FemaleCaution
HurtCommon32
InformFork32
RelyRidgeStock
SaltFantasy32
ShowDialogA
ViolinAlmost32
WorthMonitorImpulse32
Behavioral task
behavioral1
Sample
f89cdef299637000f1837fccd2f90673aabeae3e6fb7b03badca0eb89a43aa13.dll
Resource
win10-20240221-en
Target
f89cdef299637000f1837fccd2f90673aabeae3e6fb7b03badca0eb89a43aa13
Size
24KB
MD5
1cd4217604139e1a874ddfb8216c2adf
SHA1
8749006e14481dee76767da58f0347fc1a9e1eea
SHA256
f89cdef299637000f1837fccd2f90673aabeae3e6fb7b03badca0eb89a43aa13
SHA512
7a3b96f2bd1711e13f03c755235b7226decf583c5a4be155f0d05292015fa0b1a71ccff031dd29e47dad8d3391f3ae67e00e6ea9f8fe40b22d496e2cdd84ccde
SSDEEP
192:iSpTHu+xRv0dZyD79CJhcD9I+2WhhkTfuzWr5U2ko9c:ZTACDH2mhAfPC2D9c
icedid
resource | yara_rule |
---|---|
sample | IcedidFirstLoader |
This rule detects samples from the IcedID family unpacked in memory, identifying code reuse of key functions.
resource | yara_rule |
---|---|
sample | Icedid_Unpacked_in_Memory |
Checks for missing Authenticode signature.
resource |
---|
f89cdef299637000f1837fccd2f90673aabeae3e6fb7b03badca0eb89a43aa13 |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
WinHttpAddRequestHeaders
WinHttpQueryOption
WinHttpReceiveResponse
WinHttpOpen
WinHttpQueryHeaders
WinHttpReadData
WinHttpOpenRequest
WinHttpSetOption
WinHttpCloseHandle
WinHttpSendRequest
WinHttpSetStatusCallback
WinHttpConnect
WinHttpQueryDataAvailable
SHGetFolderPathA
StrStrIA
StrToIntA
StrChrA
wsprintfW
MessageBoxA
wsprintfA
GetModuleFileNameA
HeapFree
lstrcatA
GetTickCount
SwitchToThread
GetLastError
GetTickCount64
GetComputerNameExW
HeapReAlloc
lstrlenA
GetFileSize
HeapAlloc
CloseHandle
CreateFileA
WriteFile
ReadFile
GetProcessHeap
GetProcAddress
LoadLibraryA
GetTempPathA
Sleep
GetCommandLineA
WaitForSingleObject
GetUserNameW
LookupAccountNameW
memset
FemaleCaution
HurtCommon32
InformFork32
RelyRidgeStock
SaltFantasy32
ShowDialogA
ViolinAlmost32
WorthMonitorImpulse32
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ