2024-03-09_49f7719fa35949531dc74be75e14809e_icedid

Sharing

Copy URL Twitter E-mail

General

Target

2024-03-09_49f7719fa35949531dc74be75e14809e_icedid
Size

328KB
MD5

49f7719fa35949531dc74be75e14809e
SHA1

a30d28e0efe9a215eb4db37f14bb37ace4a2b32f
SHA256

32b98a528a498b4fce3f1e9c9f590828269971b12ef45e55696a624fa0badfe3
SHA512

dc1df5a574c79abc5bc68978b09c5818fe37f45b1a8b714496676d2537b593be4085c1946a87b92d5ac22f0d131b3b3e28e17fb767b1855b4fb81c01ad4f08de
SSDEEP

6144:u4Y7diEOx8cmNfc/FpkhkbadS4/oQooHPZtXk7jEP:ud7OxtGfc/vkhkI//v0EP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-03-09_49f7719fa35949531dc74be75e14809e_icedid

Files

2024-03-09_49f7719fa35949531dc74be75e14809e_icedid
.exe windows:4 windows x86 arch:x86

80ac869e065f026e7cff6b7ec77ce03e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\proj\Omnipass3\ffe\opfolderhelper\Release\OpFolderHelper.pdb

Imports

userdata

GetUserDataPtr

opfsdll

?OPFSInitFolderDecryption@@YAKPAEKPBD10K0PAK2@Z
?OPFSFolderEncryptFile@@YAKPAU__OPData@@@Z
?OPFSCloseHandle@@YAXK@Z

kernel32

HeapAlloc
HeapFree
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetSystemTimeAsFileTime
GetStartupInfoA
GetCommandLineA
HeapReAlloc
TerminateProcess
HeapSize
QueryPerformanceCounter
GetCurrentProcessId
GetTimeZoneInformation
LCMapStringA
GetDateFormatA
SetUnhandledExceptionFilter
HeapDestroy
HeapCreate
VirtualFree
IsBadWritePtr
GetStringTypeA
GetStringTypeW
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
IsBadReadPtr
IsBadCodePtr
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
SetStdHandle
SetEnvironmentVariableA
GetLocaleInfoW
GetTimeFormatA
RtlUnwind
ExitProcess
GetFileTime
SetErrorMode
GetOEMCP
GetCPInfo
GetFullPathNameA
GetVolumeInformationA
GetCurrentProcess
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WritePrivateProfileStringA
GlobalGetAtomNameA
GlobalFindAtomA
lstrcatA
lstrcmpW
GlobalFlags
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
TlsGetValue
GlobalHandle
GlobalReAlloc
LocalAlloc
FreeResource
GlobalAddAtomA
GetCurrentThread
GetCurrentThreadId
GlobalDeleteAtom
ConvertDefaultLocale
EnumResourceLanguagesA
lstrcmpA
RaiseException
FileTimeToSystemTime
SetLastError
MulDiv
FormatMessageA
lstrcpynA
ReadFile
WriteFile
CompareStringW
CompareStringA
DeleteFileA
GetLastError
GetTickCount
CreateFileA
CloseHandle
FileTimeToLocalFileTime
SetFileAttributesA
GetFileAttributesA
FindFirstFileA
FindClose
GetVersion
lstrcmpiA
LoadLibraryA
GetProcAddress
FreeLibrary
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetModuleHandleA
lstrlenW
EnterCriticalSection
GetModuleFileNameA
lstrlenA
LeaveCriticalSection
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
lstrcpyA
MultiByteToWideChar
InterlockedDecrement
WideCharToMultiByte
LocalFree
FindResourceA
LoadResource
LockResource
SizeofResource
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
LCMapStringW

user32

DestroyMenu
PostThreadMessageA
MessageBeep
GetNextDlgTabItem
GetNextDlgGroupItem
InvalidateRgn
InvalidateRect
CopyAcceleratorTableA
SetRect
IsRectEmpty
CharNextA
EndPaint
BeginPaint
GetWindowDC
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
ReleaseCapture
SetCapture
RegisterWindowMessageA
WinHelpA
GetCapture
CreateWindowExA
GetClassLongA
GetClassInfoExA
SetPropA
GetPropA
RemovePropA
IsChild
GetForegroundWindow
SetActiveWindow
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
LoadIconA
MapWindowPoints
SetForegroundWindow
UpdateWindow
GetMenu
AdjustWindowRectEx
EqualRect
RegisterClassA
DefWindowProcA
CallWindowProcA
OffsetRect
IntersectRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
CopyRect
ClientToScreen
GetWindowRect
PtInRect
GetDesktopWindow
GetClassNameA
LoadCursorA
GetSystemMetrics
GetDC
ReleaseDC
GetSysColor
GetSysColorBrush
RegisterClipboardFormatA
GetWindow
SetWindowContextHelpId
MapDialogRect
SetMenuItemBitmaps
ModifyMenuA
EnableMenuItem
CheckMenuItem
GetMenuCheckMarkDimensions
LoadBitmapA
SetWindowsHookExA
CallNextHookEx
GetMessageA
TranslateMessage
DispatchMessageA
GetActiveWindow
IsWindowVisible
GetKeyState
PeekMessageA
GetCursorPos
ValidateRect
MessageBoxA
GetLastActivePopup
EndDialog
CreateDialogIndirectParamA
SetCursor
PostQuitMessage
PostMessageA
UnregisterClassA
GetFocus
GetParent
SetWindowPos
SetFocus
EnableWindow
IsWindowEnabled
GetClientRect
ShowWindow
MoveWindow
SetWindowLongA
GetDlgCtrlID
SetWindowTextA
GetWindowLongA
IsDialogMessageA
SendDlgItemMessageA
GetDlgItem
UnhookWindowsHookEx
GetWindowTextA
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
CharUpperA
wsprintfA
SetTimer
IsWindow
KillTimer
LoadStringA
SendMessageA
GetClassInfoA

gdi32

ScaleViewportExtEx
GetMapMode
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutA
GetRgnBox
CreateRectRgnIndirect
GetTextColor
GetBkColor
GetStockObject
DeleteDC
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
GetDeviceCaps
TextOutA
RectVisible
PtVisible
GetWindowExtEx
GetViewportExtEx
SetMapMode
RestoreDC
SaveDC
GetObjectA
SetBkColor
SetTextColor
GetClipBox
DeleteObject
CreateBitmap

comdlg32

GetFileTitleA

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter

advapi32

RegOpenKeyA
RegCreateKeyExA
RegDeleteKeyA
RegEnumKeyA
RegQueryValueA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA

comctl32

ord17

shlwapi

PathFindExtensionA
PathStripToRootA
PathFindFileNameA
PathIsUNCA

oledlg

ord8

ole32

StgOpenStorageOnILockBytes
CoTaskMemAlloc
CoCreateInstance
OleRun
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
CoRevokeClassObject
OleIsCurrentClipboard
OleFlushClipboard
CLSIDFromString
CLSIDFromProgID
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CoTaskMemFree
CoGetClassObject
CoRegisterMessageFilter

oleaut32

SysAllocStringLen
OleCreateFontIndirect
SafeArrayDestroy
SysAllocString
SystemTimeToVariantTime
SysStringLen
LoadTypeLi
LoadRegTypeLi
SafeArrayCreate
SafeArrayAccessData
SafeArrayUnaccessData
VarUdateFromDate
SysStringByteLen
SysAllocStringByteLen
VariantClear
VariantCopy
VariantInit
VariantChangeType
SysFreeString
GetErrorInfo

atl71

ord61
ord32
ord64
ord58
ord17
ord20
ord31
ord18
ord22
ord23

storeng

InitStorageDriver
CloseStorageDriver

autheng

InitAuthDriver
CloseAuthDriver

Sections

.text
Size: 212KB - Virtual size: 208KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 44KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

80ac869e065f026e7cff6b7ec77ce03e

Headers

File Characteristics

PDB Paths

Imports

userdata

opfsdll

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

comctl32

shlwapi

oledlg

ole32

oleaut32

atl71

storeng

autheng

Sections

.text Size: 212KB - Virtual size: 208KB

.rdata Size: 56KB - Virtual size: 52KB

.data Size: 12KB - Virtual size: 24KB

.rsrc Size: 44KB - Virtual size: 42KB

.text
Size: 212KB - Virtual size: 208KB

.rdata
Size: 56KB - Virtual size: 52KB

.data
Size: 12KB - Virtual size: 24KB

.rsrc
Size: 44KB - Virtual size: 42KB