Static task
static1
Behavioral task
behavioral1
Sample
2024-01-01_4fd0e16e0b218c4ceb7448c0826e7282_icedid.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-01-01_4fd0e16e0b218c4ceb7448c0826e7282_icedid.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-01_4fd0e16e0b218c4ceb7448c0826e7282_icedid
-
Size
712KB
-
MD5
4fd0e16e0b218c4ceb7448c0826e7282
-
SHA1
1292b192277893380beeebb3549e89a6895415a7
-
SHA256
86ed867494966a6d110c3f1b7a6041426492135228c79d6be5ef589a5ea32358
-
SHA512
d1f6112c6aa132457394912a0d6aa38328898f2ee8809ca25cc73e53b7db1c7b11dbd221cb6f8afabd374669923e71bbb7360a0d4b72bb6fb87deb9b293642bc
-
SSDEEP
12288:a6bciaTv+eGkuZyX/b20NCkmIYBhhC0AHcQzRG0:a6Ob+eGz8NdmIYBnC0A8Mn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-01-01_4fd0e16e0b218c4ceb7448c0826e7282_icedid
Files
-
2024-01-01_4fd0e16e0b218c4ceb7448c0826e7282_icedid.exe windows:4 windows x86 arch:x86
65c1090fff1434b22392e5837bfd1a75
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ReadFile
WriteFile
SetFilePointer
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
GetFileSize
DuplicateHandle
FindClose
FindFirstFileA
GetVolumeInformationA
GetFullPathNameA
GetCPInfo
GetOEMCP
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileAttributesA
SetErrorMode
HeapReAlloc
RtlUnwind
RaiseException
ExitThread
CreateThread
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
VirtualAlloc
VirtualQuery
GetTimeFormatA
GetThreadLocale
GetCommandLineA
GetStartupInfoA
ExitProcess
SetStdHandle
GetFileType
HeapSize
HeapDestroy
HeapCreate
VirtualFree
DebugBreak
GetStdHandle
GetACP
IsValidCodePage
LCMapStringA
LCMapStringW
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
SetHandleCount
GetStringTypeA
GetStringTypeW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetLocaleInfoW
SetEnvironmentVariableA
GlobalFlags
CreateFileW
InterlockedCompareExchange
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
LocalAlloc
GetModuleFileNameW
GlobalGetAtomNameA
GlobalFindAtomA
lstrcmpW
GetVersionExA
WritePrivateProfileStringA
FreeResource
GlobalAddAtomA
SetThreadPriority
GlobalDeleteAtom
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
GetModuleHandleA
WaitForSingleObject
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
LocalFree
MulDiv
SetLastError
lstrcpyA
lstrcmpA
DeleteFileA
FreeLibrary
CompareStringA
CompareStringW
GetVersion
SuspendThread
ResumeThread
MultiByteToWideChar
InterlockedIncrement
GetProcAddress
HeapFree
WideCharToMultiByte
LoadResource
LockResource
SizeofResource
FindResourceA
FormatMessageA
lstrlenA
GetProcessHeap
HeapAlloc
InterlockedDecrement
CreateToolhelp32Snapshot
Process32First
Process32Next
GetFileTime
CompareFileTime
GetPrivateProfileStringA
GetTickCount
InterlockedExchange
SetUnhandledExceptionFilter
LoadLibraryA
OutputDebugStringA
GetLocalTime
CreateFileA
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
GetModuleFileNameA
SetEvent
CloseHandle
Sleep
OpenEventA
CreateEventA
CreateMutexA
GetLastError
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetDateFormatA
InitializeCriticalSection
user32
GetSysColorBrush
DestroyMenu
EndPaint
BeginPaint
ReleaseDC
GetDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
ShowWindow
MoveWindow
SetWindowTextA
IsDialogMessageA
RegisterWindowMessageA
WinHelpA
GetCapture
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
SetFocus
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
MapWindowPoints
SetForegroundWindow
UpdateWindow
GetMenu
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
GetSysColor
AdjustWindowRectEx
CopyRect
PtInRect
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
SetWindowLongA
SetWindowPos
SystemParametersInfoA
GetWindowPlacement
GetWindowRect
GetWindow
RegisterClipboardFormatA
GetDesktopWindow
SetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
GetDlgItem
GetNextDlgTabItem
wsprintfA
MessageBoxA
GetSystemMetrics
DrawIcon
EndDialog
GetWindowLongA
GetLastActivePopup
IsWindowEnabled
SetWindowsHookExA
CallNextHookEx
GetMessageA
TranslateMessage
DispatchMessageA
GetActiveWindow
IsWindowVisible
GetKeyState
PeekMessageA
UnregisterClassA
PostThreadMessageA
AppendMenuA
SendMessageA
GetSystemMenu
IsIconic
GetClientRect
SetTimer
EnableWindow
LoadIconA
wvsprintfA
GetWindowThreadProcessId
IsWindow
CharUpperA
GetWindowTextA
GetForegroundWindow
SetCursor
LoadCursorA
GetSubMenu
GetMenuItemCount
GetMenuItemID
GetMenuState
PostQuitMessage
PostMessageA
CheckMenuItem
GetCursorPos
ValidateRect
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
GetFocus
GetParent
ModifyMenuA
EnableMenuItem
SendDlgItemMessageA
gdi32
DeleteDC
GetStockObject
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
GetDeviceCaps
TextOutA
RectVisible
PtVisible
DeleteObject
SetMapMode
RestoreDC
SaveDC
GetObjectA
SetBkColor
SetTextColor
GetClipBox
CreateBitmap
ExtTextOutA
comdlg32
GetFileTitleA
winspool.drv
OpenPrinterA
DocumentPropertiesA
ClosePrinter
advapi32
RegSetValueExA
RegCreateKeyExA
RegQueryValueA
RegEnumKeyA
RegDeleteKeyA
RegOpenKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
shell32
ShellExecuteA
shlwapi
PathFindFileNameA
PathStripToRootA
PathFindExtensionA
PathIsUNCA
oledlg
ord8
ole32
CLSIDFromString
CLSIDFromProgID
OleFlushClipboard
OleIsCurrentClipboard
CoRegisterMessageFilter
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CoRevokeClassObject
CoInitialize
CoUninitialize
OleRun
CoCreateInstance
oleaut32
VariantInit
VariantClear
SysAllocStringByteLen
SysStringByteLen
SysFreeString
VariantCopy
SafeArrayPutElement
SafeArrayCreate
VariantChangeType
GetErrorInfo
SysAllocString
wpcap
pcap_close
pcap_loop
pcap_freealldevs
pcap_setfilter
pcap_compile
pcap_findalldevs
pcap_datalink
pcap_open_live
dbghelp
MiniDumpWriteDump
cximagecrtm
??0CxImage@@QAE@PBDK@Z
?IsValid@CxImage@@QBE_NXZ
?Encode@CxImage@@QAE_NAAPAEAAJK@Z
?FreeMemory@CxImage@@QAEXPAX@Z
?Destroy@CxImage@@QAE_NXZ
ws2_32
inet_ntoa
WSAGetLastError
gethostbyname
gethostname
WSACleanup
WSAStartup
ntohl
ntohs
inet_addr
Sections
.text Size: 588KB - Virtual size: 586KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 80KB - Virtual size: 79KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ