2024-03-12_d7190d0a6becb0f0418aa20697b9495f_icedid

Sharing

Copy URL Twitter E-mail

General

Target

2024-03-12_d7190d0a6becb0f0418aa20697b9495f_icedid
Size

1.7MB
MD5

d7190d0a6becb0f0418aa20697b9495f
SHA1

d463345f598a46de3b3d2af9a5b780032294ae88
SHA256

40c2f982026aaad863bff4c6651cf35669508469d7fd0a4b783b4f9935b3e0e6
SHA512

b15d8e2aca36c2354b9322e78c05f53150bb13c16d420f3061a38acf7710720195a30f3cf6d69fde125d3a66669046c3b8e6163cd9ddd7eed86935bc800cb60b
SSDEEP

24576:lsYtIYfELC702IFjDE60/CO67WIrIAGbXSFG9ijJdRtINZtla+l91wpnU6bHrNo:R6/Mid460m7l0XSFG9iNwZP91

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-03-12_d7190d0a6becb0f0418aa20697b9495f_icedid

Files

2024-03-12_d7190d0a6becb0f0418aa20697b9495f_icedid
.exe windows:4 windows x86 arch:x86

5ba3010863bc48ac85864ebd07b2c938

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Projects\nanotest\Nanopoint.pdb

Imports

winmm

mixerSetControlDetails
mixerClose
mixerGetNumDevs
mixerOpen
mixerGetLineInfoA
mixerGetLineControlsA
timeGetTime
mixerGetControlDetailsA

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

avicap32

capCreateCaptureWindowA

sensapi

IsDestinationReachableA

iphlpapi

GetAdaptersInfo

setupapi

SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailA
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsA

hid

HidD_GetAttributes
HidD_GetPreparsedData
HidP_GetCaps
HidD_FreePreparsedData
HidD_GetHidGuid

ws2_32

WSASetLastError
select
bind
gethostbyname
inet_addr
htons
gethostname
recv
WSACleanup
WSAStartup
socket
connect
send
closesocket

gdiplus

GdiplusStartup
GdiplusShutdown
GdipDrawString
GdipFree
GdipCreateStringFormat
GdipDeleteStringFormat
GdipDeleteGraphics
GdipCreateFontFamilyFromName
GdipMeasureString
GdipSetClipRectI
GdipCreateFont
GdipAlloc
GdipDeleteFontFamily
GdipDeleteFont
GdipCreateSolidFill
GdipSetStringFormatFlags
GdipSetStringFormatAlign
GdipCreateFromHDC
GdipSetTextRenderingHint
GdipDeleteBrush
GdipCloneBrush

kernel32

ResumeThread
SetEvent
ResetEvent
WaitForSingleObject
CreateEventA
WinExec
ReleaseSemaphore
CreateSemaphoreA
WritePrivateProfileStructA
GetPrivateProfileStructA
CancelIo
ReadFile
GetTimeZoneInformation
SetLastError
GetVersion
lstrcmpiW
CompareStringA
CompareStringW
GetEnvironmentVariableA
GetEnvironmentVariableW
GetStringTypeExA
GetStringTypeExW
GetFileSize
lstrcmpW
lstrcatA
GlobalDeleteAtom
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
FreeResource
LocalFree
FormatMessageA
VirtualProtect
SetThreadPriority
SuspendThread
MoveFileA
SetFilePointer
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
DuplicateHandle
GetVolumeInformationA
GetFullPathNameA
GetShortPathNameA
EnumResourceLanguagesA
LoadLibraryExA
GetCurrentThread
LocalAlloc
GlobalHandle
TlsGetValue
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
CreateMutexA
ReleaseMutex
WaitForMultipleObjects
LocalFileTimeToFileTime
GlobalFlags
GetCPInfo
GetOEMCP
FindResourceExA
SetErrorMode
GetDiskFreeSpaceA
GetCurrentDirectoryA
LocalUnlock
LocalLock
GetCurrentProcessId
GetSystemDirectoryA
RtlUnwind
ExitProcess
GetDateFormatA
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapReAlloc
GetStartupInfoA
GetCommandLineA
ExitThread
CreateThread
SetStdHandle
GetFileType
HeapSize
HeapDestroy
HeapCreate
VirtualFree
FatalAppExitA
IsBadWritePtr
QueryPerformanceCounter
LCMapStringA
LCMapStringW
SetUnhandledExceptionFilter
CopyFileA
GetStringTypeW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetDriveTypeA
IsBadReadPtr
IsBadCodePtr
SetEnvironmentVariableA
SetConsoleCtrlHandler
GetLocaleInfoW
GetModuleHandleA
HeapAlloc
FlushInstructionCache
lstrlenW
InterlockedIncrement
WritePrivateProfileStringA
lstrcpynA
GetCurrentProcess
GetProcessHeap
HeapFree
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
FreeLibrary
GetProcAddress
GetPrivateProfileIntA
CreateProcessA
TerminateProcess
MulDiv
lstrcmpiA
GetSystemTimeAsFileTime
FileTimeToLocalFileTime
GetFileAttributesA
SetFileAttributesA
MoveFileExA
GetLastError
GetTempFileNameA
CreateDirectoryA
GetPrivateProfileStringA
CopyFileExA
SetFileTime
RemoveDirectoryA
CreateFileA
GetFileTime
CloseHandle
FileTimeToSystemTime
SystemTimeToFileTime
CompareFileTime
FindFirstFileA
FindNextFileA
FindClose
InterlockedDecrement
MultiByteToWideChar
Sleep
lstrcmpA
GlobalSize
GlobalAlloc
GetLocalTime
GlobalReAlloc
GlobalFree
GetTempPathA
DeleteFileA
GlobalLock
GlobalUnlock
_lopen
_lread
_lclose
_hread
GetTickCount
lstrlenA
lstrcpyA
WideCharToMultiByte
FindResourceA
LoadResource
LockResource
SizeofResource
GetModuleFileNameA
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
DeleteCriticalSection
InitializeCriticalSection
RaiseException
GetTimeFormatA
GetCurrentThreadId
WriteFile
GetStringTypeA
IsDBCSLeadByte
ConvertDefaultLocale

user32

GetActiveWindow
MapDialogRect
EndDialog
GetNextDlgTabItem
CreateDialogIndirectParamA
TabbedTextOutA
DrawTextA
DrawTextExA
GrayStringA
GetWindowDC
GetKeyNameTextA
MapVirtualKeyA
IsRectEmpty
CopyAcceleratorTableA
TranslateAcceleratorA
SetMenu
BringWindowToTop
CreatePopupMenu
InsertMenuItemA
LoadAcceleratorsA
ReuseDDElParam
UnpackDDElParam
DestroyMenu
LoadMenuA
DrawIcon
SetWindowRgn
GetNextDlgGroupItem
SetWindowContextHelpId
ShowOwnedPopups
MsgWaitForMultipleObjects
GetMenuItemInfoA
GetSysColorBrush
GetDialogBaseUnits
RegisterClipboardFormatA
UnionRect
DeleteMenu
DestroyIcon
IsClipboardFormatAvailable
GetTabbedTextExtentA
PostThreadMessageA
WindowFromPoint
GetDCEx
LockWindowUpdate
GetSystemMenu
SendDlgItemMessageA
GetLastActivePopup
SetActiveWindow
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
MapWindowPoints
ScrollWindow
MessageBoxA
TrackPopupMenuEx
TrackPopupMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
ShowScrollBar
GetMenu
GetSubMenu
GetMenuItemID
GetMenuItemCount
AdjustWindowRectEx
ScreenToClient
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
SetWindowPlacement
GetDlgCtrlID
SystemParametersInfoA
GetWindowPlacement
CharUpperW
CharLowerW
CharLowerA
GetMessagePos
GetMessageTime
SetCursorPos
ShowCursor
GetClassInfoA
RegisterClassA
GetMessageA
GetMenuCheckMarkDimensions
IsIconic
GetMenuStringA
SetForegroundWindow
SetWindowsHookExA
wsprintfA
CreateWindowExA
CreateAcceleratorTableA
CharNextA
GetClassNameA
RedrawWindow
GetDlgItem
SetFocus
IsChild
DestroyAcceleratorTable
BeginPaint
EndPaint
CallWindowProcA
GetDesktopWindow
InvalidateRgn
GetSysColor
GetKeyState
RegisterWindowMessageA
GetClassInfoExA
RegisterClassExA
GetWindowTextLengthA
GetWindowTextA
SetWindowTextA
DefWindowProcA
GetMessageExtraInfo
GetSystemMetrics
SendInput
SendMessageTimeoutA
GetWindowLongA
SetWindowLongA
FindWindowA
CharUpperA
ExitWindowsEx
ClipCursor
CopyRect
EnumChildWindows
SetParent
SetWindowPos
ReleaseCapture
GetFocus
SetCapture
GetCapture
ClientToScreen
PtInRect
ValidateRect
GetWindowRect
IsWindowVisible
PostMessageA
WaitForInputIdle
EnumWindows
GetWindowThreadProcessId
OffsetRect
InflateRect
GetWindow
UpdateWindow
GetAsyncKeyState
GetForegroundWindow
GetDC
ReleaseDC
AppendMenuA
InsertMenuA
RemoveMenu
SetMenuItemBitmaps
ModifyMenuA
SetRectEmpty
SendMessageA
DestroyWindow
IsWindow
PeekMessageA
TranslateMessage
DispatchMessageA
PostQuitMessage
LoadCursorA
SetCursor
GetCursorPos
GetParent
InvalidateRect
FillRect
GetClientRect
IntersectRect
SetRect
MessageBeep
KillTimer
SetTimer
UnregisterClassA
EnableWindow
GetMenuState
EnableMenuItem
LoadBitmapA
ScrollWindowEx
IsWindowEnabled
MoveWindow
IsDialogMessageA
ShowWindow
CheckMenuItem
SetPropA
IsDlgButtonChecked
SetDlgItemTextA
SetDlgItemInt
GetDlgItemTextA
GetDlgItemInt
CheckRadioButton
CheckDlgButton
WinHelpA
GetClassLongA
CallNextHookEx
GetPropA
UnhookWindowsHookEx
RemovePropA
LoadIconA

gdi32

SetTextColor
SetBkColor
CreateBitmap
CopyMetaFileA
CreateDCA
SaveDC
RestoreDC
SetBkMode
SetPolyFillMode
SetROP2
SetMapMode
IntersectClipRect
OffsetClipRgn
LineTo
MoveToEx
SetTextAlign
SetTextJustification
SetTextCharacterExtra
SetMapperFlags
SetArcDirection
SetColorAdjustment
GetClipRgn
CreateRectRgn
SelectClipPath
GetViewportExtEx
GetWindowExtEx
GetPixel
GetClipBox
GetDCOrgEx
StartDocA
PtVisible
RectVisible
CreateDIBSection
ExtTextOutA
Escape
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
GetCurrentPositionEx
ArcTo
PolyDraw
PolylineTo
PolyBezierTo
ExtSelectClipRgn
CreateDIBPatternBrushPt
CreatePatternBrush
PlayMetaFileRecord
GetObjectType
EnumMetaFile
PlayMetaFile
CreatePen
ExtCreatePen
CreateHatchBrush
CreateRectRgnIndirect
PatBlt
GetRgnBox
CreateFontIndirectA
SetRectRgn
CombineRgn
GetMapMode
DPtoLP
CreateEllipticRgn
LPtoDP
Ellipse
GetTextExtentPoint32A
GetBkColor
GetTextColor
GetTextMetricsA
EnumFontFamiliesExA
GetCharWidthA
StartPage
EndPage
SetAbortProc
AbortDoc
EndDoc
DeleteDC
SelectObject
Rectangle
SelectClipRgn
ExcludeClipRect
GetDeviceCaps
CreateFontA
CreateSolidBrush
GetDIBits
GetCurrentObject
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
GetObjectA
GetStockObject
SetStretchBltMode
CreatePalette
SelectPalette
RealizePalette
StretchDIBits
SetDIBitsToDevice
TextOutA
DeleteObject

comdlg32

CommDlgExtendedError
PrintDlgA
PageSetupDlgA
FindTextA
ReplaceTextA
GetOpenFileNameA
GetFileTitleA
GetSaveFileNameA

winspool.drv

ClosePrinter
ord201
DocumentPropertiesA
GetJobA
GetPrinterA
OpenPrinterA

advapi32

RegQueryInfoKeyA
RegDeleteKeyA
RegOpenKeyExA
RegEnumKeyExA
RegOpenKeyA
RegQueryValueExA
RegDeleteValueA
RegFlushKey
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegCreateKeyExA
RegEnumKeyA
RegQueryValueA
RegCreateKeyA
GetFileSecurityA
RegSetValueExA
RegCloseKey
SetFileSecurityA
RegSetValueA

shell32

ShellExecuteA
SHGetPathFromIDListA
SHGetMalloc
SHGetFileInfoA
DragFinish
DragQueryFileA
SHBrowseForFolderA
SHGetSpecialFolderLocation
ExtractIconA

comctl32

PropertySheetA
ord13
ImageList_Read
ImageList_Write
ord14
ImageList_Destroy
ord17
ImageList_LoadImageA
ImageList_Merge
ImageList_Draw
ImageList_GetImageInfo
CreatePropertySheetPageA
DestroyPropertySheetPage
ImageList_Create

shlwapi

UrlUnescapeA
PathStripToRootA
PathIsUNCA
PathFindExtensionA
PathRemoveExtensionA
PathFindFileNameA

oledlg

ord8

ole32

StgOpenStorageOnILockBytes
OleDuplicateData
ReleaseStgMedium
CreateBindCtx
CoTreatAsClass
ReadClassStg
ReadFmtUserTypeStg
OleRegGetUserType
WriteClassStg
WriteFmtUserTypeStg
SetConvertStg
CoTaskMemRealloc
StgCreateDocfileOnILockBytes
CoGetClassObject
OleLockRunning
CoTaskMemAlloc
StringFromGUID2
OleUninitialize
OleInitialize
CreateStreamOnHGlobal
CLSIDFromString
CoInitialize
StringFromCLSID
CoUninitialize
CoTaskMemFree
CoCreateInstance
CLSIDFromProgID
CreateILockBytesOnHGlobal
CoDisconnectObject
CoFreeUnusedLibraries
CoRegisterClassObject
CoRevokeClassObject
OleSetClipboard
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter
OleRun

oleaut32

SysFreeString
VariantCopy
VariantChangeType
SysAllocStringLen
SysStringLen
SysStringByteLen
OleCreateFontIndirect
LoadRegTypeLi
LoadTypeLi
VarUI4FromStr
SysAllocStringByteLen
SafeArrayGetLBound
SafeArrayGetElemsize
SafeArrayGetDim
SafeArrayCreate
SafeArrayRedim
SafeArrayAllocData
SafeArrayAllocDescriptor
SafeArrayCopy
SafeArrayGetElement
SafeArrayPtrOfIndex
SafeArrayPutElement
SafeArrayLock
SafeArrayUnlock
SafeArrayDestroy
SafeArrayDestroyData
SafeArrayDestroyDescriptor
VariantTimeToSystemTime
SystemTimeToVariantTime
VariantInit
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
VariantClear
CreateErrorInfo
SysReAllocStringLen
VarDateFromStr
VarBstrFromDec
VarDecFromStr
VarCyFromStr
VarBstrFromCy
VarBstrFromDate
GetErrorInfo
SetErrorInfo
SysAllocString

wininet

InternetCloseHandle
HttpQueryInfoA
HttpSendRequestA
HttpOpenRequestA
InternetConnectA
InternetOpenA
InternetCrackUrlA
InternetSetOptionA
InternetReadFile
InternetOpenUrlA
GopherOpenFileA
FtpFindFirstFileA
GopherCreateLocatorA
FtpCommandA
GopherGetAttributeA
InternetSetFilePointer
GopherFindFirstFileA
InternetGetLastResponseInfoA
InternetFindNextFileA
InternetErrorDlg
FtpGetFileA
FtpPutFileA
FtpGetCurrentDirectoryA
FtpSetCurrentDirectoryA
FtpRemoveDirectoryA
FtpCreateDirectoryA
FtpRenameFileA
FtpDeleteFileA
InternetQueryDataAvailable
InternetGetCookieA
InternetSetOptionExA
InternetCanonicalizeUrlA
InternetSetCookieA
InternetAttemptConnect
FtpOpenFileA
InternetSetStatusCallback
InternetQueryOptionA
HttpAddRequestHeadersA
HttpSendRequestExA
InternetWriteFile
HttpEndRequestA
InternetReadFileExA

rpcrt4

UuidToStringA
RpcStringFreeA
UuidCreate

Exports

Exports

ExpandVariables
GetBrowserLocationURL
GetNanopointTerminalID
GetRealFileURL
GetTimerDuration
GetVariable
HttpGetFile
IdleMovies
IsPrinterOkayEx
IsSessionInProgress
ProcessNanoCommand
SendSMTPMessageEx
SetVariable
WriteToLogFile

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 296KB - Virtual size: 294KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 96KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5ba3010863bc48ac85864ebd07b2c938

Headers

File Characteristics

PDB Paths

Imports

winmm

version

avicap32

sensapi

iphlpapi

setupapi

hid

ws2_32

gdiplus

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

wininet

rpcrt4

Exports

Exports

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.rdata Size: 296KB - Virtual size: 294KB

.data Size: 24KB - Virtual size: 43KB

.rsrc Size: 96KB - Virtual size: 93KB

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 296KB - Virtual size: 294KB

.data
Size: 24KB - Virtual size: 43KB

.rsrc
Size: 96KB - Virtual size: 93KB