2024-01-23_16a1bcd31457761745a6df7be5b3f7f8_icedid

Sharing

Copy URL Twitter E-mail

General

Target

2024-01-23_16a1bcd31457761745a6df7be5b3f7f8_icedid
Size

604KB
MD5

16a1bcd31457761745a6df7be5b3f7f8
SHA1

3a47f137979d68eaf968341260cda3d751d6e035
SHA256

bbf8724ef921430c251d2df28170d36ce22294b40a8b393315246833b4218f37
SHA512

6168b964b4db0f4d606ae246878313a51b66d8491b50714134981344a67b493586aeec72f16f51417c21dd4100a86db88fad4f0ab7ab352f3ebd10909029861a
SSDEEP

6144:y+M2cnUTJ1Zwv80utvvq81vggUNqulq+p/VQUQfuT3QnxzBlw91wZOiRPPN8xrzf:y+M2cnwZV0utvvqpqulq+TZyzjPVUFKy

Score

1^/10

Malware Config

Signatures

Files

2024-01-23_16a1bcd31457761745a6df7be5b3f7f8_icedid
.exe windows:4 windows x86 arch:x86

5a80fa79455e433a46f2d6e816d2a269

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

19/09/2018, 00:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

28/07/2020, 00:00

Not After

18/03/2029, 00:00

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:a2:44:f0:0f:15:22:76:20:d6:b8:be
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

27/11/2023, 08:44

Not After

27/11/2024, 08:44

Subject

SERIALNUMBER=23829868,CN=CyberLink Corp.,OU=IT,O=CyberLink Corp.,STREET=15F.\, No. 100\, Minquan Rd.\, Xindian Dist.,L=New Taipei City,ST=New Taipei City,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6a
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

06/04/2022, 07:45

Not After

08/05/2033, 07:45

Subject

CN=Globalsign TSA for CodeSign1 - R6,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

10/12/2014, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

9f:df:77:36:ba:e7:17:d4:f8:8d:4e:10:65:a5:d8:4f:d3:f1:9e:96:d3:65:50:ff:71:44:a0:4a:91:0b:83:66
Signer

Actual PE Digest

9f:df:77:36:ba:e7:17:d4:f8:8d:4e:10:65:a5:d8:4f:d3:f1:9e:96:d3:65:50:ff:71:44:a0:4a:91:0b:83:66

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathRemoveExtensionW
PathAddExtensionW
PathRemoveBackslashW
PathFindFileNameW
PathFileExistsW
StrToIntW
PathStripToRootW
PathIsUNCW
PathIsRootW
PathIsUNCServerW
PathAddBackslashW
PathFindExtensionW
PathIsUNCServerShareW

mapi32

ord62
ord23
ord140
ord17
ord19
ord21
ord64

kernel32

LockFile
UnlockFile
DuplicateHandle
GetFullPathNameW
GetPrivateProfileIntW
WritePrivateProfileStringW
GetCurrentDirectoryW
InterlockedIncrement
GlobalFlags
GlobalReAlloc
GlobalHandle
TlsGetValue
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
SetErrorMode
GetFileTime
GetStartupInfoW
RtlUnwind
FlushFileBuffers
ExitProcess
TerminateProcess
HeapFree
HeapAlloc
ExitThread
HeapReAlloc
HeapSize
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetStdHandle
GetModuleFileNameA
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
GetTimeFormatA
GetDateFormatA
GetTimeZoneInformation
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
LCMapStringA
LCMapStringW
SetUnhandledExceptionFilter
IsBadWritePtr
GetOEMCP
GetCPInfo
IsBadReadPtr
IsBadCodePtr
GetStringTypeA
GetStringTypeW
GetDriveTypeA
SetStdHandle
CompareStringA
CompareStringW
SetEnvironmentVariableA
GlobalFindAtomW
lstrcatW
GetVersionExA
SuspendThread
ResumeThread
SetThreadPriority
GlobalAddAtomW
GetModuleHandleA
SetLastError
GlobalUnlock
FormatMessageW
lstrcpynW
GetCurrentThread
GetCurrentThreadId
GlobalLock
lstrcmpW
GlobalDeleteAtom
ConvertDefaultLocale
GetVersion
EnumResourceLanguagesW
lstrcpyW
LoadLibraryA
LocalFree
LocalAlloc
InterlockedDecrement
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetSystemDirectoryW
ExpandEnvironmentStringsW
OutputDebugStringW
lstrcmpiW
GetCurrentProcess
GlobalAlloc
GlobalFree
GetShortPathNameW
GetDiskFreeSpaceExW
LoadLibraryW
FreeLibrary
GetLocaleInfoW
GetNumberFormatW
RaiseException
CreateThread
GetModuleHandleW
GetProcAddress
CreateEventW
SetEvent
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CreateDirectoryW
SetEndOfFile
SetFileTime
GetFileSize
GetLastError
SetFilePointer
ReadFile
WaitForSingleObject
GetFileAttributesExW
SetFileAttributesW
FindFirstFileW
FindNextFileW
FindClose
lstrlenA
lstrlenW
WideCharToMultiByte
GetVolumeInformationW
Sleep
MoveFileW
FileTimeToLocalFileTime
FileTimeToSystemTime
CreateFileW
WriteFile
CloseHandle
FreeResource
MulDiv
GetFileAttributesW
MultiByteToWideChar
GetVersionExW
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
GetTempPathW
GetModuleFileNameW
DeleteFileW
FindResourceW
LoadResource
LockResource
SizeofResource
GetSystemTimeAsFileTime

user32

CharUpperW
RegisterWindowMessageW
WinHelpW
CreateWindowExW
GetClassInfoExW
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
SendDlgItemMessageA
GetForegroundWindow
GetLastActivePopup
GetTopWindow
GetMessageTime
GetMessagePos
MapWindowPoints
MessageBoxW
SetForegroundWindow
GetMenu
AdjustWindowRectEx
GetClassInfoW
RegisterClassW
DefWindowProcW
CallWindowProcW
SystemParametersInfoA
GetWindowPlacement
PtInRect
GetWindowTextLengthW
GetWindowTextW
SetWindowPos
SetFocus
ShowWindow
MoveWindow
SetWindowLongW
GetDlgCtrlID
SetWindowTextW
IsDialogMessageW
SetDlgItemTextW
SendDlgItemMessageW
UnhookWindowsHookEx
CopyRect
SetActiveWindow
CreateDialogIndirectParamW
DestroyWindow
GetDlgItem
IsWindowEnabled
SetMenuItemBitmaps
GetFocus
ModifyMenuW
EnableMenuItem
CheckMenuItem
GetMenuCheckMarkDimensions
SetWindowsHookExW
CallNextHookEx
GetMessageW
TranslateMessage
DispatchMessageW
IsWindowVisible
GetKeyState
DestroyCursor
PeekMessageW
GetCursorPos
ValidateRect
SetCursor
EndPaint
BeginPaint
ScreenToClient
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
PostQuitMessage
GetWindowLongW
LoadCursorW
ReleaseCapture
WindowFromPoint
SetCapture
GetCapture
GetWindowDC
ClientToScreen
SetWindowRgn
GetSysColorBrush
DestroyMenu
IsWindow
GetSysColor
GetParent
RedrawWindow
InvalidateRect
UpdateWindow
FillRect
GetActiveWindow
KillTimer
SetTimer
SystemParametersInfoW
ReleaseDC
UnregisterClassW
GetDesktopWindow
wsprintfW
GetSystemMetrics
LoadIconW
EnableWindow
MapDialogRect
GetDC
GetClientRect
GetWindowRect
IsIconic
PostMessageW
SendMessageW
DrawIcon
LoadBitmapW
GetWindow
GetNextDlgTabItem
EndDialog

gdi32

SetWindowExtEx
ScaleWindowExtEx
CreateBitmap
DPtoLP
PtVisible
GetTextCharsetInfo
EnumFontFamiliesExW
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
Escape
ExtTextOutW
TextOutW
SetBkColor
RestoreDC
SaveDC
PtInRegion
GetStockObject
CreateSolidBrush
BitBlt
GetMapMode
CreateCompatibleBitmap
GetDeviceCaps
CreateICW
SelectObject
GetPixel
DeleteDC
CreateRectRgn
CombineRgn
DeleteObject
StretchBlt
CreateCompatibleDC
CreateFontIndirectW
GetObjectW
GetClipBox
SetMapMode
SetTextColor
SetBkMode
RectVisible

comdlg32

GetSaveFileNameW
GetOpenFileNameW
GetFileTitleW

winspool.drv

ClosePrinter
DocumentPropertiesW
OpenPrinterW

advapi32

RegEnumKeyW
RegCloseKey
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
RegDeleteKeyW
RegEnumValueW
RegQueryValueW
RegOpenKeyW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW

shell32

ShellExecuteExW
SHGetMalloc
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetSpecialFolderLocation
SHGetSpecialFolderPathW
SHGetFileInfoW
SHFileOperationW

comctl32

_TrackMouseEvent
ord17

ole32

CoUninitialize
CoInitialize

oleaut32

VariantClear
VariantInit
VariantChangeType

Sections

.text
Size: 228KB - Virtual size: 226KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 264KB - Virtual size: 261KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5a80fa79455e433a46f2d6e816d2a269

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6aCertificate

Key Usages

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54Certificate

Extended Key Usages

Key Usages

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

62:a2:44:f0:0f:15:22:76:20:d6:b8:beCertificate

Extended Key Usages

Key Usages

01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6aCertificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51Certificate

Key Usages

9f:df:77:36:ba:e7:17:d4:f8:8d:4e:10:65:a5:d8:4f:d3:f1:9e:96:d3:65:50:ff:71:44:a0:4a:91:0b:83:66Signer

Headers

File Characteristics

Imports

shlwapi

mapi32

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

ole32

oleaut32

Sections

.text Size: 228KB - Virtual size: 226KB

.rdata Size: 68KB - Virtual size: 67KB

.data Size: 28KB - Virtual size: 49KB

.rsrc Size: 264KB - Virtual size: 261KB

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

62:a2:44:f0:0f:15:22:76:20:d6:b8:be
Certificate

01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6a
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

9f:df:77:36:ba:e7:17:d4:f8:8d:4e:10:65:a5:d8:4f:d3:f1:9e:96:d3:65:50:ff:71:44:a0:4a:91:0b:83:66
Signer

.text
Size: 228KB - Virtual size: 226KB

.rdata
Size: 68KB - Virtual size: 67KB

.data
Size: 28KB - Virtual size: 49KB

.rsrc
Size: 264KB - Virtual size: 261KB