2024-03-27_14f73548bb80c7578e5a0d9774cf6a46_icedid

Sharing

Copy URL Twitter E-mail

General

Target

2024-03-27_14f73548bb80c7578e5a0d9774cf6a46_icedid
Size

872KB
MD5

14f73548bb80c7578e5a0d9774cf6a46
SHA1

4a87f4c2b351e6de990ad7d87f075549ec670964
SHA256

f17db033fc28f19211c766877019141144786327e7f741d7cbf14e680f8a8e94
SHA512

0d0394bf1eb8f9dfc3ff0298e51679854e5ea528cf0503c3ed1effb88afd5c754487d7e3f39442b13a6b1cacb5231759f86269d6beab9801ed62b73dda79d4a9
SSDEEP

12288:thxOuPq0n0Ewq2hBkb5rnHVX5lFVPlOj5S3TykhiffNGjkXZ7EtK:tnZy00Ewq2hBkn5jVe5SSfFGjkXZF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-03-27_14f73548bb80c7578e5a0d9774cf6a46_icedid

Files

2024-03-27_14f73548bb80c7578e5a0d9774cf6a46_icedid
.exe windows:4 windows x86 arch:x86

ba7ba6b5d16b34a17e05e6299c7d9e46

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\Source\installers\nsiinstaller\MsiRunner\Release\MsiRunner.pdb

Imports

kernel32

GetFileSize
GetFileTime
InterlockedIncrement
LocalAlloc
GlobalReAlloc
GlobalHandle
TlsGetValue
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
GlobalFlags
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
DuplicateHandle
GetVolumeInformationA
GetFullPathNameA
GetCPInfo
GetOEMCP
SetErrorMode
ExitProcess
RtlUnwind
HeapAlloc
VirtualAlloc
GetSystemInfo
VirtualQuery
GetStartupInfoA
GetCommandLineA
GetSystemTimeAsFileTime
GetTimeFormatA
GetDateFormatA
HeapReAlloc
TerminateProcess
SetStdHandle
GetFileType
HeapSize
QueryPerformanceCounter
GetCurrentProcessId
LCMapStringA
LCMapStringW
HeapDestroy
HeapCreate
VirtualFree
IsBadWritePtr
SetUnhandledExceptionFilter
GetStringTypeA
GetStringTypeW
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetTimeZoneInformation
IsBadReadPtr
IsBadCodePtr
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
SetEnvironmentVariableA
GetLocaleInfoW
FileTimeToSystemTime
VirtualProtect
GlobalGetAtomNameA
GlobalFindAtomA
lstrcmpW
GetPrivateProfileStringA
WritePrivateProfileStringA
GlobalAddAtomA
InterlockedDecrement
GetCurrentThread
GetCurrentThreadId
GlobalDeleteAtom
lstrcmpA
ConvertDefaultLocale
EnumResourceLanguagesA
MulDiv
GetDriveTypeA
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetTickCount
lstrcpynA
FileTimeToLocalFileTime
WriteFile
ReadFile
SetFilePointer
GetModuleHandleA
SetLastError
FreeResource
GetCurrentDirectoryA
CreateDirectoryA
SetFileAttributesA
FindClose
GetCurrentProcess
GetUserDefaultLCID
GetFileAttributesA
LeaveCriticalSection
EnterCriticalSection
lstrcatA
WinExec
GetWindowsDirectoryA
lstrcpyA
FormatMessageA
LocalFree
GetModuleFileNameA
CreateFileA
CompareStringW
CompareStringA
lstrlenA
lstrlenW
lstrcmpiA
GetVersion
CreateMutexA
GetLastError
Sleep
OutputDebugStringA
GetSystemDirectoryA
WaitForSingleObject
CloseHandle
CreateProcessA
MoveFileA
DeleteFileA
LoadLibraryA
GetProcAddress
FreeLibrary
FindFirstFileA
FindNextFileA
DeleteCriticalSection
InitializeCriticalSection
RaiseException
MultiByteToWideChar
WideCharToMultiByte
FindResourceA
LoadResource
LockResource
SizeofResource
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
GetSystemDefaultLangID
HeapFree

user32

RegisterClipboardFormatA
PostThreadMessageA
WindowFromPoint
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
RegisterWindowMessageA
GetCapture
GetClassLongA
SetPropA
GetPropA
RemovePropA
GetForegroundWindow
GetLastActivePopup
GetMessageTime
GetMessagePos
MapWindowPoints
GetMenu
AdjustWindowRectEx
EqualRect
RegisterClassA
CallWindowProcA
IntersectRect
MoveWindow
IsDialogMessageA
SendDlgItemMessageA
SetWindowContextHelpId
SetWindowPos
SetMenuItemBitmaps
ModifyMenuA
EnableMenuItem
CheckMenuItem
GetMenuCheckMarkDimensions
LoadBitmapA
SetWindowsHookExA
CallNextHookEx
PeekMessageA
UnhookWindowsHookEx
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamA
GetDlgItem
IsWindowEnabled
GetNextDlgTabItem
EndDialog
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
GetClassInfoExA
UpdateWindow
GetMessageA
GetWindowTextLengthA
TranslateMessage
DispatchMessageA
DefWindowProcA
SetForegroundWindow
PostQuitMessage
CreateWindowExA
SetFocus
GetTopWindow
FindWindowA
MessageBoxA
EnumChildWindows
GetDlgCtrlID
GetWindowLongA
GetClassNameA
GetWindowTextA
SetWindowTextA
IsWindowVisible
GetWindowPlacement
ShowWindow
MapDialogRect
CopyRect
GetWindow
GetCursorPos
MessageBeep
GetDesktopWindow
SetWindowLongA
CopyIcon
DestroyCursor
SetCursor
RedrawWindow
GetWindowRect
InflateRect
PtInRect
GetKeyState
WinHelpA
GetParent
IsChild
GetFocus
ScreenToClient
PostMessageA
SystemParametersInfoA
GetSysColor
ReleaseCapture
GetSysColorBrush
LoadCursorA
IsWindow
DestroyMenu
GetNextDlgGroupItem
InvalidateRgn
CopyAcceleratorTableA
IsRectEmpty
CharNextA
DestroyWindow
SetCapture
InvalidateRect
ReleaseDC
GetDC
OffsetRect
SetRect
CharUpperA
EnableWindow
GetSystemMetrics
LoadIconA
KillTimer
ValidateRect
SetTimer
GetClientRect
IsIconic
SendMessageA
wsprintfA
DrawIcon
ExitWindowsEx
UnregisterClassA
GetClassInfoA

gdi32

GetBkColor
GetTextColor
CreateRectRgnIndirect
GetRgnBox
GetMapMode
GetWindowExtEx
GetViewportExtEx
DeleteDC
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
Escape
ExtTextOutA
RectVisible
PtVisible
SaveDC
SetBkColor
SetTextColor
GetClipBox
CreateBitmap
GetDeviceCaps
DeleteObject
SelectObject
SetTextJustification
TextOutA
GetStockObject
GetObjectA
GetTextExtentPoint32A
CreateFontIndirectA
SetMapMode
SetBkMode
RestoreDC

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

RegCloseKey
RegOpenKeyExA
RegQueryValueA
RegCreateKeyExA
RegSetValueExA
RegDeleteKeyA
RegSetValueA
RegEnumKeyA
RegQueryValueExA
RegOpenKeyA

shell32

ShellExecuteA
SHFileOperationA

comctl32

ord17

shlwapi

PathFindFileNameA
PathStripToRootA
PathFindExtensionA
PathIsUNCA

oledlg

ord8

ole32

CoFreeUnusedLibraries
CoInitialize
CoCreateInstance
CoUninitialize
CoTaskMemFree
CoRegisterMessageFilter
OleFlushClipboard
OleIsCurrentClipboard
CoRevokeClassObject
OleInitialize
OleUninitialize
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CLSIDFromString
CLSIDFromProgID
CoTaskMemAlloc

oleaut32

SysAllocStringLen
VariantCopy
VariantInit
VariantChangeType
VariantClear
SysAllocStringByteLen
SysStringLen
SystemTimeToVariantTime
SafeArrayDestroy
SysAllocString
OleCreateFontIndirect
SysFreeString

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

Exports

Exports

??0CNpsInfo@@QAE@ABV0@@Z
??0CNpsInfo@@QAE@XZ
??1CNpsInfo@@QAE@XZ
??4CNpsInfo@@QAEAAV0@ABV0@@Z
?GetCommandLineA@CNpsInfo@@QAE?AV?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?GetFamilyName@CNpsInfo@@QAE?AV?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?GetIsInstallUpdateEngine@CNpsInfo@@QAEHXZ
?GetNpcStartMode@CNpsInfo@@QAE?AW4ENpcStartMode@@XZ
?GetNpcUserSel@CNpsInfo@@QAE?AW4ENpcUserSel@@XZ
?GetRunCommonSetupX@CNpsInfo@@QAEHXZ
?GetRunLngDialog@CNpsInfo@@QAEHXZ
?SetCommandLine@CNpsInfo@@QAEXV?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?SetFamilyName@CNpsInfo@@QAEXV?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?SetIsInstallUpdateEngine@CNpsInfo@@QAEXH@Z
?SetNpcStartMode@CNpsInfo@@QAEXW4ENpcStartMode@@@Z
?SetNpcUserSel@CNpsInfo@@QAEXW4ENpcUserSel@@@Z
?SetRunCommonSetupX@CNpsInfo@@QAEXH@Z
?SetRunLngDialog@CNpsInfo@@QAEXH@Z

Sections

.text
Size: 264KB - Virtual size: 262KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 76KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 516KB - Virtual size: 515KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ba7ba6b5d16b34a17e05e6299c7d9e46

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

version

Exports

Exports

Sections

.text Size: 264KB - Virtual size: 262KB

.rdata Size: 76KB - Virtual size: 72KB

.data Size: 12KB - Virtual size: 29KB

.rsrc Size: 516KB - Virtual size: 515KB

.text
Size: 264KB - Virtual size: 262KB

.rdata
Size: 76KB - Virtual size: 72KB

.data
Size: 12KB - Virtual size: 29KB

.rsrc
Size: 516KB - Virtual size: 515KB