2024-02-20_66204c622c3e85617fdd5f8eb30f1e91_icedid

Sharing

Copy URL Twitter E-mail

General

Target

2024-02-20_66204c622c3e85617fdd5f8eb30f1e91_icedid
Size

8.9MB
MD5

66204c622c3e85617fdd5f8eb30f1e91
SHA1

30c98e0d48a4d7c40689d01aa84e0cf7fd2d6054
SHA256

70cc7361bb566b2951beddc2f15a89eb9eead8386ecd6c9e25cba63195d25bda
SHA512

d42dd3f8122512435fe5c89a71decf39a6d0aecc9b79908145aeee7b35bfe22611f32bd7e842d10d214dd0d6d76d5739ae629ea1125b179f81406a954510c244
SSDEEP

49152:a/Wht1280aA0k/Ujk3584/FuZKS398A/FufirCPZxVMw:a/st1p0aAHnJedtcPZxX

Score

1^/10

Malware Config

Signatures

Files

2024-02-20_66204c622c3e85617fdd5f8eb30f1e91_icedid
.exe windows:4 windows x86 arch:x86

369302904629889176e52df8c01bb398

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

30:d3:c1:67:26:5b:52:0c:b8:7f:25:84:4f:95:cb:04
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

29/10/2013, 00:00

Not After

27/12/2016, 23:59

Subject

CN=Shanda Games,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Security Labs,O=Shanda Games,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

dc:0c:dd:1a:c4:20:96:ab:32:da:66:c7:a8:3e:8e:81:53:0b:76:82
Signer

Actual PE Digest

dc:0c:dd:1a:c4:20:96:ab:32:da:66:c7:a8:3e:8e:81:53:0b:76:82

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

sendto
setsockopt
recvfrom
inet_ntoa
closesocket
inet_addr
gethostbyname
WSAGetLastError
WSAStartup
WSASocketA
WSACleanup

kernel32

SetErrorMode
FileTimeToLocalFileTime
GetFileTime
RtlUnwind
ExitProcess
TerminateProcess
ExitThread
CreateThread
GetSystemTimeAsFileTime
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetStartupInfoA
GetCommandLineA
HeapReAlloc
HeapDestroy
HeapCreate
VirtualFree
IsBadWritePtr
LCMapStringA
LCMapStringW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetHandleCount
GetStdHandle
GetFileType
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetStringTypeA
GetStringTypeW
GetTimeZoneInformation
IsBadReadPtr
IsBadCodePtr
SetStdHandle
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
GetLocaleInfoW
SetEnvironmentVariableA
GetFullPathNameA
GetVolumeInformationA
GetCurrentProcess
DuplicateHandle
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
ReadFile
WritePrivateProfileStringA
FileTimeToSystemTime
GetOEMCP
InterlockedIncrement
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
TlsGetValue
EnterCriticalSection
GlobalHandle
GlobalReAlloc
LeaveCriticalSection
LocalAlloc
GlobalFlags
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
lstrcpyA
lstrcmpA
InterlockedDecrement
DeleteCriticalSection
InitializeCriticalSection
RaiseException
SetLastError
GlobalFree
MulDiv
GlobalAlloc
GlobalLock
GlobalUnlock
FormatMessageA
LocalFree
GetCurrentThreadId
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
LoadLibraryA
FreeLibrary
lstrcatA
lstrcmpW
lstrcpynA
GetModuleHandleA
GetProcAddress
FreeResource
CreateMutexA
ReleaseMutex
GetModuleFileNameA
CompareStringW
CompareStringA
HeapAlloc
GetTickCount
GetCurrentProcessId
GetProcessHeap
HeapFree
GetCurrentDirectoryA
GetFileAttributesA
Sleep
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
GetFileSize
GetLastError
SetCurrentDirectoryA
CreateDirectoryA
FindFirstFileA
FindClose
WinExec
TerminateThread
DeleteFileA
WaitForSingleObject
CreateFileA
WriteFile
CloseHandle
lstrlenW
GetCPInfo
lstrlenA
lstrcmpiA
FindResourceA
LoadResource
LockResource
SizeofResource
WideCharToMultiByte
MultiByteToWideChar
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
GetVersion
GetVersionExA
HeapSize

user32

LockWindowUpdate
SetCapture
CharNextA
IsRectEmpty
CopyAcceleratorTableA
InvalidateRgn
GetNextDlgGroupItem
MessageBeep
SetParent
RegisterClipboardFormatA
PostThreadMessageA
EndDialog
EndPaint
BeginPaint
GetWindowDC
GetMessageA
TranslateMessage
ValidateRect
SetMenuItemBitmaps
EnableMenuItem
CheckMenuItem
GetMenuCheckMarkDimensions
IsWindowEnabled
ShowWindow
MoveWindow
SetWindowTextA
IsDialogMessageA
RegisterWindowMessageA
WinHelpA
CreateWindowExA
SetWindowsHookExA
CallNextHookEx
GetClassInfoExA
GetClassNameA
SetPropA
GetPropA
RemovePropA
SendDlgItemMessageA
GetFocus
SetFocus
GetWindowTextLengthA
GetWindowTextA
GetForegroundWindow
GetLastActivePopup
SetActiveWindow
DispatchMessageA
GetDlgItem
GetTopWindow
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
LoadIconA
PeekMessageA
MapWindowPoints
MessageBoxA
TrackPopupMenu
GetDCEx
SetForegroundWindow
IsWindowVisible
GetMenu
EqualRect
GetClassInfoA
RegisterClassA
UnregisterClassA
CallWindowProcA
SetWindowPos
IntersectRect
IsIconic
GetWindowPlacement
GetWindow
DefWindowProcA
GetDlgCtrlID
GetKeyState
IsChild
GetCapture
KillTimer
SetTimer
ScreenToClient
DeferWindowPos
IsWindow
SetRectEmpty
PtInRect
SetWindowLongA
GetMenuStringA
DestroyMenu
EnumDisplaySettingsA
CharUpperA
LoadCursorA
UpdateWindow
wsprintfA
GetCursorPos
FindWindowA
SetWindowRgn
LoadImageA
PostMessageA
SetCursor
DestroyCursor
GetWindowLongA
WindowFromPoint
GetParent
GetNextDlgTabItem
GetActiveWindow
InvalidateRect
ClientToScreen
GetClientRect
GetWindowRect
SendMessageA
DrawFocusRect
FrameRect
OffsetRect
InflateRect
IsMenu
DrawStateA
ReleaseCapture
GetMenuItemInfoA
GetSysColorBrush
GetSystemMetrics
SystemParametersInfoA
GetSysColor
DrawIconEx
DestroyIcon
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
EnableWindow
GetDesktopWindow
ReleaseDC
GetDC
ModifyMenuA
SetWindowContextHelpId
MapDialogRect
PostQuitMessage
CreateDialogIndirectParamA
GetSubMenu
GetMenuState
GetMenuItemID
GetMenuItemCount
AppendMenuA
CreatePopupMenu
CreateMenu
DrawEdge
FillRect
LoadBitmapA
CopyRect
SetRect
AdjustWindowRectEx
GetClassLongA

gdi32

GetViewportExtEx
GetWindowExtEx
SetViewportOrgEx
OffsetViewportOrgEx
GetClipBox
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
SetRectRgn
GetMapMode
DPtoLP
GetTextColor
GetRgnBox
GetBkColor
CreateFontA
GetCharWidthA
StretchDIBits
CreatePatternBrush
CombineRgn
CreateRectRgn
CreateBitmap
SetBkColor
SetTextColor
GetStockObject
CreateDIBSection
SelectClipRgn
MoveToEx
LineTo
IntersectClipRect
ExcludeClipRect
SetMapMode
SetBkMode
RestoreDC
SaveDC
PatBlt
Ellipse
GetBkMode
GetDeviceCaps
CreateCompatibleDC
GetObjectA
CreateCompatibleBitmap
CreateFontIndirectA
CreateSolidBrush
CreateRectRgnIndirect
CreatePen
SelectObject
DeleteObject
DeleteDC
GetTextExtentPoint32W
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetTextExtentPoint32A
SetPixel
GetPixel
BitBlt

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

RegCloseKey
RegOpenKeyExA
RegOpenKeyA
RegDeleteKeyA
RegEnumKeyA
RegQueryValueA
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA

shell32

ShellExecuteA
SHGetSpecialFolderPathA
ShellExecuteExA

comctl32

ImageList_ReplaceIcon
ImageList_GetImageCount
ImageList_GetIcon
ImageList_Draw
_TrackMouseEvent
ord17
ImageList_Destroy
ImageList_Create
ImageList_AddMasked

shlwapi

PathFindExtensionA
PathFindFileNameA
PathStripToRootA
PathIsUNCA

oledlg

ord8

ole32

CoTaskMemFree
CoInitialize
CoUninitialize
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
CoRegisterMessageFilter
CoTaskMemAlloc
CLSIDFromProgID
CLSIDFromString
CoCreateInstance
OleFlushClipboard
OleIsCurrentClipboard
CoRevokeClassObject
OleInitialize
CoFreeUnusedLibraries
OleUninitialize

oleaut32

OleCreateFontIndirect
SysAllocString
SystemTimeToVariantTime
SafeArrayDestroy
VariantCopy
SysAllocStringByteLen
SysStringLen
SysFreeString
VariantInit
VariantChangeType
VariantClear
SysAllocStringLen

wininet

InternetCloseHandle
InternetReadFile
HttpQueryInfoA
HttpSendRequestA
HttpOpenRequestA
InternetSetFilePointer
InternetConnectA
InternetOpenA
InternetAttemptConnect
InternetOpenUrlA

Sections

.text
Size: 344KB - Virtual size: 340KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 84KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8.5MB - Virtual size: 8.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

369302904629889176e52df8c01bb398

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fdCertificate

Extended Key Usages

Key Usages

30:d3:c1:67:26:5b:52:0c:b8:7f:25:84:4f:95:cb:04Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

dc:0c:dd:1a:c4:20:96:ab:32:da:66:c7:a8:3e:8e:81:53:0b:76:82Signer

Headers

File Characteristics

Imports

ws2_32

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

wininet

Sections

.text Size: 344KB - Virtual size: 340KB

.rdata Size: 84KB - Virtual size: 81KB

.data Size: 16KB - Virtual size: 30KB

.rsrc Size: 8.5MB - Virtual size: 8.5MB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

30:d3:c1:67:26:5b:52:0c:b8:7f:25:84:4f:95:cb:04
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

dc:0c:dd:1a:c4:20:96:ab:32:da:66:c7:a8:3e:8e:81:53:0b:76:82
Signer

.text
Size: 344KB - Virtual size: 340KB

.rdata
Size: 84KB - Virtual size: 81KB

.data
Size: 16KB - Virtual size: 30KB

.rsrc
Size: 8.5MB - Virtual size: 8.5MB