2024-02-28_c5352cba2dafd7d21fb35f996c52abe0_icedid

Sharing

Copy URL Twitter E-mail

General

Target

2024-02-28_c5352cba2dafd7d21fb35f996c52abe0_icedid
Size

616KB
MD5

c5352cba2dafd7d21fb35f996c52abe0
SHA1

9001f16b0ec7037cd47b033a432143c349906ae0
SHA256

bd450ed1bdeaf84c717450d704dfafe37ffb7b371e17430d62348b137a152596
SHA512

221aed8c81b8f0d10fbbc493a06c19ec18070368351ed0c6eb9c800c9e87fa994b1ee470da6762b5e9e69bee3cceabecf4fca43f3c3b8456157cf759916cc99e
SSDEEP

12288:t/umALBdvGp7Po1tsnZ+EuyEulXIN00KRdRwG:dMRoo16HuzN00Ke

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-02-28_c5352cba2dafd7d21fb35f996c52abe0_icedid

Files

2024-02-28_c5352cba2dafd7d21fb35f996c52abe0_icedid
.exe windows:5 windows x86 arch:x86

1e1053c0b351bd7c806a66fa558a3efc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Projects\prj\TerminalServer\DebugSymbols\ViLicensesSrv.pdb

Imports

seclib

?Error@CLogger@@QAAXPBDZZ
??0ScopedCryptProv@@QAE@PBD@Z
?GetPwdAddr@@YAPAEXZ
?getProvider@ScopedCryptProv@@QAEKXZ
?RestoreSessionKey@@YAKKPAEH@Z
?GetLicense@@YAPAEPAD0AAK@Z
??0CMyCritSecEx@@QAE@PAVCMyCritSec@@@Z
??1CMyCritSecEx@@QAE@XZ
?EncodeLicense@@YAPAEPADPAEAAK@Z
?FreeSecMemory@@YAXPAX@Z
?GetComputerSID@CUtils@@SAHPA_WAAI@Z
?tostr@CUtils@@SAPADPA_W@Z
?FreeMemory@CUtils@@SAXPAX@Z
?EnableRPC@CUtils@@SA_NXZ
?EnableRpcPort@CUtils@@SA_NHPBDW4eProtocol@@@Z
?Destroy@CMyEvent@@SAXAAPAV1@@Z
?Destroy@CMyCritSec@@SAXAAPAV1@@Z
?Create@CMyCritSec@@SAPAV1@XZ
?Create@CMyEvent@@SAPAV1@_N@Z
?SetEvent@CMyEvent@@QAEXXZ
?Enter@CMyCritSec@@QAEXXZ
?Leave@CMyCritSec@@QAEXXZ
?Logger@CLogger@@SAPAV1@XZ
?Debug@CLogger@@QAAXPBDZZ
?Warning@CLogger@@QAAXPBDZZ
?GetSignature@@YAKXZ
?EncodeByPwd@@YA_NPAEAAK@Z
?SplitDir@CUtils@@SA_NPBDPADH@Z
?ResetEvent@CMyEvent@@QAEXXZ
?Wait@CMyEvent@@QAEKK@Z
??1ScopedCryptProv@@QAE@XZ
?DecodeByPwd@@YA_NPAEAAK@Z
?SecObject@@YAPAVCSecContainer@@XZ
?get_Path@CSecContainer@@QAEPADXZ
?CheckSelfSign@@YA_NPAD0@Z

rpcrt4

NdrClientCall2
RpcServerListen
RpcEpRegisterA
RpcServerInqBindings
RpcServerRegisterIf
RpcServerUseProtseqEpA
RpcBindingVectorFree
RpcEpUnregister
RpcMgmtStopServerListening
RpcStringFreeA
RpcStringBindingParseA
RpcBindingFree
RpcBindingToStringBindingA
RpcBindingServerFromClient
UuidFromStringA
RpcBindingFromStringBindingA
RpcStringBindingComposeA
UuidToStringA
UuidCreate
NdrServerCall2

ntdll

strcmp
NtQueryVirtualMemory
RtlUnwind
memchr
_stricmp
sprintf
memmove
wcslen
_strnicmp
memset
memcmp
strcat
strcpy
strlen
memcpy
_fltused
atol
ceil
strncpy

netapi32

NetUserGetInfo
NetApiBufferFree

kernel32

InterlockedExchange
CompareStringA
LoadLibraryExA
GetLocaleInfoA
EnumResourceLanguagesA
ConvertDefaultLocale
GetCurrentThread
GlobalDeleteAtom
GetStringTypeExA
GetThreadLocale
lstrcmpiA
SetFilePointer
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
DuplicateHandle
GetVolumeInformationA
GetFullPathNameA
GetShortPathNameA
GlobalGetAtomNameA
GetAtomNameA
FileTimeToSystemTime
SystemTimeToFileTime
GetModuleFileNameW
GetVersionExA
lstrcmpW
GlobalFindAtomA
GlobalAddAtomA
FreeResource
SetThreadPriority
ResumeThread
SetEvent
SuspendThread
CreateEventA
LocalAlloc
LeaveCriticalSection
TlsGetValue
EnterCriticalSection
GlobalReAlloc
GlobalHandle
InitializeCriticalSection
TlsAlloc
TlsSetValue
LocalReAlloc
lstrcmpA
TlsFree
GetModuleHandleW
InterlockedIncrement
GetPrivateProfileIntA
WritePrivateProfileStringA
GetPrivateProfileStringA
GlobalFlags
FileTimeToLocalFileTime
GetFileAttributesExA
LocalFileTimeToFileTime
SetFileTime
SetFileAttributesA
GetFileAttributesA
GetFileSizeEx
GetFileTime
GetCPInfo
GetOEMCP
LoadLibraryW
GetSystemDirectoryW
HeapAlloc
RaiseException
GetSystemTimeAsFileTime
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
PeekConsoleInputA
GetNumberOfConsoleInputEvents
HeapFree
GetTimeFormatA
GetDateFormatA
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
HeapReAlloc
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
ExitProcess
ExitThread
HeapSize
FatalAppExitA
VirtualFree
HeapCreate
HeapDestroy
GetStdHandle
GetACP
IsValidCodePage
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetTimeZoneInformation
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
SetConsoleCtrlHandler
InitializeCriticalSectionAndSpinCount
CompareStringW
SetEnvironmentVariableA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetConsoleCP
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetLocaleInfoW
SetStdHandle
GlobalFree
CopyFileA
GlobalSize
GlobalAlloc
GlobalLock
GlobalUnlock
LocalFree
lstrlenW
MulDiv
SetErrorMode
lstrlenA
MultiByteToWideChar
FormatMessageA
ReadDirectoryChangesW
WaitForMultipleObjectsEx
GetCurrentDirectoryA
GetFileSize
ReadFile
InterlockedDecrement
FindFirstFileA
MoveFileA
DeleteFileA
FindNextFileA
FreeLibrary
FindClose
WriteFile
Sleep
SetLastError
CreateThread
WaitForSingleObject
TerminateThread
LoadResource
LockResource
SizeofResource
FindResourceA
WideCharToMultiByte
GetCommandLineA
GetModuleHandleA
SetUnhandledExceptionFilter
LoadLibraryA
GetProcAddress
GetLocalTime
GetModuleFileNameA
CreateDirectoryA
GetLastError
CreateFileA
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
CloseHandle
DeleteCriticalSection

user32

InflateRect
GetMenuItemInfoA
DestroyMenu
DestroyIcon
SetRectEmpty
InvalidateRect
EndDialog
GetNextDlgTabItem
CreateDialogIndirectParamA
TranslateAcceleratorA
BringWindowToTop
CreatePopupMenu
InsertMenuItemA
LoadAcceleratorsA
ReleaseCapture
GetMenuBarInfo
LoadMenuA
ReuseDDElParam
UnpackDDElParam
SetRect
SetTimer
KillTimer
WindowFromPoint
GetDialogBaseUnits
GetKeyNameTextA
MapVirtualKeyA
IsRectEmpty
GetSystemMenu
SetParent
UnionRect
GetDCEx
LockWindowUpdate
SetCapture
LoadIconA
SendDlgItemMessageA
WinHelpA
IsChild
GetCapture
SetWindowsHookExA
CallNextHookEx
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
GetFocus
IsWindow
SetFocus
GetForegroundWindow
GetLastActivePopup
SetActiveWindow
DispatchMessageA
BeginDeferWindowPos
EndDeferWindowPos
GetDlgItem
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
PeekMessageA
MapWindowPoints
ScrollWindow
TrackPopupMenuEx
TrackPopupMenu
GetKeyState
UnregisterClassA
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
EnableWindow
SetForegroundWindow
ShowScrollBar
IsWindowVisible
UpdateWindow
GetClientRect
MessageBoxA
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
GetParent
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
CopyRect
SetWindowPlacement
PtInRect
GetDlgCtrlID
SendMessageA
DefWindowProcA
CallWindowProcA
GetMenu
GetWindowLongA
SetWindowLongA
SetWindowPos
OffsetRect
IntersectRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
GetWindow
GetSysColor
EndPaint
BeginPaint
GetWindowDC
GetDC
ClientToScreen
ScreenToClient
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
FillRect
UnhookWindowsHookEx
GetWindowTextLengthA
GetWindowTextA
CharUpperA
GetSystemMetrics
PostMessageA
PostQuitMessage
ScrollWindowEx
ShowWindow
GetMenuState
GetMenuStringA
AppendMenuA
GetMenuItemID
InsertMenuA
GetMenuItemCount
GetSubMenu
RemoveMenu
MoveWindow
IsDialogMessageA
IsDlgButtonChecked
SetDlgItemTextA
SetDlgItemInt
GetDlgItemTextA
GetDlgItemInt
CheckRadioButton
GetDesktopWindow
CheckDlgButton
SetWindowTextA
DeleteMenu
ShowOwnedPopups
SetCursor
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
ModifyMenuA
EnableMenuItem
CheckMenuItem
LoadCursorA
GetSysColorBrush
GetWindowThreadProcessId
IsWindowEnabled
GetMessageA
TranslateMessage
GetActiveWindow
GetCursorPos
ValidateRect
SetMenu
RegisterWindowMessageA
ReleaseDC

gdi32

GetViewportExtEx
GetObjectA
SelectClipPath
CreateRectRgn
GetClipRgn
SelectClipRgn
DeleteObject
SetColorAdjustment
SetArcDirection
SetMapperFlags
SetTextCharacterExtra
SetTextJustification
SetTextAlign
MoveToEx
LineTo
GetPixel
StartDocA
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
SelectObject
OffsetClipRgn
OffsetViewportOrgEx
IntersectClipRect
ExcludeClipRect
GetClipBox
SetMapMode
ModifyWorldTransform
SetWorldTransform
SetGraphicsMode
SetTextColor
SetStretchBltMode
SetROP2
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
GetWindowExtEx
SetWindowExtEx
ScaleWindowExtEx
GetCurrentPositionEx
ArcTo
PolyDraw
PolylineTo
PolyBezierTo
ExtSelectClipRgn
DeleteDC
CreateDIBPatternBrushPt
CreatePatternBrush
CreateBitmap
CreateCompatibleDC
GetStockObject
SelectPalette
PlayMetaFileRecord
GetObjectType
EnumMetaFile
PlayMetaFile
CreatePen
ExtCreatePen
CreateSolidBrush
CreateHatchBrush
GetDCOrgEx
CreateFontIndirectA
CreateRectRgnIndirect
SetRectRgn
CombineRgn
GetMapMode
PatBlt
DPtoLP
GetTextExtentPoint32A
GetCharWidthA
CreateFontA
StretchDIBits
CreateCompatibleBitmap
GetBkColor
GetTextMetricsA
OffsetWindowOrgEx
BitBlt
SetPolyFillMode
SetBkMode
SetBkColor
RestoreDC
SaveDC
CreateDCA
CopyMetaFileA
SetViewportOrgEx
GetDeviceCaps

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

RegEnumKeyA
CryptDestroyHash
CryptDecrypt
CryptEncrypt
CryptDestroyKey
GetUserNameW
RegDeleteValueA
CryptHashData
CryptCreateHash
RegSetValueExA
RegCloseKey
RegCreateKeyExA
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyExA
RegDeleteKeyA
AdjustTokenPrivileges
CryptGetHashParam
LookupPrivilegeValueA
OpenProcessToken
DeregisterEventSource
CloseServiceHandle
OpenServiceA
OpenSCManagerA
RegCreateKeyA
ChangeServiceConfig2A
CreateServiceA
DeleteService
ReportEventA
RegisterEventSourceA
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
SetServiceStatus
StartServiceA
ControlService
RegQueryValueA
RegOpenKeyA
RegSetValueA
QueryServiceStatus

shell32

ExtractIconA
DragFinish
DragQueryFileA
SHGetFileInfoA

shlwapi

PathStripToRootA
PathIsUNCA
PathRemoveExtensionA
PathFindFileNameA
PathFindExtensionA
PathRemoveFileSpecW

ole32

CoDisconnectObject
CLSIDFromString
StringFromGUID2
OleDuplicateData
CoTaskMemAlloc
ReleaseStgMedium
CreateBindCtx
CoTreatAsClass
StringFromCLSID
ReadClassStg
ReadFmtUserTypeStg
CoSetProxyBlanket
CoCreateInstance
CoInitializeEx
CoTaskMemFree
SetConvertStg
OleRegGetUserType
WriteFmtUserTypeStg
WriteClassStg
CoUninitialize

oleaut32

VariantTimeToSystemTime
SystemTimeToVariantTime
VariantClear
VariantInit
SysAllocString
SysFreeString
VarUdateFromDate
SysStringLen
SysAllocStringByteLen
SysStringByteLen
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetElemsize
SafeArrayGetDim
SafeArrayCreate
SafeArrayRedim
VariantChangeType
VariantCopy
SafeArrayAllocData
SafeArrayAllocDescriptor
SafeArrayCopy
SafeArrayGetElement
SafeArrayPtrOfIndex
SafeArrayPutElement
SafeArrayLock
SafeArrayUnlock
SafeArrayDestroy
SafeArrayDestroyData
SafeArrayDestroyDescriptor
SysAllocStringLen
SysReAllocStringLen
VarDateFromStr
VarBstrFromCy
VarBstrFromDec
VarDecFromStr
VarCyFromStr
VarBstrFromDate
RegisterTypeLi
LoadTypeLi
LoadRegTypeLi
GetErrorInfo
SetErrorInfo
CreateErrorInfo

wininet

InternetReadFile
HttpSendRequestA
InternetSetOptionA
InternetOpenA
InternetConnectA
HttpOpenRequestA
InternetQueryOptionA
InternetCloseHandle

Exports

Exports

?ValidateLicense@ViLicense@License@@SA_NAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@000@Z

Sections

.text
Size: 488KB - Virtual size: 487KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 112KB - Virtual size: 111KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1e1053c0b351bd7c806a66fa558a3efc

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

seclib

rpcrt4

ntdll

netapi32

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

shlwapi

ole32

oleaut32

wininet

Exports

Exports

Sections

.text Size: 488KB - Virtual size: 487KB

.rdata Size: 112KB - Virtual size: 111KB

.data Size: 12KB - Virtual size: 27KB

.rsrc Size: 3KB - Virtual size: 2KB

.text
Size: 488KB - Virtual size: 487KB

.rdata
Size: 112KB - Virtual size: 111KB

.data
Size: 12KB - Virtual size: 27KB

.rsrc
Size: 3KB - Virtual size: 2KB