2024-01-25_8536561d5216b47b1cfd828c57b9176c_icedid

Sharing

Copy URL Twitter E-mail

General

Target

2024-01-25_8536561d5216b47b1cfd828c57b9176c_icedid
Size

1.4MB
MD5

8536561d5216b47b1cfd828c57b9176c
SHA1

54994d35eae74578a1eb98effc2faeec6194a4f7
SHA256

535a8de88551367f62f36f49ab50f7ef2ab5b3708fd97496c68fcca9725b9669
SHA512

264bfef8ac569df14ecb405035f2004477ce45732eadc8794f9bc86d7e3ad4cd08afa821f0526299fa258ab6e0a61b3db7e0df899a187448aae9ac0d0f221c86
SSDEEP

24576:a+rh5MblJ+yc3MrlTwAJQxd26PNW0/HNmsY717kAMgq2XPDc0MrR:aKMblQyprSJxBBWlMgpX40Y

Score

1^/10

Malware Config

Signatures

Files

2024-01-25_8536561d5216b47b1cfd828c57b9176c_icedid
.exe windows:5 windows x86 arch:x86

48a7a477689e9e6dd4a81c20965edfa5

Code Sign

01
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01/01/2004, 00:00

Not After

31/12/2028, 23:59

Subject

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

fc:5e:2f:5d:7e:d2:c2:e6:e5:10:c8:a8:b0:fb:e6:53
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

23/02/2022, 00:00

Not After

22/02/2024, 23:59

Subject

CN=SMART TECHNOLOGIES INVESTMENT & DEVELOPMENT JOINT STOCK COMPANY,O=SMART TECHNOLOGIES INVESTMENT & DEVELOPMENT JOINT STOCK COMPANY,ST=Ho Chi Minh,C=VN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:e0:90:c2:4c:0c:d3:16:22:9f:88:94:19:a8:4d:90:85:b5:5e:99
Signer

Actual PE Digest

6a:e0:90:c2:4c:0c:d3:16:22:9f:88:94:19:a8:4d:90:85:b5:5e:99

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

crypt32

CertCreateCertificateContext
CertFreeCertificateContext
CertGetNameStringW
CryptStringToBinaryW
CertNameToStrW

cryptui

CryptUIDlgViewContext

gdiplus

GdipCloneImage
GdiplusStartup
GdipLoadImageFromStream
GdipDrawImageRectI
GdipDeleteGraphics
GdipCreateFromHDC
GdipDisposeImage
GdipAlloc
GdipFree
GdiplusShutdown

wininet

InternetReadFile
InternetOpenUrlW
InternetOpenW
InternetCloseHandle
InternetCanonicalizeUrlW
InternetGetConnectedState

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

psapi

GetModuleBaseNameW
EnumProcessModules
EnumProcesses

kernel32

SetEvent
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
FileTimeToLocalFileTime
OpenEventA
SizeofResource
LockResource
LoadResource
FindResourceW
MultiByteToWideChar
lstrlenW
LocalAlloc
LocalFree
GetSystemTime
SystemTimeToFileTime
GetModuleFileNameW
WideCharToMultiByte
GetLastError
GetPrivateProfileStringA
WritePrivateProfileStringA
SetLastError
CloseHandle
InterlockedExchange
WaitForSingleObject
GetProcessHeap
GetTimeZoneInformation
SetEnvironmentVariableA
GetConsoleOutputCP
WriteConsoleA
CreateFileA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoA
LCMapStringA
GetStringTypeW
GetStringTypeA
InitializeCriticalSectionAndSpinCount
GetConsoleMode
GetConsoleCP
HeapReAlloc
HeapSize
HeapAlloc
LCMapStringW
IsValidCodePage
GetCPInfo
GetOEMCP
GetACP
VirtualFree
HeapFree
HeapCreate
HeapDestroy
GetStartupInfoA
SetHandleCount
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetSystemTimeAsFileTime
QueryPerformanceCounter
OutputDebugStringW
WriteConsoleW
OutputDebugStringA
GetStdHandle
DebugBreak
VirtualQuery
GetSystemInfo
VirtualAlloc
GetModuleFileNameA
ExitThread
CreateThread
ExitProcess
RaiseException
GetFileType
SetStdHandle
RtlUnwind
IsBadReadPtr
HeapValidate
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
GetTickCount
VirtualProtect
GlobalFlags
TlsGetValue
LocalReAlloc
TlsSetValue
EnterCriticalSection
GlobalReAlloc
LeaveCriticalSection
TlsFree
GlobalHandle
DeleteCriticalSection
TlsAlloc
InitializeCriticalSection
InterlockedIncrement
lstrlenA
FileTimeToSystemTime
InterlockedDecrement
SetErrorMode
GetAtomNameW
GetFileTime
GetFileSizeEx
GetCurrentProcessId
CreateEventW
GetModuleHandleW
WritePrivateProfileStringW
CompareStringA
lstrcmpA
GetCurrentThread
GetLocaleInfoW
ConvertDefaultLocale
EnumResourceLanguagesW
GetModuleHandleA
CompareStringW
LoadLibraryA
GetVersionExW
lstrcmpW
GetCurrentThreadId
GlobalGetAtomNameW
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
GetVersionExA
SuspendThread
ResumeThread
SetThreadPriority
MulDiv
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
FormatMessageW
GetThreadLocale
GetFullPathNameW
GetVolumeInformationW
FindFirstFileW
FindClose
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
ReadFile
DuplicateHandle
FreeLibrary
LoadLibraryW
MoveFileExW
WriteFile
GetTempPathW
Sleep
DeleteFileW
GetCurrentProcess
GetFileAttributesW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
TerminateProcess
OpenProcess
FreeResource
InterlockedExchangeAdd
DeleteTimerQueueTimer
CreateTimerQueueTimer
CreateFileW
GetProcAddress

user32

GetClipboardFormatNameW
GetClipboardFormatNameA
DestroyMenu
GetWindowThreadProcessId
GetCursorPos
GetMessageW
TranslateMessage
PostQuitMessage
CharNextW
GetMenuCheckMarkDimensions
ShowWindow
MoveWindow
SetWindowTextW
IsDialogMessageW
RegisterWindowMessageW
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
SendDlgItemMessageW
SendDlgItemMessageA
PeekMessageW
AdjustWindowRectEx
EqualRect
DeferWindowPos
BeginDeferWindowPos
CopyRect
EndDeferWindowPos
WinHelpW
TrackPopupMenu
GetDlgCtrlID
SetWindowsHookExW
CallNextHookEx
GetClassLongW
GetClassNameW
SetPropW
UnhookWindowsHookEx
GetPropW
CallWindowProcW
RemovePropW
DefWindowProcW
SetMenu
GetMenu
GetMessageTime
GetMessagePos
SetWindowLongW
SetWindowPos
OffsetRect
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GetWindowTextLengthW
GetWindowTextW
SetFocus
LoadMenuW
SetMenuItemBitmaps
ModifyMenuW
InsertMenuItemW
GetMenuItemInfoW
EnableMenuItem
CheckMenuItem
CreatePopupMenu
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
DrawIcon
UnpackDDElParam
LoadBitmapW
GetSysColorBrush
LoadIconW
PostThreadMessageW
MapDialogRect
SetWindowContextHelpId
GetForegroundWindow
SetForegroundWindow
GetParent
IsChild
GetLastActivePopup
GetWindow
GetTopWindow
GetNextDlgTabItem
GetNextDlgGroupItem
GetFocus
SetCapture
GetCapture
RedrawWindow
ShowOwnedPopups
IsWindowVisible
ValidateRect
InvalidateRgn
InvalidateRect
UpdateWindow
ReleaseDC
GetWindowDC
GetDC
EndPaint
BeginPaint
ScreenToClient
ClientToScreen
MapWindowPoints
GetClientRect
GetWindowRect
BringWindowToTop
IsIconic
GetSystemMenu
PostMessageW
SendMessageW
SetRectEmpty
ReleaseCapture
CopyAcceleratorTableW
PtInRect
LoadAcceleratorsW
TranslateAcceleratorW
ReuseDDElParam
EndDialog
GetDesktopWindow
UnregisterClassW
RegisterClipboardFormatW
FillRect
InflateRect
SetRect
IsRectEmpty
wsprintfW
GetActiveWindow
GetSysColor
MessageBeep
SetCursor
LoadCursorW
MessageBoxW
GetKeyState
DispatchMessageW
GetSystemMetrics
CharUpperW
GetMenuItemID
AppendMenuW
GetMenuState
GetSubMenu
GetMenuItemCount
IsMenu
IsWindowEnabled
GetDlgItem
GetWindowLongW
DestroyWindow
CreateDialogIndirectParamW
EnableWindow
IsWindow
SetActiveWindow
SystemParametersInfoW

gdi32

GetRgnBox
CreateCompatibleDC
SelectObject
GetBkColor
GetTextColor
GetMapMode
GetViewportExtEx
GetWindowExtEx
DPtoLP
PtVisible
RectVisible
BitBlt
GetPixel
TextOutW
ExtTextOutW
GetTextExtentPoint32W
Escape
GetClipBox
SetTextColor
SetBkColor
DeleteDC
SaveDC
RestoreDC
SetBkMode
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
DeleteObject
ExtSelectClipRgn
GetDeviceCaps
GetObjectW
GetStockObject
GetObjectType
CreateSolidBrush
CreatePatternBrush
CreateFontIndirectW
CreateBitmap
CreateCompatibleBitmap
CreateRectRgnIndirect

comdlg32

GetFileTitleW

winspool.drv

DocumentPropertiesW
OpenPrinterW
ClosePrinter

advapi32

CryptAcquireContextW
CryptSetProvParam
CryptGetProvParam
CryptGetUserKey
CryptGetKeyParam
CryptReleaseContext
RegEnumKeyW
OpenThreadToken
RevertToSelf
SetThreadToken
RegQueryValueW
RegDeleteKeyW
RegSetValueExW
RegCreateKeyExW
CryptDestroyKey
RegOpenKeyW
RegCloseKey
FreeSid
SetSecurityInfo
SetEntriesInAclW
AllocateAndInitializeSid
GetSecurityInfo
RegQueryValueExW
RegOpenKeyExW
CryptSetKeyParam

shell32

ShellExecuteW
DragFinish
DragQueryFileW

comctl32

InitCommonControlsEx

shlwapi

PathStripToRootW
PathRemoveFileSpecW
PathFindExtensionW
PathIsUNCW
PathFindFileNameW

oledlg

OleUIBusyW

ole32

CoRevokeClassObject
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
StringFromGUID2
CLSIDFromString
CLSIDFromProgID
CoInitializeEx
CoCreateInstance
CoTaskMemAlloc
StringFromCLSID
CoTaskMemFree
CreateStreamOnHGlobal
OleFlushClipboard
OleIsCurrentClipboard
CoRegisterMessageFilter
CoFreeUnusedLibraries
CoUninitialize
OleUninitialize
OleInitialize

oleaut32

VariantCopy
SysStringLen
SysFreeString
SafeArrayDestroy
VariantClear
VariantChangeType
VariantInit
SysAllocStringLen
OleCreateFontIndirect
SysAllocString
SystemTimeToVariantTime
VariantTimeToSystemTime

one-ca_v2

C_OpenSession
C_GetTokenInfo
E_GetAuxFunctionList
C_GetSlotList
C_SetPIN
C_Logout
C_CloseSession
C_DestroyObject
C_FindObjectsFinal
C_GetAttributeValue
C_FindObjects
C_FindObjectsInit
C_Finalize
C_Initialize
C_InitPIN
C_CreateObject
C_WaitForSlotEvent
C_Login

Sections

.text
Size: 725KB - Virtual size: 724KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 222KB - Virtual size: 221KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 434KB - Virtual size: 433KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

48a7a477689e9e6dd4a81c20965edfa5

Code Sign

01Certificate

Key Usages

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

fc:5e:2f:5d:7e:d2:c2:e6:e5:10:c8:a8:b0:fb:e6:53Certificate

Extended Key Usages

Key Usages

6a:e0:90:c2:4c:0c:d3:16:22:9f:88:94:19:a8:4d:90:85:b5:5e:99Signer

Headers

DLL Characteristics

File Characteristics

Imports

crypt32

cryptui

gdiplus

wininet

version

psapi

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

one-ca_v2

Sections

.text Size: 725KB - Virtual size: 724KB

.rdata Size: 222KB - Virtual size: 221KB

.data Size: 18KB - Virtual size: 36KB

.rsrc Size: 434KB - Virtual size: 433KB

01
Certificate

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

fc:5e:2f:5d:7e:d2:c2:e6:e5:10:c8:a8:b0:fb:e6:53
Certificate

6a:e0:90:c2:4c:0c:d3:16:22:9f:88:94:19:a8:4d:90:85:b5:5e:99
Signer

.text
Size: 725KB - Virtual size: 724KB

.rdata
Size: 222KB - Virtual size: 221KB

.data
Size: 18KB - Virtual size: 36KB

.rsrc
Size: 434KB - Virtual size: 433KB