2024-03-27_b4b03885d7f1a93dd0a3ebe1a0381dc6_icedid_vidar_zxxz

Sharing

Copy URL

Twitter E-mail

General

Target

2024-03-27_b4b03885d7f1a93dd0a3ebe1a0381dc6_icedid_vidar_zxxz
Size

10.2MB
MD5

b4b03885d7f1a93dd0a3ebe1a0381dc6
SHA1

360ae301603e4b0ce6cce39ee724dd1ab556afee
SHA256

37af1f0b90558f4a4dd4dad96fe99d1b8715a701cd47d91c972d1e88315fef59
SHA512

d05a334da1cab2052c45470777aaf2bb527b5ea5d303fd3ddd84688649a16bd80ca612c84576a9bd1b23a85aadb85eb555c4875730063c4f15e687180c119698
SSDEEP

196608:JwxidsO7NNmu37GdGpvx9Tnlng3wIamoYQ8WD/Vt3T0J3p:y4sU7ZZ9Z1Iam

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-03-27_b4b03885d7f1a93dd0a3ebe1a0381dc6_icedid_vidar_zxxz

Files

2024-03-27_b4b03885d7f1a93dd0a3ebe1a0381dc6_icedid_vidar_zxxz
.exe windows:5 windows x86 arch:x86

d3edb8b3d0915036fb5fe86ab95bdabc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\svn\nsp.netshield6\trunk\imp\place\code\pc\barclient\barclient\bin\barclient.pdb

Imports

wininet

InternetReadFile
InternetOpenA
InternetOpenUrlA
InternetCloseHandle

psapi

GetModuleFileNameExA
EnumProcessModules
GetModuleBaseNameA
EnumProcesses

iphlpapi

GetAdaptersAddresses

setupapi

SetupDiGetDeviceInstanceIdA
SetupDiGetClassDevsA
SetupDiGetDeviceRegistryPropertyA
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo

kernel32

LockResource
SizeofResource
FindResourceA
FindResourceExA
lstrlenA
GetProcAddress
GetModuleHandleW
CreateToolhelp32Snapshot
Process32First
OpenProcess
Process32Next
GetTempPathA
GetSystemDirectoryA
SetFileAttributesA
FreeResource
GetVersionExA
GetLocalTime
GlobalLock
GlobalUnlock
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
WaitForSingleObject
ReleaseMutex
LoadLibraryA
VirtualAlloc
VirtualFree
VirtualProtect
SetLastError
HeapAlloc
GetProcessHeap
HeapFree
CreateProcessA
GetExitCodeProcess
GetFileAttributesA
GetFileSize
ReadFile
CopyFileA
CreateDirectoryA
IsWow64Process
GetCurrentDirectoryA
SetCurrentDirectoryA
GlobalFree
FileTimeToLocalFileTime
FileTimeToSystemTime
lstrcpyA
lstrcatA
GetFullPathNameA
InterlockedIncrement
InterlockedDecrement
UnhandledExceptionFilter
SetUnhandledExceptionFilter
WriteFile
ExitThread
GetCurrentThreadId
CreateThread
GetSystemTimeAsFileTime
GetSystemInfo
VirtualQuery
GetFileType
SetFilePointer
HeapReAlloc
MultiByteToWideChar
GetStartupInfoA
RaiseException
RtlUnwind
LCMapStringA
LCMapStringW
GetCPInfo
LoadResource
CreateFileW
GetConsoleCP
GetConsoleMode
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
HeapSize
ExitProcess
GetTimeFormatA
GetDateFormatA
GetACP
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
GetStdHandle
HeapCreate
HeapDestroy
SetStdHandle
SetEndOfFile
SetHandleCount
FlushFileBuffers
GetTimeZoneInformation
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
SetConsoleCtrlHandler
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
InitializeCriticalSectionAndSpinCount
GetLocaleInfoW
CompareStringA
CompareStringW
SetEnvironmentVariableA
InterlockedExchange
GlobalAlloc
DeleteFileA
SetErrorMode
GetLastError
CreateMutexA
GetCurrentProcess
TerminateProcess
GetModuleHandleA
GetDriveTypeA
Sleep
FindNextFileA
PeekNamedPipe
WaitForMultipleObjects
ExpandEnvironmentStringsA
GetVersion
GlobalMemoryStatus
FlushConsoleInputBuffer
CreateFileA
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
FreeLibrary
InitializeCriticalSection
GetModuleFileNameA
FindClose
FindFirstFileA
FormatMessageA
SleepEx
InterlockedCompareExchange
WideCharToMultiByte
GetStringTypeExA
GetTickCount
GetCommandLineA
CloseHandle
GetFileInformationByHandle
ReadConsoleInputA
SetConsoleMode
IsDebuggerPresent

user32

GetParent
ReleaseDC
GetWindowRect
GetWindowDC
ExitWindowsEx
DispatchMessageA
SetWindowPos
CreateWindowExA
GetWindowThreadProcessId
EnumWindows
GetWindowLongA
SetTimer
MessageBeep
SetFocus
SetLastErrorEx
GetFocus
TranslateMessage
FindWindowExA
RegisterClassExA
LoadIconA
DefWindowProcA
GetDesktopWindow
PostMessageA
GetWindowTextA
GetClassNameA
GetForegroundWindow
PostQuitMessage
UnregisterHotKey
KillTimer
RegisterDeviceNotificationA
FindWindowExW
SendMessageA
DialogBoxIndirectParamA
GetSystemMetrics
DrawTextA
SetWindowTextA
SetDlgItemTextA
EndDialog
EndPaint
GetClientRect
GetSysColor
GetMessageA
BeginPaint
MessageBoxA
GetProcessWindowStation
GetUserObjectInformationW
FindWindowA
LoadStringA

advapi32

DeregisterEventSource
RegSetValueExA
RegCloseKey
RegSetValueExW
RegOpenKeyExW
ReportEventA
RegisterEventSourceA
RegQueryValueExA
RegCreateKeyExA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegQueryValueExW
RegDeleteValueW
CryptDestroyHash
CryptReleaseContext
CryptAcquireContextA
CryptCreateHash
CryptHashData
CryptDeriveKey
CryptSetKeyParam
CryptEncrypt
CryptDecrypt
RegOpenKeyExA
RegCreateKeyExW

shell32

SHFileOperationA
ShellExecuteA

shlwapi

PathFindExtensionW
PathFindExtensionA

gdi32

SetBkColor
GetObjectA
DeleteDC
CreateCompatibleDC
BitBlt
CreateDIBSection
DeleteObject
SelectObject
SetDIBColorTable
CreateCompatibleBitmap
GetDIBits
SetBkMode
CreateFontIndirectA

gdiplus

GdipCreateBitmapFromFileICM
GdipCreateBitmapFromFile
GdiplusShutdown
GdiplusStartup
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipSaveImageToFile
GdipCloneImage
GdipGetImageEncoders
GdipDrawImageI
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipDisposeImage
GdipAlloc
GdipFree
GdipCreateBitmapFromHBITMAP
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipGetImageEncodersSize
GdipCreateBitmapFromScan0

ws2_32

accept
listen
ioctlsocket
recv
connect
inet_addr
recvfrom
WSASetLastError
__WSAFDIsSet
select
WSAIoctl
getsockname
ntohs
bind
getsockopt
getpeername
freeaddrinfo
getaddrinfo
sendto
setsockopt
socket
WSAGetLastError
htons
htonl
shutdown
closesocket
send
inet_ntoa
gethostbyname
gethostname
WSACleanup
WSAStartup

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

winmm

mciSendStringA

wldap32

ord50
ord26
ord30
ord32
ord35
ord79
ord60
ord33
ord301
ord27
ord41
ord46
ord143
ord22
ord200
ord211

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 378KB - Virtual size: 377KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 52KB - Virtual size: 224KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14.9MB - Virtual size: 14.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d3edb8b3d0915036fb5fe86ab95bdabc

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

wininet

psapi

iphlpapi

setupapi

kernel32

user32

advapi32

shell32

shlwapi

gdi32

gdiplus

ws2_32

version

winmm

wldap32

Sections

.text Size: 1.5MB - Virtual size: 1.5MB

.rdata Size: 378KB - Virtual size: 377KB

.data Size: 52KB - Virtual size: 224KB

.rsrc Size: 14.9MB - Virtual size: 14.9MB

.text
Size: 1.5MB - Virtual size: 1.5MB

.rdata
Size: 378KB - Virtual size: 377KB

.data
Size: 52KB - Virtual size: 224KB

.rsrc
Size: 14.9MB - Virtual size: 14.9MB