2024-03-14_56e93bb4b6a0abbebf705af02278e380_icedid

Sharing

Copy URL

Twitter E-mail

General

Target

2024-03-14_56e93bb4b6a0abbebf705af02278e380_icedid
Size

1.3MB
MD5

56e93bb4b6a0abbebf705af02278e380
SHA1

9b06a0e1e30c264c0dbb47e762ef98ce8efdfbeb
SHA256

d17efa3884eba636d5a00093a0c4f26714f71b4abe3cc97ed895d9bba7094d83
SHA512

806230eb70daf196e8679e336785a1038abfbc008bca58572f7f56d4f91803495851544c347c4520461c5b07f818e662be65ee57c342e9925e131531982824aa
SSDEEP

12288:GA/qXvfxFT1QYq+3Ypd8v4+IP9HgxbpoTh:BSnx95q+Auv4Xgxpk

Score

1^/10

Malware Config

Signatures

Files

2024-03-14_56e93bb4b6a0abbebf705af02278e380_icedid
.exe windows:4 windows x86 arch:x86

568a53cd99f2b79672798230c2c2167c

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

17-11-2006 00:00

Not After

16-07-2036 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

29:f4:26:80:e6:53:cf:8f:af:d0:e9:35:55:3f:7e:86
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

07-11-2013 00:00

Not After

06-01-2016 23:59

Subject

CN=Wemade Entertainment co.\,Ltd,OU=IT Team,O=Wemade Entertainment co.\,Ltd,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\Work\Service\SVN\Korea\Ls\LSWebBroker_2\Release\LSWebBroker.pdb

Imports

winmm

timeGetTime

kernel32

GetOEMCP
SetErrorMode
GetFileTime
HeapAlloc
HeapFree
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
RtlUnwind
ExitProcess
GetStartupInfoA
GetCommandLineA
HeapReAlloc
TerminateProcess
HeapSize
SetStdHandle
GetFileType
GetCPInfo
HeapCreate
VirtualFree
IsBadWritePtr
GetTickCount
GetSystemTimeAsFileTime
SetUnhandledExceptionFilter
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetTimeZoneInformation
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
GetLocaleInfoW
SetEnvironmentVariableA
GlobalFlags
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
TlsGetValue
GlobalHandle
GlobalReAlloc
InterlockedIncrement
RaiseException
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
LocalAlloc
FileTimeToLocalFileTime
FileTimeToSystemTime
GetFullPathNameA
GetVolumeInformationA
FindFirstFileA
FindClose
GetCurrentProcess
DuplicateHandle
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
WaitForSingleObject
GetCurrentThread
lstrcmpA
GetModuleFileNameA
ConvertDefaultLocale
EnumResourceLanguagesA
lstrcpyA
GetCurrentThreadId
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
LoadLibraryA
FreeLibrary
lstrcatA
lstrcmpW
InterlockedDecrement
FreeResource
SetLastError
GlobalFree
MulDiv
GlobalAlloc
GlobalLock
GlobalUnlock
lstrcpynA
LocalFree
GetDiskFreeSpaceExA
GlobalMemoryStatus
WritePrivateProfileStringA
GetPrivateProfileStringA
GetPrivateProfileIntA
Sleep
CreateDirectoryA
CreateFileA
ReadFile
GetFileSize
QueryPerformanceCounter
QueryPerformanceFrequency
GetModuleHandleA
GetProcAddress
GetCurrentProcessId
FormatMessageA
GetWindowsDirectoryA
GetFileAttributesA
SetFileAttributesA
DeleteFileA
GetCurrentDirectoryA
SetCurrentDirectoryA
CreateProcessA
CreateMutexA
OpenMutexA
CloseHandle
ReleaseMutex
FindResourceA
LoadResource
LockResource
SizeofResource
CompareStringW
CompareStringA
lstrlenA
lstrcmpiA
GetVersion
GetLastError
WideCharToMultiByte
MultiByteToWideChar
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
HeapDestroy

user32

GetSysColorBrush
WindowFromPoint
WaitMessage
UnpackDDElParam
ReuseDDElParam
LoadMenuA
DestroyMenu
ReleaseCapture
LoadAcceleratorsA
InsertMenuItemA
CreatePopupMenu
SetRectEmpty
BringWindowToTop
SetMenu
TranslateAcceleratorA
GetMessageA
TranslateMessage
GetCursorPos
ValidateRect
ShowOwnedPopups
SetCursor
SetMenuItemBitmaps
ModifyMenuA
CheckMenuItem
GetMenuCheckMarkDimensions
ShowWindow
MoveWindow
SetWindowTextA
IsDialogMessageA
RegisterWindowMessageA
WinHelpA
GetCapture
CreateWindowExA
SetWindowsHookExA
CallNextHookEx
GetClassLongA
GetClassInfoExA
GetClassNameA
SetPropA
GetPropA
RemovePropA
SendDlgItemMessageA
GetFocus
GetForegroundWindow
GetLastActivePopup
DispatchMessageA
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
GetMessageTime
GetMessagePos
PeekMessageA
MapWindowPoints
MessageBoxA
TrackPopupMenu
GetKeyState
UpdateWindow
AdjustWindowRectEx
EqualRect
DeferWindowPos
GetClassInfoA
RegisterClassA
UnregisterClassA
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
OffsetRect
IntersectRect
IsIconic
GetWindowPlacement
CopyRect
PtInRect
GetSysColor
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
ClientToScreen
ScreenToClient
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
FillRect
UnhookWindowsHookEx
GetDesktopWindow
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
GetDlgItem
IsWindowEnabled
GetNextDlgTabItem
EndDialog
wsprintfA
GetWindowTextLengthA
GetWindowTextA
GetParent
GetWindow
SetFocus
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
WaitForInputIdle
LoadImageA
PostMessageA
GetWindowLongA
SetWindowLongA
RedrawWindow
GetMenuItemInfoA
InflateRect
LoadCursorA
IsWindow
LoadIconA
GetClientRect
GetSystemMetrics
SetWindowPos
PostQuitMessage
SetForegroundWindow
FindWindowA
KillTimer
SetTimer
IsWindowVisible
InvalidateRect
SendMessageA
LoadBitmapA
SystemParametersInfoA
EnableWindow
GetWindowRect
CharUpperA
GetMenu
EnableMenuItem

gdi32

CreateCompatibleBitmap
GetTextExtentPoint32A
CreateFontIndirectA
GetStockObject
CreateBitmap
CreatePatternBrush
DeleteDC
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
CreateFontA
CreateSolidBrush
GetClipBox
SetMapMode
SetTextColor
SetBkMode
SetBkColor
RestoreDC
SaveDC
GetDeviceCaps
SelectObject
GetObjectA
StretchBlt
DeleteObject
BitBlt
CreateCompatibleDC
GetPixel

comdlg32

GetFileTitleA

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter

advapi32

RegSetValueExA
RegCreateKeyExA
RegQueryValueExA
RegOpenKeyA
RegOpenKeyExA
RegDeleteKeyA
RegEnumKeyA
RegQueryValueA
RegCloseKey

shell32

SHBrowseForFolderA
SHGetMalloc
Shell_NotifyIconA
DragFinish
DragQueryFileA
SHGetPathFromIDListA

comctl32

ord17
_TrackMouseEvent
ImageList_Draw
ImageList_GetImageInfo
ImageList_Destroy

shlwapi

PathFindFileNameA
PathStripToRootA
PathIsUNCA
PathFindExtensionA
UrlUnescapeA

oleaut32

VariantClear
VariantChangeType
VariantInit

wininet

InternetCrackUrlA
InternetCanonicalizeUrlA
InternetQueryOptionA
InternetGetLastResponseInfoA
InternetSetStatusCallback
InternetSetFilePointer
InternetWriteFile
InternetReadFile
InternetQueryDataAvailable
InternetCloseHandle
InternetOpenUrlA
InternetOpenA

ws2_32

closesocket
accept
socket
select
gethostbyname
htonl
WSACleanup
inet_addr
bind
WSAGetLastError
WSASetLastError
WSAStartup
htons
sendto
recvfrom
WSAAsyncSelect
send
recv
connect

Sections

.text
Size: 208KB - Virtual size: 205KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 64KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1016KB - Virtual size: 1012KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

568a53cd99f2b79672798230c2c2167c

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6dCertificate

Key Usages

29:f4:26:80:e6:53:cf:8f:af:d0:e9:35:55:3f:7e:86Certificate

Extended Key Usages

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

PDB Paths

Imports

winmm

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oleaut32

wininet

ws2_32

Sections

.text Size: 208KB - Virtual size: 205KB

.rdata Size: 64KB - Virtual size: 61KB

.data Size: 12KB - Virtual size: 27KB

.rsrc Size: 1016KB - Virtual size: 1012KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d
Certificate

29:f4:26:80:e6:53:cf:8f:af:d0:e9:35:55:3f:7e:86
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

.text
Size: 208KB - Virtual size: 205KB

.rdata
Size: 64KB - Virtual size: 61KB

.data
Size: 12KB - Virtual size: 27KB

.rsrc
Size: 1016KB - Virtual size: 1012KB