2024-02-04_4872a9fd8ccac28dff85ac84dd3d2927_icedid

Sharing

Copy URL Twitter E-mail

General

Target

2024-02-04_4872a9fd8ccac28dff85ac84dd3d2927_icedid
Size

797KB
MD5

4872a9fd8ccac28dff85ac84dd3d2927
SHA1

aaf687d17e620b23381235ee2dfce046346093ae
SHA256

31eb3235294124e54efdc18941fcc7f577dd468cce0a4b78fc8bd713499bb80c
SHA512

4c102c1aea791195c1e962de9378ae849e6e4b8fe8bd7875302619e0eed93d9e8d354fe28dfa1f8815832493cb1e5367dea005698019d05ec5d9af3989126f56
SSDEEP

12288:+UsPjVIEBpBP4TesLrQTnq3cTTeABqdyW5ZXqZIJmAiMcgFxkMZehIemMI:yPyQ/sLp6eAB+rqZIJmpMcwZehIejI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-02-04_4872a9fd8ccac28dff85ac84dd3d2927_icedid

Files

2024-02-04_4872a9fd8ccac28dff85ac84dd3d2927_icedid
.exe windows:5 windows x86 arch:x86

e9c5a5e90cc034ddffea4218cccc37dc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\ci\E3-SETUP\CIBUILDS\core_build\core\vcclient\SmartInstaller\src\UnicodeRelease\SmartInstaller.pdb

Imports

zlib

ord81
ord82
ord83
ord80
ord84
ord61
ord62
ord67
ord68
ord72
ord65
ord66
ord64
ord63

kernel32

GetFileTime
DosDateTimeToFileTime
ConvertDefaultLocale
CompareStringA
InterlockedExchange
GetFileSizeEx
GetFileAttributesExW
GetCurrentThreadId
GlobalAddAtomW
GlobalFindAtomW
LocalFileTimeToFileTime
SetFileTime
lstrcpynW
WaitForSingleObject
FindNextFileW
GetFileSize
FileTimeToLocalFileTime
FileTimeToSystemTime
GetDiskFreeSpaceExW
OutputDebugStringW
GetSystemInfo
GetTempPathW
GetTimeZoneInformation
GetCurrentProcessId
GlobalMemoryStatus
FindFirstFileW
FindClose
GetCurrentThread
GetVersion
EnumResourceLanguagesW
OpenProcess
GetProcessHeap
HeapAlloc
HeapFree
GetACP
GetLocaleInfoW
SetFileAttributesW
GetFullPathNameW
CreateDirectoryW
GlobalAlloc
GlobalLock
GlobalUnlock
ExitThread
GetVersionExW
LoadLibraryW
Sleep
ExitProcess
LocalAlloc
CreateFileW
SetFilePointer
ReadFile
CloseHandle
IsBadWritePtr
WriteFile
VirtualQuery
GetModuleFileNameW
GetModuleHandleW
FormatMessageW
SetUnhandledExceptionFilter
LoadLibraryA
GetProcAddress
VirtualProtect
GlobalDeleteAtom
CompareStringW
lstrcmpW
GetVersionExA
GetModuleHandleA
lstrlenA
lstrcmpA
GetVolumeInformationW
DuplicateHandle
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
GetThreadLocale
GlobalFree
GetCurrentProcess
FlushInstructionCache
FreeLibrary
SuspendThread
FreeResource
MulDiv
CreateThread
SetCurrentDirectoryW
GetExitCodeThread
TerminateThread
GetFileAttributesW
RemoveDirectoryW
MoveFileW
ResumeThread
GetPrivateProfileSectionW
InterlockedDecrement
LocalFree
InterlockedIncrement
lstrlenW
GetTickCount
WideCharToMultiByte
lstrcmpiW
DeleteFileW
GetLastError
CopyFileW
GetPrivateProfileStringW
MultiByteToWideChar
FindResourceW
LoadResource
LockResource
SizeofResource
TlsGetValue
GlobalReAlloc
GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
SetErrorMode
SetEnvironmentVariableA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
CreateFileA
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringA
SetLastError
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
WritePrivateProfileStringW
GetConsoleMode
GetConsoleCP
GetCurrentDirectoryA
GetDateFormatA
GetTimeFormatA
InitializeCriticalSectionAndSpinCount
LCMapStringW
IsValidCodePage
GetOEMCP
GetCPInfo
QueryPerformanceCounter
VirtualFree
HeapCreate
GetStartupInfoA
SetHandleCount
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
GetStdHandle
VirtualAlloc
HeapSize
GetFileType
SetStdHandle
HeapReAlloc
GetDriveTypeA
GetSystemTimeAsFileTime
RaiseException
RtlUnwind
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
GlobalFlags

gdi32

SaveDC
RestoreDC
SetBkColor
SetBkMode
SetTextColor
SetMapMode
GetClipBox
DeleteObject
SelectClipRgn
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
DeleteDC
CreateBitmap
CreateRectRgnIndirect
GetRgnBox
LPtoDP
DPtoLP
GetWindowExtEx
GetStockObject
GetDeviceCaps
GetTextExtentPointW
GetTextMetricsW
SelectObject
CreateFontW
CreateFontIndirectW
GetTextExtentPoint32W
GetTextColor
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
GetBkColor
GetObjectW
PtVisible
RectVisible
TextOutW
ExtTextOutW
Escape
CreateRectRgn
GetMapMode
GetViewportExtEx

user32

RegisterClipboardFormatW
GetNextDlgGroupItem
InvalidateRgn
CopyAcceleratorTableW
SetRect
IsRectEmpty
UnregisterClassW
PostThreadMessageW
GetDC
RegisterWindowMessageW
ReleaseDC
DestroyMenu
SetTimer
IsWindowVisible
InvalidateRect
MessageBoxW
PostQuitMessage
UpdateWindow
GetClientRect
EnableWindow
GetParent
SendMessageW
PostMessageW
MessageBeep
PeekMessageW
IsDialogMessageW
TranslateMessage
DispatchMessageW
FindWindowW
GetWindowThreadProcessId
GetClassLongW
WindowFromDC
GetSysColor
GetCursorPos
GrayStringW
TabbedTextOutW
GetFocus
EqualRect
DrawTextW
FillRect
IsWindow
wvsprintfW
DrawTextExW
LoadCursorW
KillTimer
OffsetRect
GetKeyState
SetCursor
ReleaseCapture
SetCapture
RedrawWindow
PtInRect
GetWindowLongW
SetWindowLongW
FindWindowExW
GetWindowRect
ShowWindow
GetDlgItem
GetClassNameW
GetWindowTextW
SetWindowTextW
ScreenToClient
CopyRect
BeginPaint
EndPaint
ClientToScreen
AdjustWindowRectEx
MoveWindow
GetWindow
GetDlgCtrlID
GetSubMenu
GetMenuItemCount
GetMenuItemID
GetMenuState
GetSystemMetrics
CharUpperW
GetSysColorBrush
GetWindowPlacement
IsIconic
SystemParametersInfoA
IntersectRect
SetWindowPos
GetMenu
CallWindowProcW
DefWindowProcW
SetWindowPlacement
RegisterClassW
GetClassInfoW
GetClassInfoExW
CreateWindowExW
SetForegroundWindow
SetMenu
MapWindowPoints
GetMessagePos
GetMessageTime
UnhookWindowsHookEx
DestroyWindow
GetTopWindow
SetActiveWindow
GetLastActivePopup
GetForegroundWindow
GetWindowTextLengthW
SetFocus
RemovePropW
GetPropW
SetPropW
CallNextHookEx
SetWindowsHookExW
GetCapture
IsChild
WinHelpW
SendDlgItemMessageA
SendDlgItemMessageW
LoadIconW
IsWindowEnabled
EndDialog
GetNextDlgTabItem
CreateDialogIndirectParamW
GetActiveWindow
GetDesktopWindow
CheckMenuItem
EnableMenuItem
ModifyMenuW
LoadBitmapW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
CharNextW
ValidateRect
GetMessageW
MapDialogRect
SetWindowContextHelpId
GetWindowDC

ole32

OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CLSIDFromProgID
CLSIDFromString
CoRevokeClassObject
CoTaskMemAlloc
CoTaskMemFree
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CoUninitialize
CoCreateInstance
CoInitialize
CreateStreamOnHGlobal

oleaut32

VariantTimeToSystemTime
SystemTimeToVariantTime
OleLoadPicture
VariantCopy
VariantClear
VariantInit
SysFreeString
SysStringByteLen
SysAllocStringByteLen
SysAllocString
OleCreateFontIndirect
GetErrorInfo
SafeArrayDestroy
VariantChangeType
SysAllocStringLen
SysStringLen

oledlg

ord3
OleUIBusyW
ord1

shell32

SHGetFolderPathW
ShellExecuteW
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetDesktopFolder
SHChangeNotify
SHFileOperationW
SHGetMalloc
SHGetSpecialFolderLocation
ord680
SHCreateDirectoryExW

comctl32

ord17

advapi32

AccessCheck
RegOpenKeyExW
RegCreateKeyExW
RegQueryValueW
RegEnumKeyW
RegDeleteValueW
RegCloseKey
RegSetValueExW
RegOpenKeyW
RegCreateKeyW
RegEnumKeyExW
GetFileSecurityW
ImpersonateSelf
OpenThreadToken
MapGenericMask
RegDeleteKeyW
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
DuplicateTokenEx
OpenProcessToken
GetTokenInformation
IsValidSid
GetSidSubAuthorityCount
GetSidSubAuthority
RegQueryValueExW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

shlwapi

PathAppendW
PathStripToRootW
PathIsUNCW
UrlUnescapeW
PathFindExtensionW
PathFindFileNameW
SHCopyKeyW

wsock32

inet_addr
WSACleanup
gethostname
WSAStartup
gethostbyname

wininet

InternetSetOptionW
InternetCloseHandle
InternetSetStatusCallbackW
InternetCrackUrlW
HttpQueryInfoW
InternetOpenUrlW
InternetOpenW
InternetReadFileExA
HttpSendRequestW
HttpOpenRequestW
InternetConnectW
InternetReadFile
InternetGetConnectedStateExW
InternetCanonicalizeUrlW
InternetQueryDataAvailable
HttpAddRequestHeadersW
InternetGetLastResponseInfoW
InternetSetFilePointer
InternetWriteFile

comdlg32

GetFileTitleW

winspool.drv

DocumentPropertiesW
OpenPrinterW
ClosePrinter

Sections

.text
Size: 523KB - Virtual size: 523KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 144KB - Virtual size: 143KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 115KB - Virtual size: 114KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e9c5a5e90cc034ddffea4218cccc37dc

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

zlib

kernel32

gdi32

user32

ole32

oleaut32

oledlg

shell32

comctl32

advapi32

version

shlwapi

wsock32

wininet

comdlg32

winspool.drv

Sections

.text Size: 523KB - Virtual size: 523KB

.rdata Size: 144KB - Virtual size: 143KB

.data Size: 13KB - Virtual size: 53KB

.rsrc Size: 115KB - Virtual size: 114KB

.text
Size: 523KB - Virtual size: 523KB

.rdata
Size: 144KB - Virtual size: 143KB

.data
Size: 13KB - Virtual size: 53KB

.rsrc
Size: 115KB - Virtual size: 114KB