NEAS[.]2023-09-05_fb3a5f1f22944d2bfd0b10936ca325ef_icedid_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.2023-09-05_fb3a5f1f22944d2bfd0b10936ca325ef_icedid_JC.exe
Size

1.3MB
MD5

fb3a5f1f22944d2bfd0b10936ca325ef
SHA1

97527d04c05baaf5a8455500de491876e174779d
SHA256

efa0affca7bede40096c11923b0e01026aa060e488a1a1e6b740b6bb67b5ed2d
SHA512

0de44e7f3294340f4a7713a59ed61e5efa6812ee54e215f8f5f8e5e8ff0b3137afb1616964d405a50721c544948e85ff51adcf7fbaf42372923c661682a25131
SSDEEP

24576:/LNOevAJlbUK1m5qi/SfcFPjqJ5i9NXe/WIMXptbJwfgtTkj:pOaAJlTijqJMXcsJwfgtT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.2023-09-05_fb3a5f1f22944d2bfd0b10936ca325ef_icedid_JC.exe

Files

NEAS.2023-09-05_fb3a5f1f22944d2bfd0b10936ca325ef_icedid_JC.exe
.exe windows:4 windows x86

271dc0f2c8580de9b780dbf8984856cd

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

kernel32

WriteConsoleA
AllocConsole
FreeConsole
QueryPerformanceFrequency
GetLocalTime
SetProcessWorkingSetSize
FlushInstructionCache
GetLocaleInfoW
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
IsBadCodePtr
IsBadReadPtr
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetStdHandle
SetHandleCount
LCMapStringW
LCMapStringA
GetTimeZoneInformation
GetStringTypeW
GetStringTypeA
QueryPerformanceCounter
IsBadWritePtr
VirtualFree
HeapCreate
HeapDestroy
HeapSize
GetFileType
SetStdHandle
GetCommandLineA
GetStartupInfoA
CreateThread
ExitThread
GetDriveTypeA
HeapReAlloc
VirtualAlloc
HeapAlloc
ExitProcess
RtlUnwind
HeapFree
GetOEMCP
GetCPInfo
GetVolumeInformationA
DuplicateHandle
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
TlsGetValue
GlobalHandle
GlobalReAlloc
GlobalFlags
GetCurrentDirectoryA
LocalAlloc
FreeResource
GlobalGetAtomNameA
GlobalFindAtomA
lstrcmpW
InterlockedDecrement
SetErrorMode
GlobalAddAtomA
MulDiv
CreateEventA
ResetEvent
CreateIoCompletionPort
GetQueuedCompletionStatus
SetEvent
CreateNamedPipeA
PostQueuedCompletionStatus
CancelIo
ConnectNamedPipe
SetEnvironmentVariableA
OpenProcess
GetExitCodeProcess
FormatMessageA
ExpandEnvironmentStringsA
GetSystemDirectoryA
SetLastError
SleepEx
ReleaseMutex
DebugBreak
TerminateProcess
GetModuleFileNameW
CreateProcessW
SetUnhandledExceptionFilter
VirtualProtect
WriteProcessMemory
lstrcpynA
IsDebuggerPresent
GetSystemTimeAsFileTime
GlobalMemoryStatus
VirtualQuery
FileTimeToDosDateTime
OutputDebugStringA
RaiseException
GetCurrentProcessId
lstrcatA
lstrcpyA
CreateDirectoryA
GetFileTime
GetFullPathNameA
FindNextFileA
GetFileAttributesA
FindFirstFileA
FindClose
FileTimeToLocalFileTime
FileTimeToSystemTime
GetFileSize
SetFilePointer
WriteFile
LocalFree
GetCurrentThread
GlobalDeleteAtom
ConvertDefaultLocale
EnumResourceLanguagesA
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
SizeofResource
LockResource
LoadResource
FindResourceA
GetModuleHandleA
GetCurrentThreadId
WideCharToMultiByte
ReadFile
AreFileApisANSI
WritePrivateProfileStringA
DeviceIoControl
CreateFileA
GetSystemInfo
GetCurrentProcess
GetProcessAffinityMask
SetProcessAffinityMask
Sleep
lstrcmpA
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetPrivateProfileIntA
DeleteFileA
CopyFileA
GetModuleFileNameA
IsDBCSLeadByte
InterlockedIncrement
InterlockedExchangeAdd
WinExec
CreateMutexA
OpenMutexA
FreeLibrary
CloseHandle
GetProcAddress
LoadLibraryA
GetTickCount
SetCurrentDirectoryA
MultiByteToWideChar
GetLastError
GetVersion
lstrcmpiA
lstrlenW
lstrlenA
LeaveCriticalSection
EnterCriticalSection
CompareStringA
CompareStringW
WaitForSingleObject
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
OpenFileMappingA
GetPrivateProfileStringA
InitializeCriticalSection
DeleteCriticalSection
CreateProcessA

user32

UnregisterClassA
SetPropA
GetPropA
MessageBoxW
wsprintfA
wvsprintfA
EnumChildWindows
SetCapture
TrackMouseEvent
EqualRect
BeginPaint
EndPaint
UnionRect
IntersectRect
GetKeyState
GetClassInfoExA
SystemParametersInfoA
CreateWindowExA
CallWindowProcA
MoveWindow
GetWindowRgn
DefWindowProcA
RegisterClassExA
DrawEdge
GetSysColor
WindowFromPoint
InflateRect
GetParent
MapWindowPoints
LoadBitmapA
PeekMessageA
IsDialogMessageA
TranslateMessage
DispatchMessageA
EnableScrollBar
ShowScrollBar
SetScrollRange
GetScrollRange
GetScrollPos
SetScrollPos
GetScrollInfo
SetScrollInfo
GrayStringA
DrawTextExA
TabbedTextOutA
GetDC
IsRectEmpty
AdjustWindowRectEx
DrawTextA
OffsetRect
SetRect
FillRect
ClientToScreen
GetFocus
IsChild
IsZoomed
GetCursor
SetCursor
ReleaseCapture
PostQuitMessage
RedrawWindow
PostMessageA
IsWindow
IsWindowVisible
MonitorFromWindow
EnableWindow
GetCursorPos
MonitorFromPoint
GetMonitorInfoA
SetWindowRgn
SetLayeredWindowAttributes
KillTimer
SetTimer
ScreenToClient
GetClientRect
CopyRect
PtInRect
LoadImageA
SendMessageA
CharUpperA
FindWindowA
MessageBoxA
IsIconic
GetForegroundWindow
GetWindowThreadProcessId
GetSubMenu
GetMenuItemCount
GetMenuItemID
GetMenuState
ShowOwnedPopups
IsWindowEnabled
GetLastActivePopup
ValidateRect
GetActiveWindow
GetMessageA
CallNextHookEx
SetWindowsHookExA
GetMenuCheckMarkDimensions
CheckMenuItem
EnableMenuItem
ModifyMenuA
SetMenuItemBitmaps
UnhookWindowsHookEx
ReleaseDC
GetWindowDC
GetDlgItem
SendDlgItemMessageA
SetWindowTextA
GetDlgCtrlID
SetFocus
GetWindowTextA
GetWindowTextLengthA
GetWindow
GetWindowPlacement
RegisterClassA
GetClassInfoA
DeferWindowPos
GetMenu
TrackPopupMenu
ScrollWindow
GetMessagePos
GetMessageTime
GetTopWindow
EndDeferWindowPos
BeginDeferWindowPos
SetActiveWindow
RemovePropA
GetClassNameA
GetClassLongA
GetCapture
WinHelpA
RegisterWindowMessageA
EndDialog
GetNextDlgTabItem
CreateDialogIndirectParamA
GetDesktopWindow
CopyAcceleratorTableA
InvalidateRgn
DrawIcon
GetSysColorBrush
GetMenuItemInfoA
DestroyMenu
TranslateAcceleratorA
SetMenu
SetRectEmpty
CreatePopupMenu
InsertMenuItemA
LoadAcceleratorsA
ReuseDDElParam
UnpackDDElParam
LoadMenuA
CharNextA
MapDialogRect
SetWindowContextHelpId
RegisterClipboardFormatA
MessageBeep
GetNextDlgGroupItem
PostThreadMessageA
CharPrevA
AttachThreadInput
SetForegroundWindow
BringWindowToTop
SwitchToThisWindow
ShowWindow
GetWindowLongA
SetWindowLongA
CreateDialogParamA
GetWindowRect
GetSystemMetrics
SetWindowPos
LoadIconA
LoadCursorA
DestroyWindow
SetDlgItemTextA
UpdateWindow
InvalidateRect

gdi32

GetGlyphOutlineA
CreatePatternBrush
ExtSelectClipRgn
OffsetViewportOrgEx
SetViewportOrgEx
GetPixel
GetWindowExtEx
GetViewportExtEx
GetTextColor
GetBkColor
GetMapMode
Ellipse
LPtoDP
CreateEllipticRgn
GetRgnBox
SetViewportExtEx
ScaleWindowExtEx
SetWindowExtEx
OffsetWindowOrgEx
SetWindowOrgEx
SetDIBitsToDevice
GetTextMetricsA
CombineRgn
ExtCreateRegion
GetClipRgn
SelectClipRgn
CreateRectRgn
PtInRegion
RoundRect
Rectangle
CreatePen
CreateFontA
CreateRectRgnIndirect
BitBlt
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetClipBox
CreateCompatibleBitmap
StretchBlt
GetTextExtentPoint32A
GetDeviceCaps
SetTextColor
SetBkColor
CreateSolidBrush
CreateRoundRectRgn
CreateFontIndirectA
SetBkMode
GetStockObject
CreateDIBSection
GetObjectA
DeleteObject
SelectObject
DeleteDC
CreateCompatibleDC
ScaleViewportExtEx
MoveToEx
LineTo
IntersectClipRect
SetMapMode
SetStretchBltMode
RestoreDC
SaveDC
CreateBitmap

advapi32

RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
RegCreateKeyA
RegOpenKeyA
RegSetValueA
GetUserNameA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegCreateKeyExA
RegQueryValueA
RegEnumKeyA
RegDeleteKeyA
RegDeleteValueA

shell32

ShellExecuteA
DragFinish
DragQueryFileA
Shell_NotifyIconA
SHChangeNotify
ShellExecuteExA

ole32

OleFlushClipboard
OleIsCurrentClipboard
CoRevokeClassObject
CoFreeUnusedLibraries
CoRegisterMessageFilter
CLSIDFromProgID
CLSIDFromString
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CoTaskMemAlloc
CoTaskMemFree
CoDisconnectObject
OleUninitialize
OleInitialize

oleaut32

SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetElemsize
SafeArrayGetDim
SafeArrayCreate
VariantCopy
OleCreateFontIndirect
SysAllocString
SafeArrayDestroy
SystemTimeToVariantTime
VariantChangeType
SysStringLen
SysAllocStringByteLen
VariantInit
SysFreeString
SysAllocStringLen
LoadTypeLi
VariantClear

msimg32

GradientFill
AlphaBlend
TransparentBlt

comctl32

ImageList_GetImageCount
ImageList_Draw
ImageList_GetImageInfo
_TrackMouseEvent
ImageList_Destroy
ImageList_Create
ord17
ImageList_AddMasked

shlwapi

PathFileExistsA
UrlUnescapeA
PathStripToRootA
PathIsUNCA
PathFindFileNameA
PathFindExtensionA

oledlg

ord8

gdiplus

GdiplusShutdown

winmm

timeGetTime
PlaySoundA

iphlpapi

GetAdaptersInfo

ws2_32

getservbyname
gethostbyaddr
getservbyport
__WSAFDIsSet
htonl
bind
ntohs
getsockname
send
select
closesocket
WSAStartup
WSACleanup
WSAGetLastError
inet_ntoa
gethostbyname
inet_addr
WSASetLastError
socket
connect
setsockopt
getpeername
getsockopt
ioctlsocket
recv
gethostname
htons

wininet

HttpOpenRequestA
InternetConnectA
FtpOpenFileA
HttpSendRequestA
InternetReadFile
InternetWriteFile
InternetSetFilePointer
InternetSetStatusCallback
InternetOpenA
InternetGetLastResponseInfoA
InternetCloseHandle
HttpQueryInfoA
FtpSetCurrentDirectoryA
InternetQueryDataAvailable
InternetSetOptionExA
InternetCanonicalizeUrlA
InternetCrackUrlA

oleacc

LresultFromObject
AccessibleObjectFromWindow
CreateStdAccessibleObject

winspool.drv

ClosePrinter
OpenPrinterA
DocumentPropertiesA

comdlg32

GetFileTitleA

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 224KB - Virtual size: 221KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

271dc0f2c8580de9b780dbf8984856cd

Headers

File Characteristics

Imports

version

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

msimg32

comctl32

shlwapi

oledlg

gdiplus

winmm

iphlpapi

ws2_32

wininet

oleacc

winspool.drv

comdlg32

Sections

.text Size: 1.0MB - Virtual size: 1.0MB

.rdata Size: 224KB - Virtual size: 221KB

.data Size: 16KB - Virtual size: 45KB

.rsrc Size: 52KB - Virtual size: 52KB

.text
Size: 1.0MB - Virtual size: 1.0MB

.rdata
Size: 224KB - Virtual size: 221KB

.data
Size: 16KB - Virtual size: 45KB

.rsrc
Size: 52KB - Virtual size: 52KB