D:\VS2008程序\VS2008中文版\Bin\WFFCrypt.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-21_000ab372834685326917b002f4558183_icedid.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-02-21_000ab372834685326917b002f4558183_icedid.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-02-21_000ab372834685326917b002f4558183_icedid
-
Size
11.0MB
-
MD5
000ab372834685326917b002f4558183
-
SHA1
b3674680da7dea2f1539ad4c42c5fbc9315886eb
-
SHA256
d3ff4785e1909be72d04ac12393c3109e81a6dda9c4241a02b9af179b4803045
-
SHA512
814b4cb3ba96efdd46b5666eb7c23cb4f5dbdd243d9ea046d4fdbc2152e518aa29158f766254645e1093d86d5edb4e82a3e194a5d149da8f95ef353c806809a0
-
SSDEEP
196608:xjK4EbUQNpxQ5VtEFscXtY16ljgViIxaHZkYntinnomikKWXO7RgmKrlIcL:0x+dcX4qjgViIxaHZkYntinnomikKWXh
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-02-21_000ab372834685326917b002f4558183_icedid
Files
-
2024-02-21_000ab372834685326917b002f4558183_icedid.exe windows:5 windows x86 arch:x86
61f445b7e2a325f5eb5341f980d0a6b3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
CreateFileMappingA
OpenFileMappingA
SetEnvironmentVariableA
CreateFileA
GetTimeZoneInformation
GetConsoleOutputCP
WriteConsoleA
GetVersionExW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
GetDateFormatA
GetTimeFormatA
InitializeCriticalSectionAndSpinCount
GetConsoleMode
GetConsoleCP
HeapReAlloc
LCMapStringA
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
SetConsoleCtrlHandler
FatalAppExitA
VirtualFree
HeapFree
HeapCreate
HeapDestroy
GetStartupInfoA
SetHandleCount
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetSystemTimeAsFileTime
QueryPerformanceCounter
OutputDebugStringW
WriteConsoleW
OutputDebugStringA
GetStdHandle
ExitProcess
GetFileType
SetStdHandle
GetModuleFileNameA
ExitThread
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsBadReadPtr
HeapValidate
DebugBreak
RaiseException
IsDebuggerPresent
VirtualQuery
GetSystemInfo
VirtualAlloc
RtlUnwind
GetStartupInfoW
GetDiskFreeSpaceW
GetTempFileNameW
FindResourceExW
GetCurrentDirectoryW
WritePrivateProfileStringW
LocalLock
LocalUnlock
TlsGetValue
LocalReAlloc
TlsSetValue
GlobalReAlloc
TlsFree
GlobalHandle
TlsAlloc
LocalAlloc
DeleteCriticalSection
InitializeCriticalSection
GetProfileIntW
VirtualProtect
SetErrorMode
GlobalFlags
CompareStringA
GetCurrentThread
GetLocaleInfoW
ConvertDefaultLocale
EnumResourceLanguagesW
GetCurrentProcessId
InterlockedIncrement
InterlockedDecrement
GetThreadLocale
GetStringTypeExW
GetFullPathNameW
MoveFileW
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
DuplicateHandle
GetHandleInformation
LocalFileTimeToFileTime
GetAtomNameW
lstrcmpA
CopyFileW
GlobalSize
FormatMessageW
LocalFree
CompareStringW
lstrcmpW
GetCurrentThreadId
GlobalGetAtomNameW
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
GetVersionExA
SuspendThread
GetThreadPriority
SetThreadPriority
GetModuleHandleA
GetModuleHandleW
SetEvent
ResetEvent
GlobalAlloc
ResumeThread
GlobalFree
CreateEventW
GetCurrentProcess
CreateMutexW
LoadLibraryA
SetLastError
WinExec
GetWindowsDirectoryW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
OpenProcess
TerminateProcess
GetLocalTime
GlobalLock
GlobalUnlock
GetPrivateProfileIntW
RemoveDirectoryW
GetModuleFileNameW
GetComputerNameW
Sleep
GetFileSizeEx
SetFilePointerEx
SetFilePointer
ReadFile
GetSystemDirectoryW
SetFileAttributesW
MoveFileExW
DeleteFileW
CreateFileMappingW
MapViewOfFile
GetFileSize
FlushViewOfFile
UnmapViewOfFile
GetLogicalDriveStringsW
GetProcessHeap
HeapAlloc
HeapSize
CreateThread
ReadDirectoryChangesW
GetLongPathNameW
WaitForSingleObject
TerminateThread
MulDiv
GetSystemTime
GetTickCount
WideCharToMultiByte
GetDiskFreeSpaceExW
GetDriveTypeW
GetVolumeInformationW
GetLastError
GetPrivateProfileStringW
GetFileAttributesW
lstrcpynW
GetTempPathW
CreateDirectoryW
SystemTimeToFileTime
SetFileTime
GetFileTime
FileTimeToLocalFileTime
FileTimeToSystemTime
GetShortPathNameW
lstrcatW
FindFirstFileW
FindClose
FindNextFileW
LoadLibraryW
GetProcAddress
FreeLibrary
lstrcpyW
InterlockedExchange
EnterCriticalSection
LeaveCriticalSection
CreateFileW
WriteFile
CloseHandle
SizeofResource
lstrlenW
lstrcmpiW
FreeResource
FindResourceW
LoadResource
LockResource
MultiByteToWideChar
GetCPInfo
lstrlenA
GetVersion
OpenEventA
user32
SetDlgItemTextW
SetDlgItemInt
GetDlgItemTextW
GetDlgItemInt
CheckRadioButton
CheckDlgButton
RegisterWindowMessageW
MessageBoxW
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
SendDlgItemMessageW
SendDlgItemMessageA
DispatchMessageW
AdjustWindowRectEx
EqualRect
DeferWindowPos
BeginDeferWindowPos
EndDeferWindowPos
ScrollWindow
GetScrollInfo
SetScrollInfo
WinHelpW
TrackPopupMenuEx
TrackPopupMenu
SetWindowPlacement
GetDlgItem
GetWindowTextLengthW
GetKeyState
DestroyWindow
SetWindowsHookExW
CallNextHookEx
GetClassLongW
GetClassNameW
SetPropW
UnhookWindowsHookEx
GetPropW
CallWindowProcW
RemovePropW
DefWindowProcW
SetMenu
GetMenu
GetMessageTime
OffsetRect
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GetMenuCheckMarkDimensions
SetRectEmpty
OpenIcon
CloseWindow
LoadIconW
PostThreadMessageW
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
EnableWindow
GetWindowContextHelpId
SetWindowContextHelpId
SendNotifyMessageW
GetForegroundWindow
SetForegroundWindow
ShowCaret
HideCaret
SetCaretPos
GetCaretPos
CreateCaret
GetClipboardViewer
GetClipboardOwner
GetOpenClipboardWindow
OpenClipboard
SetClipboardViewer
ChangeClipboardChain
FlashWindow
SetParent
GetParent
GetLastActivePopup
GetTopWindow
FindWindowExW
FindWindowW
ChildWindowFromPointEx
ChildWindowFromPoint
ShowScrollBar
GetNextDlgTabItem
GetNextDlgGroupItem
DlgDirSelectComboBoxExW
DlgDirSelectExW
DlgDirListComboBoxW
DlgDirListW
GetDesktopWindow
GetFocus
SetCapture
GetCapture
SetActiveWindow
GetActiveWindow
IsDlgButtonChecked
SetTimer
DrawCaption
DrawAnimatedRects
EnableScrollBar
RedrawWindow
LockWindowUpdate
GetDCEx
ShowOwnedPopups
IsWindowVisible
ValidateRgn
ValidateRect
InvalidateRgn
InvalidateRect
GetUpdateRgn
GetUpdateRect
MapWindowPoints
GetClientRect
BringWindowToTop
GetWindowRgn
SetWindowRgn
ArrangeIconicWindows
IsZoomed
IsIconic
HiliteMenuItem
GetSystemMenu
DrawMenuBar
DragDetect
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
ScreenToClient
MapDialogRect
CheckMenuRadioItem
GetMenuContextHelpId
SetMenuContextHelpId
LoadMenuIndirectW
LoadMenuW
SetMenuItemBitmaps
RemoveMenu
ModifyMenuW
InsertMenuItemW
InsertMenuW
GetSubMenu
SetMenuItemInfoW
GetMenuState
GetMenuItemID
GetMenuItemCount
GetMenuDefaultItem
SetMenuDefaultItem
GetMenuItemInfoW
GetSysColor
SystemParametersInfoW
DestroyIcon
DrawIconEx
EnableMenuItem
CheckMenuItem
AppendMenuW
DeleteMenu
CreatePopupMenu
CreateMenu
ScrollDC
GrayStringW
GetTabbedTextExtentW
DrawTextExW
DrawTextW
TabbedTextOutW
DrawFocusRect
DrawFrameControl
DrawEdge
DrawStateW
DrawIcon
InvertRect
ScrollWindowEx
IsDialogMessageW
SetWindowTextW
MoveWindow
ShowWindow
IsWindowEnabled
CharUpperW
CreateDialogIndirectParamW
EndDialog
GetWindowThreadProcessId
GetMessageW
GetAsyncKeyState
LoadAcceleratorsW
TranslateAcceleratorW
ReuseDDElParam
UnpackDDElParam
GetMenuBarInfo
GetClipboardFormatNameA
FrameRect
ExcludeUpdateRgn
WindowFromDC
GetClipboardFormatNameW
UnregisterClassW
GetDialogBaseUnits
WaitMessage
CopyAcceleratorTableW
RegisterClipboardFormatW
InSendMessage
GetSystemMetrics
FillRect
MsgWaitForMultipleObjects
PeekMessageA
IsWindowUnicode
GetMessageA
DispatchMessageA
SubtractRect
UnionRect
InflateRect
PtInRect
GetSysColorBrush
DestroyCursor
IsMenu
SetCursor
PostMessageW
ReleaseDC
CreateIconIndirect
GetDC
GetIconInfo
IsRectEmpty
GetTabbedTextExtentA
KillTimer
LoadImageW
SendMessageW
PostQuitMessage
PeekMessageW
GetMessagePos
LoadBitmapW
LoadCursorW
UpdateWindow
GetCursorPos
GetWindowTextW
GetWindow
TranslateMessage
RegisterHotKey
UnregisterHotKey
SetWindowPos
SetWindowLongW
GetWindowLongW
CloseClipboard
GetClipboardData
IsClipboardFormatAvailable
ClipCursor
mouse_event
keybd_event
ReleaseCapture
IsWindow
CopyIcon
MessageBeep
SetFocus
IsChild
LoadStringW
GetDlgCtrlID
GetWindowRect
WindowFromPoint
GetKeyNameTextW
MapVirtualKeyW
IsCharLowerW
MapVirtualKeyExW
GetKeyboardLayout
SetRect
CopyRect
DestroyMenu
GetMenuStringW
CharNextW
gdi32
GetMapMode
GetGraphicsMode
GetWorldTransform
GetViewportOrgEx
GetViewportExtEx
GetWindowOrgEx
GetWindowExtEx
DPtoLP
LPtoDP
FillRgn
FrameRgn
InvertRgn
PaintRgn
PtVisible
RectVisible
GetCurrentPositionEx
Arc
Polyline
Chord
Ellipse
Pie
Polygon
PolyPolygon
Rectangle
RoundRect
PatBlt
FloodFill
ExtFloodFill
TextOutW
ExtTextOutW
GetTextAlign
GetTextFaceW
GetTextMetricsW
GetTextCharacterExtra
GetCharWidthW
GetFontLanguageInfo
GetCharacterPlacementW
GetAspectRatioFilterEx
Escape
SetBoundsRect
GetBoundsRect
ResetDCW
GetOutlineTextMetricsW
GetCharABCWidthsW
GetFontData
GetKerningPairsW
GetGlyphOutlineW
StartDocW
StartPage
EndPage
SetAbortProc
AbortDoc
EndDoc
MaskBlt
PlgBlt
SetPixelV
AngleArc
GetArcDirection
PolyPolyline
GetColorAdjustment
GetCurrentObject
PolyBezier
DrawEscape
ExtEscape
GetCharABCWidthsFloatW
GetTextColor
AbortPath
BeginPath
CloseFigure
EndPath
FillPath
FlattenPath
GetMiterLimit
GetPath
GetROP2
StrokeAndFillPath
StrokePath
WidenPath
GdiComment
GetBkColor
CreateMetaFileW
CloseMetaFile
CreateEnhMetaFileW
CloseEnhMetaFile
SaveDC
RestoreDC
SelectPalette
SetBkMode
SetPolyFillMode
SetROP2
SetGraphicsMode
SetWorldTransform
ModifyWorldTransform
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
GetClipBox
SelectClipRgn
ExcludeClipRect
IntersectClipRect
OffsetClipRgn
MoveToEx
LineTo
SetTextAlign
SetTextJustification
SetTextCharacterExtra
SetMapperFlags
ArcTo
SetArcDirection
PolyDraw
PolylineTo
SetColorAdjustment
PolyBezierTo
GetClipRgn
SelectClipPath
ExtSelectClipRgn
PlayMetaFileRecord
EnumMetaFile
PlayMetaFile
StretchDIBits
GetDCOrgEx
CopyMetaFileW
EnumFontFamiliesExW
DeleteMetaFile
GetCharWidthFloatW
GetStretchBltMode
RealizePalette
GetNearestColor
EnumObjects
GetBrushOrgEx
CreateICW
CreateDCW
RectInRegion
PtInRegion
GetRgnBox
OffsetRgn
EqualRgn
CombineRgn
SetRectRgn
GetRegionData
ExtCreateRegion
PathToRegion
CreateRoundRectRgn
CreatePolyPolygonRgn
GetPolyFillMode
SetMiterLimit
GetBkMode
SetPaletteEntries
GetPaletteEntries
CreateHalftonePalette
CreatePalette
CreateDiscardableBitmap
GetBitmapDimensionEx
SetBitmapDimensionEx
GetBitmapBits
SetBitmapBits
CreateBitmapIndirect
CreateFontW
CreateFontIndirectW
GetTextExtentPoint32W
DeleteDC
DeleteObject
CreateSolidBrush
BitBlt
SelectObject
CreateDIBSection
CreateCompatibleDC
GetStockObject
SetTextColor
CreatePatternBrush
CreateBrushIndirect
CreateHatchBrush
ExtCreatePen
CreatePolygonRgn
CreateEllipticRgnIndirect
CreateEllipticRgn
SetBkColor
CreateBitmap
CreateCompatibleBitmap
CreateRectRgnIndirect
CreateRectRgn
ResizePalette
GetNearestPaletteIndex
PlayEnhMetaFile
CreateDIBPatternBrushPt
CreatePenIndirect
CreatePen
GetObjectType
UnrealizeObject
SetStretchBltMode
SetBrushOrgEx
StretchBlt
GetDeviceCaps
CreateDIBitmap
UpdateColors
AddFontResourceW
RemoveFontResourceW
SetDIBColorTable
GetObjectW
GetPixel
SetPixel
AnimatePalette
comdlg32
GetFileTitleW
winspool.drv
GetJobW
OpenPrinterW
DocumentPropertiesW
ClosePrinter
advapi32
RegEnumKeyW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW
SetThreadToken
RevertToSelf
OpenThreadToken
GetFileSecurityW
SetFileSecurityW
RegDeleteValueW
RegCreateKeyW
RegCloseKey
RegOpenKeyW
RegSetValueW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegQueryValueW
RegDeleteKeyW
shell32
SHFileOperationW
SHGetFileInfoW
SHGetSpecialFolderPathW
SHChangeNotify
SHGetSpecialFolderLocation
SHGetMalloc
ExtractIconExW
ord727
SHGetDesktopFolder
ShellExecuteW
ExtractIconW
DragQueryFileW
DragFinish
DragAcceptFiles
SHBrowseForFolderW
SHGetPathFromIDListW
ord178
ShellExecuteExW
comctl32
ImageList_GetIconSize
_TrackMouseEvent
shlwapi
PathStripToRootW
PathRemoveFileSpecW
PathFindExtensionW
PathRemoveExtensionW
PathFindFileNameW
PathIsUNCW
oledlg
OleUIInsertObjectW
OleUIConvertW
OleUIChangeIconW
OleUIEditLinksW
OleUIUpdateLinksW
OleUIPasteSpecialW
OleUIBusyW
ole32
CreateGenericComposite
CreateItemMoniker
CoRegisterMessageFilter
CoFreeUnusedLibraries
OleUninitialize
OleInitialize
CoRevokeClassObject
CoRegisterClassObject
StgOpenStorageOnILockBytes
CoGetClassObject
OleRun
StringFromGUID2
CLSIDFromString
CLSIDFromProgID
OleFlushClipboard
OleSetClipboard
OleIsCurrentClipboard
CreateFileMoniker
CoInitializeEx
ReleaseStgMedium
CreateOleAdviseHolder
CoTreatAsClass
StringFromCLSID
ReadClassStg
ReadFmtUserTypeStg
OleRegGetUserType
WriteClassStg
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
OleRegGetMiscStatus
WriteFmtUserTypeStg
SetConvertStg
CreateBindCtx
OleDuplicateData
CreateStreamOnHGlobal
CreateILockBytesOnHGlobal
GetClassFile
CoGetMalloc
StgCreateDocfile
StgOpenStorage
StgIsStorageFile
OleLockRunning
OleSetContainedObject
OleCreateFromData
OleCreateLinkFromData
OleCreateFromFile
OleCreateLinkToFile
OleCreate
OleLoad
OleSave
StgIsStorageILockBytes
GetHGlobalFromILockBytes
OleGetIconOfClass
CoLockObjectExternal
GetRunningObjectTable
IsAccelerator
OleTranslateAccelerator
CoDisconnectObject
CreateDataAdviseHolder
OleRegEnumVerbs
DoDragDrop
OleSetMenuDescriptor
OleGetClipboard
StgCreateDocfileOnILockBytes
OleCreateStaticFromData
CoUninitialize
CoInitialize
CoCreateInstance
CoTaskMemFree
OleQueryLinkFromData
OleQueryCreateFromData
OleIsRunning
OleSaveToStream
CoUnmarshalInterface
CoMarshalInterface
CoReleaseMarshalData
CoTaskMemAlloc
WriteClassStm
oleaut32
SysAllocString
SysFreeString
OleLoadPicture
SysAllocStringLen
VariantClear
VariantChangeType
SystemTimeToVariantTime
VariantInit
SysStringLen
SysAllocStringByteLen
SysStringByteLen
SafeArrayGetDim
SafeArrayGetElemsize
RegisterTypeLi
LoadTypeLi
LoadRegTypeLi
SafeArrayUnaccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayRedim
SafeArrayCreate
VariantCopy
SysReAllocStringLen
VarCyFromStr
VarBstrFromCy
SafeArrayCopy
SafeArrayAllocData
SafeArrayAllocDescriptor
SafeArrayGetElement
SafeArrayPtrOfIndex
SafeArrayPutElement
SafeArrayLock
SafeArrayUnlock
SafeArrayDestroy
SafeArrayDestroyData
SafeArrayDestroyDescriptor
VarBstrFromDec
VarDecFromStr
VarDateFromStr
VarBstrFromDate
OleCreateFontIndirect
DosDateTimeToVariantTime
VariantTimeToSystemTime
VarUdateFromDate
VarDateFromUdate
SafeArrayAccessData
skinhu
SkinH_DetachEx
SkinH_Attach
winmm
mciSendCommandW
PlaySoundW
avifil32
AVIFileInit
AVIFileOpenW
AVIFileRelease
AVIFileInfoW
AVIFileExit
gdiplus
GdipLoadImageFromStream
GdipDrawImageRectI
GdipCreateFromHDC
GdiplusStartup
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipDrawImageI
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipAlloc
GdipCloneImage
GdipDisposeImage
GdipFree
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromFile
GdiplusShutdown
GdipLoadImageFromStreamICM
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
Sections
.text Size: 5.1MB - Virtual size: 5.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 583KB - Virtual size: 582KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5.4MB - Virtual size: 5.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ