2024-01-08_4471d71c63b0254309059ac3db2a082e_icedid

Sharing

Copy URL Twitter E-mail

General

Target

2024-01-08_4471d71c63b0254309059ac3db2a082e_icedid
Size

483KB
MD5

4471d71c63b0254309059ac3db2a082e
SHA1

abc4462d1329d4f3e61447b6a4ff9a85a8326697
SHA256

695e413f60c97f0afb887a35377e52e214f465d1fecf2f4108cddeef6c614cdb
SHA512

fdb9fbe4358acc2b3f94f4b6398c26683b113a9c94f443942812555f1d2844a860e1757a29f572d98603559bef2ae66ed547d6a0058c9c46d8f1d1d1a4c77199
SSDEEP

6144:MLy9eOhRLzTl0mrCyGBUTru0zs2qRz8GdShfUFGXX/U7LhAmMmf20Baot/K/nU3w:MLyYKr+uruHZV8qSm7LhAmN2ol3YAEPP

Score

1^/10

Malware Config

Signatures

Files

2024-01-08_4471d71c63b0254309059ac3db2a082e_icedid
.exe windows:4 windows x86 arch:x86

4182d499f8f19fe113cb3c058d5d548c

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

18:2a:64:5c:db:db:f6:b0:45:a0:80:58:14:c2:83:6f
Certificate

Issuer

CN=WoSign Class 3 Code Signing CA,O=WoSign CA Limited,C=CN

Not Before

23/10/2015, 00:01

Not After

23/10/2016, 00:01

Subject

CN=深圳市迅刻网络技术有限公司,O=深圳市迅刻网络技术有限公司,L=深圳市,ST=广东省,C=CN,1.2.840.113549.1.9.1=#0c0f78756e6b656e65744071712e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

46:bb:b3:40:fa:b9:c1:79:28:93:8c:93:da:10:86:79
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Class 3 Code Signing CA,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3d
Certificate

Issuer

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

01/03/2011, 01:00

Not After

01/03/2016, 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

20:a0:3e:c4:dc:88:05:34:90:76:0f:73:dc:74:70:9f:e7:bf:92:a9
Signer

Actual PE Digest

20:a0:3e:c4:dc:88:05:34:90:76:0f:73:dc:74:70:9f:e7:bf:92:a9

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetFileAttributesA
GetFileTime
SetErrorMode
GetTickCount
ExitThread
CreateThread
HeapFree
HeapAlloc
GetProcessHeap
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitProcess
GetSystemTimeAsFileTime
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapReAlloc
GetCommandLineA
GetStartupInfoA
RtlUnwind
RaiseException
HeapSize
SetStdHandle
GetFileType
GetConsoleCP
GetConsoleMode
GetStdHandle
GetACP
HeapDestroy
HeapCreate
VirtualFree
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTimeZoneInformation
GetStringTypeA
GetStringTypeW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
LCMapStringA
LCMapStringW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
GetLocaleInfoW
SetEnvironmentVariableA
CreateFileA
GetFullPathNameA
GetVolumeInformationA
FindFirstFileA
FindClose
GetCurrentProcess
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
DeleteFileA
GetThreadLocale
GetOEMCP
GetCPInfo
InterlockedIncrement
GlobalFlags
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
LocalAlloc
FileTimeToLocalFileTime
FileTimeToSystemTime
InterlockedDecrement
GetModuleFileNameW
GetCurrentProcessId
WritePrivateProfileStringA
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
lstrcmpA
LocalFree
MulDiv
FreeResource
GetCurrentThreadId
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
FreeLibrary
LoadLibraryA
SetLastError
lstrcmpW
GetModuleHandleA
GetProcAddress
GetVersionExA
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GetVersion
CompareStringA
InterlockedExchange
CompareStringW
lstrlenA
GetLastError
FindResourceA
LoadResource
LockResource
SizeofResource
OutputDebugStringA
SystemTimeToFileTime
WaitForSingleObject
CreateProcessA
MultiByteToWideChar
WideCharToMultiByte
GetModuleFileNameA
GetLocalTime
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CloseHandle
Sleep
SetHandleCount
FormatMessageA

user32

UnregisterClassA
RegisterClipboardFormatA
PostThreadMessageA
IsWindowEnabled
ShowWindow
MoveWindow
SetWindowTextA
IsDialogMessageA
RegisterWindowMessageA
SendDlgItemMessageA
WinHelpA
IsChild
GetCapture
SetWindowsHookExA
CallNextHookEx
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
GetFocus
IsWindow
SetFocus
GetWindowTextLengthA
GetWindowTextA
GetForegroundWindow
GetLastActivePopup
SetActiveWindow
DispatchMessageA
GetDlgItem
GetTopWindow
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageA
MapWindowPoints
GetKeyState
MessageBeep
IsWindowVisible
UpdateWindow
GetMenu
PostMessageA
GetSubMenu
GetMenuItemID
GetMenuItemCount
MessageBoxA
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
GetSysColor
AdjustWindowRectEx
ScreenToClient
EqualRect
CopyRect
PtInRect
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
GetWindowLongA
SetWindowLongA
SetWindowPos
OffsetRect
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GetWindow
CharUpperA
SetWindowRgn
ReleaseDC
ReleaseCapture
SetCapture
LoadCursorA
GetSysColorBrush
SetForegroundWindow
GetDC
KillTimer
DrawIcon
GetSystemMetrics
IsIconic
SetTimer
AppendMenuA
GetSystemMenu
LoadIconA
EnableWindow
SendMessageA
GetClientRect
DestroyMenu
GetWindowThreadProcessId
GetParent
GetWindowRect
InvalidateRect
GetNextDlgGroupItem
InvalidateRgn
SetRect
IsRectEmpty
CopyAcceleratorTableA
CharNextA
SetCursor
GetMessageA
TranslateMessage
GetCursorPos
ValidateRect
GetDesktopWindow
GetActiveWindow
CreateDialogIndirectParamA
GetNextDlgTabItem
EndDialog
SetWindowContextHelpId
MapDialogRect
PostQuitMessage
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
ModifyMenuA
EnableMenuItem
CheckMenuItem
GetMenuState
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA

gdi32

SetMapMode
GetViewportExtEx
GetWindowExtEx
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
SetBkMode
ExtSelectClipRgn
DeleteDC
CreateBitmap
GetDeviceCaps
CreateRectRgnIndirect
GetMapMode
GetBkColor
GetTextColor
GetRgnBox
RestoreDC
SaveDC
GetObjectA
SetBkColor
SetTextColor
GetClipBox
CombineRgn
GetPixel
CreateRectRgn
SelectObject
DeleteObject
CreateCompatibleBitmap
CreateCompatibleDC
ScaleWindowExtEx
BitBlt
GetStockObject

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

RegQueryValueA
RegEnumKeyA
RegDeleteKeyA
RegCloseKey
RegSetValueExA
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegOpenKeyA

comctl32

InitCommonControlsEx
_TrackMouseEvent

shlwapi

PathStripToRootA
UrlUnescapeA
PathFindFileNameA
PathFindExtensionA
PathIsUNCA

oledlg

ord8

ole32

CoRegisterMessageFilter
OleFlushClipboard
CreateStreamOnHGlobal
CoTaskMemFree
CoTaskMemAlloc
CLSIDFromProgID
CLSIDFromString
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CoRevokeClassObject
OleIsCurrentClipboard

oleaut32

VariantClear
VariantChangeType
VariantInit
SysAllocStringLen
SysStringLen
SysFreeString
SysAllocStringByteLen
VariantCopy
SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
SysAllocString
OleCreateFontIndirect

gdiplus

GdipGetImageWidth
GdipAlloc
GdipFree
GdipCloneImage
GdipDisposeImage
GdipGetImageHeight
GdipDrawImageRectRectI
GdipDrawImageRectI
GdipDeleteGraphics
GdipCreateFromHDC
GdiplusShutdown
GdiplusStartup
GdipCreateBitmapFromStream

ws2_32

WSACleanup
WSAStartup
WSACloseEvent
socket
connect
closesocket
send
recv
inet_addr
htons
setsockopt
WSAGetLastError
gethostbyname

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

wininet

HttpSendRequestA
InternetWriteFile
InternetSetFilePointer
InternetSetStatusCallback
InternetGetLastResponseInfoA
HttpQueryInfoA
InternetConnectA
InternetQueryDataAvailable
InternetSetOptionExA
InternetCanonicalizeUrlA
HttpOpenRequestA
InternetOpenA
InternetCrackUrlA
InternetReadFile
HttpQueryInfoW
InternetSetOptionA
InternetCloseHandle
InternetOpenUrlA

Sections

.text
Size: 308KB - Virtual size: 304KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 72KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 76KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4182d499f8f19fe113cb3c058d5d548c

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

18:2a:64:5c:db:db:f6:b0:45:a0:80:58:14:c2:83:6fCertificate

Extended Key Usages

Key Usages

46:bb:b3:40:fa:b9:c1:79:28:93:8c:93:da:10:86:79Certificate

Extended Key Usages

Key Usages

3dCertificate

Key Usages

20:a0:3e:c4:dc:88:05:34:90:76:0f:73:dc:74:70:9f:e7:bf:92:a9Signer

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

comctl32

shlwapi

oledlg

ole32

oleaut32

gdiplus

ws2_32

version

wininet

Sections

.text Size: 308KB - Virtual size: 304KB

.rdata Size: 72KB - Virtual size: 70KB

.data Size: 16KB - Virtual size: 27KB

.rsrc Size: 76KB - Virtual size: 75KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

18:2a:64:5c:db:db:f6:b0:45:a0:80:58:14:c2:83:6f
Certificate

46:bb:b3:40:fa:b9:c1:79:28:93:8c:93:da:10:86:79
Certificate

3d
Certificate

20:a0:3e:c4:dc:88:05:34:90:76:0f:73:dc:74:70:9f:e7:bf:92:a9
Signer

.text
Size: 308KB - Virtual size: 304KB

.rdata
Size: 72KB - Virtual size: 70KB

.data
Size: 16KB - Virtual size: 27KB

.rsrc
Size: 76KB - Virtual size: 75KB