2024-03-16_149f95353e40b1a5a93300b24fa97c41_icedid

Sharing

Copy URL Twitter E-mail

General

Target

2024-03-16_149f95353e40b1a5a93300b24fa97c41_icedid
Size

2.4MB
MD5

149f95353e40b1a5a93300b24fa97c41
SHA1

f2f31865b8e3fdb3f21d93ce9c9680515e898d95
SHA256

84a6d8f76f25f33ca333783b303667c6919f796ee6b6a827f6048a4a945f2aa2
SHA512

5bff594056e6c6f725ecc1ad07851d0e986f570190619c91d5f527a2974ea5143210fc183012233e0bdbf285ae12822e35f14d4763027b11d17ae913a2265acc
SSDEEP

24576:z1B0wiCIxf7ysHPbEWyaWytTSfSyPF//SZ:cwitzwWZWYyPF//SZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-03-16_149f95353e40b1a5a93300b24fa97c41_icedid

Files

2024-03-16_149f95353e40b1a5a93300b24fa97c41_icedid
.exe windows:4 windows x86 arch:x86

20220825d0ee276cf43fc67db03cb066

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

gethostname
WSAStartup
WSACleanup
WSAGetLastError
socket
WSAIoctl
closesocket
inet_addr
gethostbyaddr

comctl32

ImageList_Draw
ImageList_Destroy
ImageList_Create
ImageList_GetImageInfo
ImageList_AddMasked
ImageList_SetBkColor
ImageList_GetIcon
ImageList_ReplaceIcon
ord17
ImageList_GetImageCount
_TrackMouseEvent

iphlpapi

GetAdaptersInfo

rpcrt4

UuidToStringA
UuidCreate
RpcStringFreeA

gdiplus

GdipDeleteGraphics
GdipCreateFromHDC
GdipDrawImageRectI
GdiplusShutdown
GdiplusStartup

kernel32

TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
GetCPInfo
GetOEMCP
FileTimeToSystemTime
DeleteFileA
WriteFile
FlushFileBuffers
SetEndOfFile
GetFileSize
GetCurrentProcess
FindClose
FindFirstFileA
GetFullPathNameA
GetCurrentDirectoryA
GetStringTypeA
FileTimeToLocalFileTime
GetDiskFreeSpaceA
TlsGetValue
GetSystemDefaultLangID
GetSystemInfo
FindNextFileA
SetCurrentDirectoryA
GetTickCount
GetWindowsDirectoryA
WinExec
GlobalHandle
GlobalReAlloc
LocalAlloc
InterlockedIncrement
GlobalFlags
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
lstrcpyA
SuspendThread
ResumeThread
SetThreadPriority
GetPrivateProfileStringA
WritePrivateProfileStringA
GetPrivateProfileIntA
InterlockedDecrement
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
lstrcatA
lstrcmpW
GetModuleHandleA
MulDiv
GlobalAlloc
lstrcpynA
GlobalLock
GlobalUnlock
GlobalFree
FreeResource
CreateFileA
SetFilePointer
ReadFile
LoadLibraryExA
GetFileAttributesA
FormatMessageA
LocalFree
CreateEventA
CreateThread
WaitForSingleObjectEx
SetEvent
WaitForSingleObject
lstrcmpA
GetCurrentThreadId
GetProcAddress
FreeLibrary
CloseHandle
SetLastError
CreateMutexA
LoadLibraryA
CreateDirectoryA
GetModuleFileNameA
LeaveCriticalSection
EnterCriticalSection
LoadResource
LockResource
SizeofResource
FindResourceA
CompareStringW
CompareStringA
lstrlenA
lstrlenW
lstrcmpiA
GetVersion
WideCharToMultiByte
MultiByteToWideChar
GetLastError
DeleteCriticalSection
InitializeCriticalSection
RaiseException
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
SetStdHandle
GetTimeZoneInformation
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetStringTypeW
RtlUnwind
HeapFree
HeapReAlloc
HeapAlloc
VirtualProtect
VirtualAlloc
VirtualQuery
GetSystemTimeAsFileTime
GetDriveTypeA
GetStartupInfoA
GetCommandLineA
ExitProcess
ExitThread
TerminateProcess
HeapSize
SetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
IsBadWritePtr
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
GetLocaleInfoW
GetCurrentProcessId
SetErrorMode

user32

WinHelpA
GetCapture
CreateWindowExA
SetWindowsHookExA
CallNextHookEx
GetClassLongA
GetClassInfoExA
SetPropA
GetPropA
RemovePropA
SendDlgItemMessageA
SetFocus
GetWindowTextLengthA
GetWindowTextA
GetLastActivePopup
DispatchMessageA
GetTopWindow
GetMessageTime
GetMessagePos
MapWindowPoints
GetKeyState
IsDialogMessageA
SetWindowTextA
MoveWindow
ShowWindow
DrawStateA
CopyIcon
DestroyCursor
LoadMenuA
GetSysColorBrush
PostQuitMessage
ValidateRect
GetMessageA
TranslateMessage
GetMenuCheckMarkDimensions
ReleaseCapture
WindowFromPoint
SetCapture
DestroyMenu
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
wsprintfA
SetMenuItemBitmaps
ModifyMenuA
CheckMenuItem
DrawFrameControl
IsMenu
SetScrollPos
GetMenu
AdjustWindowRectEx
ScreenToClient
GetClassInfoA
RegisterClassA
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
SetWindowLongA
SetWindowPos
GetWindowPlacement
PtInRect
GetWindow
GetMenuState
GetMenuStringA
GetMenuItemCount
GetDesktopWindow
GetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
GetWindowLongA
GetDlgItem
IsWindowEnabled
GetNextDlgTabItem
EndDialog
DrawIconEx
DrawFocusRect
LoadBitmapA
InflateRect
CopyRect
RegisterWindowMessageA
DrawAnimatedRects
EnumChildWindows
SystemParametersInfoA
GetClassNameA
GetCursorPos
TrackPopupMenu
SetActiveWindow
GetMenuItemID
IsWindow
SetCursor
UpdateWindow
FillRect
OffsetRect
InvalidateRect
RedrawWindow
GetParent
GetDC
ReleaseDC
LoadImageA
PeekMessageA
GetForegroundWindow
IsWindowVisible
GetWindowRect
IsIconic
RemoveMenu
InsertMenuA
GetSubMenu
SetMenuDefaultItem
AppendMenuA
DrawIcon
MessageBoxA
FindWindowA
PostMessageA
MessageBeep
DestroyIcon
GetSystemMetrics
GetIconInfo
LoadIconA
MapDialogRect
SetForegroundWindow
GetFocus
KillTimer
SetTimer
GetSystemMenu
SendMessageA
EnableMenuItem
LoadCursorA
GetSysColor
EnableWindow
GetClientRect
UnregisterClassA
IsRectEmpty
UnhookWindowsHookEx

advapi32

RegDeleteValueA
RegCloseKey
RegOpenKeyExA
RegSetValueExA
RegQueryValueExA
RegCreateKeyExA
RegOpenKeyA
RegDeleteKeyA
RegQueryValueA
RegEnumKeyA

ole32

CoUninitialize
CoInitialize
CoCreateInstance

shell32

SHGetSpecialFolderPathA
ExtractIconExA
SHGetFileInfoA
SHGetMalloc
SHGetPathFromIDListA
SHBrowseForFolderA
SHAppBarMessage
Shell_NotifyIconA
ShellExecuteA

oleaut32

VariantInit
VariantChangeType
VariantClear
SystemTimeToVariantTime
SysAllocString
SysStringLen
SysAllocStringLen
SysFreeString

shlwapi

PathFindFileNameA
PathFindExtensionA
PathRemoveExtensionA

gdi32

CreateDCA
GetObjectA
GetTextExtentPoint32A
GetDeviceCaps
CreateFontIndirectA
CreateCompatibleBitmap
CreateCompatibleDC
Rectangle
BitBlt
CreateSolidBrush
DeleteObject
GetStockObject
SetViewportOrgEx
GetViewportOrgEx
GetClipBox
SetTextColor
SetBkColor
CreateBitmap
SaveDC
RestoreDC
SetBkMode
SetStretchBltMode
SetMapMode
SetTextAlign
SetTextJustification
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
SelectObject
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
DeleteDC
CreateRectRgnIndirect
DPtoLP
CreateDIBSection
SetDIBitsToDevice
StretchBlt

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter

wininet

InternetCloseHandle
InternetOpenA
InternetConnectA
HttpOpenRequestA
InternetReadFile
HttpQueryInfoA
HttpSendRequestA
HttpAddRequestHeadersA

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

Sections

.text
Size: 440KB - Virtual size: 437KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 116KB - Virtual size: 114KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 806KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

20220825d0ee276cf43fc67db03cb066

Headers

File Characteristics

Imports

ws2_32

comctl32

iphlpapi

rpcrt4

gdiplus

kernel32

user32

advapi32

ole32

shell32

oleaut32

shlwapi

gdi32

winspool.drv

wininet

version

Sections

.text Size: 440KB - Virtual size: 437KB

.rdata Size: 116KB - Virtual size: 114KB

.data Size: 24KB - Virtual size: 806KB

.rsrc Size: 1.8MB - Virtual size: 1.8MB

.text
Size: 440KB - Virtual size: 437KB

.rdata
Size: 116KB - Virtual size: 114KB

.data
Size: 24KB - Virtual size: 806KB

.rsrc
Size: 1.8MB - Virtual size: 1.8MB