2024-03-15_f09ed27900625d5a12a85d76eabc633f_floxif_icedid

Sharing

Copy URL

Twitter E-mail

General

Target

2024-03-15_f09ed27900625d5a12a85d76eabc633f_floxif_icedid
Size

638KB
MD5

f09ed27900625d5a12a85d76eabc633f
SHA1

4e8ad0159d6859fffcc887db650e63413b671d0b
SHA256

23587d26a0f3b9e414e890b92e36a57e4c3348744806eb03e7b5a95142ee1a4a
SHA512

8d57c4a581c8337b5d37364f7148f98b29508a68f6c1145b52722fce0cd6473ca9dc929e1a4714c85fb33a0d918621b155775cc48bfab4e3521f31f8186a7ff2
SSDEEP

12288:l+Q/qbp9auCMd077MI6xZSz4RZXy1390oAfV+R4WqBjvrEH7m:l+Q/njMd/7S5d90P0uWcrEH7m

Score

1^/10

Malware Config

Signatures

Files

2024-03-15_f09ed27900625d5a12a85d76eabc633f_floxif_icedid
.exe windows:5 windows x86 arch:x86

048eaae127c0c952b3b0f503fe5e4181

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

52:26:ef:21:b3:01:e5:ea:2c:0c:bd:0d:d3:d3:9f:6e
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

28-12-2010 00:00

Not After

29-12-2013 23:59

Subject

CN=Cimatron Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Cimatron Ltd.,L=Givat Shmuel,ST=Givat Shmuel,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:e9:86:6c:1b:b4:b1:10:03:68:e5:95:5e:cb:b7:fc:23:7c:50:f5
Signer

Actual PE Digest

41:e9:86:6c:1b:b4:b1:10:03:68:e5:95:5e:cb:b7:fc:23:7c:50:f5

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegOpenKeyExA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegDeleteKeyW
RegEnumKeyW
RegOpenKeyW
RegQueryValueW
RegCreateKeyExW
RegQueryValueExA

kernel32

GlobalFlags
WritePrivateProfileStringW
GlobalFindAtomW
CompareStringW
GetVersionExA
TlsGetValue
GlobalUnlock
GlobalFree
FreeResource
SetLastError
GlobalAddAtomW
GlobalDeleteAtom
GetCurrentThread
GetCurrentThreadId
ConvertDefaultLocale
EnumResourceLanguagesW
GlobalReAlloc
GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
DeleteCriticalSection
TlsFree
GetThreadLocale
SetFilePointer
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
DuplicateHandle
FindFirstFileW
GetVolumeInformationW
GetFullPathNameW
CreateFileW
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileAttributesW
GetFileSizeEx
GetFileTime
GetTickCount
GetStartupInfoW
RtlUnwind
RaiseException
ExitProcess
HeapReAlloc
SetStdHandle
GetFileType
HeapSize
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
SetUnhandledExceptionFilter
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetStartupInfoA
HeapCreate
VirtualFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
GetConsoleCP
GetConsoleMode
GetTimeZoneInformation
GetLocaleInfoA
LCMapStringA
GetStringTypeA
GetStringTypeW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA
LoadLibraryA
ExpandEnvironmentStringsA
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
WideCharToMultiByte
lstrlenW
LoadLibraryW
GetProcAddress
FreeLibrary
DeleteFileW
GetTempPathW
GetModuleFileNameW
LoadResource
LockResource
SizeofResource
FindResourceW
GetCommandLineW
MulDiv
GetCurrentProcessId
GetEnvironmentVariableA
GetModuleHandleA
CreateFileA
CloseHandle
ReadFile
LocalAlloc
LocalFree
WriteFile
GetFileSize
FindClose
GetLocalTime
SystemTimeToFileTime
GetSystemTime
GetVersion
DeviceIoControl
SetErrorMode
FindFirstFileA
FindNextFileA
GetModuleFileNameA
GetLastError
Sleep
SearchPathA
WaitForSingleObject
CreateSemaphoreA
OpenSemaphoreA
ReleaseSemaphore
InterlockedIncrement
InterlockedDecrement
GetComputerNameW
GetModuleHandleW
FormatMessageW
HeapFree
HeapAlloc
GetProcessHeap
GetCurrentProcess
GetVersionExW
ReleaseMutex
CreateMutexW
lstrlenA
GlobalAlloc
lstrcmpW
GlobalLock
InterlockedExchange
CompareStringA
GetLocaleInfoW
lstrcmpA

user32

UnregisterClassW
DestroyMenu
GetNextDlgGroupItem
InvalidateRgn
InvalidateRect
CopyAcceleratorTableW
SetRect
IsRectEmpty
CharNextW
CharUpperW
RegisterClipboardFormatW
PostThreadMessageW
MessageBeep
SetWindowLongW
GetSysColorBrush
ReleaseCapture
LoadCursorW
GetClientRect
IsIconic
DrawIcon
GetSystemMetrics
GetWindowRect
SendMessageW
LoadIconW
EnableWindow
PostQuitMessage
PostMessageW
CheckMenuItem
EnableMenuItem
GetMenuState
ModifyMenuW
GetParent
GetFocus
LoadBitmapW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
ValidateRect
GetCursorPos
PeekMessageW
GetKeyState
IsWindowVisible
GetActiveWindow
DispatchMessageW
TranslateMessage
GetMessageW
CallNextHookEx
SetWindowsHookExW
SetCursor
MessageBoxW
IsWindowEnabled
GetLastActivePopup
GetWindowLongW
GetWindowThreadProcessId
EndDialog
GetDlgItem
IsWindow
DestroyWindow
CreateDialogIndirectParamW
SetActiveWindow
GetDesktopWindow
SetWindowPos
MapDialogRect
SetWindowContextHelpId
GetWindow
GetSubMenu
GetMenuItemCount
GetMenuItemID
GetWindowPlacement
SystemParametersInfoA
IntersectRect
OffsetRect
GetNextDlgTabItem
GetMenu
PtInRect
CopyRect
CallWindowProcW
DefWindowProcW
GetDlgCtrlID
EqualRect
ScreenToClient
AdjustWindowRectEx
GetSysColor
RegisterClassW
GetClassInfoW
GetClassInfoExW
CreateWindowExW
UpdateWindow
SetForegroundWindow
SetMenu
MapWindowPoints
GetMessagePos
GetMessageTime
UnhookWindowsHookEx
GetTopWindow
GetForegroundWindow
GetWindowTextW
GetWindowTextLengthW
SetFocus
RemovePropW
GetPropW
SetPropW
GetClassNameW
GetClassLongW
GetCapture
IsChild
WinHelpW
SendDlgItemMessageA
SendDlgItemMessageW
RegisterWindowMessageW
IsDialogMessageW
SetWindowTextW
MoveWindow
ShowWindow
TabbedTextOutW
DrawTextW
DrawTextExW
GrayStringW
ClientToScreen
GetDC
ReleaseDC
GetWindowDC
BeginPaint
EndPaint
SetCapture

winspool.drv

ClosePrinter
DocumentPropertiesW
OpenPrinterW

shell32

SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetMalloc
SHBrowseForFolderW

shlwapi

PathAppendW
PathFindFileNameW
PathRemoveFileSpecW
PathStripToRootW
PathIsUNCW
PathFindExtensionW

oledlg

OleUIBusyW

ole32

CoRegisterMessageFilter
CoUninitialize
CoInitialize
CoSetProxyBlanket
CoCreateInstance
CLSIDFromProgID
CLSIDFromString
CoTaskMemFree
CoTaskMemAlloc
CoInitializeEx
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CoRevokeClassObject
OleIsCurrentClipboard
OleFlushClipboard

oleaut32

VariantCopy
SafeArrayDestroy
SystemTimeToVariantTime
VariantTimeToSystemTime
OleCreateFontIndirect
VariantInit
VariantChangeType
SysAllocStringLen
VariantClear
SysFreeString
SysStringLen
SysAllocStringByteLen
SysAllocString

comdlg32

GetFileTitleW

gdi32

GetBkColor
GetStockObject
DeleteDC
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutW
TextOutW
GetRgnBox
PtVisible
GetTextColor
GetWindowExtEx
GetViewportExtEx
DeleteObject
SetMapMode
RestoreDC
SaveDC
GetObjectW
SetBkColor
SetTextColor
GetClipBox
GetDeviceCaps
CreateBitmap
CreateRectRgnIndirect
GetMapMode
RectVisible

iphlpapi

GetAdaptersInfo

Sections

.text
Size: 430KB - Virtual size: 429KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 70KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 31KB - Virtual size: 410KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

048eaae127c0c952b3b0f503fe5e4181

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

52:26:ef:21:b3:01:e5:ea:2c:0c:bd:0d:d3:d3:9f:6eCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

41:e9:86:6c:1b:b4:b1:10:03:68:e5:95:5e:cb:b7:fc:23:7c:50:f5Signer

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

winspool.drv

shell32

shlwapi

oledlg

ole32

oleaut32

comdlg32

gdi32

iphlpapi

Sections

.text Size: 430KB - Virtual size: 429KB

.rdata Size: 70KB - Virtual size: 69KB

.data Size: 31KB - Virtual size: 410KB

.rsrc Size: 23KB - Virtual size: 23KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

52:26:ef:21:b3:01:e5:ea:2c:0c:bd:0d:d3:d3:9f:6e
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

41:e9:86:6c:1b:b4:b1:10:03:68:e5:95:5e:cb:b7:fc:23:7c:50:f5
Signer

.text
Size: 430KB - Virtual size: 429KB

.rdata
Size: 70KB - Virtual size: 69KB

.data
Size: 31KB - Virtual size: 410KB

.rsrc
Size: 23KB - Virtual size: 23KB