2024-01-27_63de88226ce980a108199b8d3260120f_icedid

Sharing

Copy URL Twitter E-mail

General

Target

2024-01-27_63de88226ce980a108199b8d3260120f_icedid
Size

522KB
MD5

63de88226ce980a108199b8d3260120f
SHA1

f79d0c52307a0ecc642a18d88eff8a2768d6b901
SHA256

f6a8e7da082c4c8eaca89343c9acbdd4bc69cb64161322fbd20b8654e4667885
SHA512

0109f40f15f02a293fb55d06fb0f969514c6cbbb75b3668157b54338e85540101a21316bbb553adc41d839a7b27b8c7e704211744e54634e8dfa2e0e6c087b3c
SSDEEP

6144:XcMe7nK+PXt9CLO9uQ/4YHiiN4uOkCOabHtsguEPIZ0:XJe7nKsXzOO91lN4ZkCXzt2EPIZ0

Score

1^/10

Malware Config

Signatures

Files

2024-01-27_63de88226ce980a108199b8d3260120f_icedid
.exe windows:4 windows x86 arch:x86

47992f98134f5cd915f5b45f64408777

Code Sign

02:3a:64
Certificate

Issuer

CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US

Not Before

18/10/2012, 14:38

Not After

20/05/2022, 14:38

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7e:1f:df:72:99:e8:d2:45:a1:5d:0b:a8:e5:b1:59:ba
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

19/05/2022, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

02:28:93:61:8a:1d:fa:73:d6:6c:50:fe:4e:e6:de:61
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

26/11/2010, 00:00

Not After

25/11/2013, 23:59

Subject

CN=Shanda Games,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Netwrok Security,O=Shanda Games,L=ShangHai,ST=ShangHai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

79:48:ae:33:97:73:56:1a:18:5d:51:74:e3:17:09:89:92:d3:c4:f3
Signer

Actual PE Digest

79:48:ae:33:97:73:56:1a:18:5d:51:74:e3:17:09:89:92:d3:c4:f3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

g:\cs\Goweb\Release\GOWEB.pdb

Imports

kernel32

IsBadWritePtr
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringA
LCMapStringW
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
SetUnhandledExceptionFilter
GetStringTypeW
GetTimeZoneInformation
IsBadReadPtr
IsBadCodePtr
SetStdHandle
SetEnvironmentVariableA
VirtualFree
HeapCreate
HeapDestroy
HeapSize
TerminateProcess
GetVersionExA
HeapReAlloc
GetCommandLineA
GetStartupInfoA
VirtualQuery
GetSystemInfo
VirtualAlloc
VirtualProtect
RtlUnwind
ExitProcess
HeapAlloc
HeapFree
GetFileTime
GetFileAttributesA
FileTimeToLocalFileTime
SetErrorMode
GetTickCount
CreateFileA
GetFullPathNameA
GetVolumeInformationA
FindFirstFileA
FindClose
GetCurrentProcess
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
FileTimeToSystemTime
GetOEMCP
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
TlsGetValue
EnterCriticalSection
GlobalHandle
GlobalReAlloc
LeaveCriticalSection
LocalAlloc
GlobalFlags
WritePrivateProfileStringA
GetCurrentThread
GetModuleFileNameA
ConvertDefaultLocale
EnumResourceLanguagesA
lstrcpyA
InterlockedIncrement
lstrcmpA
DeleteCriticalSection
InitializeCriticalSection
RaiseException
CloseHandle
InterlockedDecrement
SetLastError
GlobalFree
MulDiv
GlobalAlloc
GlobalLock
GlobalUnlock
FormatMessageA
LocalFree
GetCurrentThreadId
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
LoadLibraryA
FreeLibrary
lstrcatA
lstrcmpW
lstrcpynA
GetModuleHandleA
GetProcAddress
CompareStringW
CompareStringA
GetLastError
lstrlenW
FreeResource
GetCPInfo
lstrlenA
lstrcmpiA
FindResourceA
LoadResource
LockResource
SizeofResource
WideCharToMultiByte
MultiByteToWideChar
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
GetVersion
GetStringTypeA

user32

SetParent
RegisterClipboardFormatA
PostThreadMessageA
ReleaseCapture
SetWindowContextHelpId
MapDialogRect
wsprintfA
CreateDialogIndirectParamA
EndDialog
PostQuitMessage
CharNextA
EndPaint
BeginPaint
GetWindowDC
GetMessageA
TranslateMessage
ValidateRect
SetMenuItemBitmaps
EnableMenuItem
CheckMenuItem
GetMenuCheckMarkDimensions
IsWindowEnabled
ShowWindow
MoveWindow
SetWindowTextA
IsDialogMessageA
RegisterWindowMessageA
WinHelpA
CreateWindowExA
SetWindowsHookExA
CallNextHookEx
GetClassLongA
GetClassInfoExA
GetClassNameA
SetPropA
GetPropA
RemovePropA
SendDlgItemMessageA
GetFocus
SetFocus
GetWindowTextLengthA
GetWindowTextA
GetForegroundWindow
GetLastActivePopup
SetActiveWindow
DispatchMessageA
GetDlgItem
GetTopWindow
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
MessageBeep
PeekMessageA
MapWindowPoints
MessageBoxA
TrackPopupMenu
SetForegroundWindow
IsWindowVisible
UpdateWindow
GetMenu
AdjustWindowRectEx
EqualRect
GetClassInfoA
RegisterClassA
UnregisterClassA
CallWindowProcA
SetWindowPos
IntersectRect
IsIconic
GetWindowPlacement
GetWindow
DefWindowProcA
SetRect
CopyRect
GetSysColor
FillRect
GetSysColorBrush
LoadBitmapA
DrawEdge
CreateMenu
CreatePopupMenu
AppendMenuA
GetMenuItemCount
GetMenuItemID
GetDlgCtrlID
GetKeyState
GetCursorPos
IsChild
GetCapture
KillTimer
SetTimer
ScreenToClient
DeferWindowPos
IsWindow
SetRectEmpty
PtInRect
SetWindowLongA
GetMenuStringA
DestroyMenu
GetNextDlgGroupItem
InvalidateRgn
CopyAcceleratorTableA
CharUpperA
LoadIconA
LoadImageA
PostMessageA
SetCursor
DestroyCursor
GetWindowLongA
WindowFromPoint
GetParent
GetNextDlgTabItem
GetActiveWindow
InvalidateRect
ClientToScreen
GetClientRect
GetWindowRect
IsRectEmpty
SetCapture
LockWindowUpdate
GetDCEx
GetMessagePos
LoadCursorA
GetMenuState
GetSubMenu
ModifyMenuA
GetDC
ReleaseDC
GetDesktopWindow
EnableWindow
TabbedTextOutA
DrawTextA
DrawTextExA
GrayStringA
DestroyIcon
DrawIconEx
SystemParametersInfoA
GetSystemMetrics
GetMenuItemInfoA
DrawStateA
IsMenu
InflateRect
OffsetRect
FrameRect
DrawFocusRect
SendMessageA

gdi32

ExtSelectClipRgn
CreatePatternBrush
SetRectRgn
CombineRgn
GetMapMode
GetTextColor
GetRgnBox
ScaleWindowExtEx
SetWindowExtEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
GetWindowExtEx
GetViewportExtEx
CreateRectRgn
SelectClipRgn
MoveToEx
LineTo
IntersectClipRect
ExcludeClipRect
SetMapMode
CreateRectRgnIndirect
DeleteDC
RestoreDC
SaveDC
GetClipBox
GetBkColor
CreateFontA
GetCharWidthA
StretchDIBits
CreateBitmap
SetBkColor
SetTextColor
GetStockObject
GetTextExtentPoint32W
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetTextExtentPoint32A
SetPixel
GetPixel
PatBlt
Ellipse
GetBkMode
GetDeviceCaps
GetObjectA
CreateCompatibleBitmap
CreateFontIndirectA
CreatePen
CreateCompatibleDC
CreateDIBSection
SelectObject
BitBlt
CreateSolidBrush
DeleteObject
SetBkMode

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

RegCloseKey
RegOpenKeyExA
RegOpenKeyA
RegDeleteKeyA
RegEnumKeyA
RegQueryValueA
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA

shell32

ShellExecuteExA

comctl32

ImageList_ReplaceIcon
ImageList_GetImageCount
ImageList_GetIcon
ImageList_Draw
_TrackMouseEvent
ord17
ImageList_Destroy
ImageList_Create
ImageList_AddMasked

shlwapi

PathFindFileNameA
PathStripToRootA
PathFindExtensionA
PathIsUNCA

oledlg

ord8

ole32

StgOpenStorageOnILockBytes
CoGetClassObject
CLSIDFromString
CLSIDFromProgID
StgCreateDocfileOnILockBytes
CoTaskMemFree
CreateILockBytesOnHGlobal
OleUninitialize
CoFreeUnusedLibraries
CoRegisterMessageFilter
OleFlushClipboard
OleIsCurrentClipboard
CoRevokeClassObject
CoTaskMemAlloc
OleInitialize

oleaut32

SysAllocStringLen
VariantClear
VariantChangeType
VariantInit
SysFreeString
SysStringLen
SysAllocStringByteLen
OleCreateFontIndirect
VariantCopy
SafeArrayDestroy
SystemTimeToVariantTime
SysAllocString

Sections

.text
Size: 204KB - Virtual size: 203KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 248KB - Virtual size: 244KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

47992f98134f5cd915f5b45f64408777

Code Sign

02:3a:64Certificate

Extended Key Usages

Key Usages

7e:1f:df:72:99:e8:d2:45:a1:5d:0b:a8:e5:b1:59:baCertificate

Extended Key Usages

Key Usages

02:28:93:61:8a:1d:fa:73:d6:6c:50:fe:4e:e6:de:61Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

79:48:ae:33:97:73:56:1a:18:5d:51:74:e3:17:09:89:92:d3:c4:f3Signer

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

Sections

.text Size: 204KB - Virtual size: 203KB

.rdata Size: 48KB - Virtual size: 47KB

.data Size: 12KB - Virtual size: 22KB

.rsrc Size: 248KB - Virtual size: 244KB

02:3a:64
Certificate

7e:1f:df:72:99:e8:d2:45:a1:5d:0b:a8:e5:b1:59:ba
Certificate

02:28:93:61:8a:1d:fa:73:d6:6c:50:fe:4e:e6:de:61
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

79:48:ae:33:97:73:56:1a:18:5d:51:74:e3:17:09:89:92:d3:c4:f3
Signer

.text
Size: 204KB - Virtual size: 203KB

.rdata
Size: 48KB - Virtual size: 47KB

.data
Size: 12KB - Virtual size: 22KB

.rsrc
Size: 248KB - Virtual size: 244KB