wsprintfA
MessageBoxA
RegisterClassA
CreateWindowExA
EnumThreadWindows
WaitForInputIdle
DestroyWindow
UnregisterClassA
SendMessageA
GetWindowTextA
FindWindowA
DefWindowProcA
GetSystemMetrics
PeekMessageA
CharUpperA
SetTimer
GetMessageA
TranslateMessage
DispatchMessageA
KillTimer
PostThreadMessageA

gdi32

GetStockObject
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
Escape
ExtTextOutA
RectVisible
PtVisible
TextOutA
GetClipBox
SetMapMode
SetTextColor
SetBkColor
RestoreDC
SaveDC
CreateBitmap
GetDeviceCaps
SelectObject
DeleteObject
DeleteDC
CreateSolidBrush
SetBkMode

comdlg32

GetFileTitleA

winspool.drv

ClosePrinter
OpenPrinterA
DocumentPropertiesA

advapi32

DeleteService
RegQueryValueA
RegEnumKeyA
RegDeleteKeyA
RegisterEventSourceA
ReportEventA
DeregisterEventSource
OpenSCManagerA
CloseServiceHandle
CreateServiceA
OpenServiceA
StartServiceA
QueryServiceStatus
ControlService
RegCloseKey
OpenThreadToken
OpenProcessToken
GetTokenInformation
LookupAccountNameA
IsValidSid
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
RegOpenKeyA
AllocateAndInitializeSid
FreeSid
RegCreateKeyExA
RegSetValueExA
RegDeleteValueA
RegOpenKeyExA
RegQueryValueExA

shell32

FindExecutableA

comctl32

InitCommonControlsEx

shlwapi

PathFindExtensionA
PathStripToRootA
PathFindFileNameA
PathIsUNCA

ole32

CoUninitialize
CoInitializeSecurity
CoInitializeEx
CoSetProxyBlanket
CoCreateInstance

oleaut32

VariantInit
VariantChangeType
SysStringLen
VariantClear
SysFreeString
SysAllocString

ws2_32

select
htonl
bind
WSAGetLastError
getsockname
WSASetLastError
sendto
accept
WSAAsyncSelect
WSAStartup
inet_addr
htons
gethostbyname
WSACleanup
socket
connect
setsockopt
inet_ntoa
ntohs
recvfrom
recv
send
shutdown
listen
closesocket

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 749KB - Virtual size: 749KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 123KB - Virtual size: 584KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ee12693235e5234aff5553108c6b156d

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

ws2_32

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.rdata Size: 749KB - Virtual size: 749KB

.data Size: 123KB - Virtual size: 584KB

.rsrc Size: 16KB - Virtual size: 16KB

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 749KB - Virtual size: 749KB

.data
Size: 123KB - Virtual size: 584KB

.rsrc
Size: 16KB - Virtual size: 16KB