2024-03-08_4f9d11f0d1a5bcc8daa2b225515179ec_icedid

Sharing

Copy URL Twitter E-mail

General

Target

2024-03-08_4f9d11f0d1a5bcc8daa2b225515179ec_icedid
Size

250KB
MD5

4f9d11f0d1a5bcc8daa2b225515179ec
SHA1

d2102b471e69afc25d8eda4f1ea746f00b5bfbb8
SHA256

90c8be37c4f65420e169aba316acf083db74d7723d1202cae685dd84a4b9b306
SHA512

97bb0f6e2bfd744e6c5081fc315a3180a45f822b95c7cfb21ba01150bbc252939c5d07e38506901d5575b1a93ffc3544ed3ba026d71ab68382c64bdc4e841b10
SSDEEP

3072:+RVN5+VG/hJOXbNWsB3kuULkR9OKFHrvTcipOO+tPeJxaEPgCTpM:yE6yrNWshkuHrFHrg/ONJ8EP8

Score

1^/10

Malware Config

Signatures

Files

2024-03-08_4f9d11f0d1a5bcc8daa2b225515179ec_icedid
.exe windows:4 windows x86 arch:x86

abc99e8c5fb333f179f7f40ffe0a4642

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4d:62:90:e5:8c:54:f0:f1:eb:17:34:1a:13:10:e6:a4
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

30/09/2010, 00:00

Not After

01/01/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

10:02:1a:27:d2:83:12:88:5c:61:3a:a4:98:58:0f:6f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08/03/2011, 00:00

Not After

22/04/2014, 23:59

Subject

CN=Intel Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=ISWQL,O=Intel Corporation,L=Folsom,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

13:b4:35:8b:bc:d6:ea:d4:0c:08:e0:2f:03:13:9b:98:78:a5:89:86
Signer

Actual PE Digest

13:b4:35:8b:bc:d6:ea:d4:0c:08:e0:2f:03:13:9b:98:78:a5:89:86

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\ccviews\flashusb\dwdtoolsrc\FlashUSB\uninstall\msvc2005\uninstall\Release\uninstall.pdb

Imports

setupapi

SetupDiGetDeviceInstallParamsA
SetupDiDestroyDeviceInfoList
SetupDiCallClassInstaller
SetupDiGetDeviceRegistryPropertyA
SetupDiEnumDeviceInfo
SetupDiGetClassDevsA

kernel32

GetCPInfo
GetOEMCP
SetErrorMode
HeapFree
HeapAlloc
VirtualAlloc
HeapReAlloc
GetCommandLineA
GetProcessHeap
GetStartupInfoA
RaiseException
RtlUnwind
ExitProcess
HeapSize
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
VirtualFree
GetStdHandle
Sleep
GetACP
SetHandleCount
GetFileType
GetConsoleCP
GetConsoleMode
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
GetThreadLocale
SetEndOfFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
GlobalFlags
InterlockedIncrement
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
GlobalGetAtomNameA
GlobalFindAtomA
lstrcmpW
InterlockedDecrement
GetModuleFileNameW
GetCurrentProcessId
GlobalAddAtomA
FreeResource
WritePrivateProfileStringA
GetCurrentThread
GetCurrentThreadId
ConvertDefaultLocale
GetModuleFileNameA
EnumResourceLanguagesA
GetLocaleInfoA
lstrcmpA
GlobalDeleteAtom
GetModuleHandleA
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
MulDiv
SetLastError
FindClose
FindNextFileA
FindFirstFileA
CloseHandle
GetCurrentProcess
GetVersionExA
FreeLibrary
GetProcAddress
LoadLibraryA
DeleteFileA
SetFileAttributesA
GetFileAttributesA
LocalAlloc
GetWindowsDirectoryA
FindResourceA
LoadResource
LockResource
SizeofResource
LocalFree
FormatMessageA
GetVersion
CompareStringA
GetLastError
InterlockedExchange
MultiByteToWideChar
WideCharToMultiByte
lstrlenA
HeapDestroy

user32

LoadCursorA
GetSysColorBrush
EndPaint
BeginPaint
ReleaseDC
GetDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
RegisterWindowMessageA
WinHelpA
GetCapture
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
GetForegroundWindow
GetTopWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetForegroundWindow
UpdateWindow
GetMenu
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
PtInRect
CallWindowProcA
GetWindowPlacement
GetWindowRect
GetWindowTextA
SetWindowPos
SetFocus
ShowWindow
SetWindowLongA
GetDlgCtrlID
SetWindowTextA
IsDialogMessageA
SendDlgItemMessageA
GetWindow
GetSysColor
SystemParametersInfoA
DestroyMenu
CopyRect
UnhookWindowsHookEx
GetWindowThreadProcessId
GetLastActivePopup
MessageBoxA
LoadIconA
SetCursor
SetWindowsHookExA
CallNextHookEx
GetMessageA
TranslateMessage
DispatchMessageA
IsWindowVisible
GetKeyState
PeekMessageA
GetCursorPos
ValidateRect
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
GetFocus
ModifyMenuA
EnableMenuItem
UnregisterClassA
GetSystemMenu
AppendMenuA
IsIconic
GetSystemMetrics
GetClientRect
DrawIcon
ExitWindowsEx
SendMessageA
EnableWindow
GetSubMenu
GetMenuItemCount
GetMenuItemID
GetMenuState
PostMessageA
PostQuitMessage
CheckMenuItem
GetDesktopWindow
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
IsWindow
GetWindowLongA
GetDlgItem
IsWindowEnabled
GetParent
GetNextDlgTabItem
EndDialog
DefWindowProcA

gdi32

SetWindowExtEx
ScaleWindowExtEx
DeleteDC
GetStockObject
PtVisible
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
TextOutA
GetObjectA
CreateBitmap
GetDeviceCaps
DeleteObject
SetMapMode
RestoreDC
SaveDC
SetBkColor
SetTextColor
GetClipBox
ExtTextOutA
RectVisible

winspool.drv

ClosePrinter
DocumentPropertiesA
OpenPrinterA

advapi32

RegQueryValueA
RegOpenKeyA
RegDeleteValueA
RegSetValueExA
RegCreateKeyExA
InitiateSystemShutdownExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegDeleteKeyA
RegCloseKey
RegQueryValueExA
RegEnumKeyA
RegOpenKeyExA

shlwapi

PathFindFileNameA
PathFindExtensionA

oleaut32

VariantClear
VariantChangeType
VariantInit

Sections

.text
Size: 152KB - Virtual size: 150KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

abc99e8c5fb333f179f7f40ffe0a4642

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

4d:62:90:e5:8c:54:f0:f1:eb:17:34:1a:13:10:e6:a4Certificate

Extended Key Usages

Key Usages

61:0c:12:06:00:00:00:00:00:1bCertificate

Key Usages

10:02:1a:27:d2:83:12:88:5c:61:3a:a4:98:58:0f:6fCertificate

Extended Key Usages

Key Usages

13:b4:35:8b:bc:d6:ea:d4:0c:08:e0:2f:03:13:9b:98:78:a5:89:86Signer

Headers

File Characteristics

PDB Paths

Imports

setupapi

kernel32

user32

gdi32

winspool.drv

advapi32

shlwapi

oleaut32

Sections

.text Size: 152KB - Virtual size: 150KB

.rdata Size: 40KB - Virtual size: 36KB

.data Size: 8KB - Virtual size: 22KB

.rsrc Size: 40KB - Virtual size: 39KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

4d:62:90:e5:8c:54:f0:f1:eb:17:34:1a:13:10:e6:a4
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

10:02:1a:27:d2:83:12:88:5c:61:3a:a4:98:58:0f:6f
Certificate

13:b4:35:8b:bc:d6:ea:d4:0c:08:e0:2f:03:13:9b:98:78:a5:89:86
Signer

.text
Size: 152KB - Virtual size: 150KB

.rdata
Size: 40KB - Virtual size: 36KB

.data
Size: 8KB - Virtual size: 22KB

.rsrc
Size: 40KB - Virtual size: 39KB