2024-03-26_20636947ff9c26742f15dcd3b1f2f293_icedid

Sharing

Copy URL Twitter E-mail

General

Target

2024-03-26_20636947ff9c26742f15dcd3b1f2f293_icedid
Size

1.0MB
MD5

20636947ff9c26742f15dcd3b1f2f293
SHA1

c2e77a98bdb5756aa2c29eb79bc720189d37d5ad
SHA256

710ed82ca667bb1f30694a541ea8259c52ddc0757483c7c711708bb161e71812
SHA512

c0c730fa8aa3c39781bf4e2d7a55467d4630b8a224b6d3bb0175ce48915f5be336cc5aa69a806984b96c66dd731b16db81ef3eec36074b3cc58c168f57c16f67
SSDEEP

24576:8l/BanLnBzUP8M34/Mwm4NZgPr9Bk2ax3:waLBzUPpkMYNZcS3

Score

1^/10

Malware Config

Signatures

Files

2024-03-26_20636947ff9c26742f15dcd3b1f2f293_icedid
.exe windows:5 windows x86 arch:x86

7f749333afd4c05f7e02b0fbc4ce3581

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

53:4a:be:d0:be:56:d9:84:0d:d1:2d:db:84:f8:b0:31
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

31/07/2009, 00:00

Not After

01/09/2011, 23:59

Subject

CN=NVIDIA Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Software,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

02:a9:a0:fd:a6:fd:39:a8:18:3b:f7:f9:87:f3:ff:11:d2:4c:40:6f
Signer

Actual PE Digest

02:a9:a0:fd:a6:fd:39:a8:18:3b:f7:f9:87:f3:ff:11:d2:4c:40:6f

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\bld\r190_93\drivers\stereo_vision\Apps\NVStView\Release\bin\NvStView.pdb

Imports

winmm

timeGetTime

shlwapi

PathStripToRootA
PathIsUNCA
PathRemoveExtensionA
PathFindFileNameA
PathFindExtensionA
PathRemoveFileSpecW
PathAppendA

nvimage

?UpdateFujiOffsets@@YA_NAAVOffsetsData@@KK@Z
CreateImageObject
DestroyImageObject
??1OffsetsData@@QAE@XZ

d3d9

Direct3DCreate9

kernel32

HeapDestroy
VirtualFree
GetTickCount
GetTimeZoneInformation
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoW
GetProcessHeap
CompareStringW
SetEnvironmentVariableA
GetVersionExA
GetSystemTimeAsFileTime
ExpandEnvironmentStringsW
GetFileAttributesA
SizeofResource
GetSystemDirectoryA
FindFirstFileA
FindNextFileA
FindClose
MoveFileA
ExpandEnvironmentStringsA
FormatMessageW
LocalFree
OutputDebugStringA
QueryPerformanceFrequency
QueryPerformanceCounter
GetModuleHandleA
FindResourceExA
GetLastError
LoadResource
LockResource
GetUserDefaultUILanguage
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
CreateFileW
GetSystemDefaultLCID
FreeLibrary
LoadLibraryA
GetProcAddress
DisableThreadLibraryCalls
HeapCreate
SetLastError
LocalAlloc
LeaveCriticalSection
TlsGetValue
EnterCriticalSection
GlobalLock
GlobalReAlloc
GlobalUnlock
GlobalHandle
GlobalAlloc
InitializeCriticalSection
TlsAlloc
TlsSetValue
LocalReAlloc
DeleteCriticalSection
GlobalFree
TlsFree
GetModuleFileNameW
InterlockedDecrement
FindResourceA
WideCharToMultiByte
GetModuleFileNameA
GetCurrentProcessId
lstrlenA
MulDiv
MultiByteToWideChar
lstrlenW
FormatMessageA
GlobalSize
CopyFileA
CloseHandle
SetThreadPriority
ResumeThread
GetCurrentThreadId
WaitForSingleObject
SetEvent
SuspendThread
CreateEventA
CompareStringA
GetModuleHandleW
InterlockedIncrement
GlobalGetAtomNameA
GetAtomNameA
lstrcmpA
GetThreadLocale
FileTimeToSystemTime
SystemTimeToFileTime
lstrcmpW
GlobalDeleteAtom
GlobalFindAtomA
GlobalAddAtomA
FreeResource
DeleteFileA
GetStringTypeExA
lstrcmpiA
ReadFile
WriteFile
SetFilePointer
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
GetFileSize
DuplicateHandle
GetCurrentProcess
GetVolumeInformationA
GetFullPathNameA
GetShortPathNameA
CreateFileA
GlobalFlags
InterlockedExchange
GetLocaleInfoA
EnumResourceLanguagesA
ConvertDefaultLocale
GetCurrentThread
GetCPInfo
GetOEMCP
SetErrorMode
FileTimeToLocalFileTime
LocalFileTimeToFileTime
SetFileTime
SetFileAttributesA
GetFileSizeEx
GetFileTime
GetPrivateProfileIntA
WritePrivateProfileStringA
GetPrivateProfileStringA
GetCurrentDirectoryA
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
Sleep
ExitProcess
CreateDirectoryA
GetConsoleCP
GetConsoleMode
GetCommandLineA
GetStartupInfoA
HeapAlloc
HeapFree
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapReAlloc
ExitThread
CreateThread
HeapSize
GetACP
IsValidCodePage
LCMapStringA
LCMapStringW
GetStdHandle
FatalAppExitA
SetConsoleCtrlHandler
InitializeCriticalSectionAndSpinCount
SetStdHandle
GetFileType
SetHandleCount
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FreeEnvironmentStringsA

user32

SetForegroundWindow
GetScrollPos
SetScrollPos
GetScrollRange
SetScrollRange
TrackPopupMenuEx
ScrollWindow
MapWindowPoints
GetMessagePos
GetMessageTime
GetTopWindow
EndDeferWindowPos
BeginDeferWindowPos
SetActiveWindow
IsWindow
RemovePropA
GetPropA
SetPropA
GetClassNameA
GetClassLongA
IsChild
WinHelpA
RegisterWindowMessageA
CheckRadioButton
IsDialogMessageA
SetWindowTextA
MoveWindow
ScrollWindowEx
DestroyIcon
CharUpperA
GetDesktopWindow
InflateRect
GetMenuItemInfoA
FillRect
TabbedTextOutA
DrawTextA
DrawTextExA
GrayStringA
GetWindowDC
BeginPaint
EndPaint
SetRectEmpty
ShowOwnedPopups
DeleteMenu
ShowScrollBar
CreateDialogIndirectParamA
BringWindowToTop
CreatePopupMenu
InsertMenuItemA
ReleaseCapture
GetMenuBarInfo
LoadMenuA
ReuseDDElParam
UnpackDDElParam
SetRect
WindowFromPoint
GetDialogBaseUnits
GetKeyNameTextA
MapVirtualKeyA
IsRectEmpty
GetSystemMenu
SetParent
UnionRect
GetDCEx
LockWindowUpdate
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
GetFocus
ModifyMenuA
SetScrollInfo
GetWindowTextLengthA
GetWindowTextA
GetSysColor
GetSysColorBrush
SetWindowsHookExA
CallNextHookEx
GetActiveWindow
IsWindowVisible
PeekMessageA
ValidateRect
GetMenuState
AppendMenuA
GetMenuItemID
GetMenuItemCount
GetWindowThreadProcessId
GetLastActivePopup
IsWindowEnabled
MessageBoxA
UnhookWindowsHookEx
UpdateWindow
GetClassInfoExA
GetClassInfoA
AdjustWindowRectEx
EqualRect
DeferWindowPos
GetNextDlgTabItem
GetScrollInfo
CopyRect
PtInRect
GetWindow
SetWindowPlacement
GetDlgCtrlID
OffsetRect
IntersectRect
SystemParametersInfoA
IsIconic
LoadAcceleratorsA
TranslateAcceleratorA
DestroyAcceleratorTable
FindWindowA
InvalidateRect
LoadIconA
PostMessageA
GetMenuStringA
InvalidateRgn
GetCapture
ClientToScreen
GetKeyState
TrackPopupMenu
DestroyMenu
SetCapture
ShowWindow
PostQuitMessage
GetDlgItemInt
SendMessageW
EnumDisplaySettingsExA
SendDlgItemMessageA
IsDlgButtonChecked
EnableWindow
ChildWindowFromPoint
SetWindowLongA
CheckDlgButton
GetMenu
EnableMenuItem
wsprintfW
RemoveMenu
InsertMenuA
GetSubMenu
EnumDisplayDevicesA
ScreenToClient
GetDlgItemTextA
SetDlgItemTextA
ShowCursor
GetCursorInfo
MessageBoxW
GetCursorPos
SetDlgItemInt
EndDialog
DefWindowProcA
RegisterClassA
CreateWindowExA
SetFocus
DestroyWindow
UnregisterClassA
GetDC
GetWindowPlacement
CheckMenuItem
GetWindowRect
KillTimer
GetAsyncKeyState
DispatchMessageA
TranslateMessage
GetMessageA
SetTimer
SetWindowPos
SetCursor
LoadCursorA
ClipCursor
SetCursorPos
GetForegroundWindow
LoadMenuIndirectW
GetWindowInfo
SetMenu
CreateDialogIndirectParamW
DialogBoxIndirectParamW
GetSystemMetrics
ReleaseDC
SendMessageA
GetWindowLongA
CallWindowProcA
GetClientRect
GetParent
GetDlgItem

gdi32

GetViewportExtEx
GetWindowExtEx
GetPixel
StartDocA
PtVisible
RectVisible
TextOutA
Escape
SelectClipPath
CreateRectRgn
GetClipRgn
SelectClipRgn
SetColorAdjustment
SetArcDirection
SetMapperFlags
SetTextCharacterExtra
RestoreDC
SaveDC
ExtTextOutA
SetBkMode
SetPolyFillMode
SetROP2
SetStretchBltMode
SetGraphicsMode
SetWorldTransform
ModifyWorldTransform
SetMapMode
ExcludeClipRect
IntersectClipRect
OffsetClipRgn
LineTo
MoveToEx
SetTextAlign
CreateCompatibleDC
BitBlt
DeleteDC
Rectangle
GetDeviceCaps
SelectObject
GetTextExtentPoint32A
GetStockObject
CreateBitmap
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
CreateFontIndirectA
GetObjectA
SetBkColor
SetTextColor
GetClipBox
GetDCOrgEx
CreateDCA
DeleteObject
CopyMetaFileA
GetTextMetricsA
GetBkColor
DPtoLP
PatBlt
GetMapMode
CombineRgn
SetRectRgn
CreateRectRgnIndirect
CreateCompatibleBitmap
StretchDIBits
CreateFontA
GetCharWidthA
CreateHatchBrush
CreateSolidBrush
ExtCreatePen
CreatePen
PlayMetaFile
EnumMetaFile
GetObjectType
PlayMetaFileRecord
SelectPalette
CreatePatternBrush
CreateDIBPatternBrushPt
ExtSelectClipRgn
PolyBezierTo
PolylineTo
PolyDraw
ArcTo
GetCurrentPositionEx
ScaleWindowExtEx
SetTextJustification

comdlg32

GetFileTitleA
GetOpenFileNameW

advapi32

RegSetValueA
RegCreateKeyExA
RegCreateKeyA
RegOpenKeyA
RegQueryValueA
RegDeleteKeyA
RegEnumKeyA
RegSetValueExA
RegDeleteValueA
RegOpenKeyExW
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegEnumValueA
RegQueryValueExW

shell32

SHGetMalloc
ExtractIconA
ShellExecuteA
DragQueryFileA
DragFinish
DragAcceptFiles
SHGetDesktopFolder
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA

ole32

ReadFmtUserTypeStg
OleRegGetUserType
ReadClassStg
CoUninitialize
SetConvertStg
CoTaskMemFree
StringFromCLSID
CoTreatAsClass
CreateBindCtx
ReleaseStgMedium
CoTaskMemAlloc
OleDuplicateData
StringFromGUID2
CoDisconnectObject
CoCreateInstance
WriteClassStg
CLSIDFromString
CoInitialize
WriteFmtUserTypeStg
CoInitializeEx

oleacc

LresultFromObject
AccessibleObjectFromWindow
CreateStdAccessibleObject

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

oleaut32

SysFreeString
SysStringLen
SysAllocStringByteLen
SysStringByteLen
RegisterTypeLi
LoadTypeLi
LoadRegTypeLi
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetElemsize
SafeArrayGetDim
SafeArrayCreate
VariantClear
SafeArrayRedim
VariantChangeType
VariantCopy
SafeArrayAllocDescriptor
SafeArrayCopy
SafeArrayGetElement
SafeArrayPtrOfIndex
SafeArrayPutElement
SafeArrayLock
SafeArrayUnlock
SafeArrayDestroy
SafeArrayDestroyData
SafeArrayDestroyDescriptor
SysAllocStringLen
VariantTimeToSystemTime
SystemTimeToVariantTime
SysReAllocStringLen
VarDateFromStr
VarBstrFromCy
VarBstrFromDec
VarDecFromStr
VarCyFromStr
VarBstrFromDate
VariantInit
SafeArrayAllocData

Sections

.text
Size: 521KB - Virtual size: 520KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 98KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 21KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 418KB - Virtual size: 488KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

7f749333afd4c05f7e02b0fbc4ce3581

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

61:0c:12:06:00:00:00:00:00:1bCertificate

Key Usages

53:4a:be:d0:be:56:d9:84:0d:d1:2d:db:84:f8:b0:31Certificate

Extended Key Usages

Key Usages

02:a9:a0:fd:a6:fd:39:a8:18:3b:f7:f9:87:f3:ff:11:d2:4c:40:6fSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

winmm

shlwapi

nvimage

d3d9

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleacc

winspool.drv

oleaut32

Sections

.text Size: 521KB - Virtual size: 520KB

.rdata Size: 98KB - Virtual size: 97KB

.data Size: 21KB - Virtual size: 85KB

.rsrc Size: 418KB - Virtual size: 488KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

53:4a:be:d0:be:56:d9:84:0d:d1:2d:db:84:f8:b0:31
Certificate

02:a9:a0:fd:a6:fd:39:a8:18:3b:f7:f9:87:f3:ff:11:d2:4c:40:6f
Signer

.text
Size: 521KB - Virtual size: 520KB

.rdata
Size: 98KB - Virtual size: 97KB

.data
Size: 21KB - Virtual size: 85KB

.rsrc
Size: 418KB - Virtual size: 488KB