2024-03-29_32f5d5abcaaa08a9b9fbd43ba723e254_icedid

Sharing

Copy URL Twitter E-mail

General

Target

2024-03-29_32f5d5abcaaa08a9b9fbd43ba723e254_icedid
Size

6.8MB
MD5

32f5d5abcaaa08a9b9fbd43ba723e254
SHA1

796cda2030377a7ff8775cca48bb5027119934dc
SHA256

9dce80284e4fe9ae4d31642f36653e0228c212a4ccffd82cd1c6311de333be9e
SHA512

1c3fe1f4ea3682283cad2db9420acb4665c3780785574ab110955cbd34696b6c55777c13caa194e6b7948ad6ed68b0eaa8b09d774e6f51d5c183c577c5de40ef
SSDEEP

98304:wrXPyHNPGqtw71i8SvIBD4ktOabI8VCk5V6j0lJ2+HS02LscDiII9MdKA:dAq671VSvIBD4ktOabIxk5Vlm+qqMd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-03-29_32f5d5abcaaa08a9b9fbd43ba723e254_icedid

Files

2024-03-29_32f5d5abcaaa08a9b9fbd43ba723e254_icedid
.exe windows:5 windows x86 arch:x86

cb9d7f220d4a2ffa9c837cf48364fff3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Workspace\VC\product\2012\ispiritPro\Release\ispiritPro.pdb

Imports

winmm

mixerGetLineInfoW
waveOutPrepareHeader
waveOutWrite
waveOutGetErrorTextW
mixerGetLineControlsW
PlaySoundW
mixerGetControlDetailsW
mixerSetControlDetails
mixerOpen
mixerClose
waveInOpen
waveOutOpen
waveInUnprepareHeader
waveInClose
waveInStart
waveInReset
waveInPrepareHeader
waveInAddBuffer
waveInGetErrorTextW
waveOutUnprepareHeader
waveOutClose
waveOutReset

sqlite3

sqlite3_free
sqlite3_column_count
sqlite3_column_text
sqlite3_column_int
sqlite3_column_name
sqlite3_column_type
sqlite3_step
sqlite3_finalize
sqlite3_errmsg
sqlite3_free_table
sqlite3_mprintf
sqlite3_prepare
sqlite3_open
sqlite3_close
sqlite3_exec
sqlite3_busy_timeout

audioexp

ord1

kernel32

GetVersion
GetTempPathA
CreateThread
SetFilePointer
SystemTimeToFileTime
GetCurrentDirectoryW
LocalFileTimeToFileTime
SetFileTime
GlobalSize
GetVersionExA
lstrcmpW
LoadLibraryA
CompareStringW
GlobalDeleteAtom
GlobalFindAtomW
GlobalAddAtomW
GetCurrentThreadId
FindNextFileW
FileTimeToSystemTime
FileTimeToLocalFileTime
GetModuleHandleA
lstrcmpA
lstrlenA
SuspendThread
GetThreadLocale
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
GetFileSize
GetVolumeInformationW
GetFullPathNameW
GetFileAttributesExW
GetFileSizeEx
RaiseException
GetProfileIntW
VirtualProtect
CompareStringA
LoadLibraryExW
GetLocaleInfoW
EnumResourceLanguagesW
ConvertDefaultLocale
GetCurrentThread
TlsGetValue
GlobalReAlloc
GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
GlobalGetAtomNameW
GlobalFlags
SetErrorMode
VirtualAlloc
GetSystemInfo
VirtualQuery
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
MoveFileA
ExitThread
HeapReAlloc
RtlUnwind
SetStdHandle
GetFileType
HeapSize
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetStartupInfoA
HeapCreate
VirtualFree
QueryPerformanceCounter
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
InitializeCriticalSectionAndSpinCount
GetConsoleCP
GetConsoleMode
GetTimeFormatA
GetDateFormatA
GetTimeZoneInformation
LCMapStringA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
GetCurrentDirectoryA
GetDriveTypeA
SetEnvironmentVariableA
FindClose
FindFirstFileW
ExitProcess
GetStartupInfoW
GetCommandLineW
WriteFile
CreateFileW
GetLocalTime
LocalAlloc
DeleteCriticalSection
InitializeCriticalSection
GetWindowsDirectoryW
ReleaseMutex
ResetEvent
MulDiv
CreateEventW
GlobalFree
SetProcessWorkingSetSize
OpenProcess
GetCurrentProcessId
WaitForSingleObject
ReadFile
CreateProcessW
GetCurrentProcess
DuplicateHandle
CreatePipe
HeapFree
GetProcessHeap
HeapAlloc
LocalFree
FormatMessageW
GetSystemTime
GetModuleFileNameW
GetVersionExW
FreeLibrary
FreeResource
CloseHandle
CreateSemaphoreW
SetEvent
CreateDirectoryW
GetFileAttributesW
GlobalUnlock
GlobalLock
GlobalAlloc
WritePrivateProfileStringW
GetPrivateProfileStringW
DeleteFileW
CopyFileW
GetFileTime
GetTickCount
MoveFileW
ResumeThread
MultiByteToWideChar
WideCharToMultiByte
InterlockedExchange
LeaveCriticalSection
EnterCriticalSection
lstrlenW
InterlockedDecrement
InterlockedIncrement
GetProcAddress
GetModuleHandleW
LoadLibraryW
GetLastError
SetLastError
Sleep
FindResourceW
LoadResource
LockResource
SizeofResource
SetThreadPriority

user32

IsDialogMessageW
SetWindowTextW
ShowWindow
EnableMenuItem
GetMenuCheckMarkDimensions
GetWindowDC
EndDialog
GetNextDlgTabItem
CreateDialogIndirectParamW
GetActiveWindow
ValidateRect
GetMessageW
GetMenuItemInfoW
DestroyMenu
CharUpperW
WaitMessage
CharNextW
CopyAcceleratorTableW
MapDialogRect
RegisterClipboardFormatW
SetWindowContextHelpId
ShowOwnedPopups
GetSysColorBrush
UnregisterClassW
BringWindowToTop
InsertMenuItemW
ReuseDDElParam
UnpackDDElParam
GetNextDlgGroupItem
GetCapture
SetWindowsHookExW
CallNextHookEx
GetClassLongW
SetPropW
GetPropW
RemovePropW
SetFocus
GetWindowTextLengthW
GetWindowTextW
SetActiveWindow
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
MapWindowPoints
ScrollWindow
SetMenu
GetScrollRange
GetScrollPos
ShowScrollBar
GetClassInfoExW
GetClassInfoW
DeferWindowPos
GetScrollInfo
SetScrollInfo
GetDlgCtrlID
CallWindowProcW
GetMenu
SetWindowPos
SystemParametersInfoA
GetWindowPlacement
GetWindowThreadProcessId
GetLastActivePopup
IsWindowEnabled
GetMenuState
DefWindowProcW
CreateWindowExW
RegisterClassW
wsprintfW
keybd_event
mouse_event
EndPaint
BeginPaint
MessageBoxA
TrackPopupMenu
SetMenuDefaultItem
SystemParametersInfoW
GrayStringW
DrawTextExW
TabbedTextOutW
CopyIcon
GetMessagePos
MessageBeep
CopyRect
FlashWindow
DestroyIcon
CreateIconIndirect
UpdateWindow
GetFocus
InsertMenuW
GetMenuItemID
GetForegroundWindow
GetLastInputInfo
RegisterWindowMessageW
SetForegroundWindow
SetMenuItemBitmaps
GetSystemMenu
RegisterHotKey
UnregisterHotKey
MessageBoxW
WinHelpW
WindowFromPoint
IsChild
AdjustWindowRectEx
IsWindow
ClientToScreen
IntersectRect
FindWindowExW
ReleaseCapture
SetCapture
FindWindowW
GetWindowLongW
SetWindowLongW
InvalidateRgn
PostQuitMessage
DrawIcon
IsIconic
LoadIconW
LoadImageW
FillRect
IsClipboardFormatAvailable
GetAsyncKeyState
GetClipboardData
AppendMenuW
RemoveMenu
GetMenuItemCount
MoveWindow
GetDlgItem
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
CheckMenuItem
ModifyMenuW
GetSubMenu
LoadMenuW
TranslateAcceleratorW
GetKeyState
LoadAcceleratorsW
PostMessageW
PostThreadMessageW
LoadBitmapW
SetWindowRgn
EqualRect
KillTimer
SetTimer
LoadCursorW
SetCursor
ScreenToClient
GetCursorPos
InvalidateRect
PtInRect
SetRect
InflateRect
OffsetRect
SetScrollRange
IsRectEmpty
ReleaseDC
GetDC
SetScrollPos
GetSystemMetrics
GetClientRect
GetSysColor
SetRectEmpty
DispatchMessageW
TranslateMessage
PeekMessageW
GetCaretPos
IsWindowVisible
SendMessageW
GetParent
GetWindow
GetClassNameW
GetDesktopWindow
GetWindowRect
EnableWindow
SendDlgItemMessageW
DrawTextW
SendDlgItemMessageA
CreatePopupMenu

gdi32

Ellipse
CreateBrushIndirect
SetBrushOrgEx
CreateBitmapIndirect
GetTextMetricsW
PtVisible
RectVisible
TextOutW
ExtTextOutW
Escape
GetDIBits
GetBkColor
StretchDIBits
MoveToEx
LineTo
CopyMetaFileW
GetClipBox
SetTextColor
SetBkColor
CreateBitmap
SaveDC
RestoreDC
SetBkMode
SetMapMode
ExcludeClipRect
CreateRectRgnIndirect
SelectClipRgn
GetCurrentObject
CreateDCW
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
CreatePatternBrush
GetMapMode
ScaleViewportExtEx
DPtoLP
LPtoDP
GetRgnBox
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
StretchBlt
CreatePen
GetTextColor
CreatePolygonRgn
GetPixel
Rectangle
CreateFontIndirectW
CreateSolidBrush
DeleteEnhMetaFile
CopyEnhMetaFileW
GetDeviceCaps
CreateFontW
GetObjectW
SetDIBColorTable
GetDIBColorTable
DeleteObject
CreateDIBSection
DeleteDC
CombineRgn
CreateRoundRectRgn
CreateEllipticRgn
CreateRectRgn
GetTextExtentPoint32W
BitBlt
GetStockObject
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
GetWindowExtEx
GetViewportExtEx
SetWindowOrgEx

msimg32

GradientFill
TransparentBlt

comdlg32

GetFileTitleW

winspool.drv

DocumentPropertiesW
OpenPrinterW
ClosePrinter

advapi32

RegQueryValueW
RegEnumKeyW
RegDeleteKeyW
RegCreateKeyExW
RegEnumKeyExA
RegEnumKeyA
RegQueryValueExA
RegOpenKeyExA
RegDeleteValueW
RegOpenKeyW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegSetValueExW
RegCreateKeyW

shell32

Shell_NotifyIconW
SHGetMalloc
SHBrowseForFolderW
SHGetPathFromIDListW
SHChangeNotify
DragQueryFileW
SHGetSpecialFolderLocation
DragFinish
ShellExecuteW

comctl32

InitCommonControlsEx
_TrackMouseEvent

shlwapi

UrlUnescapeW
PathFindExtensionW
PathRemoveFileSpecW
PathIsUNCW
PathStripToRootW
ord219
PathFindFileNameW

wsock32

htons
connect
send
recv
WSASetLastError
getpeername
closesocket
htonl
WSAGetLastError
accept
select
WSAAsyncSelect
recvfrom
sendto
socket
ntohs
ioctlsocket
WSACleanup
inet_addr
gethostbyname
gethostname
WSAStartup
setsockopt
listen
bind

oledlg

OleUIBusyW

ole32

CoRegisterMessageFilter
ReleaseStgMedium
CoTaskMemAlloc
OleDuplicateData
CoInitializeEx
OleGetClipboard
CoGetClassObject
StgOpenStorageOnILockBytes
CoDisconnectObject
RegisterDragDrop
CoLockObjectExternal
RevokeDragDrop
OleIsCurrentClipboard
OleFlushClipboard
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CLSIDFromProgID
CLSIDFromString
CoTaskMemFree
OleRun
CoUninitialize
CoInitialize
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
CreateStreamOnHGlobal
CoCreateInstance
CoRevokeClassObject

oleaut32

GetErrorInfo
OleLoadPicture
LoadTypeLi
VariantTimeToSystemTime
SystemTimeToVariantTime
SysAllocString
SysAllocStringByteLen
SysStringLen
SysFreeString
SysAllocStringLen
VariantInit
VariantClear
VariantChangeType
SysStringByteLen
VariantCopy
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayCreate
SafeArrayDestroy
SafeArrayGetLBound
SafeArrayGetUBound
VarBstrCmp
OleCreateFontIndirect
DispCallFunc
LoadRegTypeLi
SafeArrayGetElemsize
SafeArrayGetDim

urlmon

URLDownloadToFileW

gdiplus

GdipSetEmpty
GdipSetLineBlend
GdipSetLineColors
GdipAddPathLine2I
GdipCreateLineBrushI
GdipCreatePen2
GdipDrawPolygonI
GdipFillRectangle
GdipFillPolygonI
GdipCreateLineBrushFromRect
GdipSetPenLineJoin
GdipAddPathStringI
GdipResetPath
GdipAddPathRectangleI
GdipClosePathFigure
GdipAddPathEllipseI
GdipAddPathArcI
GdipCreatePen1
GdipDeletePen
GdipSetPenMode
GdipDrawEllipse
GdipGetSmoothingMode
GdipSetSmoothingMode
GdipSetClipRectI
GdipCreateSolidFill
GdipDeleteBrush
GdipFree
GdipAlloc
GdipCloneBrush
GdipFillRectangleI
GdipSetInterpolationMode
GdipDrawLineI
GdipGetPageUnit
GdipSetPageUnit
GdipCreatePath
GdipDeletePath
GdipDrawPath
GdipFillPath
GdipCreateRegionHrgn
GdipDeleteRegion
GdipSetClipRegion
GdiplusStartup
GdiplusShutdown
GdipCloneImage
GdipDisposeImage
GdipCreateBitmapFromFile
GdipCreateBitmapFromFileICM
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImagePaletteSize
GdipGetImagePalette
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipCreateBitmapFromScan0
GdipGetImageGraphicsContext
GdipDeleteGraphics
GdipDrawImageI
GdipCreateFromHDC
GdipDrawImageRectI
GdipLoadImageFromStream
GdipLoadImageFromStreamICM
GdipLoadImageFromFile
GdipLoadImageFromFileICM
GdipDrawImageRectRectI
GdipDrawImagePointsI
GdipCreateBitmapFromStream
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromHBITMAP
GdipCreateRegion
GdipCreateRegionRectI
GdipResetClip
GdipCombineRegionRegion
GdipCreateLineBrushFromRectI
GdipSetLinePresetBlend
GdipSetLineWrapMode
GdipCreatePathGradientFromPath
GdipSetPathGradientCenterPointI
GdipSetPathGradientSurroundColorsWithCount
GdipGetPathGradientPointCount
GdipSetPathGradientCenterColor
GdipCreateRegionPath
GdipCloneRegion
GdipFillEllipseI
GdipTranslateRegionI
GdipAddPathPolygonI
GdipCreateFont
GdipGetGenericFontFamilySansSerif
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipDeleteFont
GdipCreateStringFormat
GdipDeleteStringFormat
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipDrawString
GdipSetPathFillMode
GdipGetImageBounds
GdipDrawImageRectRect
GdipCreateImageAttributes
GdipDisposeImageAttributes
GdipSetImageAttributesColorMatrix
GdipSetTextRenderingHint
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipSaveImageToFile

psapi

GetProcessMemoryInfo

ws2_32

WSAEnumProtocolsW
WSACreateEvent
WSARecv
WSAWaitForMultipleEvents
WSAResetEvent
WSAGetOverlappedResult
WSASend
WSACloseEvent
WSASocketW

wininet

InternetQueryDataAvailable
DeleteUrlCacheEntryW
FindNextUrlCacheEntryW
FindCloseUrlCache
InternetCrackUrlW
InternetCanonicalizeUrlW
InternetQueryOptionW
HttpOpenRequestW
InternetOpenUrlW
InternetConnectW
HttpSendRequestExW
HttpEndRequestW
HttpSendRequestW
InternetReadFile
InternetWriteFile
InternetSetFilePointer
InternetSetStatusCallbackW
InternetOpenW
InternetGetLastResponseInfoW
InternetCloseHandle
HttpQueryInfoW
HttpAddRequestHeadersW
InternetSetOptionExW
FindFirstUrlCacheEntryW

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 550KB - Virtual size: 549KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 41KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4.7MB - Virtual size: 4.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cb9d7f220d4a2ffa9c837cf48364fff3

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

winmm

sqlite3

audioexp

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

wsock32

oledlg

ole32

oleaut32

urlmon

gdiplus

psapi

ws2_32

wininet

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.rdata Size: 550KB - Virtual size: 549KB

.data Size: 41KB - Virtual size: 72KB

.rsrc Size: 4.7MB - Virtual size: 4.7MB

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 550KB - Virtual size: 549KB

.data
Size: 41KB - Virtual size: 72KB

.rsrc
Size: 4.7MB - Virtual size: 4.7MB