2024-04-04_38787b80b635e551ea8b72bf3e4abeb3_icedid

Sharing

Copy URL Twitter E-mail

General

Target
2024-04-04_38787b80b635e551ea8b72bf3e4abeb3_icedid
Size 1.9MB
Sample240404-m6fs6adb4v
SHA256 5cde89f3cb9bd1b72aeeb52ad2261d47c8009f13ea22e6c12f04069090c680f0
MD5 38787b80b635e551ea8b72bf3e4abeb3
SHA1 1855e20614a72f16e738c0b79e63b138938a064f
SHA512 5941b8b3332cd6dd179cd6320b471e3e975090513314fcf400734780976ebab642fc9c8129da47be700afef561ea69d7ddb1fb945c499a2244cb97c533024032
SSDEEP 49152:G4mONZgohRz8J4FOTdfTOJIMzHRX4WZ3rnp6:fmOj04FOTtTUHZ3rnw
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-04-04_38787b80b635e551ea8b72bf3e4abeb3_icedid

File Explorer

2024-04-04_38787b80b635e551ea8b72bf3e4abeb3_icedid

.exe 1.9MB

2024-04-04_38787b80b635e551ea8b72bf3e4abeb3_icedid

IMPHASH 2243d45d9f989c5cd8aab7b59e9ba0dd
SHA256 5cde89f3cb9bd1b72aeeb52ad2261d47c8009f13ea22e6c12f04069090c680f0
MD5 38787b80b635e551ea8b72bf3e4abeb3
SHA1 1855e20614a72f16e738c0b79e63b138938a064f
SHA512 5941b8b3332cd6dd179cd6320b471e3e975090513314fcf400734780976ebab642fc9c8129da47be700afef561ea69d7ddb1fb945c499a2244cb97c533024032
SSDEEP 49152:G4mONZgohRz8J4FOTdfTOJIMzHRX4WZ3rnp6:fmOj04FOTtTUHZ3rnw
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

435744

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\DCB\CBT_Main\BuildResults\bin\Win32\Release\AdobeARM.pdb

msi

ord160 ord159 ord114 ord120 ord123 ord205 ord70 ord141 ord8 ord16 ord195 ord92 ord118 ord171 ord116 ord115 ord119 ord131 ord150 ord78 ord181 ord281 ord240 ord32 ord88

psapi

GetModuleBaseNameW EnumProcessModules EnumProcesses GetModuleFileNameExW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

wininet

DeleteUrlCacheEntryW HttpQueryInfoW InternetReadFile InternetCrackUrlW InternetOpenW InternetConnectW HttpOpenRequestW HttpSendRequestW InternetErrorDlg InternetSetOptionW InternetCloseHandle

sensapi

IsNetworkAlive

secur32

LsaGetLogonSessionData LsaFreeReturnBuffer

kernel32

GetModuleFileNameW GetModuleHandleA GlobalAlloc GlobalLock GlobalUnlock GlobalFree MulDiv FlushFileBuffers GetFullPathNameW LockFile UnlockFile DuplicateHandle LoadLibraryExW LoadLibraryA GetCurrentThreadId GetVersionExW GlobalDeleteAtom FileTimeToLocalFileTime FindNextFileW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SetThreadPriority LeaveCriticalSection ResumeThread GetPrivateProfileIntW GlobalAddAtomW EncodePointer GetSystemDirectoryW GlobalFindAtomW CompareStringW GetFileAttributesExW GetFileSizeEx GetFileTime InitializeCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree GlobalReAlloc GlobalHandle LocalReAlloc SetErrorMode GetLocaleInfoW GetSystemDefaultUILanguage EnterCriticalSection GlobalFlags GetUserDefaultLCID ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW OutputDebugStringA GetCurrentProcessId ProcessIdToSessionId GlobalMemoryStatusEx GetEnvironmentVariableW GetSystemInfo DeleteCriticalSection DecodePointer RaiseException InitializeCriticalSectionEx OpenEventW Module32NextW Module32FirstW GetNativeSystemInfo Process32NextW GetLongPathNameW Process32FirstW CreateToolhelp32Snapshot FindResourceExW GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy lstrcmpA lstrcmpW LocalAlloc GetExitCodeProcess CreateProcessW GetFileInformationByHandle OpenMutexW CreateMutexW SystemTimeToFileTime SetEndOfFile RemoveDirectoryW GetFileSize SetFilePointer GetThreadLocale GetPrivateProfileSectionNamesW MoveFileW WaitNamedPipeW CreateNamedPipeW ConnectNamedPipe SetNamedPipeHandleState DisconnectNamedPipe ReadFile LocalFree GetUserDefaultLangID WideCharToMultiByte SetCurrentDirectoryW GetCurrentDirectoryW FreeLibrary UnmapViewOfFile OpenFileMappingW MapViewOfFile FormatMessageW GetLocalTime GetModuleHandleW GetVolumeInformationW GetPrivateProfileStringW WritePrivateProfileStringW MoveFileExW CreateFileW GetCurrentThread GetCurrentProcess GetTempPathW OpenProcess CopyFileW GetProcAddress GetACP LoadLibraryW WaitForSingleObject SetEvent GetTickCount64 CloseHandle CreateEventW SetLastError Sleep GetThreadPriority MultiByteToWideChar FindClose FindFirstFileW DeleteFileW lstrlenW SetFileAttributesW SetFileTime WriteFile GetLastError InitializeCriticalSectionAndSpinCount CreateDirectoryW GetFileAttributesW FindResourceW LoadResource LockResource SizeofResource OutputDebugStringW GetStringTypeW LCMapStringW GetCPInfo RtlUnwind GetDriveTypeW SetEnvironmentVariableW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetCommandLineA GetCommandLineW SetStdHandle GetFileType HeapQueryInformation GetStdHandle ExitProcess GetDateFormatW GetTimeFormatW IsValidLocale EnumSystemLocalesW GetTimeZoneInformation GetConsoleCP GetConsoleMode ReadConsoleW SetFilePointerEx FindFirstFileExW IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW WriteConsoleW SuspendThread GetUserDefaultUILanguage

user32

DestroyMenu GetMonitorInfoW MonitorFromWindow WinHelpW UnhookWindowsHookEx GetTopWindow GetClassNameW GetClassLongW PtInRect MapWindowPoints AdjustWindowRectEx RemovePropW GetPropW SetPropW ShowScrollBar GetScrollPos RedrawWindow TrackPopupMenu SetMenu GetMenu GetCapture EndDeferWindowPos DeferWindowPos BeginDeferWindowPos IsChild IsMenu CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW CallWindowProcW DefWindowProcW GetMessageTime GetMessagePos CopyRect GetSysColor ScreenToClient EndPaint BeginPaint ReleaseDC GetDC TabbedTextOutW GrayStringW DrawTextExW DrawTextW GetDesktopWindow GetNextDlgTabItem EndDialog CreateDialogIndirectParamW DestroyWindow SetWindowLongW GetWindowTextLengthW SetFocus GetDlgCtrlID SetDlgItemTextW GetSysColorBrush ShowWindow GetLastActivePopup GetWindowLongW IsWindowEnabled CallNextHookEx SetWindowsHookExW ValidateRect GetKeyState DispatchMessageW TranslateMessage GetMessageW LoadBitmapW SetMenuItemInfoW GetMenuCheckMarkDimensions SetMenuItemBitmaps EnableMenuItem CheckMenuItem PostQuitMessage CharUpperW GetMenuStringW OffsetRect SendDlgItemMessageA UnregisterClassW GetWindow FindWindowW ExitWindowsEx RegisterWindowMessageW EnumWindows RealChildWindowFromPoint InvalidateRect GetWindowTextW IsWindowVisible GetWindowThreadProcessId FindWindowExW SystemParametersInfoW SetActiveWindow DrawAnimatedRects SetForegroundWindow SetMenuDefaultItem ModifyMenuW GetMenuItemID GetMenuItemCount GetSubMenu ClientToScreen GetCursorPos LoadMenuW SetCursor DrawFocusRect InflateRect SetRectEmpty GetParent SetWindowTextW LoadCursorW GetActiveWindow DrawIcon GetClientRect GetSystemMetrics IsIconic PeekMessageW UpdateWindow GetFocus IsWindow SetTimer GetWindowRect SendMessageW LoadIconW EnableWindow PostMessageW SetWindowPos GetForegroundWindow KillTimer MessageBoxW GetDlgItem IsDialogMessageW

gdi32

SetMapMode CreateBitmap ScaleWindowExtEx ScaleViewportExtEx OffsetViewportOrgEx GetDeviceCaps DeleteDC GetTextExtentPoint32W SetWindowExtEx SetViewportOrgEx SetViewportExtEx ExtTextOutW TextOutW SetTextColor CreateFontIndirectW GetObjectW SetBkMode SetBkColor SelectObject SaveDC RestoreDC RectVisible PtVisible GetStockObject GetClipBox Escape DeleteObject

winspool.drv

DocumentPropertiesW ClosePrinter OpenPrinterW

advapi32

RegEnumKeyExW RegOpenKeyExW RegQueryInfoKeyW RegEnumValueW RegCloseKey CopySid GetLengthSid IsValidSid GetSidSubAuthority InitializeSid GetSidLengthRequired OpenProcessToken RegQueryValueW RegEnumKeyW RegDeleteKeyW RegFlushKey ConvertSidToStringSidW LookupAccountNameW ControlService QueryServiceStatusEx CloseServiceHandle OpenServiceW OpenSCManagerW CreateWellKnownSid RegCreateKeyW RegDeleteKeyExW LookupAccountSidW GetTokenInformation DuplicateTokenEx CreateProcessAsUserW AdjustTokenPrivileges LookupPrivilegeValueW GetUserNameW RegCreateKeyExW RegQueryValueExW RegSetValueExW RegDeleteValueW ConvertStringSecurityDescriptorToSecurityDescriptorW CheckTokenMembership DuplicateToken OpenThreadToken

shell32

SHGetFolderPathW SHCreateDirectoryExW ShellExecuteExW SHFileOperationW Shell_NotifyIconW SHAppBarMessage ShellExecuteW

comctl32

_TrackMouseEvent InitCommonControlsEx

shlwapi

PathIsUNCW PathStripToRootW PathFindExtensionW PathFindFileNameW SHDeleteKeyW

ole32

CoInitialize CoUninitialize CoTaskMemFree CoInitializeEx CoInitializeSecurity CoCreateInstance OleRun CoCreateGuid

oleaut32

SysAllocString SysFreeString VariantClear SysAllocStringByteLen SysStringByteLen VariantInit VariantCopy VariantChangeType GetErrorInfo

urlmon

URLDownloadToFileW

userenv

CreateEnvironmentBlock UnloadUserProfile DestroyEnvironmentBlock

crypt32

CryptProtectData CryptDecodeObject CryptMsgClose CertCloseStore CertFreeCertificateContext CertGetNameStringW CertFindCertificateInStore CryptQueryObject CryptUnprotectData CryptMsgGetParam

wintrust

WinVerifyTrust

oleacc

CreateStdAccessibleObject LresultFromObject

Sharing

General

Malware Config

Signatures

File Explorer

2024-04-04_38787b80b635e551ea8b72bf3e4abeb3_icedid

msi

psapi

version

wininet

sensapi

secur32

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

urlmon

userenv

crypt32

wintrust

oleacc

generic