2024-02-17_1a0fcaf6d306597dea4187b472f465d9_icedid

Sharing

Copy URL Twitter E-mail

General

Target

2024-02-17_1a0fcaf6d306597dea4187b472f465d9_icedid
Size

1.0MB
MD5

1a0fcaf6d306597dea4187b472f465d9
SHA1

7faa6ea8e2931a72eb21c7ee7dab77023b6b8f96
SHA256

e00393e84e8c07b1a1eb8a25462f759c988c7b31120f5e20afe99d2735f6736d
SHA512

bde4ff1ec1c6a85ac4c41ba4857fa984c3290030743c36c1782a8bac721e666489c8a3d523afc02676b2f18b740618f9b58be77fdc27b4e54996699e01534645
SSDEEP

12288:IhpIFO+vHGh1dn4vpoZYVeInvnZNrX2fbwQOkCBj/0yerx+TnlF6c1Yg9O+u9iR:c1icMeGlGfbwQOf1eIRMc1P9O+u9N

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-02-17_1a0fcaf6d306597dea4187b472f465d9_icedid

Files

2024-02-17_1a0fcaf6d306597dea4187b472f465d9_icedid
.exe windows:4 windows x86 arch:x86

68e0e80bc2161e79b8d5cea5df4c7bd5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\Dev\Code\XoftSpySE SP0.5\Release\XoftSpy.pdb

Imports

comctl32

ImageList_Read
ImageList_Write
ord14
ImageList_Destroy
ImageList_Create
ImageList_LoadImageA
ImageList_Merge
DestroyPropertySheetPage
CreatePropertySheetPageA
ImageList_Duplicate
ImageList_DrawIndirect
ImageList_Draw
_TrackMouseEvent
ord17
ImageList_GetImageInfo
ImageList_GetBkColor
ImageList_SetBkColor
PropertySheetA
ord13

user32

SetTimer
OffsetRect
PtInRect
IsWindow
ReleaseCapture
GetSysColor
ClientToScreen
LoadMenuA
ModifyMenuA
GetSubMenu
GetCursorPos
LoadCursorA
InvalidateRect
SetCursor
CopyRect
SystemParametersInfoA
GetDC
ReleaseDC
GetMessagePos
MapWindowPoints
PostThreadMessageA
GetTabbedTextExtentA
UnionRect
GetDCEx
LockWindowUpdate
SetParent
wvsprintfA
SetActiveWindow
SetFocus
TabbedTextOutA
IsClipboardFormatAvailable
MessageBeep
GetNextDlgGroupItem
DestroyIcon
DeleteMenu
WaitMessage
WindowFromPoint
InvalidateRgn
CopyAcceleratorTableA
SetRect
IsRectEmpty
GetSysColorBrush
SetWindowContextHelpId
ShowOwnedPopups
PostQuitMessage
DestroyMenu
GetMenuItemInfoA
GetDialogBaseUnits
MapDialogRect
GetAsyncKeyState
KillTimer
GetKeyNameTextA
GetMessageA
ValidateRect
GetMenuStringA
InsertMenuA
RemoveMenu
EndPaint
BeginPaint
GetWindowDC
wsprintfA
SetMenuItemBitmaps
GetMenuState
EnableMenuItem
CheckMenuItem
GetMenuCheckMarkDimensions
LoadBitmapA
ScrollWindowEx
DrawTextA
DrawTextExA
GrayStringA
SetWindowLongA
ExitWindowsEx
MsgWaitForMultipleObjects
UpdateWindow
CharNextA
CharLowerW
CharLowerA
CharUpperW
CharUpperA
UnregisterClassA
EnumWindows
GetWindowTextA
GetWindowThreadProcessId
BringWindowToTop
ScreenToClient
SetScrollPos
RegisterWindowMessageA
GetSystemMetrics
GetFocus
FrameRect
DrawEdge
FindWindowA
SetClassLongA
GetClassLongA
AppendMenuA
GetSystemMenu
IsIconic
LoadIconA
SetCapture
InflateRect
RegisterClipboardFormatA
TranslateAcceleratorA
SetMenu
SetRectEmpty
CreatePopupMenu
InsertMenuItemA
LoadAcceleratorsA
ReuseDDElParam
UnpackDDElParam
MapVirtualKeyA
MoveWindow
SetWindowTextA
IsDlgButtonChecked
SetDlgItemTextA
SetDlgItemInt
GetDlgItemTextA
GetDlgItemInt
CheckRadioButton
CheckDlgButton
WinHelpA
GetCapture
CreateWindowExA
SetWindowsHookExA
CallNextHookEx
GetClassInfoExA
GetClassNameA
SetPropA
GetPropA
RemovePropA
SendDlgItemMessageA
IsChild
GetWindowTextLengthA
GetForegroundWindow
GetLastActivePopup
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
ScrollWindow
MessageBoxA
TrackPopupMenuEx
TrackPopupMenu
GetKeyState
SetScrollRange
GetScrollRange
GetScrollPos
SetForegroundWindow
ShowScrollBar
IsWindowVisible
PeekMessageA
IsDialogMessageA
TranslateMessage
DispatchMessageA
LoadImageA
PostMessageA
GetWindowRect
EnableWindow
GetParent
RedrawWindow
GetClientRect
SendMessageA
FillRect
EndDialog
GetNextDlgTabItem
IsWindowEnabled
GetDlgItem
GetWindowLongA
DestroyWindow
CreateDialogIndirectParamA
GetActiveWindow
GetDesktopWindow
GetWindow
GetWindowPlacement
IntersectRect
SetWindowPos
CallWindowProcA
DefWindowProcA
GetDlgCtrlID
SetWindowPlacement
RegisterClassA
GetClassInfoA
SetScrollInfo
GetScrollInfo
DeferWindowPos
EqualRect
AdjustWindowRectEx
GetMenuItemCount
GetMenuItemID
GetMenu
ShowWindow

autoupdate

_AuSetup@4
_AuInitialize@4
_AuQueryServerAsync@4
_AuDownloadUpdateAsync@4
_AuAbort@4
_AuRunAutoUpdate@4

shlwapi

PathIsUNCA
PathStripToRootA
UrlUnescapeA
PathFindExtensionA
PathRemoveExtensionA
PathGetCharTypeA
PathUnquoteSpacesA
PathFileExistsA
PathFindFileNameA

shfolder

SHGetFolderPathA

zlibwapi

ord26
ord2
ord83
ord82
ord81
ord80
ord84

kernel32

Thread32Next
ResumeThread
SuspendThread
Thread32First
ReadFile
GetFileTime
SetFilePointer
EnumResourceNamesA
EnumResourceLanguagesA
FindResourceExA
EnumResourceTypesA
MultiByteToWideChar
GetEnvironmentVariableW
GetVersion
GetEnvironmentVariableA
CompareStringW
CompareStringA
lstrlenW
GetStringTypeExW
GetStringTypeExA
lstrcmpiW
lstrcmpiA
InitializeCriticalSection
DeleteCriticalSection
RaiseException
QueryDosDeviceA
VirtualAlloc
VirtualFree
GetCurrentProcessId
DuplicateHandle
TerminateThread
EnterCriticalSection
LeaveCriticalSection
GetTempPathA
GetLogicalDriveStringsA
GetShortPathNameA
lstrcpynA
CreateMutexA
SetCurrentDirectoryA
GlobalUnlock
lstrcpyA
lstrcatA
FreeResource
GlobalFree
lstrcmpW
GlobalDeleteAtom
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
GetCurrentThreadId
GlobalAlloc
GlobalSize
SetThreadPriority
SetEvent
CreateEventA
MoveFileA
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
GetVolumeInformationA
GetFullPathNameA
lstrcmpA
VirtualProtect
InterlockedDecrement
LocalAlloc
ConvertDefaultLocale
GlobalFlags
GlobalReAlloc
GlobalHandle
TlsGetValue
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
InterlockedIncrement
GetCPInfo
GetOEMCP
SystemTimeToFileTime
SetErrorMode
LocalFileTimeToFileTime
SetFileTime
GetPrivateProfileIntA
WritePrivateProfileStringA
GetPrivateProfileStringA
GetCurrentDirectoryA
LocalUnlock
LocalLock
GetTickCount
GetTempFileNameA
GetDiskFreeSpaceA
RtlUnwind
GetDriveTypeA
GetSystemTimeAsFileTime
GetTimeFormatA
GetDateFormatA
GetSystemInfo
VirtualQuery
ExitThread
CreateThread
ExitProcess
GetStartupInfoA
GetCommandLineA
HeapReAlloc
SetStdHandle
GetFileType
HeapSize
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
FatalAppExitA
GetTimeZoneInformation
SetUnhandledExceptionFilter
HeapDestroy
HeapCreate
IsBadWritePtr
SetHandleCount
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
SetConsoleCtrlHandler
IsBadReadPtr
IsBadCodePtr
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
SetEnvironmentVariableA
GetLocaleInfoW
GetProcessHeap
HeapAlloc
HeapFree
SetLastError
GetCurrentThread
GetCurrentProcess
GetLastError
CreateToolhelp32Snapshot
Process32First
TerminateProcess
Process32Next
LoadLibraryA
GetProcAddress
FreeLibrary
OpenProcess
WriteFile
ExpandEnvironmentStringsA
Sleep
GlobalLock
GetModuleHandleA
FormatMessageA
LocalFree
GetModuleFileNameA
MulDiv
CreateFileA
GetFileSize
CloseHandle
CopyFileA
lstrlenA
WaitForSingleObject
RemoveDirectoryA
DeleteFileA
FindNextFileA
SetFileAttributesA
GetFileAttributesA
FindFirstFileA
FindClose
FileTimeToLocalFileTime
FileTimeToSystemTime
WideCharToMultiByte
LoadResource
LockResource
SizeofResource
FindResourceA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
GetVersionExA
CreateDirectoryA

gdi32

StartPage
GetCharWidthA
GetTextColor
GetRgnBox
EnumFontFamiliesExA
CombineRgn
SetRectRgn
GetTextMetricsA
PatBlt
CreateRectRgnIndirect
CreateDCA
CopyMetaFileA
CreateHatchBrush
ExtCreatePen
PlayMetaFile
EnumMetaFile
GetObjectType
PlayMetaFileRecord
SelectPalette
CreatePatternBrush
CreateDIBPatternBrushPt
ExtSelectClipRgn
PolyBezierTo
PolylineTo
PolyDraw
ArcTo
GetCurrentPositionEx
ScaleWindowExtEx
SetWindowExtEx
EndPage
SetAbortProc
AbortDoc
EndDoc
StretchDIBits
CreateFontA
OffsetWindowOrgEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
StartDocA
GetPixel
SelectClipPath
GetClipRgn
SelectClipRgn
SetColorAdjustment
SetArcDirection
SetMapperFlags
SetTextCharacterExtra
SetTextJustification
SetTextAlign
MoveToEx
LineTo
OffsetClipRgn
IntersectClipRect
ExcludeClipRect
SetMapMode
SetROP2
SetPolyFillMode
SetBkMode
RestoreDC
SaveDC
GetClipBox
GetDCOrgEx
CreateBitmap
SetBkColor
SetTextColor
DeleteDC
SetStretchBltMode
SelectObject
CreateRectRgn
GetCurrentObject
GetTextExtentPoint32A
Escape
ExtTextOutA
TextOutA
BitBlt
RectVisible
PtVisible
LPtoDP
DPtoLP
GetWindowExtEx
GetViewportExtEx
GetMapMode
GetBkColor
CreateCompatibleBitmap
StretchBlt
CreateCompatibleDC
GetObjectA
GetViewportOrgEx
SetViewportOrgEx
DeleteObject
Rectangle
CreateFontIndirectA
CreatePen
GetDeviceCaps
CreateSolidBrush
GetStockObject

comdlg32

CommDlgExtendedError
PrintDlgA
PageSetupDlgA
ReplaceTextA
GetOpenFileNameA
GetSaveFileNameA
GetFileTitleA
FindTextA

winspool.drv

ClosePrinter
GetJobA
OpenPrinterA
DocumentPropertiesA

advapi32

RegSetValueA
GetUserNameA
RegEnumKeyExA
RegQueryValueA
RegCreateKeyA
SetFileSecurityA
RegEnumValueA
RegQueryInfoKeyA
RegOpenKeyExA
RegDeleteValueA
RegCloseKey
RegSetValueExA
RegCreateKeyExA
RegQueryValueExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
OpenThreadToken
RegDeleteKeyA
RegEnumKeyA
GetFileSecurityA
RegOpenKeyA

shell32

SHGetDesktopFolder
DragQueryFileA
DragFinish
ExtractIconA
SHGetFileInfoA
SHGetMalloc
SHGetSpecialFolderLocation
ShellExecuteExA
ShellExecuteA

oledlg

ord8

ole32

StgOpenStorageOnILockBytes
CoGetClassObject
StringFromGUID2
CoDisconnectObject
CLSIDFromString
CLSIDFromProgID
OleDuplicateData
ReleaseStgMedium
CoTaskMemAlloc
CreateBindCtx
StgCreateDocfileOnILockBytes
StringFromCLSID
ReadClassStg
ReadFmtUserTypeStg
OleRegGetUserType
WriteClassStg
WriteFmtUserTypeStg
SetConvertStg
CoTaskMemFree
CoInitialize
CoCreateInstance
CoUninitialize
CreateILockBytesOnHGlobal
OleRun
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CoRegisterClassObject
CoRevokeClassObject
OleSetClipboard
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter
CreateStreamOnHGlobal
CoTreatAsClass

oleaut32

SafeArrayGetUBound
LoadTypeLi
OleCreateFontIndirect
VarBstrFromDate
VarBstrFromCy
VarCyFromStr
VarDecFromStr
VarBstrFromDec
VarDateFromStr
SysReAllocStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroyDescriptor
SafeArrayDestroyData
SafeArrayDestroy
SafeArrayUnlock
SafeArrayLock
SafeArrayPutElement
SafeArrayPtrOfIndex
SafeArrayGetElement
SafeArrayCopy
SafeArrayAllocDescriptor
SafeArrayAllocData
SafeArrayRedim
SafeArrayCreate
SafeArrayGetDim
SafeArrayGetElemsize
SafeArrayGetLBound
VariantClear
SafeArrayAccessData
SafeArrayUnaccessData
LoadRegTypeLi
SysAllocString
DispCallFunc
VariantCopy
VarBstrCmp
SysStringByteLen
SysAllocStringByteLen
SysStringLen
SysAllocStringLen
VariantInit
VariantChangeType
SysFreeString

wininet

HttpOpenRequestA
InternetOpenUrlA
GopherOpenFileA
InternetConnectA
FtpFindFirstFileA
GopherCreateLocatorA
FtpCommandA
FtpOpenFileA
GopherGetAttributeA
HttpSendRequestExA
HttpEndRequestA
HttpSendRequestA
InternetReadFile
InternetWriteFile
InternetSetFilePointer
InternetSetStatusCallback
InternetOpenA
GopherFindFirstFileA
InternetGetLastResponseInfoA
InternetCloseHandle
InternetFindNextFileA
HttpQueryInfoA
HttpAddRequestHeadersA
InternetErrorDlg
FtpGetFileA
FtpPutFileA
FtpGetCurrentDirectoryA
FtpSetCurrentDirectoryA
FtpRemoveDirectoryA
FtpCreateDirectoryA
FtpRenameFileA
FtpDeleteFileA
InternetQueryDataAvailable
InternetGetCookieA
InternetSetCookieA
InternetSetOptionExA
InternetQueryOptionA
InternetCanonicalizeUrlA
InternetCrackUrlA

Sections

.text
Size: 788KB - Virtual size: 784KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 212KB - Virtual size: 210KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

68e0e80bc2161e79b8d5cea5df4c7bd5

Headers

File Characteristics

PDB Paths

Imports

comctl32

user32

autoupdate

shlwapi

shfolder

zlibwapi

kernel32

gdi32

comdlg32

winspool.drv

advapi32

shell32

oledlg

ole32

oleaut32

wininet

Sections

.text Size: 788KB - Virtual size: 784KB

.rdata Size: 212KB - Virtual size: 210KB

.data Size: 12KB - Virtual size: 27KB

.rsrc Size: 48KB - Virtual size: 44KB

.text
Size: 788KB - Virtual size: 784KB

.rdata
Size: 212KB - Virtual size: 210KB

.data
Size: 12KB - Virtual size: 27KB

.rsrc
Size: 48KB - Virtual size: 44KB