2024-03-27_ac07f40b5eb9dfdadaed34f37d0ed77c_icedid

Sharing

Copy URL Twitter E-mail

General

Target

2024-03-27_ac07f40b5eb9dfdadaed34f37d0ed77c_icedid
Size

668KB
MD5

ac07f40b5eb9dfdadaed34f37d0ed77c
SHA1

8d1ce90666e3eb3406b7f6df3e92b290e827024e
SHA256

c61c35f217ff45e6e22769a429f838b28252af1addd979556df1f46cba5b0e16
SHA512

bd81c52fc3dd040aba8fc1dcd201bee6e6a29bf131217fcbe7399f24b352c9c87c8d4f721e04f173369ea1d7a83dc7f737b782b969b2a5aa54e82197671991f4
SSDEEP

12288:vSXtmNX4RDPJcQc13vngT/GEaoJxllWFoTjdrM9r0v9FXuoR0CpJ2M0zV1yQb0Z5:vmmNX4RDPJcQc1fTrour0voCzwCZhz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-03-27_ac07f40b5eb9dfdadaed34f37d0ed77c_icedid

Files

2024-03-27_ac07f40b5eb9dfdadaed34f37d0ed77c_icedid
.exe windows:4 windows x86 arch:x86

97e6278defd1c2a6a8870c03a3fa9eee

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mpr

WNetCloseEnum
WNetOpenEnumW
WNetEnumResourceW

kernel32

InterlockedIncrement
LoadLibraryA
GetExitCodeProcess
LocalFree
LocalAlloc
GetExitCodeThread
WaitForMultipleObjects
SetNamedPipeHandleState
GetCurrentThread
GetComputerNameW
GetProcessHeap
HeapAlloc
HeapFree
EnumResourceLanguagesW
lstrcmpiA
LoadLibraryExW
GetLogicalDriveStringsW
QueryDosDeviceW
FlushFileBuffers
DisconnectNamedPipe
LeaveCriticalSection
ReleaseMutex
OpenMutexW
EnterCriticalSection
WaitForSingleObject
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetStdHandle
GetOEMCP
GetACP
lstrlenW
GetStringTypeW
GetStringTypeA
GetCPInfo
IsBadCodePtr
SetUnhandledExceptionFilter
LCMapStringW
LCMapStringA
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetCurrentDirectoryA
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
GetTimeZoneInformation
HeapReAlloc
HeapSize
RaiseException
ExitProcess
GetCommandLineA
GetStartupInfoA
GetDriveTypeW
RtlUnwind
FileTimeToLocalFileTime
FileTimeToSystemTime
OpenFileMappingW
CreateMutexW
DeleteCriticalSection
InitializeCriticalSection
GetModuleFileNameW
GetModuleFileNameA
ExpandEnvironmentStringsW
GetShortPathNameW
MoveFileExW
WritePrivateProfileSectionW
GetPrivateProfileSectionW
GetPrivateProfileSectionNamesW
GetProfileIntW
WriteProfileStringW
GetProfileStringW
EnumSystemLocalesW
GetSystemInfo
GetVersion
GetVersionExW
IsBadReadPtr
GetCurrentProcessId
GetCurrentProcess
DuplicateHandle
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
GetEnvironmentVariableW
GetPrivateProfileStringW
GetPrivateProfileIntW
WritePrivateProfileStringW
WriteProcessMemory
ReadProcessMemory
GlobalReAlloc
GlobalSize
GlobalFlags
GetWindowsDirectoryW
GetLocalTime
EnumResourceNamesW
FindResourceW
GetFullPathNameW
MoveFileW
GetProcessVersion
lstrcmpiW
TlsGetValue
LocalReAlloc
InterlockedDecrement
TlsSetValue
TlsAlloc
SetErrorMode
lstrcatW
GlobalAddAtomW
LoadResource
LockResource
GetCurrentDirectoryW
SetCurrentDirectoryW
RemoveDirectoryW
GetTempPathW
GetTempFileNameW
DeleteFileW
GetFileAttributesW
CreateProcessW
SetThreadPriority
ResumeThread
FindFirstFileW
FindNextFileW
FindClose
CreateDirectoryW
GetSystemDirectoryW
SetEndOfFile
ReadFile
GetFileSize
SetFilePointer
CreateFileW
GetModuleHandleW
FormatMessageW
GlobalGetAtomNameW
GetCurrentThreadId
TransactNamedPipe
WriteFile
GetTickCount
WaitNamedPipeW
SetLastError
lstrcmpW
MulDiv
GetLocaleInfoW
OpenProcess
TerminateProcess
CloseHandle
LoadLibraryW
GetProcAddress
FreeLibrary
WideCharToMultiByte
MultiByteToWideChar
IsDBCSLeadByteEx
CopyFileW
SetFileAttributesW
GetLastError
Sleep
GetCommandLineW
GlobalAlloc
GlobalLock
GlobalHandle
GlobalUnlock
GlobalFree
lstrlenA
GetDriveTypeA
lstrcpynW
GetModuleHandleA
lstrcpyW
GlobalFindAtomW
GlobalDeleteAtom

user32

SetCursor
ShowCursor
LoadCursorW
CharUpperW
GetWindow
SetWindowPos
GetSystemMetrics
GetClassNameW
GetWindowLongW
ReleaseDC
GetDC
GetWindowTextW
GetDlgCtrlID
GetWindowTextLengthW
GetClientRect
MessageBoxW
SendMessageW
GetWindowRect
EnableWindow
GetDlgItem
IntersectRect
GetDlgItemTextW
GetDialogBaseUnits
SetWindowTextW
wvsprintfW
DrawTextW
GetParent
PtInRect
IsWindowEnabled
UpdateWindow
InflateRect
LoadStringA
MessageBoxA
IsZoomed
ScreenToClient
PeekMessageW
PostQuitMessage
IsDialogMessageW
TranslateMessage
DispatchMessageW
DeferWindowPos
GetClassLongW
ClientToScreen
ExitWindowsEx
SetRect
GetSysColorBrush
FillRect
GetSysColor
RemovePropW
CallWindowProcW
GetPropW
SetPropW
MsgWaitForMultipleObjects
BeginPaint
EndPaint
DefWindowProcW
IsIconic
GetClassInfoW
RegisterClassW
LoadImageW
SystemParametersInfoW
KillTimer
DestroyWindow
UnregisterClassW
GetSystemMenu
GetMenuItemCount
GetMenuItemID
DeleteMenu
GetWindowThreadProcessId
SendMessageTimeoutW
TrackMouseEvent
GrayStringW
TabbedTextOutW
EndDialog
DialogBoxParamW
wsprintfW
GetDesktopWindow
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
GetAsyncKeyState
IsDlgButtonChecked
LoadIconW
IsWindowVisible
ValidateRect
GetKeyState
GetActiveWindow
GetMessageW
GetWindowPlacement
RegisterWindowMessageW
SetForegroundWindow
GetForegroundWindow
GetMessagePos
GetMessageTime
GetSubMenu
GetMenu
GetCapture
GetTopWindow
CopyRect
AdjustWindowRectEx
GetFocus
MapWindowPoints
GetNextDlgTabItem
EnableMenuItem
CheckMenuItem
SetMenuItemBitmaps
ModifyMenuW
GetMenuState
LoadBitmapW
GetMenuCheckMarkDimensions
DestroyMenu
DestroyIcon
WinHelpW
EnumWindows
CharLowerW
LoadStringW
CallNextHookEx
CreateWindowExW
MessageBeep
SetWindowsHookExW
UnhookWindowsHookEx
GetGUIThreadInfo
GetLastActivePopup
PostMessageW
FindWindowW
SetTimer
ShowWindow
IsWindow
SetFocus
SetDlgItemTextW
SetWindowLongW
InvalidateRect
GetCursorPos
OffsetRect

gdi32

GetRgnBox
GetFontLanguageInfo
SetBkColor
StretchBlt
BitBlt
CreateFontW
TranslateCharsetInfo
GetCharacterPlacementW
GetCharacterPlacementA
GetObjectType
GetGlyphOutlineW
GetCurrentObject
SetPixel
CreateCompatibleDC
CreateFontIndirectW
DeleteObject
ResetDCW
EnumFontFamiliesExW
CreateCompatibleBitmap
PatBlt
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
GetOutlineTextMetricsW
GetCharWidthW
GetCharWidthA
GetStockObject
GetObjectW
CreateDCW
ExtEscape
DeleteDC
GetTextExtentPointW
GetTextMetricsW
SelectObject
GetTextExtentPoint32W
GetDeviceCaps
SaveDC
RestoreDC
SetTextColor
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
GetClipBox
CreateBitmap

winspool.drv

DeletePrinterConnectionW
GetPrinterDriverDirectoryW
AddPrinterW
DeviceCapabilitiesW
AddPrinterConnectionW
AddMonitorW
AddPrinterDriverW
SetPrinterW
DeletePrinter
GetPrinterDriverW
GetPrinterW
OpenPrinterW
EnumPrinterDriversW
EnumPrintersW
EnumPortsW
GetJobW
ClosePrinter
DeletePrinterDriverW
DocumentPropertiesW
DeleteMonitorW
GetPrinterA

advapi32

InitializeSecurityDescriptor
RegQueryValueExW
RegOpenKeyW
SetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
OpenThreadToken
OpenProcessToken
GetUserNameW
RegDeleteKeyW
RegDeleteKeyA
GetSidLengthRequired
GetSidIdentifierAuthority
InitializeSid
LookupPrivilegeValueW
AdjustTokenPrivileges
GetSecurityDescriptorOwner
LookupAccountNameW
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
AllocateAndInitializeSid
GetSecurityDescriptorDacl
GetAclInformation
GetAce
EqualSid
FreeSid
ControlService
StartServiceW
OpenSCManagerW
OpenServiceW
QueryServiceStatus
EnumDependentServicesW
DeleteService
CreateServiceW
CloseServiceHandle
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW
RegSetKeySecurity
RegConnectRegistryW
RegFlushKey
RegUnLoadKeyW
RegLoadKeyW
LookupAccountSidW
RegEnumKeyW
RegCreateKeyW
RegGetKeySecurity
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegOpenKeyExW
RegCloseKey

shell32

SHChangeNotify
SHGetSpecialFolderLocation
SHGetDesktopFolder
CommandLineToArgvW
ShellExecuteW

ole32

CoTaskMemFree
CoTaskMemAlloc
CoUninitialize
CoCreateInstance
CoInitialize

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

comctl32

ord17

shlwapi

StrRetToBufW
StrRetToStrW

Sections

.text
Size: 480KB - Virtual size: 478KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 96KB - Virtual size: 129KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

97e6278defd1c2a6a8870c03a3fa9eee

Headers

File Characteristics

Imports

mpr

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

ole32

version

comctl32

shlwapi

Sections

.text Size: 480KB - Virtual size: 478KB

.rdata Size: 40KB - Virtual size: 38KB

.data Size: 96KB - Virtual size: 129KB

.rsrc Size: 48KB - Virtual size: 44KB

.text
Size: 480KB - Virtual size: 478KB

.rdata
Size: 40KB - Virtual size: 38KB

.data
Size: 96KB - Virtual size: 129KB

.rsrc
Size: 48KB - Virtual size: 44KB