2024-02-23_bb8ccec55398c8fe8d8f762db6522aad_icedid

Sharing

Copy URL Twitter E-mail

General

Target

2024-02-23_bb8ccec55398c8fe8d8f762db6522aad_icedid
Size

839KB
MD5

bb8ccec55398c8fe8d8f762db6522aad
SHA1

86a6834f2912eb8d7dbbc12abfb70ccef7f061db
SHA256

af1cc76ccd6f59f59ef534dacf339f1df3905d69476ad624f2aef37aa82ecc20
SHA512

b4af2e945fd6bc5dd9b4b8de581743ebb8d024f05480b6a772edb8b4fdab02b794fa3798d4224ee2d55c1e20c1fdf0e7950aff8574b6c89916fda59d4f40f750
SSDEEP

12288:YZCy9VGlboBOaP4aBmWdATCjt4f8fOcjq7FGVsqVk9hIGtTr7sf0VK0:YZ6sPd1XfOYqZGVuHTr7vK0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-02-23_bb8ccec55398c8fe8d8f762db6522aad_icedid

Files

2024-02-23_bb8ccec55398c8fe8d8f762db6522aad_icedid
.exe windows:5 windows x86 arch:x86

68c69998e724941bea0699175ca391a1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DebugBreak
FileTimeToDosDateTime
GetFileInformationByHandle
MapViewOfFile
ResetEvent
InterlockedCompareExchange
GlobalLock
GlobalUnlock
GlobalReAlloc
GlobalAlloc
GetSystemTime
SystemTimeToFileTime
FindNextFileW
GetPrivateProfileSectionW
FindResourceExW
GetStartupInfoW
MulDiv
SetProcessWorkingSetSize
CreateDirectoryW
GetFileSizeEx
WideCharToMultiByte
RaiseException
GetTempPathW
GetTempFileNameW
GetFileAttributesExW
UnmapViewOfFile
GetFileSize
CreateFileMappingW
MapViewOfFileEx
SetEndOfFile
ReadFile
UnlockFile
LockFile
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
lstrlenA
OutputDebugStringW
SetUnhandledExceptionFilter
TerminateProcess
GetCurrentThreadId
WritePrivateProfileStringW
CopyFileW
SetFilePointer
WriteFile
VirtualProtect
CreateToolhelp32Snapshot
Thread32First
OpenThread
GetThreadTimes
Thread32Next
CreateEventW
CreateThread
OpenProcess
GetTickCount
SetEvent
GetProcessTimes
InterlockedDecrement
GlobalFree
InterlockedIncrement
GetSystemDirectoryW
GetFileAttributesW
LocalAlloc
MultiByteToWideChar
GetSystemInfo
GetModuleHandleA
SearchPathW
GetLongPathNameW
lstrlenW
CreateProcessW
LocalFree
GetPrivateProfileStringW
GetPrivateProfileIntW
GetCurrentProcess
FindFirstFileW
FindClose
GetVersionExW
SetLastError
IsBadReadPtr
DeleteFileW
RemoveDirectoryW
GetCommandLineW
CreateMutexW
GetLastError
SetProcessShutdownParameters
LoadLibraryW
FreeLibrary
GetCurrentProcessId
CreateFileW
DeviceIoControl
FindResourceW
LoadResource
LockResource
SizeofResource
OpenEventW
WaitForSingleObject
Sleep
WaitForMultipleObjects
MoveFileExW
UnlockFileEx
LockFileEx
SetFilePointerEx
GetEnvironmentVariableW
SetEnvironmentVariableW
ReleaseMutex
GetLocalTime
SetEnvironmentVariableA
GetProcessHeap
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoA
GetModuleFileNameW
CloseHandle
GetStringTypeW
GetModuleHandleW
GetProcAddress
GetStringTypeA
LCMapStringA
InitializeCriticalSectionAndSpinCount
LCMapStringW
GetTimeZoneInformation
GetDateFormatA
GetTimeFormatA
GetConsoleMode
GetConsoleCP
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
QueryPerformanceCounter
VirtualFree
HeapCreate
GetStartupInfoA
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
GetStdHandle
VirtualQuery
VirtualAlloc
HeapSize
FormatMessageW
GetVersionExA
lstrcmpW
LoadLibraryA
CompareStringW
GlobalDeleteAtom
GlobalFindAtomW
GlobalAddAtomW
FreeResource
InterlockedExchange
CompareStringA
GetLocaleInfoW
lstrcmpA
EnumResourceLanguagesW
ConvertDefaultLocale
GetCurrentThread
TlsGetValue
GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
GlobalFlags
GetThreadLocale
FileTimeToSystemTime
FlushFileBuffers
DuplicateHandle
GetVolumeInformationW
GetFullPathNameW
SetErrorMode
FileTimeToLocalFileTime
LocalFileTimeToFileTime
GetFileTime
RtlUnwind
ExitThread
UnhandledExceptionFilter
IsDebuggerPresent
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
HeapReAlloc
ExitProcess

user32

GetFocus
RemovePropW
GetPropW
SetPropW
GetClassNameW
GetClassLongW
CallNextHookEx
SetWindowsHookExW
GetCapture
IsChild
WinHelpW
SendDlgItemMessageA
SendDlgItemMessageW
CheckMenuItem
EnableMenuItem
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
IsDialogMessageW
MoveWindow
IsWindowEnabled
PostQuitMessage
ValidateRect
GetActiveWindow
TranslateMessage
GetMessageW
RegisterClipboardFormatW
MapDialogRect
SetWindowContextHelpId
EndDialog
GetNextDlgTabItem
CreateDialogIndirectParamW
DestroyMenu
GetSysColorBrush
UnregisterClassW
CharUpperW
MessageBeep
PostThreadMessageW
CharNextW
IsRectEmpty
CopyAcceleratorTableW
InvalidateRgn
SetCapture
ReleaseCapture
GetNextDlgGroupItem
SetFocus
GetWindowTextLengthW
GetWindowTextW
GetLastActivePopup
SetActiveWindow
DispatchMessageW
GetDlgItem
GetTopWindow
DestroyWindow
GetMessageTime
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
GetMessagePos
LoadBitmapW
CopyRect
GetDlgCtrlID
CallWindowProcW
GetMenu
SetWindowPos
IntersectRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
EndPaint
BeginPaint
GetIconInfo
GetSysColor
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
SetRect
RedrawWindow
UpdateWindow
GetForegroundWindow
GetWindow
GetWindowInfo
GetShellWindow
WindowFromPoint
GetAncestor
GetWindowThreadProcessId
GetMenuItemID
GetDC
DrawIconEx
InflateRect
GetCursorPos
RegisterWindowMessageW
LoadMenuW
ModifyMenuW
GetSubMenu
SetMenuDefaultItem
DeleteMenu
DestroyIcon
SetClassLongW
GetParent
GetDesktopWindow
IsWindow
SystemParametersInfoW
GetWindowLongW
SetWindowLongW
SetLayeredWindowAttributes
SetWindowRgn
EqualRect
SetCursor
SendMessageW
wvsprintfW
GetWindowRect
GetClientRect
InvalidateRect
PtInRect
FrameRect
KillTimer
SetTimer
ReleaseDC
GetWindowDC
DrawIcon
MessageBoxW
OffsetRect
SetWindowTextW
ClientToScreen
ScreenToClient
UnhookWindowsHookEx
EnableWindow
LoadIconW
LoadCursorW
DefWindowProcW
AppendMenuW
FillRect
SendMessageTimeoutW
FindWindowW
GetSystemMetrics
ShowWindow
SetForegroundWindow
WaitForInputIdle
PostMessageW
PeekMessageW
MapWindowPoints
TrackPopupMenu
GetKeyState
SetMenu
IsWindowVisible
CreateWindowExW
GetClassInfoExW
GetMenuItemCount
GetMenuStringW
GetMenuState

gdi32

MoveToEx
LineTo
GetClipBox
SetMapMode
Escape
ExtTextOutW
SetTextColor
RectVisible
PtVisible
DeleteDC
EnumFontFamiliesW
GetDeviceCaps
GetStockObject
CreateRoundRectRgn
CreateFontIndirectW
Rectangle
CreateSolidBrush
CreatePen
StretchBlt
BitBlt
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
CreateFontW
GetObjectW
DeleteObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
GetViewportExtEx
GetTextExtentExPointW
GetWindowExtEx
SetBkMode
SetBkColor
RestoreDC
SaveDC
CreateBitmap
TextOutW
GetRgnBox
GetTextColor
GetBkColor
GetMapMode
CreateRectRgnIndirect

advapi32

RegEnumKeyExW
RegDeleteKeyW
RegQueryValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExA
FreeSid
SetEntriesInAclW
AllocateAndInitializeSid
ChangeServiceConfigW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
ControlService
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegEnumKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegOpenKeyW
GetTokenInformation
CloseServiceHandle
OpenServiceW
OpenSCManagerW
RegDeleteValueW

shell32

ShellExecuteW
CommandLineToArgvW
ShellExecuteExW
SHCreateDirectoryExW
Shell_NotifyIconW
ord680
SHGetSpecialFolderPathW
SHGetPathFromIDListW
SHGetSpecialFolderLocation

ole32

OleFlushClipboard
OleIsCurrentClipboard
CoTaskMemAlloc
CoRevokeClassObject
CoGetClassObject
CoTaskMemFree
CLSIDFromString
CLSIDFromProgID
OleInitialize
CoFreeUnusedLibraries
CoCreateInstance
CoInitialize
CoRegisterMessageFilter
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
OleUninitialize
CoUninitialize

oleaut32

SysAllocString
SysFreeString
SysAllocStringLen
VariantClear
VariantChangeType
VariantInit
OleCreateFontIndirect
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroy
SysStringLen
VariantCopy

comctl32

_TrackMouseEvent

shlwapi

PathRemoveFileSpecW
StrChrW
PathFindExtensionW
PathIsRelativeW
StrCmpIW
PathAddBackslashW
PathFindFileNameW
StrRStrIW
PathStripToRootW
PathIsUNCW
StrRChrW
SHDeleteValueW
SHSetValueW
PathFileExistsW
PathAppendW
SHGetValueW
StrStrW
StrStrIW
PathCombineW
PathIsDirectoryW
StrCmpW
PathIsPrefixW

oledlg

OleUIBusyW

urlmon

URLDownloadToCacheFileW
URLDownloadToFileW

imm32

ImmDisableIME

setupapi

SetupIterateCabinetW

iphlpapi

GetAdaptersInfo

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

wininet

HttpAddRequestHeadersA
InternetQueryOptionW
InternetSetOptionA
InternetWriteFile
InternetOpenW
InternetConnectW
HttpOpenRequestW
InternetCloseHandle
InternetReadFile
InternetSetStatusCallbackA
InternetErrorDlg
HttpQueryInfoW
InternetSetOptionW
InternetCrackUrlW
InternetGetConnectedState
InternetConnectA
InternetOpenA
HttpOpenRequestA
HttpQueryInfoA
InternetReadFileExA
HttpSendRequestExA
HttpEndRequestA
HttpSendRequestW
DeleteUrlCacheEntryW

rpcrt4

RpcStringFreeW
RpcStringBindingComposeW
NdrClientCall2
RpcBindingFree
RpcBindingFromStringBindingW

psapi

GetModuleFileNameExW

oleacc

CreateStdAccessibleObject
LresultFromObject

winspool.drv

ClosePrinter
OpenPrinterW
DocumentPropertiesW

comdlg32

GetFileTitleW

netapi32

Netbios

ws2_32

inet_ntoa
WSAStartup
WSACleanup
getpeername
ntohl

crypt32

CryptMsgClose
CryptMsgUpdate
CryptMsgOpenToDecode
CertOpenStore
CertGetCertificateContextProperty
CertGetNameStringW
CertCloseStore

wintrust

WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain

winmm

timeGetTime

Sections

.text
Size: 507KB - Virtual size: 506KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 150KB - Virtual size: 149KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 159KB - Virtual size: 159KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

68c69998e724941bea0699175ca391a1

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

shlwapi

oledlg

urlmon

imm32

setupapi

iphlpapi

version

wininet

rpcrt4

psapi

oleacc

winspool.drv

comdlg32

netapi32

ws2_32

crypt32

wintrust

winmm

Sections

.text Size: 507KB - Virtual size: 506KB

.rdata Size: 150KB - Virtual size: 149KB

.data Size: 16KB - Virtual size: 44KB

.rsrc Size: 159KB - Virtual size: 159KB

.text
Size: 507KB - Virtual size: 506KB

.rdata
Size: 150KB - Virtual size: 149KB

.data
Size: 16KB - Virtual size: 44KB

.rsrc
Size: 159KB - Virtual size: 159KB