e:\Work\Project\xsystem\release\xlauncher.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-23_b9d0409ac4994baa0fb23ebcfb0859cb_icedid.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-02-23_b9d0409ac4994baa0fb23ebcfb0859cb_icedid.exe
Resource
win10v2004-20240221-en
General
-
Target
2024-02-23_b9d0409ac4994baa0fb23ebcfb0859cb_icedid
-
Size
516KB
-
MD5
b9d0409ac4994baa0fb23ebcfb0859cb
-
SHA1
c19cf8e7fc9d0ad11b1b5e87e9240a120a5c346f
-
SHA256
5feae79ebbdcaad88d8593aa58c213c30248360eac2f7fe79f3b6a94d3c814d4
-
SHA512
57182200ba87a1031355aacdb7abcc037b0fa753c596b749db76dbd7b668f377551635af492f034c45190f8bc705946751a612259f77f206a330f1f1ba430c4f
-
SSDEEP
12288:jXvYylquRLL+EIvTRdmhAKmZgcy94gwvE/79A2AlEP0:jXvYylNLLNuTj2mZgzegSE/79A2A5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-02-23_b9d0409ac4994baa0fb23ebcfb0859cb_icedid
Files
-
2024-02-23_b9d0409ac4994baa0fb23ebcfb0859cb_icedid.exe windows:4 windows x86 arch:x86
1d40d3ec4e2305f214e57d17fe6d052f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
xlog
?XLOG_USERW@@YAXPB_WZZ
xengine
?SearchFile@XFileMgr@@QAEHABVXString@@0HAAV?$XArray@VXString@@@@@Z
??0XInstance@@QAE@PBDH@Z
?g_dPerformanceFreq@@3NA
?XMD5BlockCheckSumFile@@YAHPB_WPA_WIP6AHHH0PAX@Z2@Z
?TransportFile@XFileMgr@@QAEHABVXString@@0IIP6AHHHPB_WPAX@Z2@Z
?OpenCompressFile@XFileMgr@@QBEPAVXFile@@ABVXString@@W4XFILE_OPEN_TYPE@@PBDH@Z
?GetFileSize@XFileMgr@@QBEIABVXString@@@Z
?IsFileMatch@XFileMgr@@QAEHABVXString@@0IP6AHHHPB_WPAX@Z@Z
?XGetMemorySizeString@@YAXIPA_W@Z
?SetFileReadOnly@XFileMgr@@QBEHABVXString@@H@Z
?CreateDirectoryOverlapped@XFileMgr@@QAEHABVXString@@@Z
?ReleaseEngine@XMain@@QAEHXZ
??_VXClassBase@@SAXPAX@Z
??3XClassBase@@SAXPAX@Z
??1XInstance@@UAE@XZ
?XHeapFree@@YAXPAX@Z
??_7XClassBase@@6B@
??1XClassBase@@UAE@XZ
?DebugCheck@XInstance@@UAEHXZ
?CreateMutexGroup@XMain@@QAEIABUXMUTEX_GROUP_DESC@@@Z
?g_xmain@@3VXMain@@A
??0XXMLFile@@QAE@PBDH@Z
??1XXMLFile@@UAE@XZ
?Load@XXMLFile@@QAEHABVXString@@@Z
?BeginNodeRead@XXMLFile@@QAEHAAVXString@@@Z
?ReadAttr@XXMLFile@@QAEHAAVXString@@0@Z
?EndNodeRead@XXMLFile@@QAEHAAVXString@@@Z
?IsFileExist@XFileMgr@@QBEHABVXString@@@Z
?XHeapAlloc@@YAPAXI@Z
?OpenFile@XFileMgr@@QBEPAVXFile@@ABVXString@@W4XFILE_OPEN_TYPE@@PBDH@Z
?CloseFile@XFileMgr@@QBEHPAVXFile@@@Z
?BeginNodeWrite@XXMLFile@@QAEHABVXString@@@Z
?WriteAttr@XXMLFile@@QAEHABVXString@@0@Z
?EndNodeWrite@XXMLFile@@QAEHABVXString@@@Z
?OpenFTPFile@XFileMgr@@QBEPAVXFile@@ABVXString@@W4XFILE_OPEN_TYPE@@PBDH@Z
?Save@XXMLFile@@QAEHABVXString@@H@Z
?InitializeEngine@XMain@@QAEHPAUHWND__@@IPB_W@Z
?GetCurrentThreadType@XMain@@QBE?AW4XTHREAD_TYPE@@XZ
?XGetCurrentThreadType@@YA?AW4XTHREAD_TYPE@@XZ
?WriteFileDirect@XFileMgr@@QBEHABVXString@@PBXI@Z
?SetFileOpenPriority@XFileMgr@@QAEHW4XFILE_OPEN_PRIORITY@@@Z
kernel32
InterlockedExchange
CompareStringA
GetLocaleInfoW
lstrcmpA
EnumResourceLanguagesW
GetVersion
ConvertDefaultLocale
GetCurrentThread
WritePrivateProfileStringW
InterlockedDecrement
GetModuleHandleA
GetVersionExW
GlobalFlags
lstrlenA
GetThreadLocale
FileTimeToSystemTime
LocalAlloc
LeaveCriticalSection
TlsGetValue
EnterCriticalSection
GlobalReAlloc
GlobalHandle
InitializeCriticalSection
TlsAlloc
TlsSetValue
LocalReAlloc
DeleteCriticalSection
InterlockedIncrement
ReadFile
WriteFile
SetFilePointer
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
GetFileSize
DuplicateHandle
FindClose
FindFirstFileW
GetVolumeInformationW
GetFullPathNameW
CreateFileW
SetErrorMode
GetTickCount
FileTimeToLocalFileTime
GetFileTime
HeapFree
HeapAlloc
GetProcessHeap
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
HeapReAlloc
RaiseException
HeapSize
VirtualProtect
VirtualAlloc
GetSystemInfo
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
SetHandleCount
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
GetTimeZoneInformation
SetStdHandle
GetConsoleCP
GetConsoleMode
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
SetEnvironmentVariableA
GlobalAlloc
FormatMessageW
LocalFree
MulDiv
GetCurrentThreadId
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
LoadLibraryW
FreeLibrary
CompareStringW
LoadLibraryA
SetLastError
lstrcmpW
GetModuleHandleW
GetProcAddress
GetVersionExA
lstrlenW
MultiByteToWideChar
GlobalLock
GlobalUnlock
GlobalFree
FreeResource
OpenProcess
GetCurrentProcessId
QueryPerformanceCounter
GetLastError
MoveFileExW
GetFileAttributesW
CopyFileW
WideCharToMultiByte
Sleep
GetWindowsDirectoryW
GetModuleFileNameW
VirtualQuery
GetCommandLineW
CreateProcessW
CloseHandle
CreateThread
DeleteFileW
GetUserDefaultLangID
FindResourceW
LoadResource
LockResource
SizeofResource
GetCurrentProcess
TerminateProcess
ExitProcess
TlsFree
user32
RegisterWindowMessageW
GetMenuState
CheckMenuItem
EnableMenuItem
ModifyMenuW
LoadBitmapW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
MapDialogRect
SetWindowContextHelpId
ValidateRect
GetCursorPos
GetMessageW
SetCursor
GetWindowThreadProcessId
DestroyMenu
TabbedTextOutW
DrawTextW
DrawTextExW
GrayStringW
ClientToScreen
GetDC
ReleaseDC
GetWindowDC
BeginPaint
EndPaint
GetSysColorBrush
LoadCursorW
SetCapture
ReleaseCapture
CharNextW
CopyAcceleratorTableW
IsRectEmpty
SetRect
InvalidateRect
InvalidateRgn
GetNextDlgGroupItem
MessageBeep
CharUpperW
UnregisterClassW
RegisterClipboardFormatW
PostThreadMessageW
GetForegroundWindow
GetLastActivePopup
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
SendDlgItemMessageA
UnregisterClassA
SetForegroundWindow
UpdateWindow
GetMenu
PostMessageW
GetSubMenu
GetMenuItemID
GetMenuItemCount
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
GetSysColor
AdjustWindowRectEx
EqualRect
CopyRect
PtInRect
DefWindowProcW
CallWindowProcW
OffsetRect
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GetWindowRect
GetWindowTextLengthW
GetWindowTextW
GetFocus
SetWindowPos
SetFocus
ShowWindow
MoveWindow
SetWindowLongW
GetDlgCtrlID
SetWindowTextW
IsDialogMessageW
SendDlgItemMessageW
GetWindow
GetDesktopWindow
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamW
DestroyWindow
IsWindow
GetWindowLongW
GetDlgItem
IsWindowEnabled
GetParent
GetNextDlgTabItem
EndDialog
DispatchMessageW
TranslateMessage
PeekMessageW
MessageBoxW
IsWindowVisible
DrawIcon
GetClientRect
GetSystemMetrics
IsIconic
PostQuitMessage
AppendMenuW
GetSystemMenu
LoadIconW
EnableWindow
WinHelpW
IsChild
SendMessageW
GetCapture
SetWindowsHookExW
CallNextHookEx
GetClassLongW
GetClassNameW
SetPropW
GetPropW
MapWindowPoints
RemovePropW
GetKeyState
gdi32
SetTextColor
SetBkColor
GetObjectW
GetDeviceCaps
CreateBitmap
ExtTextOutW
SaveDC
RestoreDC
GetClipBox
SetMapMode
DeleteObject
GetViewportExtEx
GetWindowExtEx
TextOutW
Escape
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
PtVisible
ExtSelectClipRgn
DeleteDC
GetStockObject
CreateRectRgnIndirect
GetBkColor
GetTextColor
GetRgnBox
GetMapMode
RectVisible
comdlg32
GetFileTitleW
winspool.drv
OpenPrinterW
DocumentPropertiesW
ClosePrinter
advapi32
RegDeleteKeyW
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
RegOpenKeyW
RegCloseKey
RegEnumKeyW
RegQueryValueW
comctl32
InitCommonControlsEx
shlwapi
PathFindFileNameW
PathStripToRootW
PathFindExtensionW
PathIsUNCW
oledlg
OleUIBusyW
ole32
OleFlushClipboard
OleIsCurrentClipboard
CoRevokeClassObject
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CLSIDFromString
CLSIDFromProgID
CoTaskMemAlloc
CoTaskMemFree
CoRegisterMessageFilter
oleaut32
OleCreateFontIndirect
SysAllocString
SystemTimeToVariantTime
SysStringLen
SysFreeString
SysAllocStringLen
VariantClear
VariantChangeType
VariantInit
VariantCopy
SafeArrayDestroy
VariantTimeToSystemTime
psapi
EnumProcessModules
EnumProcesses
GetModuleFileNameExW
dbghelp
SymCleanup
SymGetModuleBase64
SymEnumerateModules64
SymInitialize
Sections
.text Size: 272KB - Virtual size: 269KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 84KB - Virtual size: 83KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 140KB - Virtual size: 136KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ