65dc9f50ea56438fb056a7d5c6a3f0d60f746562a41cb036ce2e34de44039de2
- SHA256 65dc9f50ea56438fb056a7d5c6a3f0d60f746562a41cb036ce2e34de44039de2
Password
infected
Behavioral task
behavioral1
Sample
adjure.04.30.2021.docm
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
adjure.04.30.2021.docm
Resource
win10v2004-20231215-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
jaazci2.dll
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
jaazci2.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
leftTitleRepo.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
leftTitleRepo.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 65dc9f50ea56438fb056a7d5c6a3f0d60f746562a41cb036ce2e34de44039de2
- Size 1.6MB
- Sample240313-ykn37aee41
- SHA256 65dc9f50ea56438fb056a7d5c6a3f0d60f746562a41cb036ce2e34de44039de2
- MD5 d36553fb4c3261800b5a06107a15b3bf
- SHA1 ba0194ead229fa5ee156112f9754f3ae6b9498d4
- SHA512 813925a5fbc4337526607592d9c8e97e24cafc26576ad7a1bfef7b8b0255418c50022270a102304be3b878233a7714408ed316785ef1d63ffe7e78383eadc8e9
- SSDEEP 49152:463ft6vjuNVJMl5+BNa9OaCyHo9pBZ6A/P1bdbN:4u6juNVJMl5+BN6FCDbBZ6A/PDR
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
-
resource static1/unpack001/adjure.04.30.2021.doc - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/jaazci2.dll unpack001/leftTitleRepo.jpg
File Explorer
-
65dc9f50ea56438fb056a7d5c6a3f0d60f746562a41cb036ce2e34de44039de2.zip 1.6MB
-
2021-04-30-IcedID-malware-list.txt1KB
-
2021-04-30-fake-gzip-binary-from-desazasilkor.top.bin.gz 380KB
-
2021-04-30-infection-traffic-screenshot.jpg.jpg 831KB
-
2021-04-30-scheduled-task-for-icedID.txt3KB
-
adjure.04.30.2021.doc.docm .doc 76KB
-
jaazci2.dll.dll 47KB
-
leftTitleRepo.jpg.dll 55KB
-
license.dat333KB
2021-04-30-IcedID-malware-list.txt
- SHA256 47f15abd6dd2f392e7f3809e07fdce9fbefd3c21d51ba2455aad632815c8db51
- MD5 8e9c9048e8e33eafa91363451dc22fc1
- SHA1 b4f2657a96e1c4ef6c6c23a8a5d271f8ecc875f9
- SHA512 cf62a367cf97df830eab4c376e002f24178cfaecdf70b54efadf8a58e7620d5293d9a1c7d6b1286f4a1f43f1a99bb8f9878913429da6f62086abe553322bac6e
- MD5 SHA1 SHA512
2021-04-30-fake-gzip-binary-from-desazasilkor.top.bin
- SHA256 f9b219db3bc9ec99fbeb35d4eee180343ea15943fe650e0b692116597a0dcc6a
- MD5 bd8142f9a4c77e77859d22d529a0f2ab
- SHA1 7298dbc38413508cdcb80f4af99987e9e7403cca
- SHA512 b24b95acf11020ef6130c0e9e79641ab31c57334c34d98c32ef1d25a36a1df1300be32dc7110fd1f0525820054bf7a462485a4ede77e9e375bd3a4fbf69da432
- SSDEEP 6144:0icJ/j0p4Psq+EG/SlSEUQfaz2TCZqAE5j9Ry6RBALdcGZoC2l3k3lvPWPZBMJH:wre40FEiSl3zfaz2GMAGjXyyudcGD2hi
- MD5 SHA1 SHA512 SSDEEP
2021-04-30-infection-traffic-screenshot.jpg
- SHA256 5c54a676c6d3472c628c602031f8229eeb6595ffefad07818a2180f1962f1b49
- MD5 fe14fa226c180ff967252c795ffcf301
- SHA1 3b938960e44dc6224fc38bfb4413e7e0da1bf5b9
- SHA512 1209ce8c6abd03b2ba2c702b5bd55a7078813f67577f778537bbcdb6bcf421758f44a9d0916cd205500bcf0a5473eab584841cbe2ffebe058e523f92589d7452
- SSDEEP 12288:TwPpg7dSf71OL0/035nACZd5Mi9xEaMYOctR7WaBlMEAdO8hI4kh6rBfJWQctkkm:TweEOL0UnAuoYOinWY8hFXrbWQ6f6B3
- MD5 SHA1 SHA512 SSDEEP
2021-04-30-scheduled-task-for-icedID.txt
- SHA256 9a92ea3f83a88b32424ddfea77ec8901fef9ec88b174bc1f4a66a63c0dd0fd87
- MD5 d2e87d5c1deb30b12c968e6154dc94ae
- SHA1 3368f66d5a4601836d27eba95e8f9a797b28c727
- SHA512 e960ab9058a03b52c2281c135dbe2345a978967a33b87d701f5b7e3876890fe67430fa472e4f0c7c63e46ff4b697cde03a4f300b9b76a5c671f7db9d53049d25
- MD5 SHA1 SHA512
adjure.04.30.2021.doc
- SHA256 b3dbdf013c494dc354374a50e95635d53d2dabfc59527a17a5f104e8deb07554
- MD5 9749a2caec0f624162f5face69dee4b6
- SHA1 fb2135c7ca8b93a84a5e42fe4d6b844c21b7936c
- SHA512 29ac52a776927704ca72e5c26d1dbfce9bc8218371efb30f847b94714460816bcd8953d141dfdeaa9f31a6d2a879a302f2498edfb4aad2adcd927571bdb744c0
- SSDEEP 1536:jTcpJQrigxDjV+l0rM81NCGCPisEHOAq4eyO6i1itW7YUvOMkksCLlg33h:jyJQe6nnrxRCPdYZuyL3t5UmMkkoHh
- MD5 SHA1 SHA512 SSDEEP
ThisDocument
UserForm1
lenLoadOption
mainTextboxException
countDataCounter
jaazci2.dll
- IMPHASH cfa8dd488fd4044f7dbcc5838881a33c
- SHA256 9164570c7f50fe724aaeffeb1a30b3531053f17ab805cf85a780102335dbdde3
- MD5 b6451a4daa6c2eb8d8900e60a3abcc27
- SHA1 b32f6d53eab87a178c059a5c1bdfbf11d76b9146
- SHA512 282092e0d62065c5023c2720c80f32c2fd568cae24791173248662d0e2d3db55732275b8a9fa89dcd73d6c6f3a54ec980e6db8bbb2dcb91d2b9510c202aa55eb
- SSDEEP 768:dZ+kEL8Bt5WdLdPcN+OiV/5pMY6gjPREPhfSog+L+1AgXJpF6T:dZvEL8+RPfNVn6gjJ05W17XY
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
7507
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
LoadLibraryA
GetCurrentThreadId
GetCurrentProcessId
GetProcAddress
?druio@@YAHXZ
?dweby@@YAHXZ
?hoprtw@@YAHXZ
PluginInit
update
Name
.text
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
180B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=259, version=25930,
count=3, id=257, version=25203,
count=4, id=1, productName=Unmarked objects,
count=5, productName=Unmarked objects (old),
count=1, id=256, productName=VS2017 v15.6.0 build 26128, version=26128,
count=1, id=258, productName=VS2017 v15.6.0 build 26128, version=26128,
leftTitleRepo.jpg
- IMPHASH cfa8dd488fd4044f7dbcc5838881a33c
- SHA256 2f20a4b32df2bcdd3a013998c40079a021e42203b0f7d44cdc85c8ab8689c5b0
- MD5 0d366e2470025a3bd66baa22c6aa78df
- SHA1 45e57932f502b4658546d626b76b93a5136c0239
- SHA512 fe243d4f28b287c262b72598b4cb76451637dd76486428e84e2ffd99d03af2f8666833addf6dd9e6dda1744b688bb8c6634e74c90815432ce275e47fb69b9c45
- SSDEEP 768:Pn8Sg0+bpDPQPqxBtfQqxonY1rCsxPbEBJHVpEyVfkgAv36HAV1Mb7nTaqx:kDtEQBaQoSPIB5evK6qbna8
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
6401
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
LoadLibraryA
GetCurrentThreadId
GetCurrentProcessId
GetProcAddress
?druio@@YAHXZ
?dweby@@YAHXZ
?hoprtw@@YAHXZ
DllRegisterServer
PluginInit
Name
.text
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
180B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=259, version=25930,
count=3, id=257, version=25203,
count=4, id=1, productName=Unmarked objects,
count=5, productName=Unmarked objects (old),
count=1, id=256, productName=VS2017 v15.6.0 build 26128, version=26128,
count=1, id=258, productName=VS2017 v15.6.0 build 26128, version=26128,
license.dat
- SHA256 29d2a8344bd725d7a8b43cc77a82b3db57a5226ce792ac4b37e7f73ec468510e
- MD5 3c6263a9c4117c78d26fc4380af014f2
- SHA1 eca410dd57af16227220e08067c1895c258eb92b
- SHA512 0969cde0d327b9f4b2be708437aea2a1d7a9ba9482125e143ce25c6a2f07e8ee1fa9b23e12f4e88157305f59209e2a8b3a2b2e7eb143b114e3f0c95ba57a2e1a
- SSDEEP 6144:zsBoiLlIorxTbp4o8x4It25elAQpB/lP3O21uZoXq8ZTipooUDFkPt8gi976D+se:YKIIMxTbp4otQAQpdl221U89ipTc4CRd
- MD5 SHA1 SHA512 SSDEEP