NEAS[.]2023-09-07_d8a41144e59dbc89a1ea8f918be3adff_icedid_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.2023-09-07_d8a41144e59dbc89a1ea8f918be3adff_icedid_JC.exe
Size

1.1MB
MD5

d8a41144e59dbc89a1ea8f918be3adff
SHA1

a09aaf8b3a18499c96e726c7c78b1d5b3ec537a5
SHA256

bd8982138d76c6c9223447e9bc691496ee54b1a7281dee50909d342f6e7208d0
SHA512

4d5868cd15f347a29656b54a8629f3a0a29fc4fcfd1bb7584bc804b6e0c17ae76502fe836aa02123c72efec4492a2b6f382e9082b490edda5b9cac3632a139b4
SSDEEP

24576:OaJom9yMqr2TQITvOuY6ooPwAxvj9eam5UVJqFGTuk1wT25OCs:z9y7STQIT2WooPwyb1Tu2wT25OCs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.2023-09-07_d8a41144e59dbc89a1ea8f918be3adff_icedid_JC.exe

Files

NEAS.2023-09-07_d8a41144e59dbc89a1ea8f918be3adff_icedid_JC.exe
.exe windows:4 windows x86

b4d57c29c83a350cdd6a64887fa97f7a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathFindExtensionA
PathFindFileNameA
UrlUnescapeA
PathStripToRootA
PathFileExistsA
PathRemoveBackslashW
PathFileExistsW
PathRemoveFileSpecW
PathIsUNCA

kernel32

lstrcmpW
GlobalFindAtomA
GlobalGetAtomNameA
LocalAlloc
GetCurrentDirectoryA
GlobalFlags
GlobalReAlloc
GlobalHandle
TlsGetValue
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
MoveFileA
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
DuplicateHandle
GetVolumeInformationA
GetCPInfo
GetOEMCP
SetErrorMode
ExitProcess
RtlUnwind
HeapFree
HeapAlloc
VirtualAlloc
GetDriveTypeA
GetStartupInfoA
HeapReAlloc
GlobalAddAtomA
GetDateFormatA
ExitThread
CreateThread
SetStdHandle
GetFileType
HeapSize
QueryPerformanceCounter
GetStringTypeA
GetStringTypeW
HeapDestroy
HeapCreate
VirtualFree
IsBadWritePtr
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetTimeZoneInformation
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
CreatePipe
IsBadReadPtr
IsBadCodePtr
SetEnvironmentVariableA
GetLocaleInfoW
FreeResource
SetLastError
LocalFree
GlobalDeleteAtom
ConvertDefaultLocale
EnumResourceLanguagesA
CreateIoCompletionPort
GetQueuedCompletionStatus
CreateNamedPipeA
PostQueuedCompletionStatus
CancelIo
ConnectNamedPipe
GetFileAttributesW
CreateDirectoryW
CreateFileW
OutputDebugStringW
ResetEvent
CreateEventW
CreateEventA
SetEvent
GetExitCodeThread
TerminateThread
FreeLibrary
FormatMessageA
RemoveDirectoryA
FindNextFileA
FindFirstFileA
FindClose
FileTimeToSystemTime
CompareStringW
CompareStringA
lstrlenW
GetVersion
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
ReleaseMutex
DebugBreak
TerminateProcess
DeleteFileA
GetModuleFileNameW
CreateProcessW
WaitForSingleObject
SetUnhandledExceptionFilter
VirtualProtect
WriteProcessMemory
lstrcpynA
IsDebuggerPresent
GetSystemTimeAsFileTime
GlobalMemoryStatus
GetSystemInfo
VirtualQuery
FileTimeToLocalFileTime
FileTimeToDosDateTime
OutputDebugStringA
RaiseException
GetCurrentThreadId
GetCurrentProcessId
LoadLibraryA
GetProcAddress
GetFileSize
SetFilePointer
ReadFile
lstrcatA
SetFileAttributesA
GetFileAttributesA
CreateDirectoryA
GetFileTime
DosDateTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
lstrcmpiA
GetFullPathNameA
MultiByteToWideChar
InterlockedDecrement
InterlockedIncrement
SleepEx
GetSystemDirectoryA
PeekNamedPipe
WaitForMultipleObjects
ExpandEnvironmentStringsA
GetFileInformationByHandle
MulDiv
GetPrivateProfileStringA
WritePrivateProfileStringA
GetModuleHandleA
OpenProcess
GetExitCodeProcess
Sleep
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetLastError
GetEnvironmentVariableA
GetTickCount
GetPrivateProfileIntA
lstrcmpA
OpenMutexA
CreateMutexA
GetCommandLineA
WideCharToMultiByte
FindResourceA
LoadResource
LockResource
SizeofResource
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
CreateFileA
GetModuleFileNameA
lstrcpyA
lstrlenA
WriteFile
CloseHandle
CreateProcessA
SetThreadPriority
GetCurrentThread
GetCurrentProcess
SetPriorityClass
ResumeThread
GetTimeFormatA

user32

MessageBeep
GetNextDlgGroupItem
InvalidateRgn
CopyAcceleratorTableA
CharNextA
PostThreadMessageA
GetSysColorBrush
GetWindowDC
ReleaseDC
DestroyMenu
MoveWindow
SetWindowTextA
RegisterWindowMessageA
WinHelpA
GetClassLongA
GetClassInfoExA
GetClassNameA
RemovePropA
SendDlgItemMessageA
SetFocus
IsChild
GetWindowTextA
GetForegroundWindow
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
TrackPopupMenu
SetForegroundWindow
UpdateWindow
GetMenu
GetSysColor
AdjustWindowRectEx
GetClassInfoA
RegisterClassA
UnregisterClassA
GetDlgCtrlID
CallWindowProcA
SetWindowLongA
SystemParametersInfoA
GetWindowPlacement
SetMenuItemBitmaps
GetFocus
ModifyMenuA
EnableMenuItem
CheckMenuItem
GetMenuCheckMarkDimensions
LoadBitmapA
SetWindowsHookExA
CallNextHookEx
GetMessageA
IsWindowVisible
ValidateRect
GetLastActivePopup
GetWindow
SetWindowContextHelpId
GetDesktopWindow
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
GetDlgItem
IsWindowEnabled
GetNextDlgTabItem
EndDialog
RegisterClipboardFormatA
GetMenuState
GetMenuItemID
GetMenuItemCount
PeekMessageA
DispatchMessageA
IsDialogMessageA
TranslateMessage
CharUpperA
GetDC
GetWindowLongA
LoadCursorA
EnumChildWindows
GetWindowThreadProcessId
TrackMouseEvent
BeginPaint
EndPaint
UnionRect
IntersectRect
CopyRect
SetCursor
GetKeyState
MessageBoxW
wvsprintfA
GetWindowRect
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
ScreenToClient
ReleaseCapture
GetScrollInfo
GetScrollPos
GetParent
SetCapture
GetCapture
ClientToScreen
EqualRect
OffsetRect
IsRectEmpty
MapWindowPoints
WindowFromPoint
InvalidateRect
InflateRect
SetRectEmpty
SetRect
PtInRect
SetWindowRgn
KillTimer
RedrawWindow
IsWindow
RegisterClassExA
CreateWindowExA
SetPropA
ShowWindow
GetPropA
DefWindowProcA
SetWindowPos
PostMessageA
PostQuitMessage
GetCursorPos
GetSystemMetrics
MessageBoxA
LoadIconA
EnableWindow
SetTimer
GetClientRect
BringWindowToTop
IsIconic
GetSystemMenu
SendMessageA
LoadMenuA
GetSubMenu
AppendMenuA
DrawIcon
wsprintfA
MapDialogRect

gdi32

ScaleWindowExtEx
SetWindowExtEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
SetViewportOrgEx
GetWindowExtEx
GetViewportExtEx
GetRgnBox
GetTextColor
GetBkColor
GetMapMode
GetStockObject
MoveToEx
ExtSelectClipRgn
RectVisible
GetTextExtentPointA
CreateCompatibleBitmap
CreateCompatibleDC
OffsetViewportOrgEx
BitBlt
LineTo
IntersectClipRect
SetMapMode
SetBkMode
RestoreDC
SaveDC
SetBkColor
SetTextColor
CreateBitmap
GetDeviceCaps
CombineRgn
ExtCreateRegion
GetClipRgn
CreateRectRgn
SelectClipRgn
Rectangle
Escape
ExtTextOutA
TextOutA
PtVisible
GetClipBox
GetObjectA
DeleteDC
CreateDIBSection
SelectObject
CreateRoundRectRgn
CreatePen
DeleteObject
CreateFontIndirectA
CreateRectRgnIndirect

msimg32

AlphaBlend

comdlg32

GetFileTitleA

winspool.drv

ClosePrinter
OpenPrinterA
DocumentPropertiesA

advapi32

RegQueryValueA
LookupPrivilegeValueA
OpenProcessToken
GetUserNameA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegOpenKeyA
RegCreateKeyExA
RegSetValueExA
AdjustTokenPrivileges
RegEnumKeyA
RegDeleteKeyA

shell32

ShellExecuteA
Shell_NotifyIconA

comctl32

ord17
ImageList_Destroy

oledlg

ord8

ole32

CoTaskMemAlloc
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CoGetClassObject
CoRevokeClassObject
CoTaskMemFree
CLSIDFromString
CLSIDFromProgID
CoCreateInstance
OleRun
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal

oleaut32

VariantClear
OleCreateFontIndirect
SysAllocStringLen
SysAllocString
SysStringLen
SysAllocStringByteLen
VariantChangeType
VariantInit
SystemTimeToVariantTime
SafeArrayDestroy
VariantCopy
SysFreeString

ws2_32

recv
send
ntohs
gethostname
inet_ntoa
WSAStartup
WSACleanup
closesocket
accept
socket
select
gethostbyname
htonl
htons
inet_addr
bind
recvfrom
getsockname
getpeername
WSASetLastError
connect
sendto
getsockopt
setsockopt
getservbyname
gethostbyaddr
getservbyport
listen
__WSAFDIsSet
ioctlsocket
WSAGetLastError

wininet

InternetCanonicalizeUrlA
InternetCrackUrlA
InternetCombineUrlA

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

wldap32

ord50
ord26
ord30
ord32
ord35
ord60
ord200
ord33
ord301
ord27
ord41
ord46
ord143
ord211
ord22
ord79

Sections

.text
Size: 864KB - Virtual size: 862KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 168KB - Virtual size: 164KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 104KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b4d57c29c83a350cdd6a64887fa97f7a

Headers

File Characteristics

Imports

shlwapi

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

oledlg

ole32

oleaut32

ws2_32

wininet

version

wldap32

Sections

.text Size: 864KB - Virtual size: 862KB

.rdata Size: 168KB - Virtual size: 164KB

.data Size: 16KB - Virtual size: 37KB

.rsrc Size: 104KB - Virtual size: 100KB

.text
Size: 864KB - Virtual size: 862KB

.rdata
Size: 168KB - Virtual size: 164KB

.data
Size: 16KB - Virtual size: 37KB

.rsrc
Size: 104KB - Virtual size: 100KB