2024-03-13_174e36c639ec37d282167887286eacd1_icedid

Sharing

Copy URL

Twitter E-mail

General

Target

2024-03-13_174e36c639ec37d282167887286eacd1_icedid
Size

1.5MB
MD5

174e36c639ec37d282167887286eacd1
SHA1

ae979a9f46f48ad6b0de8bb235db7d985ca00212
SHA256

37c6880fdb6210e327b01387d25bfbb5f07b83fce0276ad58f2f83ea11c38171
SHA512

4e5792532d62118199175dde8a5e3ae3cf1bc0be476f04a694dc22839c6c06bfb13a617b3c856482f8af0f1b49837853ef60f5786244118056d1ac3f24182570
SSDEEP

24576:85FvbTgUEgN1Z/i/FI5sK05awFluAtpWHi2TBlgPM1WZNaYl5e+Zdk32O6ECdQ9z:8CSxSPk34ECdaTDejgprVBV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-03-13_174e36c639ec37d282167887286eacd1_icedid

Files

2024-03-13_174e36c639ec37d282167887286eacd1_icedid
.exe windows:4 windows x86 arch:x86

371f3640eca747b5b32da1a08f9b0a55

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

activeds

ord9
ord3

kernel32

InterlockedIncrement
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
MultiByteToWideChar
WideCharToMultiByte
RaiseException
GetLastError
InitializeCriticalSection
DeleteCriticalSection
GetVersion
lstrcmpiA
lstrlenW
lstrlenA
GetCurrentThread
CompareStringA
CompareStringW
InterlockedDecrement
HeapFree
CloseHandle
HeapAlloc
GetProcessHeap
SizeofResource
LockResource
LoadResource
FindResourceA
lstrcpyA
DeleteFileA
lstrcatA
FreeLibrary
GetProcAddress
SetCurrentDirectoryA
GetCurrentDirectoryA
LoadLibraryA
SetEnvironmentVariableA
IsBadCodePtr
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStringTypeW
GetStringTypeA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
LCMapStringW
LCMapStringA
IsBadWritePtr
VirtualFree
HeapCreate
HeapDestroy
HeapSize
SetStdHandle
SetConsoleCtrlHandler
GetCommandLineA
GetDriveTypeA
ExitProcess
HeapReAlloc
GetDateFormatA
GetTimeFormatA
RtlUnwind
VirtualAlloc
GetOEMCP
GetCPInfo
GlobalFlags
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
TlsGetValue
GlobalHandle
GlobalReAlloc
SetErrorMode
WritePrivateProfileStringA
ConvertDefaultLocale
EnumResourceLanguagesA
lstrcmpA
SetThreadPriority
GetFullPathNameA
GetVolumeInformationA
DuplicateHandle
UnlockFile
LockFile
FlushFileBuffers
VirtualProtect
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
lstrcmpW
FreeResource
SetLastError
GlobalFree
MulDiv
GlobalAlloc
GlobalLock
GlobalUnlock
FlushConsoleInputBuffer
QueryPerformanceCounter
GetStdHandle
GetFileType
OutputDebugStringA
GetSystemTimeAsFileTime
GetSystemInfo
VirtualQuery
FileTimeToDosDateTime
IsBadReadPtr
MoveFileA
CreateDirectoryA
CreatePipe
GetStartupInfoA
CreateThread
TerminateProcess
ExitThread
SetHandleInformation
GetCurrentProcessId
CopyFileA
WinExec
GetTickCount
SetFilePointer
SetEndOfFile
GetTempPathA
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
GetCurrentThreadId
TerminateThread
lstrcpynA
WriteFile
GetFileSize
SystemTimeToTzSpecificLocalTime
GlobalMemoryStatus
ReadFile
CreateFileA
GetTimeZoneInformation
SystemTimeToFileTime
SetFileTime
GetSystemTime
GetLocalTime
GetFileTime
CreateEventA
SuspendThread
SetEvent
ResumeThread
RemoveDirectoryA
GetModuleHandleA
Beep
ReleaseMutex
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
WaitForSingleObject
GetExitCodeProcess
OpenMutexA
CreateMutexA
FindNextFileA
FindFirstFileA
FindClose
FileTimeToLocalFileTime
FileTimeToSystemTime
GlobalMemoryStatusEx
EnterCriticalSection
LeaveCriticalSection
GetFileAttributesA
GetComputerNameA
LocalAlloc
Sleep
GetModuleFileNameA
CreateProcessA
GetCurrentProcess
FormatMessageA
LocalFree

user32

GetSysColorBrush
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
GrayStringA
DrawTextA
TabbedTextOutA
SetWindowContextHelpId
PostQuitMessage
CharNextA
IsRectEmpty
DrawTextExA
SetRect
CopyAcceleratorTableA
InvalidateRect
GetMessageA
ValidateRect
SetMenuItemBitmaps
ModifyMenuA
EnableMenuItem
CheckMenuItem
GetMenuCheckMarkDimensions
IsDialogMessageA
WinHelpA
SetWindowsHookExA
CallNextHookEx
GetClassLongA
GetClassInfoExA
GetClassNameA
SetPropA
GetPropA
RemovePropA
SetFocus
IsChild
GetWindowTextLengthA
GetWindowTextA
InvalidateRgn
GetLastActivePopup
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
MapWindowPoints
GetKeyState
IsWindowVisible
UpdateWindow
GetMenu
AdjustWindowRectEx
EqualRect
GetDlgCtrlID
CallWindowProcA
SetWindowPos
OffsetRect
IntersectRect
SystemParametersInfoA
GetWindowPlacement
ReleaseDC
GetDC
CopyRect
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamA
IsWindowEnabled
GetMenuState
GetMenuItemID
GetNextDlgGroupItem
MessageBeep
GetMenuItemCount
GetSubMenu
GetDesktopWindow
GetUserObjectInformationW
wvsprintfA
GetProcessWindowStation
GetThreadDesktop
GetUserObjectSecurity
SetUserObjectSecurity
DestroyCursor
RedrawWindow
TrackPopupMenu
DestroyMenu
ReleaseCapture
SetCapture
RegisterClipboardFormatA
PostThreadMessageA
GetForegroundWindow
LoadCursorA
SetCursor
LoadBitmapA
GetWindowRect
PtInRect
MapDialogRect
MoveWindow
DestroyIcon
DialogBoxParamA
EndDialog
SetWindowTextA
IsDlgButtonChecked
SetDlgItemTextA
GetDlgItem
ShowWindow
SendDlgItemMessageA
GetDlgItemTextA
GetClassInfoA
GetWindowLongA
SetWindowLongA
GetCursorPos
LoadIconA
GetSystemMetrics
LoadImageA
SetForegroundWindow
IsIconic
GetSystemMenu
InsertMenuA
AppendMenuA
CreatePopupMenu
DrawIcon
RegisterClassA
CreateWindowExA
PeekMessageA
DispatchMessageA
TranslateMessage
DestroyWindow
WaitForInputIdle
DefWindowProcA
wsprintfA
MessageBoxA
GetParent
GetTopWindow
GetSysColor
SendMessageTimeoutA
ExitWindowsEx
KillTimer
SetTimer
IsWindow
GetFocus
GetClientRect
GetNextDlgTabItem
GetWindow
PostMessageA
RegisterWindowMessageA
EnableWindow
SendMessageA
UnregisterClassA
CharUpperA
GetCapture

gdi32

GetRgnBox
GetTextColor
GetBkColor
GetMapMode
GetStockObject
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
DeleteObject
CreateSolidBrush
DeleteDC
GetObjectA
SelectObject
GetDeviceCaps
CreateRectRgnIndirect
GetClipBox
SetTextColor
SetBkColor
CreateBitmap
ExtTextOutA
SaveDC
RestoreDC
SetMapMode
GetViewportExtEx
GetWindowExtEx
PtVisible
RectVisible
TextOutA
SetViewportOrgEx
Escape

comdlg32

GetOpenFileNameA
GetFileTitleA
GetSaveFileNameA

winspool.drv

ClosePrinter
DocumentPropertiesA
OpenPrinterA

advapi32

InitializeSecurityDescriptor
GetAce
GetSecurityDescriptorDacl
MapGenericMask
GetFileSecurityA
ImpersonateLoggedOnUser
OpenThreadToken
AccessCheck
RevertToSelf
FreeSid
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
AddAccessAllowedAce
InitializeAcl
GetLengthSid
EqualSid
LookupAccountSidA
LookupAccountNameA
AllocateAndInitializeSid
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
LsaClose
LsaAddAccountRights
LsaNtStatusToWinError
LsaOpenPolicy
CheckTokenMembership
RegCloseKey
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegOpenKeyA
RegOpenKeyExA
RegEnumKeyA
RegQueryValueA
RegDeleteKeyA
RegisterEventSourceA
ReportEventA
DeregisterEventSource
GetUserNameA
CreateProcessAsUserA
GetAclInformation
AddAce
GetTokenInformation
IsValidSid
CopySid
LogonUserA
QueryServiceConfigA
StartServiceA
QueryServiceStatus
ChangeServiceConfigA
ControlService
DeleteService
OpenServiceA
OpenSCManagerA
CreateServiceA
CloseServiceHandle
GetFileSecurityW

shell32

ord195
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetMalloc
SHGetSpecialFolderLocation
ShellExecuteA
ShellExecuteExA
Shell_NotifyIconA

comctl32

PropertySheetA
CreatePropertySheetPageA
ImageList_Destroy
ImageList_Add
ImageList_Create
ord17

shlwapi

SHDeleteKeyA
PathFindExtensionA
PathStripToRootA
PathFindFileNameA
PathIsUNCA
PathRemoveFileSpecA

oledlg

ord8

ole32

CoFreeUnusedLibraries
CoTaskMemAlloc
OleUninitialize
CoTaskMemFree
CoCreateInstance
CoInitialize
CoUninitialize
CoRegisterMessageFilter
OleInitialize
CoRevokeClassObject
OleIsCurrentClipboard
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CLSIDFromString
CLSIDFromProgID
OleFlushClipboard

oleaut32

OleCreateFontIndirect
SysFreeString
SysStringLen
SysAllocStringByteLen
SysStringByteLen
VariantInit
SafeArrayGetElement
VariantClear
SystemTimeToVariantTime
SysAllocString
VarUdateFromDate
VariantTimeToSystemTime
VarBstrCat
VariantChangeType
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreate
SafeArrayGetUBound
SafeArrayGetLBound
VariantCopy
VarBstrCmp
SafeArrayDestroy
SysAllocStringLen

ws2_32

getpeername
send
WSACancelBlockingCall
shutdown
closesocket
connect
socket
ntohs
getsockname
inet_ntoa
accept
select
listen
bind
htons
gethostbyname
htonl
setsockopt
WSAGetLastError
inet_addr
sendto
recvfrom
ioctlsocket
getsockopt
recv
WSAStartup
WSACleanup
gethostname
WSAAsyncSelect

crypt32

CertFindChainInStore
CertOpenSystemStoreA
CertVerifyCertificateChainPolicy
CertEnumSystemStore
CertGetIntendedKeyUsage
CertGetPublicKeyLength
CertVerifyTimeValidity
CertFreeCertificateContext
CertFreeCertificateChain
CertGetCertificateChain
CertDuplicateCertificateContext
CryptFindOIDInfo
CertCloseStore
PFXImportCertStore
CertAddCertificateContextToStore
CertDeleteCertificateFromStore
CertOpenStore
CertEnumCertificatesInStore
CertGetNameStringA
CertFindCertificateInStore

psapi

GetProcessMemoryInfo

secur32

GetUserNameExA

Sections

.text
Size: 996KB - Virtual size: 994KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 236KB - Virtual size: 233KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 144KB - Virtual size: 180KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 132KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

371f3640eca747b5b32da1a08f9b0a55

Headers

File Characteristics

Imports

version

activeds

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

ws2_32

crypt32

psapi

secur32

Sections

.text Size: 996KB - Virtual size: 994KB

.rdata Size: 236KB - Virtual size: 233KB

.data Size: 144KB - Virtual size: 180KB

.rsrc Size: 132KB - Virtual size: 128KB

.text
Size: 996KB - Virtual size: 994KB

.rdata
Size: 236KB - Virtual size: 233KB

.data
Size: 144KB - Virtual size: 180KB

.rsrc
Size: 132KB - Virtual size: 128KB