2024-03-13_590555df856f039ad6e4ea8a428dee9e_icedid

Sharing

Copy URL

Twitter E-mail

General

Target

2024-03-13_590555df856f039ad6e4ea8a428dee9e_icedid
Size

11.8MB
MD5

590555df856f039ad6e4ea8a428dee9e
SHA1

111d358bb5bd65420ab355c89eaf398d77f5e38f
SHA256

8fb999d99750ffd6671295def1b154da3b8eb0de661e0d5d40d2baba28519316
SHA512

5453192ad4d30b66a6dc8567ef447aff5f94354eae5ca30292eacc453e3260878c49fd598dbe14d345533f680c679c0bdf41b38e3b56bcf85181eed7fe469932
SSDEEP

196608:qS6MSe6xw0QMQIhoG2Q3Zg3NKVI1f3gSgLNuX3P66XOfRydJ15dI:qjnEBGVZg3NKpDNa15G

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-03-13_590555df856f039ad6e4ea8a428dee9e_icedid

Files

2024-03-13_590555df856f039ad6e4ea8a428dee9e_icedid
.exe windows:5 windows x86 arch:x86

6c53a04f820a5435a4d716ac02251ec4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

crypt32

CertDuplicateCertificateContext
CryptEncryptMessage
CryptVerifyDetachedMessageSignature
CryptVerifyMessageSignature
CryptEncodeObject
CertEnumCertificatesInStore
CertOpenStore
CertCloseStore
CryptDecryptMessage
CryptMsgOpenToDecode
CryptMsgUpdate
CryptMsgClose
CertFindCertificateInStore
CertSetCertificateContextProperty
CertNameToStrW
CryptDecodeObject
CertCreateCertificateContext
CryptSignMessage
CryptMsgControl
CryptMsgGetParam
CertGetSubjectCertificateFromStore
CertGetCertificateContextProperty
CertFreeCertificateContext

advapi32

RegSetValueA
RegOpenKeyExW
SetFileSecurityA
GetFileSecurityA
CryptGetUserKey
CryptDestroyKey
CryptExportKey
CryptGetProvParam
CryptEnumProvidersA
CryptCreateHash
CryptSetHashParam
CryptDestroyHash
CryptSignHashA
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
ReportEventA
RegisterEventSourceA
CreateServiceA
RegDeleteKeyA
DeleteService
ImpersonateLoggedOnUser
CreateProcessAsUserA
RevertToSelf
OpenSCManagerA
OpenServiceA
CloseServiceHandle
QueryServiceConfigA
QueryServiceStatus
ChangeServiceConfigA
StartServiceA
ControlService
RegCloseKey
RegConnectRegistryA
RegOpenKeyExA
RegCreateKeyExA
RegQueryValueExA
RegEnumKeyExA
OpenProcessToken
GetTokenInformation
LookupAccountSidA
EnumServicesStatusExA
RegQueryValueA
GetUserNameA
RegEnumValueA
RegOpenKeyA
RegSetValueExA
RegDeleteValueA
LookupPrivilegeValueA
AdjustTokenPrivileges
RegEnumKeyA

oleaut32

VariantTimeToSystemTime
VarBstrFromDate
VariantClear
SysAllocString
SysAllocStringLen
SysAllocStringByteLen
VariantChangeType
VariantCopy
VariantInit
SafeArrayDestroy
SysStringLen
OleCreateFontIndirect
SysFreeString
VarUdateFromDate
SystemTimeToVariantTime
VarDateFromStr

ole32

CoInitializeEx
CoCreateInstance
CoInitializeSecurity
CoInitialize
CoUninitialize
CoTaskMemFree
StringFromCLSID
ReleaseStgMedium
CoTaskMemAlloc
OleDuplicateData
CLSIDFromString
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
DoDragDrop
OleIsCurrentClipboard
OleFlushClipboard
RegisterDragDrop
CoLockObjectExternal
RevokeDragDrop
OleGetClipboard
CoCreateGuid
CLSIDFromProgID
CoGetClassObject
CoRevokeClassObject
CoRegisterMessageFilter
CreateStreamOnHGlobal
OleTranslateAccelerator
IsAccelerator
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
OleLockRunning

netapi32

NetServerGetInfo
Netbios
NetApiBufferFree
NetServerEnum

mpr

WNetCloseEnum
WNetOpenEnumA
WNetEnumResourceA

ws2_32

getsockname
select
htons
ntohs
getsockopt
listen
gethostbyaddr
recvfrom
__WSAFDIsSet
inet_ntoa
accept
closesocket
WSASocketA
WSACleanup
WSAStartup
WSASetLastError
WSAGetLastError
setsockopt
bind
shutdown
send
sendto
gethostname
recv
inet_addr
connect
gethostbyname
ioctlsocket
socket

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

psapi

EnumProcesses
GetProcessMemoryInfo
GetModuleFileNameExA
GetModuleBaseNameA

kernel32

MoveFileW
CreateDirectoryW
FindClose
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetFileTime
LocalFileTimeToFileTime
SetEndOfFile
FindFirstFileA
FindNextFileA
CreateThread
CreateFileW
GetComputerNameA
MulDiv
lstrlenW
GlobalSize
lstrcmpW
LoadLibraryW
InitializeCriticalSectionAndSpinCount
CompareStringA
GlobalDeleteAtom
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
FreeResource
FindResourceA
lstrcmpA
CreateActCtxW
ReleaseActCtx
FileTimeToLocalFileTime
ResumeThread
WaitForSingleObject
SuspendThread
CreateEventA
GetThreadLocale
GetStringTypeExA
lstrcmpiA
FlushFileBuffers
LockFile
UnlockFile
DuplicateHandle
GetShortPathNameA
ReplaceFileA
GetTempFileNameA
GetDiskFreeSpaceA
GetProfileIntA
lstrcpyW
InterlockedExchange
GetModuleHandleW
LoadLibraryExA
GetLocaleInfoA
GetSystemDefaultUILanguage
ConvertDefaultLocale
GetUserDefaultUILanguage
GetPrivateProfileIntA
WritePrivateProfileStringA
GetPrivateProfileStringA
TlsGetValue
GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
GlobalFlags
GetCPInfo
GetSystemDirectoryW
GetFileAttributesExA
GetFileSizeEx
SetErrorMode
GetNumberFormatA
SearchPathA
VirtualProtect
FindResourceExW
GetSystemInfo
VirtualQuery
DecodePointer
GetTimeFormatA
GetDateFormatA
GetSystemTimeAsFileTime
EncodePointer
RemoveDirectoryA
GetDriveTypeW
GetCommandLineA
HeapSetInformation
GetStartupInfoW
RtlUnwind
GetTimeZoneInformation
RaiseException
HeapReAlloc
ExitThread
HeapQueryInformation
HeapSize
SetStdHandle
GetFileType
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsValidCodePage
GetFileAttributesW
HeapCreate
GetStringTypeW
LCMapStringW
IsProcessorFeaturePresent
SetHandleCount
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetConsoleCP
GetConsoleMode
CompareStringW
WriteConsoleW
SetEnvironmentVariableA
DeleteFileW
CopyFileW
GetModuleFileNameW
GetCurrentDirectoryW
GetFullPathNameA
GetFullPathNameW
GetModuleFileNameA
GetComputerNameW
GetOEMCP
GetACP
GetCurrentThreadId
GetSystemTime
CompareFileTime
SystemTimeToFileTime
GetCurrentDirectoryA
GlobalUnlock
GlobalLock
ReadFile
GetFileSize
SetFilePointer
SetCurrentDirectoryA
GetWindowsDirectoryA
GetLocalTime
GetSystemDirectoryA
SetFileAttributesA
WriteFile
GlobalReAlloc
SetSystemPowerState
GetCurrentThread
SetThreadPriority
TerminateProcess
InterlockedDecrement
InterlockedIncrement
MoveFileA
CopyFileA
GetCurrentProcessId
LocalAlloc
GetFileAttributesA
GetCurrentProcess
GetVersion
GetVersionExA
lstrcpynA
lstrcatA
lstrcpyA
GlobalMemoryStatus
GlobalFree
GlobalAlloc
OpenProcess
FileTimeToSystemTime
GetFileTime
CreateFileA
GetDriveTypeA
GetLogicalDriveStringsA
GetTickCount
FormatMessageA
LocalFree
CreateProcessA
DeleteFileA
VirtualFree
VirtualAlloc
ExitProcess
CloseHandle
FreeLibrary
HeapFree
GetProcessHeap
HeapAlloc
GetVolumeInformationA
ActivateActCtx
GetProcAddress
GetModuleHandleA
LoadLibraryA
GetLastError
DeactivateActCtx
SetLastError
Sleep
GetTempPathA
MultiByteToWideChar
lstrlenA
FindResourceW
LoadResource
LockResource
SizeofResource
WideCharToMultiByte
SetFileAttributesW
GetStdHandle
CreateDirectoryA
SetEvent

user32

DrawEdge
DrawFrameControl
SetCursorPos
GetMenuDefaultItem
InvertRect
HideCaret
EnableScrollBar
GetIconInfo
UpdateLayeredWindow
IsCharLowerA
MapVirtualKeyExA
DefFrameProcA
DefMDIChildProcA
TranslateMDISysAccel
FrameRect
GetUpdateRect
CharUpperBuffA
CopyIcon
SubtractRect
GetDoubleClickTime
GetWindowRgn
UnregisterClassA
SetLayeredWindowAttributes
EnumDisplayMonitors
CopyImage
RealChildWindowFromPoint
GetSysColorBrush
UnpackDDElParam
ReuseDDElParam
LoadMenuA
DestroyIcon
LoadAcceleratorsA
InsertMenuItemA
CreatePopupMenu
TranslateAcceleratorA
ShowOwnedPopups
SetWindowContextHelpId
MapDialogRect
PostQuitMessage
IsZoomed
IsClipboardFormatAvailable
DestroyCursor
SetRect
SetRectEmpty
IntersectRect
ReleaseCapture
LoadCursorW
SetCapture
SetWindowRgn
OffsetRect
IsRectEmpty
CharUpperA
GetMenuItemInfoA
InflateRect
GetMessageA
TranslateMessage
WaitMessage
MapVirtualKeyA
GetKeyNameTextA
EndPaint
BeginPaint
GetWindowDC
GetWindowThreadProcessId
CreateDialogIndirectParamA
GetNextDlgTabItem
EndDialog
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
EnableMenuItem
CheckMenuItem
IsWindowEnabled
ShowWindow
MoveWindow
SetWindowTextA
IsDialogMessageA
SetDlgItemTextA
GetDlgItemTextA
CheckDlgButton
SendDlgItemMessageA
WinHelpA
IsChild
GetCapture
DrawIconEx
CallNextHookEx
GetClassLongA
SetPropA
GetPropA
RemovePropA
SetFocus
GetWindowTextLengthA
GetWindowTextA
GetForegroundWindow
GetLastActivePopup
DispatchMessageA
BeginDeferWindowPos
EndDeferWindowPos
GetDlgItem
CopyAcceleratorTableA
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
PeekMessageA
MonitorFromWindow
GetMonitorInfoA
MapWindowPoints
ScrollWindow
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
SetWindowPlacement
GetWindowPlacement
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
GetMenu
PtInRect
GetWindow
GetMenuStringA
DrawMenuBar
DestroyMenu
SetWindowPos
CreateWindowExA
SendMessageW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
ShowScrollBar
RegisterClipboardFormatA
FlashWindow
InsertMenuA
GetActiveWindow
ExitWindowsEx
SetActiveWindow
SetParent
SystemParametersInfoA
EnumChildWindows
GetClassNameA
PostMessageA
TrackPopupMenu
GetMenuItemID
GetMenuItemCount
SetMenuDefaultItem
LoadIconA
RegisterWindowMessageA
GrayStringA
DrawTextExA
TabbedTextOutA
DrawTextA
IsWindow
GetParent
DrawFocusRect
GetFocus
UnionRect
GetNextDlgGroupItem
InvalidateRgn
CharNextA
LoadImageW
DrawStateA
LockWindowUpdate
IsMenu
DeleteMenu
MonitorFromPoint
SetClassLongA
NotifyWinEvent
CreateAcceleratorTableA
DestroyAcceleratorTable
CopyRect
GetDC
GetKeyState
FillRect
GetSysColor
DrawIcon
GetClientRect
IsIconic
SetForegroundWindow
AppendMenuA
GetAsyncKeyState
GetKeyboardState
GetKeyboardLayout
ToAsciiEx
WindowFromPoint
GetTabbedTextExtentW
SetWindowsHookExA
CreateMenu
GetSystemMenu
ClientToScreen
RemoveMenu
ModifyMenuA
GetMenuState
GetSubMenu
LoadMenuW
GetSystemMetrics
SetWindowLongA
GetWindowLongA
MessageBeep
UpdateWindow
IsWindowVisible
LoadCursorA
SetCursor
GetDesktopWindow
MessageBoxA
LoadImageA
BringWindowToTop
LoadIconW
GetMessagePos
ScreenToClient
GetCursorPos
InvalidateRect
SetTimer
KillTimer
RedrawWindow
SendMessageA
GetWindowRect
EnableWindow
LoadAcceleratorsW
GetTopWindow
PostThreadMessageA
ValidateRect
ReleaseDC

gdi32

CreateCompatibleDC
CreateFontA
SelectObject
BitBlt
GetTextExtentPoint32A
ExtTextOutA
CreateSolidBrush
GetObjectA
GetTextMetricsA
CreateCompatibleBitmap
CreateRectRgn
PtVisible
RectVisible
TextOutA
Escape
DeleteObject
StretchBlt
GetDeviceCaps
CreateFontIndirectA
StretchDIBits
CreateBitmap
GetStockObject
SelectPalette
RealizePalette
GetDIBits
CopyMetaFileA
CreateDCA
SetTextColor
SetBkColor
SaveDC
RestoreDC
SetBkMode
SetPolyFillMode
SetROP2
SetStretchBltMode
SetMapMode
GetClipBox
ExcludeClipRect
IntersectClipRect
GetViewportOrgEx
Rectangle
GetCharWidthA
LineTo
MoveToEx
SetTextAlign
CreateDIBitmap
EnumFontFamiliesA
GetTextCharsetInfo
GetNearestColor
GetBkColor
GetBkMode
GetPolyFillMode
GetROP2
GetStretchBltMode
GetTextColor
GetTextAlign
GetTextFaceA
GetTextExtentPointA
GetTextExtentPoint32W
GetWindowOrgEx
OffsetRgn
GetRgnBox
CreateRoundRectRgn
SetDIBColorTable
SetPixel
CreatePolygonRgn
Polyline
Polygon
CreatePalette
GetPaletteEntries
GetNearestPaletteIndex
GetSystemPaletteEntries
EnumFontFamiliesExA
PtInRegion
FillRgn
FrameRgn
GetBoundsRect
ExtFloodFill
SetPaletteEntries
SetPixelV
AbortDoc
SetAbortProc
EndPage
StartPage
GetMapMode
CombineRgn
SetRectRgn
CreateDIBSection
Ellipse
LPtoDP
DPtoLP
CreateEllipticRgn
PatBlt
CreateRectRgnIndirect
CreateHatchBrush
CreatePen
GetObjectType
CreatePatternBrush
DeleteDC
ExtSelectClipRgn
GetCurrentPositionEx
ScaleWindowExtEx
SetWindowExtEx
OffsetWindowOrgEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
StartDocA
GetPixel
GetWindowExtEx
GetViewportExtEx
SelectClipRgn
SetLayout
GetLayout
EndDoc

msimg32

TransparentBlt
AlphaBlend

comdlg32

GetFileTitleA

winspool.drv

GetJobA
DocumentPropertiesA
ClosePrinter
OpenPrinterA

shell32

DragQueryFileA
Shell_NotifyIconA
SHAppBarMessage
SHGetSpecialFolderLocation
SHBrowseForFolderA
SHGetPathFromIDListA
SHGetFileInfoA
ExtractIconA
SHAddToRecentDocs
ShellExecuteA
DragFinish
SHGetMalloc
SHGetDesktopFolder

comctl32

ImageList_GetIconSize

shlwapi

PathFindExtensionA
PathRemoveExtensionA
PathFindFileNameA
PathStripToRootA
PathIsUNCA
PathRemoveFileSpecW
UrlUnescapeA

odbc32

ord72
ord4
ord17
ord68
ord44
ord3
ord5
ord51
ord50
ord45
ord59
ord13
ord18
ord46
ord12
ord19
ord11
ord49
ord48
ord8
ord20
ord14
ord9
ord15
ord23
ord1
ord2
ord16
ord61
ord10
ord41

oledlg

ord8

wsock32

WSAAsyncSelect
htonl

activeds

ord13
ord9

oleacc

AccessibleObjectFromWindow
CreateStdAccessibleObject
LresultFromObject

gdiplus

GdipDrawImageRectI
GdipSetInterpolationMode
GdipCreateFromHDC
GdipCreateBitmapFromHBITMAP
GdipCloneImage
GdipDrawImageI
GdipGetImageGraphicsContext
GdiplusStartup
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage
GdipDeleteGraphics
GdipAlloc
GdipFree
GdiplusShutdown

wininet

InternetOpenUrlA
InternetReadFile
InternetWriteFile
InternetSetFilePointer
InternetSetStatusCallback
InternetOpenA
InternetGetLastResponseInfoA
InternetCloseHandle
InternetCrackUrlA
InternetCanonicalizeUrlA
InternetQueryOptionA
InternetSetOptionExA
InternetQueryDataAvailable

imm32

ImmGetOpenStatus
ImmReleaseContext
ImmGetContext

winmm

PlaySoundA

Sections

.text
Size: 6.6MB - Virtual size: 6.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 289KB - Virtual size: 342KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3.5MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6c53a04f820a5435a4d716ac02251ec4

Headers

DLL Characteristics

File Characteristics

Imports

crypt32

advapi32

oleaut32

ole32

netapi32

mpr

ws2_32

version

psapi

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

shell32

comctl32

shlwapi

odbc32

oledlg

wsock32

activeds

oleacc

gdiplus

wininet

imm32

winmm

Sections

.text Size: 6.6MB - Virtual size: 6.6MB

.rdata Size: 1.4MB - Virtual size: 1.4MB

.data Size: 289KB - Virtual size: 342KB

.rsrc Size: 3.5MB - Virtual size: 3.5MB

.text
Size: 6.6MB - Virtual size: 6.6MB

.rdata
Size: 1.4MB - Virtual size: 1.4MB

.data
Size: 289KB - Virtual size: 342KB

.rsrc
Size: 3.5MB - Virtual size: 3.5MB