2024-02-19_37fb24317f54fe84d45a2205086f024f_icedid

Sharing

Copy URL

Twitter E-mail

General

Target

2024-02-19_37fb24317f54fe84d45a2205086f024f_icedid
Size

601KB
MD5

37fb24317f54fe84d45a2205086f024f
SHA1

a5a9bd19479a46b3bf75c770259e01870e31154d
SHA256

fd0a9199abedd2f49651c8fce438ed8498b66ce2ee37039fad3dcf8cd32f3ac2
SHA512

3202f0db0569fcfaab2d7543e8b924bb9dd67bf1121c851f6d8f5cc980fed84c74e3730db3e2eabda8109d00dd50461328fd5b3dd34ac7b981da9c01a19fe7bb
SSDEEP

12288:vrBSXNDbwpGHYcsPxXtrplqHq3zjPVUFK:DBwbmeGPXrpP7

Score

1^/10

Malware Config

Signatures

Files

2024-02-19_37fb24317f54fe84d45a2205086f024f_icedid
.exe windows:4 windows x86 arch:x86

5dafc0cbbda3a6d0adceb91552eef038

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

79:9a:c3:97:60:95:54:6d:05:de:53:95:16:6b:ff:83
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

16/11/2012, 00:00

Not After

12/04/2015, 23:59

Subject

CN=CyberLink Corp.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=CyberLink Corp.,L=New Taipei City,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

22:36:66:a1:d4:f9:b2:4d:82:cc:39:05:48:1c:d7:63:51:d6:ee:7c
Signer

Actual PE Digest

22:36:66:a1:d4:f9:b2:4d:82:cc:39:05:48:1c:d7:63:51:d6:ee:7c

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\Work_Data_D_Drive\Z_Work\Z_SVN_Done\PowerBakcup\2.6\Trunk\RestoreTool\Release_Unicode\Sve\2KXP\RestoreTool.pdb

Imports

shlwapi

PathRemoveExtensionW
PathAddExtensionW
PathRemoveBackslashW
PathFileExistsW
PathFindFileNameW
StrToIntW
PathStripToRootW
PathIsUNCW
PathIsRootW
PathIsUNCServerW
PathAddBackslashW
PathFindExtensionW
PathIsUNCServerShareW

mapi32

ord62
ord23
ord140
ord17
ord19
ord21
ord64

kernel32

LockFile
UnlockFile
DuplicateHandle
GetFullPathNameW
GetPrivateProfileIntW
WritePrivateProfileStringW
GetCurrentDirectoryW
InterlockedIncrement
GlobalFlags
GlobalReAlloc
GlobalHandle
TlsGetValue
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
SetErrorMode
GetFileTime
GetStartupInfoW
RtlUnwind
FlushFileBuffers
ExitProcess
TerminateProcess
HeapFree
HeapAlloc
ExitThread
HeapReAlloc
HeapSize
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetStdHandle
GetModuleFileNameA
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
GetTimeFormatA
GetDateFormatA
GetTimeZoneInformation
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
LCMapStringA
LCMapStringW
SetUnhandledExceptionFilter
IsBadWritePtr
GetOEMCP
GetCPInfo
IsBadReadPtr
IsBadCodePtr
GetStringTypeA
GetStringTypeW
GetDriveTypeA
SetStdHandle
CompareStringA
CompareStringW
SetEnvironmentVariableA
GlobalFindAtomW
lstrcatW
GetVersionExA
SuspendThread
ResumeThread
SetThreadPriority
GlobalAddAtomW
GetModuleHandleA
SetLastError
GlobalUnlock
FormatMessageW
lstrcpynW
GetCurrentThread
GetCurrentThreadId
GlobalLock
lstrcmpW
GlobalDeleteAtom
ConvertDefaultLocale
GetVersion
EnumResourceLanguagesW
lstrcpyW
LoadLibraryA
LocalFree
LocalAlloc
InterlockedDecrement
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetSystemDirectoryW
ExpandEnvironmentStringsW
OutputDebugStringW
lstrcmpiW
GetCurrentProcess
GlobalAlloc
GlobalFree
GetShortPathNameW
GetDiskFreeSpaceExW
LoadLibraryW
FreeLibrary
GetLocaleInfoW
GetNumberFormatW
RaiseException
CreateThread
GetModuleHandleW
GetProcAddress
CreateEventW
SetEvent
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CreateDirectoryW
SetEndOfFile
SetFileTime
GetFileSize
GetLastError
SetFilePointer
ReadFile
WaitForSingleObject
GetFileAttributesExW
SetFileAttributesW
FindFirstFileW
FindNextFileW
FindClose
lstrlenA
lstrlenW
WideCharToMultiByte
GetVolumeInformationW
Sleep
MoveFileW
FileTimeToLocalFileTime
FileTimeToSystemTime
CreateFileW
WriteFile
CloseHandle
FreeResource
MulDiv
GetFileAttributesW
MultiByteToWideChar
GetVersionExW
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
GetTempPathW
GetModuleFileNameW
DeleteFileW
FindResourceW
LoadResource
LockResource
SizeofResource
GetSystemTimeAsFileTime

user32

CharUpperW
RegisterWindowMessageW
WinHelpW
CreateWindowExW
GetClassInfoExW
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
SendDlgItemMessageA
GetForegroundWindow
GetLastActivePopup
GetTopWindow
GetMessageTime
GetMessagePos
MapWindowPoints
MessageBoxW
SetForegroundWindow
GetMenu
AdjustWindowRectEx
GetClassInfoW
RegisterClassW
DefWindowProcW
CallWindowProcW
SystemParametersInfoA
GetWindowPlacement
PtInRect
GetWindowTextLengthW
GetWindowTextW
SetWindowPos
SetFocus
ShowWindow
MoveWindow
SetWindowLongW
GetDlgCtrlID
SetWindowTextW
IsDialogMessageW
SetDlgItemTextW
SendDlgItemMessageW
UnhookWindowsHookEx
CopyRect
SetActiveWindow
CreateDialogIndirectParamW
DestroyWindow
GetDlgItem
IsWindowEnabled
SetMenuItemBitmaps
GetFocus
ModifyMenuW
EnableMenuItem
CheckMenuItem
GetMenuCheckMarkDimensions
SetWindowsHookExW
CallNextHookEx
GetMessageW
TranslateMessage
DispatchMessageW
IsWindowVisible
GetKeyState
DestroyCursor
PeekMessageW
GetCursorPos
ValidateRect
SetCursor
EndPaint
BeginPaint
ScreenToClient
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
PostQuitMessage
GetWindowLongW
LoadCursorW
ReleaseCapture
WindowFromPoint
SetCapture
GetCapture
GetWindowDC
ClientToScreen
SetWindowRgn
GetSysColorBrush
DestroyMenu
IsWindow
GetSysColor
GetParent
RedrawWindow
InvalidateRect
UpdateWindow
FillRect
GetActiveWindow
KillTimer
SetTimer
SystemParametersInfoW
ReleaseDC
UnregisterClassW
GetDesktopWindow
wsprintfW
GetSystemMetrics
LoadIconW
EnableWindow
MapDialogRect
GetDC
GetClientRect
GetWindowRect
IsIconic
PostMessageW
SendMessageW
DrawIcon
LoadBitmapW
GetWindow
GetNextDlgTabItem
EndDialog

gdi32

SetWindowExtEx
ScaleWindowExtEx
CreateBitmap
DPtoLP
PtVisible
GetTextCharsetInfo
EnumFontFamiliesExW
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
Escape
ExtTextOutW
TextOutW
SetBkColor
RestoreDC
SaveDC
PtInRegion
GetStockObject
CreateSolidBrush
BitBlt
GetMapMode
CreateCompatibleBitmap
GetDeviceCaps
CreateICW
SelectObject
GetPixel
DeleteDC
CreateRectRgn
CombineRgn
DeleteObject
StretchBlt
CreateCompatibleDC
CreateFontIndirectW
GetObjectW
GetClipBox
SetMapMode
SetTextColor
SetBkMode
RectVisible

comdlg32

GetSaveFileNameW
GetOpenFileNameW
GetFileTitleW

winspool.drv

ClosePrinter
DocumentPropertiesW
OpenPrinterW

advapi32

RegEnumKeyW
RegCloseKey
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
RegDeleteKeyW
RegEnumValueW
RegQueryValueW
RegOpenKeyW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW

shell32

ShellExecuteExW
SHGetMalloc
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetSpecialFolderLocation
SHGetSpecialFolderPathW
SHGetFileInfoW
SHFileOperationW

comctl32

_TrackMouseEvent
ord17

ole32

CoUninitialize
CoInitialize

oleaut32

VariantClear
VariantInit
VariantChangeType

Sections

.text
Size: 228KB - Virtual size: 226KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 264KB - Virtual size: 262KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5dafc0cbbda3a6d0adceb91552eef038

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fdCertificate

Extended Key Usages

Key Usages

79:9a:c3:97:60:95:54:6d:05:de:53:95:16:6b:ff:83Certificate

Extended Key Usages

Key Usages

61:19:93:e4:00:00:00:00:00:1cCertificate

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

22:36:66:a1:d4:f9:b2:4d:82:cc:39:05:48:1c:d7:63:51:d6:ee:7cSigner

Headers

File Characteristics

PDB Paths

Imports

shlwapi

mapi32

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

ole32

oleaut32

Sections

.text Size: 228KB - Virtual size: 226KB

.rdata Size: 68KB - Virtual size: 66KB

.data Size: 28KB - Virtual size: 49KB

.rsrc Size: 264KB - Virtual size: 262KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

79:9a:c3:97:60:95:54:6d:05:de:53:95:16:6b:ff:83
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

22:36:66:a1:d4:f9:b2:4d:82:cc:39:05:48:1c:d7:63:51:d6:ee:7c
Signer

.text
Size: 228KB - Virtual size: 226KB

.rdata
Size: 68KB - Virtual size: 66KB

.data
Size: 28KB - Virtual size: 49KB

.rsrc
Size: 264KB - Virtual size: 262KB