2024-02-19_4d7285ecebb08bfdb06922f14cbf2b1e_icedid

Sharing

Copy URL Twitter E-mail

General

Target

2024-02-19_4d7285ecebb08bfdb06922f14cbf2b1e_icedid
Size

3.0MB
MD5

4d7285ecebb08bfdb06922f14cbf2b1e
SHA1

a0760d7855cad8b73c26f8c1e8321157a0a8bb55
SHA256

e0921daa7dba04df168bf23570342fe961ab734b9b11cb8ae3abfb1e1b86064a
SHA512

d5fcddfd6c5b5e9664a21ff7a48aa26e76408c913550602f6e7d95e5ed936edaf47306d64e7ab53a396a787f3e831459b766e6241e8d9211edc1412bf9bb1259
SSDEEP

12288:JTC1dnDKnI2QWBxFNEz+l1y0teDHZK3ooGHTU+SWFJ9jedWqEv0nA0:JhnI2QWBxFaDHhoGzU+JFziEv0nN

Score

1^/10

Malware Config

Signatures

Files

2024-02-19_4d7285ecebb08bfdb06922f14cbf2b1e_icedid
.exe windows:4 windows x86 arch:x86

08be37565a36b4dae35f0093b293f494

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0b:1f:bb:5b:e9:81:f5:63:e7:75:b5:da:6a:e2:e9:b8
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

02/11/2014, 00:00

Not After

01/01/2016, 23:59

Subject

CN=Eye of Imagination,OU=IT Team,O=Eye of Imagination,L=Jung-gu,ST=Daegu,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

05:3b:d7:d1:5d:35:f3:f7:62:56:0b:a0:98:a8:51:4a:cc:bb:41:2d
Signer

Actual PE Digest

05:3b:d7:d1:5d:35:f3:f7:62:56:0b:a0:98:a8:51:4a:cc:bb:41:2d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

f:\project_2008\snsstory\Oradisk_candle_vgrid\Filebus\Bin\OradiskDown.pdb

Imports

urlmon

URLDownloadToFileA

user32

InvalidateRect
CopyRect
GetSysColor
FillRect
GetDC
ReleaseDC
SetRect
GetClassInfoA
FindWindowA
SendMessageA
CharUpperA
EnableWindow
LoadIconA
DrawIconEx
GetWindowLongA
PtInRect
InflateRect
LoadBitmapA
DrawFocusRect
GetClientRect
LoadMenuA
ReuseDDElParam
UnpackDDElParam
RegisterClipboardFormatA
GetFocus
SetTimer
LoadAcceleratorsA
InsertMenuItemA
SetRectEmpty
SetMenu
TranslateAcceleratorA
UnregisterClassA
GetMenuItemInfoA
MessageBeep
GetNextDlgGroupItem
InvalidateRgn
CopyAcceleratorTableA
CharNextA
GetSysColorBrush
LoadCursorA
DrawIcon
IsRectEmpty
EndPaint
BeginPaint
GetWindowDC
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
MoveWindow
SetWindowTextA
IsDialogMessageA
MessageBoxA
PostMessageA
BringWindowToTop
AttachThreadInput
GetWindowThreadProcessId
GetForegroundWindow
RedrawWindow
KillTimer
ShowWindow
SetForegroundWindow
DestroyMenu
TrackPopupMenu
GetCursorPos
SetMenuDefaultItem
AppendMenuA
CreatePopupMenu
CloseWindow
GetSystemMetrics
ReleaseCapture
GetIconInfo
LoadImageA
DestroyIcon
OffsetRect
ClientToScreen
GetCapture
SetCapture
WindowFromPoint
SetCursor
UpdateWindow
CallWindowProcA
SetWindowLongA
IsWindow
GetWindowRect
GetParent
GetActiveWindow
SetWindowRgn
GetClassNameA
EnumChildWindows
MapWindowPoints
ReplyMessage
ExitWindowsEx
SetWindowPos
PostThreadMessageA
RegisterWindowMessageA
SendDlgItemMessageA
WinHelpA
IsChild
GetClassLongA
SetPropA
GetPropA
RemovePropA
SetFocus
GetWindowTextLengthA
GetWindowTextA
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
ScrollWindow
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
ShowScrollBar
GetMenu
CreateWindowExA
GetClassInfoExA
GetSubMenu
GetMenuItemCount
GetMenuItemID
GetMenuState
PostQuitMessage
CheckMenuItem
EnableMenuItem
ModifyMenuA
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
ValidateRect
PeekMessageA
GetKeyState
IsWindowVisible
DispatchMessageA
TranslateMessage
GetMessageA
CallNextHookEx
SetWindowsHookExA
ShowOwnedPopups
IsWindowEnabled
GetLastActivePopup
EndDialog
GetNextDlgTabItem
GetDlgItem
DestroyWindow
CreateDialogIndirectParamA
SetActiveWindow
GetDesktopWindow
MapDialogRect
SetWindowContextHelpId
GetWindow
GetWindowPlacement
IsIconic
SystemParametersInfoA
IntersectRect
DefWindowProcA
GetDlgCtrlID
SetScrollInfo
GetScrollInfo
DeferWindowPos
EqualRect
ScreenToClient
AdjustWindowRectEx
RegisterClassA

wininet

DeleteUrlCacheEntry

kernel32

GetSystemInfo
TerminateThread
GetExitCodeThread
GetVolumeInformationA
GetCurrentThreadId
GetModuleFileNameA
InterlockedDecrement
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
GlobalReAlloc
GetVersionExA
VirtualFreeEx
ReadProcessMemory
VirtualAllocEx
OpenProcess
GetDiskFreeSpaceExA
GetNumberFormatA
GetTickCount
CreateRemoteThread
GetExitCodeProcess
DuplicateHandle
GetCurrentProcess
GetSystemDirectoryA
GetProcessHeap
LocalFree
FormatMessageA
LoadLibraryExA
EnterCriticalSection
EnumResourceLanguagesA
ConvertDefaultLocale
GlobalDeleteAtom
GlobalAddAtomA
GetCurrentProcessId
lstrcmpW
GlobalFindAtomA
GlobalGetAtomNameA
FindClose
FindNextFileA
FileTimeToSystemTime
FileTimeToLocalFileTime
FindFirstFileA
GetThreadLocale
ReadFile
WriteFile
SetFilePointer
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
GetFileSize
GetFullPathNameA
CreateFileA
GetModuleFileNameW
InterlockedIncrement
LocalAlloc
TlsGetValue
GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
WritePrivateProfileStringA
GetCurrentDirectoryA
GlobalFlags
GetCPInfo
GetOEMCP
SetErrorMode
GetFileAttributesA
GetFileTime
RtlUnwind
VirtualProtect
VirtualAlloc
VirtualQuery
HeapReAlloc
ExitThread
CreateThread
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
GetSystemTimeAsFileTime
GetTimeFormatA
GetDateFormatA
GetStartupInfoA
ExitProcess
HeapSize
VirtualFree
GetStdHandle
GetACP
IsValidCodePage
GetTimeZoneInformation
GetStringTypeA
GetStringTypeW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetDriveTypeA
GetConsoleCP
GetConsoleMode
LCMapStringA
LCMapStringW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetCurrentThread
SetThreadPriority
CreateDirectoryA
GetModuleHandleA
SetLastError
lstrcpynA
SetEvent
ResetEvent
FindResourceA
LoadResource
SizeofResource
FreeResource
LockResource
GlobalAlloc
ResumeThread
GlobalLock
GlobalUnlock
MulDiv
GlobalFree
CloseHandle
CreateEventA
LoadLibraryA
GetProcAddress
FreeLibrary
lstrcmpA
DeleteFileA
WaitForSingleObject
lstrcpyA
CreateMutexA
GetCommandLineA
GetLastError
Sleep
lstrlenA
WideCharToMultiByte
CompareStringA
CompareStringW
MultiByteToWideChar
InterlockedExchange
GetVersion
GetLocaleInfoA

gdi32

TextOutA
GetRgnBox
GetTextColor
GetBkColor
Ellipse
LPtoDP
CreateEllipticRgn
CreatePatternBrush
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
Escape
ExtTextOutA
RectVisible
PtVisible
GetWindowExtEx
GetViewportExtEx
SelectClipRgn
SetBkMode
RestoreDC
SaveDC
SetTextColor
GetClipBox
CreateDCA
GetPixel
CreateRectRgn
CreateFontA
CreateDIBSection
ExtCreateRegion
CombineRgn
DPtoLP
CreateBitmap
GetMapMode
SetMapMode
SetBkColor
CreateFontIndirectA
GetStockObject
GetTextExtentPoint32A
StretchBlt
Rectangle
SetRectRgn
CreateRectRgnIndirect
GetObjectA
CreatePen
CreateSolidBrush
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
DeleteDC
DeleteObject
GetDeviceCaps

comdlg32

GetFileTitleA

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter

advapi32

LookupPrivilegeValueA
RegOpenKeyExA
RegEnumKeyA
RegQueryValueA
RegOpenKeyA
OpenProcessToken
RegConnectRegistryA
AdjustTokenPrivileges
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegQueryInfoKeyA
RegCloseKey
RegEnumValueA

shell32

SHGetSpecialFolderPathA
Shell_NotifyIconA
ShellExecuteA
SHGetFileInfoA
DragFinish
DragQueryFileA
ShellExecuteExA

comctl32

ord17

shlwapi

StrFormatByteSize64A
PathFindFileNameA
PathFindExtensionA
PathStripToRootA
PathIsUNCA
PathGetArgsA

oledlg

ord8

ole32

CoTaskMemFree
CoRegisterMessageFilter
OleFlushClipboard
OleIsCurrentClipboard
CoRevokeClassObject
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CreateStreamOnHGlobal
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CLSIDFromString
CLSIDFromProgID
CoTaskMemAlloc
CoCreateInstance
CoInitialize
CoUninitialize

oleaut32

OleCreateFontIndirect
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroy
VariantCopy
SafeArrayCreate
SafeArrayGetDim
SafeArrayGetElemsize
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SysStringLen
VariantInit
VariantChangeType
SysAllocString
SysAllocStringLen
VariantClear
SysStringByteLen
SysAllocStringByteLen
OleLoadPicture
SysFreeString

ws2_32

WSACleanup
connect
htons
WSARecv
WSASend
WSAWaitForMultipleEvents
setsockopt
WSAConnect
WSASocketA
WSAGetLastError
select
__WSAFDIsSet
recv
socket
closesocket
inet_addr
WSAStartup

v_down

?GetStartPoint@@YA_JXZ
?GetValidDownSize@@YA_JXZ
?GetStatus@@YAHXZ
?OnStop_Download@@YAXXZ
?OnStart_Download@@YAHH@Z
?SetDownloadFile@@YAXPA_W00_J@Z
?SetDownMainSvrInfo@@YAXPADHH@Z
?InitNodeLib@@YAXPAD@Z

Sections

.text
Size: 452KB - Virtual size: 451KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 116KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

08be37565a36b4dae35f0093b293f494

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

0b:1f:bb:5b:e9:81:f5:63:e7:75:b5:da:6a:e2:e9:b8Certificate

Extended Key Usages

Key Usages

05:3b:d7:d1:5d:35:f3:f7:62:56:0b:a0:98:a8:51:4a:cc:bb:41:2dSigner

Headers

File Characteristics

PDB Paths

Imports

urlmon

user32

wininet

kernel32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

ws2_32

v_down

Sections

.text Size: 452KB - Virtual size: 451KB

.rdata Size: 116KB - Virtual size: 112KB

.data Size: 16KB - Virtual size: 27KB

.rsrc Size: 2.5MB - Virtual size: 2.5MB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

0b:1f:bb:5b:e9:81:f5:63:e7:75:b5:da:6a:e2:e9:b8
Certificate

05:3b:d7:d1:5d:35:f3:f7:62:56:0b:a0:98:a8:51:4a:cc:bb:41:2d
Signer

.text
Size: 452KB - Virtual size: 451KB

.rdata
Size: 116KB - Virtual size: 112KB

.data
Size: 16KB - Virtual size: 27KB

.rsrc
Size: 2.5MB - Virtual size: 2.5MB