2024-03-29_eef720d992c3555e40b89bb49659477c_icedid

Sharing

Copy URL Twitter E-mail

General

Target

2024-03-29_eef720d992c3555e40b89bb49659477c_icedid
Size

3.1MB
MD5

eef720d992c3555e40b89bb49659477c
SHA1

67b6dcec39f967d38bd51bcaaa790f3811d14cc4
SHA256

a2131f436a81390dcb7dd4d8517a0839190669c58d5a07f2a517ca0efce4694e
SHA512

991e49b857f714347546ff8132bcc861c70a8ba60b3c7bc7c3ca8255aedc875d3a594f741dab49689d5b65ac3590f607381bb393b46b7250662cb8008746620a
SSDEEP

49152:9iBrJAM6zuXGgopl5JsU/aih0borjwFCVuX+r0TdZs:85/zXcfsU/t0EQFCVcNZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-03-29_eef720d992c3555e40b89bb49659477c_icedid

Files

2024-03-29_eef720d992c3555e40b89bb49659477c_icedid
.exe windows:4 windows x86 arch:x86

23af00b490c48065a279e266cdc0f0ea

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\4story\Main Araz4Story Sources - Kopie\TClient\TClient\Exec\TClient.pdb

Imports

d3dx9_43

D3DXQuaternionSlerp
D3DXQuaternionRotationAxis
D3DXMatrixInverse
D3DXMatrixRotationYawPitchRoll
D3DXMatrixPerspectiveFovLH
D3DXMatrixOrthoLH
D3DXMatrixLookAtLH
D3DXLoadSurfaceFromFileInMemory
D3DXLoadSurfaceFromSurface
D3DXGetImageInfoFromFileInMemory
D3DXCreateTextureFromFileInMemoryEx
D3DXQuaternionInverse
D3DXQuaternionNormalize
D3DXMatrixDecompose
D3DXSaveSurfaceToFileA
D3DXSphereBoundProbe
D3DXMatrixRotationQuaternion
D3DXPlaneIntersectLine
D3DXPlaneNormalize
D3DXIntersectTri
D3DXMatrixRotationZ
D3DXVec2Normalize
D3DXPlaneFromPointNormal
D3DXPlaneFromPoints
D3DXMatrixRotationX
D3DXMatrixTransformation2D
D3DXAssembleShader
D3DXMatrixTransformation
D3DXVec3TransformCoord
D3DXCreateTexture
D3DXMatrixTranslation
D3DXMatrixRotationY
D3DXVec3Normalize
D3DXMatrixScaling
D3DXMatrixTranspose
D3DXMatrixMultiply
D3DXQuaternionMultiply

winmm

mmioGetInfo
timeGetTime
mmioClose
mmioDescend
mmioSeek
mmioAdvance
mmioSetInfo
mmioAscend
mmioRead
mmioOpenA

advapi32

RegCloseKey
CryptAcquireContextA
CryptCreateHash
RegQueryValueA
RegEnumKeyA
RegDeleteKeyA
RegOpenKeyA
RegEnumValueA
RegCreateKeyExA
GetUserNameA
RegSetValueExA
RegDeleteValueA
RegOpenKeyExA
RegQueryValueExA
CryptHashData
CryptDeriveKey
CryptEncrypt
CryptDestroyKey
CryptDestroyHash
CryptReleaseContext
CloseServiceHandle
ControlService
StartServiceA
ChangeServiceConfigA

imm32

ImmSetConversionStatus
ImmGetCompositionStringA
ImmGetContext
ImmNotifyIME
ImmReleaseContext
ImmGetCandidateListA
ImmGetConversionStatus

dsound

ord11

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

dbghelp

GetTimestampForLoadedLibrary
StackWalk
EnumerateLoadedModules
MiniDumpWriteDump

d3d9

Direct3DCreate9

kernel32

SetUnhandledExceptionFilter
UnmapViewOfFile
GlobalFree
ResetEvent
GlobalAlloc
GetFileSize
MapViewOfFile
CreateFileMappingA
MulDiv
GetProcAddress
OutputDebugStringA
FormatMessageA
GetComputerNameA
lstrcpyA
LoadLibraryA
TerminateProcess
GetExitCodeThread
Module32Next
Module32First
CreateToolhelp32Snapshot
FindClose
FindNextFileA
FindFirstFileA
GetSystemDefaultLangID
VirtualQuery
FreeLibrary
LoadLibraryExA
VirtualFree
VirtualProtect
VirtualAlloc
SetEndOfFile
QueryPerformanceFrequency
QueryPerformanceCounter
HeapFree
HeapAlloc
GetProcessHeap
LocalLock
GetExitCodeProcess
CopyFileA
lstrcatA
OpenMutexA
TerminateThread
ExitProcess
GetSystemDirectoryA
GetModuleFileNameW
GetCurrentDirectoryA
GetTempFileNameA
GetTempPathA
DuplicateHandle
SetStdHandle
GetStdHandle
InterlockedIncrement
lstrcpynA
GlobalUnlock
GlobalLock
SetLastError
GetPrivateProfileIntA
WritePrivateProfileStringA
GetPrivateProfileStringA
lstrcmpW
GlobalDeleteAtom
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
FreeResource
FlushFileBuffers
LockFile
UnlockFile
GetVolumeInformationA
GetFullPathNameA
EnumResourceLanguagesA
ConvertDefaultLocale
FileTimeToSystemTime
FileTimeToLocalFileTime
GetLocalTime
GetFileAttributesA
GetFileTime
GlobalReAlloc
GlobalHandle
TlsGetValue
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
GlobalFlags
GetCPInfo
GetOEMCP
SetErrorMode
RtlUnwind
GetSystemTimeAsFileTime
GetTimeFormatA
GetDateFormatA
GetDriveTypeA
GetStartupInfoA
GetCommandLineA
HeapReAlloc
GetFileType
HeapSize
HeapDestroy
HeapCreate
IsBadWritePtr
GetTimeZoneInformation
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
IsBadCodePtr
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
SetEnvironmentVariableA
GetLocaleInfoW
LocalUnlock
LocalFree
GetCurrentProcessId
CreateDirectoryA
GetModuleFileNameA
lstrcmpA
SetFilePointer
SetThreadLocale
GetCurrentThreadId
CreateFileA
ReadFile
GetSystemInfo
CreateEventA
WaitForSingleObject
CloseHandle
DeleteFileA
CreateProcessA
CreateThread
SetThreadPriority
ResumeThread
SetEvent
LeaveCriticalSection
EnterCriticalSection
InterlockedDecrement
GetTickCount
Sleep
GetSystemTime
IsDBCSLeadByte
FindResourceA
LoadResource
LockResource
SizeofResource
GetStringTypeExA
CompareStringW
CompareStringA
lstrlenA
lstrcmpiA
GetVersion
DeleteCriticalSection
InitializeCriticalSection
GetLastError
RaiseException
WideCharToMultiByte
MultiByteToWideChar
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
GetCurrentProcess
GetCurrentThread
GetModuleHandleA
IsBadReadPtr
LocalAlloc
WriteFile

user32

MapWindowPoints
GetMessagePos
GetMessageTime
DestroyWindow
GetTopWindow
SetActiveWindow
GetLastActivePopup
IsWindow
RemovePropA
GetPropA
SetPropA
GetClassNameA
GetClassInfoExA
GetClassLongA
CreateWindowExA
GetCapture
WinHelpA
RegisterWindowMessageA
LoadBitmapA
GetMenuCheckMarkDimensions
CheckMenuItem
EnableMenuItem
ModifyMenuA
SetMenuItemBitmaps
MapDialogRect
SetWindowContextHelpId
TabbedTextOutA
DrawTextA
DrawTextExA
GrayStringA
GetWindowDC
BeginPaint
EndPaint
GetNextDlgTabItem
CreateDialogIndirectParamA
GetDesktopWindow
GetNextDlgGroupItem
MessageBeep
CopyAcceleratorTableA
InvalidateRgn
GetSysColorBrush
DestroyMenu
CharNextA
RegisterClipboardFormatA
PostThreadMessageA
GetWindowTextA
SetFocus
IsWindowEnabled
MoveWindow
GetDlgCtrlID
IsDialogMessageA
GetMessageA
GetActiveWindow
GetMenuState
GetMenuStringA
GetMenuItemID
InsertMenuA
GetMenuItemCount
GetSubMenu
DestroyCaret
GetWindowLongA
ValidateRect
GetCaretBlinkTime
CallWindowProcA
IsChild
ChildWindowFromPointEx
GetFocus
InvalidateRect
ReleaseDC
IsRectEmpty
GetKeyboardLayout
wsprintfA
EnumChildWindows
SetCapture
IsWindowVisible
GetClientRect
DeleteMenu
ShowWindow
GetWindowRect
EndDialog
SetWindowTextA
GetDlgItem
SetWindowPos
GetParent
SetParent
SetForegroundWindow
LoadCursorA
EnumDisplaySettingsA
EnableWindow
DestroyCursor
ActivateKeyboardLayout
GetDC
IsIconic
SetWindowsHookExA
LoadAcceleratorsA
PeekMessageA
TranslateAcceleratorA
TranslateMessage
DispatchMessageA
WaitMessage
UnhookWindowsHookEx
CallNextHookEx
LoadIconA
GetForegroundWindow
UpdateWindow
PostMessageA
SendMessageA
SetRectEmpty
GetAsyncKeyState
GetKeyState
MessageBoxA
SetCursor
PostQuitMessage
AdjustWindowRect
SetWindowLongA
EqualRect
IntersectRect
MapVirtualKeyA
SetRect
ReleaseCapture
ClipCursor
GetCursorPos
OffsetRect
SetCursorPos
ShowCursor
ScreenToClient
ClientToScreen
GetMenu
GetSysColor
AdjustWindowRectEx
SendDlgItemMessageA
InflateRect
PtInRect
CopyRect
UnregisterClassA
GetClassInfoA
RegisterClassA
DefWindowProcA
GetWindowPlacement
SystemParametersInfoA
GetSystemMetrics
GetWindow
GetWindowTextLengthA
CharUpperA

gdi32

SetTextColor
SetBkColor
GetObjectA
GetClipBox
CreateBitmap
SaveDC
RestoreDC
SetMapMode
GetDeviceCaps
BitBlt
CreateFontIndirectA
CreateFontA
GetViewportExtEx
GetWindowExtEx
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
GetStockObject
CreateRectRgnIndirect
GetRgnBox
GetMapMode
GetBkColor
GetTextColor
CreateCompatibleDC
SelectObject
CreateDIBSection
DeleteObject
DeleteDC

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterA
ClosePrinter
DocumentPropertiesA

shell32

ShellExecuteA

comctl32

ord17

shlwapi

PathStripToRootA
PathFindExtensionA
PathFindFileNameA
PathIsUNCA

oledlg

ord8

ole32

OleFlushClipboard
CoRegisterMessageFilter
CoTaskMemFree
CoInitialize
OleIsCurrentClipboard
CoUninitialize
CoCreateInstance
CoSetProxyBlanket
CoRevokeClassObject
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CLSIDFromString
CLSIDFromProgID
CoTaskMemAlloc

oleaut32

VariantCopy
SafeArrayDestroy
SystemTimeToVariantTime
SysAllocStringLen
SysStringLen
VariantClear
VariantChangeType
VariantInit
SysAllocString
SysFreeString
OleCreateFontIndirect
SysAllocStringByteLen

ws2_32

getsockname
closesocket
gethostbyname
connect
recv
send
htons
inet_ntoa
WSAStartup
WSAGetLastError
WSAAsyncSelect
inet_addr
setsockopt
ioctlsocket
WSASocketA
WSACleanup
sendto
socket

iphlpapi

GetAdaptersInfo

gdiplus

GdipCreateFontFromDC
GdipCreateFromHDC
GdipSetStringFormatLineAlign
GdiplusShutdown
GdiplusStartup
GdipSetTextRenderingHint
GdipMeasureString
GdipDrawString
GdipSetStringFormatAlign
GdipCreateSolidFill
GdipDeleteFont
GdipDeleteGraphics
GdipDeleteStringFormat
GdipCreateStringFormat
GdipFree
GdipAlloc
GdipDeleteBrush

Exports

Exports

fcEXP

Sections

.text
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 276KB - Virtual size: 275KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 165KB - Virtual size: 310KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 109KB - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

23af00b490c48065a279e266cdc0f0ea

Headers

File Characteristics

PDB Paths

Imports

d3dx9_43

winmm

advapi32

imm32

dsound

version

dbghelp

d3d9

kernel32

user32

gdi32

comdlg32

winspool.drv

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

ws2_32

iphlpapi

gdiplus

Exports

Exports

Sections

.text Size: 2.5MB - Virtual size: 2.5MB

.rdata Size: 276KB - Virtual size: 275KB

.data Size: 165KB - Virtual size: 310KB

.rsrc Size: 109KB - Virtual size: 109KB

.text
Size: 2.5MB - Virtual size: 2.5MB

.rdata
Size: 276KB - Virtual size: 275KB

.data
Size: 165KB - Virtual size: 310KB

.rsrc
Size: 109KB - Virtual size: 109KB