2023-08-26_e9acade0bbf52b13fa13ca73aca10d79_icedid_JC[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

2023-08-26_e9acade0bbf52b13fa13ca73aca10d79_icedid_JC.exe
Size

3.8MB
MD5

e9acade0bbf52b13fa13ca73aca10d79
SHA1

f889152778978f68776a0efe380b14a8ee91f0cc
SHA256

d6c3c84ee3623f5b4fbc6035a7ea3399de981ae125aecc598c00a0ed37f68fa5
SHA512

3464fc38f7a08c556e9a8c567b09eeab7578a1bf567bd7be48f0cb8bf50bd28ecaebb1f66062bc76faf6d2b4f0567a341a043275860b09b67cbfd70d4ec3f5c7
SSDEEP

98304:qddtjA64y61nxulIPtIRQ5HJhkm6eTKJ5Om9FDWRgX3iNaR+OSl2rm/3J59xZL8M:qhjA6UNxLyQRJhkm6eTKJ5Om9FDWRgXq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2023-08-26_e9acade0bbf52b13fa13ca73aca10d79_icedid_JC.exe

Files

2023-08-26_e9acade0bbf52b13fa13ca73aca10d79_icedid_JC.exe
.exe windows:5 windows x86

b6cf3ef893855a8000099f4c57c7a0b9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

wininet

InternetErrorDlg
FtpGetFileW
FtpPutFileW
FtpGetCurrentDirectoryW
FtpSetCurrentDirectoryW
FtpRemoveDirectoryW
FtpCreateDirectoryW
InternetFindNextFileW
FtpDeleteFileW
InternetQueryDataAvailable
InternetGetCookieW
InternetSetCookieW
InternetSetOptionExW
InternetQueryOptionW
InternetCanonicalizeUrlW
InternetCrackUrlW
GopherFindFirstFileW
InternetGetLastResponseInfoW
FtpRenameFileW
InternetOpenW
HttpSendRequestW
HttpSendRequestExW
InternetWriteFile
HttpEndRequestW
HttpQueryInfoW
InternetReadFile
InternetCloseHandle
InternetSetFilePointer
GopherGetAttributeW
FtpOpenFileW
FtpCommandW
GopherCreateLocatorW
FtpFindFirstFileW
GopherOpenFileW
InternetOpenUrlW
InternetSetOptionW
HttpAddRequestHeadersW
HttpOpenRequestW
InternetConnectW
InternetSetStatusCallbackW

ws2_32

closesocket
send
gethostname
connect
inet_ntoa
inet_addr
socket
WSACleanup
WSAStartup
gethostbyname
htons

wtsapi32

WTSQueryUserToken

dynamicdll

?GetMultiMainKey@CCdgExchg@@QAEHPAD@Z
?GetDyKey@CCdgExchg@@QAEXPAD@Z
?GetConnectSer@CCdgExchg@@QAEHXZ
?GetPrintPolicy@CCdgExchg@@QAEXAAU_PRINT_EXCHG_INFO@@@Z
?GetPolicy@CCdgExchg@@QAEHPAU_Encrypt_Policy@@@Z
?GetDefaultUserNameAndPsw@CCdgExchg@@QAEXPAD00@Z
?GetLogRecordType@CCdgExchg@@QAEXAAULogRecordType@@@Z
??1CCdgExchg@@UAE@XZ
??0CCdgExchg@@QAE@XZ
?GetCDGKey@CCdgExchg@@QAEXPAD@Z
?GetMultiKeyListInfo@CCdgExchg@@QAEHPAU_MultiKey_Policy@@@Z

kernel32

HeapReAlloc
SetStdHandle
HeapSize
VirtualProtect
IsDebuggerPresent
GetSystemInfo
VirtualQuery
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetStartupInfoA
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTimeZoneInformation
GetCPInfo
GetOEMCP
IsValidCodePage
GetTimeFormatA
GetDateFormatA
LCMapStringW
LCMapStringA
FatalAppExitA
SetConsoleCtrlHandler
InitializeCriticalSectionAndSpinCount
GetConsoleCP
GetConsoleMode
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
CreateFileA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetCurrentDirectoryA
SetCurrentDirectoryA
GetDriveTypeA
GetFullPathNameA
SetEnvironmentVariableA
UnhandledExceptionFilter
GetSystemTimeAsFileTime
GetStartupInfoW
SetErrorMode
GetCurrentDirectoryW
GetAtomNameW
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
TlsGetValue
GlobalFlags
GetProfileIntW
GetFileSizeEx
LocalFileTimeToFileTime
GetFileAttributesExW
GlobalGetAtomNameW
GetDiskFreeSpaceW
GetFileTime
SetFileTime
SuspendThread
SetThreadPriority
FileTimeToLocalFileTime
GetShortPathNameW
GetFullPathNameW
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
GetThreadLocale
GetStringTypeExW
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesW
GetLocaleInfoW
CompareStringA
lstrlenA
lstrcmpA
GetModuleHandleA
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
CompareStringW
LoadLibraryA
GetVersionExA
FreeResource
OutputDebugStringA
GetEnvironmentVariableA
lstrcpyA
ResetEvent
lstrcpynW
lstrcmpW
FreeLibrary
SetUnhandledExceptionFilter
GetCurrentThreadId
ReleaseMutex
ExitProcess
OpenMutexW
lstrcpyW
RaiseException
GlobalAlloc
TerminateProcess
OpenProcess
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
OpenFileMappingW
HeapFree
GetProcessHeap
HeapAlloc
MulDiv
GlobalUnlock
GlobalLock
GlobalSize
GlobalReAlloc
GetACP
GetVersion
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetCurrentProcess
DuplicateHandle
FileTimeToDosDateTime
SystemTimeToFileTime
GetLocalTime
GetSystemTime
GetFileInformationByHandle
GetFileType
FileTimeToSystemTime
GetModuleFileNameA
GetVersionExW
WTSGetActiveConsoleSessionId
RemoveDirectoryW
ReadFile
WaitForMultipleObjects
CreateThread
GetVolumeInformationW
GetDriveTypeW
GetLogicalDriveStringsW
GetModuleHandleW
FindClose
FindNextFileW
FindFirstFileW
GetExitCodeProcess
GetTempFileNameW
TerminateThread
GetExitCodeThread
WideCharToMultiByte
CreateEventW
lstrcmpiW
SetEvent
OpenEventW
Sleep
MoveFileW
SetLastError
GetCommandLineW
CreateProcessW
SetFileAttributesW
GetFileAttributesW
MoveFileExW
DeleteFileW
CopyFileW
GetCurrentProcessId
GetTickCount
GetTempPathW
GetProcAddress
LoadLibraryW
WaitForSingleObject
InterlockedIncrement
FormatMessageW
lstrlenW
LocalAlloc
LocalFree
InterlockedDecrement
GetSystemDirectoryW
GetComputerNameW
ResumeThread
InterlockedExchange
GetWindowsDirectoryA
lstrcatA
GetLastError
CreateMutexW
lstrcatW
GetWindowsDirectoryW
CloseHandle
WriteFile
SetFilePointer
GetFileSize
CreateFileW
OutputDebugStringW
CreateDirectoryW
GetEnvironmentVariableW
GetModuleFileNameW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
FindResourceW
LoadResource
LockResource
SizeofResource
MultiByteToWideChar
RtlUnwind
GlobalFree
ExitThread
InterlockedCompareExchange
InterlockedExchangeAdd
VirtualAlloc

user32

TranslateAcceleratorW
ShowOwnedPopups
GetMessageW
ValidateRect
CharUpperW
SetWindowContextHelpId
MapDialogRect
PostQuitMessage
SetWindowRgn
MapVirtualKeyW
GetKeyNameTextW
GetWindowThreadProcessId
EndPaint
BeginPaint
GetWindowDC
GetMenuStringW
InsertMenuW
RemoveMenu
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
ModifyMenuW
GetMenuState
EnableMenuItem
CheckMenuItem
ScrollWindowEx
ShowWindow
MoveWindow
SetWindowTextW
IsDialogMessageW
IsDlgButtonChecked
SetDlgItemTextW
SetDlgItemInt
GetDlgItemTextW
GetDlgItemInt
CheckRadioButton
CheckDlgButton
RegisterWindowMessageW
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
IsChild
SetWindowsHookExW
CallNextHookEx
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
SetFocus
GetWindowTextLengthW
GetWindowTextW
GetForegroundWindow
GetLastActivePopup
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
BringWindowToTop
ScrollWindow
TrackPopupMenuEx
TrackPopupMenu
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
ShowScrollBar
GetMenuItemID
CreateWindowExW
GetClassInfoExW
RegisterClassW
AdjustWindowRectEx
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
SetWindowPlacement
GetDlgCtrlID
CallWindowProcW
GetMenu
SetWindowLongW
LockWindowUpdate
OffsetRect
SystemParametersInfoA
GetWindowPlacement
GetWindow
LoadMenuW
GetSubMenu
GetDesktopWindow
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamW
DestroyWindow
GetWindowLongW
GetDlgItem
IsWindowEnabled
GetNextDlgTabItem
EndDialog
MessageBeep
GetCaretBlinkTime
WindowFromPoint
ClientToScreen
CopyRect
IsWindowVisible
IsRectEmpty
GetDoubleClickTime
GrayStringW
DrawTextExW
TabbedTextOutW
ReleaseCapture
GetCapture
ClipCursor
SetCapture
InvertRect
PtInRect
GetFocus
IsClipboardFormatAvailable
SetRectEmpty
InsertMenuItemW
LoadAcceleratorsW
GetMenuBarInfo
DestroyMenu
ReuseDDElParam
UnpackDDElParam
DestroyCursor
RedrawWindow
SetCursorPos
GetMenuItemInfoW
IsZoomed
RegisterClipboardFormatW
GetDialogBaseUnits
GetSysColorBrush
UnregisterClassW
CharNextW
CopyAcceleratorTableW
InvalidateRgn
GetNextDlgGroupItem
DestroyIcon
GetSystemMenu
SetParent
UnionRect
InSendMessage
WindowFromDC
GetTabbedTextExtentA
MapWindowPoints
GetDCEx
InvalidateRect
GetCursorPos
KillTimer
GetKeyState
IntersectRect
GetParent
GetWindowRect
DefWindowProcW
GetClassInfoW
SetRect
LoadCursorW
SetCursor
DrawTextW
InflateRect
DrawEdge
FrameRect
FillRect
GetSysColor
ReleaseDC
GetDC
SystemParametersInfoW
DispatchMessageW
TranslateMessage
PeekMessageW
DeleteMenu
GetMenuItemCount
CreateMenu
AppendMenuW
CreatePopupMenu
IsWindow
LoadBitmapW
PostMessageW
ScreenToClient
GetMessagePos
DrawIcon
GetSystemMetrics
IsIconic
LoadIconW
FlashWindow
SetTimer
PostThreadMessageW
wsprintfW
UpdateWindow
MessageBoxW
GetClientRect
LoadImageW
SendMessageW
EnableWindow
WaitMessage
SendNotifyMessageW
SetWindowPos
SetForegroundWindow

gdi32

GetRgnBox
GetNearestColor
GetBkMode
GetPolyFillMode
GetROP2
GetStretchBltMode
GetTextAlign
GetTextFaceW
GetTextExtentPoint32A
GetWindowOrgEx
CreateMetaFileW
CloseMetaFile
DeleteMetaFile
GetTextColor
GetMapMode
LineTo
CombineRgn
SetRectRgn
StretchDIBits
GetCharWidthW
GetViewportOrgEx
SetAbortProc
Ellipse
LPtoDP
DPtoLP
CreateEllipticRgn
CreateRectRgnIndirect
CreateHatchBrush
CreateSolidBrush
ExtCreatePen
PlayMetaFile
EnumMetaFile
GetObjectType
PlayMetaFileRecord
SelectPalette
GetStockObject
CreatePatternBrush
CreateDIBPatternBrushPt
DeleteDC
ExtSelectClipRgn
PolyBezierTo
PolylineTo
PolyDraw
ArcTo
GetCurrentPositionEx
ScaleWindowExtEx
SetWindowExtEx
OffsetWindowOrgEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
GetPixel
GetWindowExtEx
GetViewportExtEx
SelectClipPath
CreateRectRgn
GetClipRgn
SelectClipRgn
DeleteObject
SetColorAdjustment
CreatePen
StartDocW
StartPage
EndPage
SetArcDirection
SetMapperFlags
SetTextCharacterExtra
SetTextJustification
SetTextAlign
EndDoc
AbortDoc
Rectangle
CreateFontW
OffsetClipRgn
IntersectClipRect
ExcludeClipRect
SetMapMode
ModifyWorldTransform
SetWorldTransform
SetGraphicsMode
SetStretchBltMode
SetROP2
SetPolyFillMode
SetBkMode
RestoreDC
SaveDC
CreateDCW
CopyMetaFileW
CreateBitmap
SetBkColor
SetTextColor
GetClipBox
GetDCOrgEx
PatBlt
GetTextMetricsW
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
GetObjectW
CreateHalftonePalette
CreateCompatibleDC
GetDIBColorTable
CreatePalette
BitBlt
CreateFontIndirectW
GetTextExtentPoint32W
GetCurrentObject
GetDeviceCaps
CreateCompatibleBitmap
GetBkColor
MoveToEx

comdlg32

GetFileTitleW

winspool.drv

ClosePrinter
OpenPrinterW
GetJobW
DocumentPropertiesW

advapi32

RegDeleteKeyW
ImpersonateLoggedOnUser
GetUserNameW
RevertToSelf
GetTokenInformation
ConvertSidToStringSidW
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyW
RegQueryValueW
RegOpenKeyW
RegCloseKey
GetUserNameA
LookupAccountNameW
GetFileSecurityW
InitializeSecurityDescriptor
GetSecurityDescriptorDacl
GetAclInformation
GetLengthSid
InitializeAcl
GetAce
EqualSid
AddAce
AddAccessAllowedAce
SetSecurityDescriptorDacl
GetSecurityDescriptorControl
SetFileSecurityW
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
SetNamedSecurityInfoW
IsValidSid
OpenProcessToken
ConvertSecurityDescriptorToStringSecurityDescriptorW
SetSecurityInfo
GetSecurityInfo
CreateProcessAsUserW
RegQueryInfoKeyW
RegEnumKeyExW
RegEnumKeyW
RegCreateKeyExW
RegSetValueW
AdjustTokenPrivileges
LookupPrivilegeValueW
RegDeleteValueW
RegSetValueExW

shell32

DragFinish
SHFileOperationW
SHGetFolderPathW
SHGetFileInfoW
ShellExecuteExA
SHGetSpecialFolderPathW
SHGetMalloc
SHGetSpecialFolderLocation
SHGetPathFromIDListW
ShellExecuteW
SHGetDesktopFolder
ExtractIconW
DragQueryFileW
SHChangeNotify
SHGetPathFromIDListA
SHBrowseForFolderW

shlwapi

PathFileExistsW
PathIsDirectoryW
StrRetToStrW
PathMatchSpecW
PathFindExtensionW
PathRemoveExtensionW
PathFindFileNameW
PathStripToRootW
PathIsUNCW
UrlUnescapeW
PathRemoveFileSpecW

oledlg

OleUIBusyW

ole32

ReadFmtUserTypeStg
OleRegGetUserType
WriteClassStg
WriteFmtUserTypeStg
SetConvertStg
StringFromGUID2
CoUninitialize
OleRun
CoCreateInstance
CoCreateGuid
CoInitialize
CoGetClassObject
OleLockRunning
ReleaseStgMedium
CoTaskMemAlloc
StringFromCLSID
CoTreatAsClass
OleDuplicateData
CLSIDFromProgID
CLSIDFromString
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
OleSetClipboard
OleIsCurrentClipboard
OleFlushClipboard
OleGetClipboard
ReadClassStg
CoDisconnectObject
RegisterDragDrop
CoLockObjectExternal
RevokeDragDrop
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
CoInitializeEx
OleRegEnumVerbs
OleRegGetMiscStatus
OleTranslateAccelerator
IsAccelerator
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
CoRegisterClassObject
CoRevokeClassObject
CoRegisterMessageFilter
CreateStreamOnHGlobal
OleSave
WriteClassStm
OleSaveToStream
OleQueryLinkFromData
OleQueryCreateFromData
OleSetMenuDescriptor
CreateDataAdviseHolder
CreateOleAdviseHolder
DoDragDrop
CreateBindCtx
StgIsStorageFile
StgOpenStorage
StgCreateDocfile
CoGetMalloc
OleIsRunning
GetRunningObjectTable
CreateFileMoniker
CreateGenericComposite
CreateItemMoniker
OleGetIconOfClass
OleCreateLinkToFile
OleCreateFromFile
OleSetContainedObject
GetHGlobalFromILockBytes
OleLoad
OleCreate
OleCreateStaticFromData
OleCreateLinkFromData
OleCreateFromData
CoTaskMemFree

oleaut32

SysStringLen
OleCreateFontIndirect
LoadRegTypeLi
LoadTypeLi
RegisterTypeLi
VarBstrFromDate
VarDecFromStr
VarBstrFromDec
VarBstrFromCy
VarCyFromStr
SysReAllocStringLen
VarDateFromStr
SafeArrayDestroyDescriptor
SafeArrayDestroyData
SafeArrayDestroy
SafeArrayUnlock
SafeArrayLock
SafeArrayPutElement
SafeArrayPtrOfIndex
SafeArrayGetElement
SafeArrayCopy
SafeArrayAllocDescriptor
SafeArrayAllocData
VariantCopy
SafeArrayRedim
SafeArrayCreate
SafeArrayGetDim
SafeArrayGetElemsize
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SysAllocStringLen
VarUdateFromDate
SystemTimeToVariantTime
VariantTimeToSystemTime
VariantChangeType
SysAllocString
VariantClear
VariantInit
SysAllocStringByteLen
SysStringByteLen
SysFreeString
GetErrorInfo
SetErrorInfo
CreateErrorInfo

filelock

AddProtFileList
AddProtProc
AddPassProc
AddHideProc
ord30
ord31
GetMD5Value
MD5Val2Str
RemoveProtFileList
DecodeRC4
ord356
DecodeAES
ord150
LeavePassFilter
EnterPassFilter
DecryptLockFile
EncryptLockFile
EncodeAES
IsEncryptLockFile
EncryptLockFileBuffer
CanFileDecrypted
CheckEncrytFile
EncodeRC4
RestFileHeadData
GetWorkMode

dgdecrypt

DecryptDGFile
IsCryptedDGFile

sqlite

sqlite3_data_count
sqlite3_column_text
sqlite3_finalize
sqlite3_step
sqlite3_column_int
sqlite3_free
sqlite3_exec
sqlite3_close
sqlite3_open16
sqlite3_prepare

psapi

GetModuleBaseNameW
EnumProcessModules
EnumProcesses

iphlpapi

GetTcpTable
GetAdaptersInfo

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

dbghelp

MiniDumpWriteDump

Exports

Exports

??0CCdgExchg@@QAE@ABV0@@Z
??4CCdgExchg@@QAEAAV0@ABV0@@Z
??_7CCdgExchg@@6B@

Sections

.text
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 556KB - Virtual size: 556KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 26KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 264KB - Virtual size: 263KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 214KB - Virtual size: 216KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

b6cf3ef893855a8000099f4c57c7a0b9

Headers

DLL Characteristics

File Characteristics

Imports

wininet

ws2_32

wtsapi32

dynamicdll

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

shlwapi

oledlg

ole32

oleaut32

filelock

dgdecrypt

sqlite

psapi

iphlpapi

version

dbghelp

Exports

Exports

Sections

.text Size: 2.8MB - Virtual size: 2.8MB

.rdata Size: 556KB - Virtual size: 556KB

.data Size: 26KB - Virtual size: 48KB

.rsrc Size: 264KB - Virtual size: 263KB

.reloc Size: 214KB - Virtual size: 216KB

.text
Size: 2.8MB - Virtual size: 2.8MB

.rdata
Size: 556KB - Virtual size: 556KB

.data
Size: 26KB - Virtual size: 48KB

.rsrc
Size: 264KB - Virtual size: 263KB

.reloc
Size: 214KB - Virtual size: 216KB