Static task
static1
Behavioral task
behavioral1
Sample
icedid_loader.dll
Resource
win10v2004-20240226-en
General
-
Target
icedid_loader.dll
-
Size
192KB
-
MD5
6779daf60f7aa4bc357b264f32ff6cde
-
SHA1
1c6e76af95f2a17b8e518965d62b3c9d7ecba6d5
-
SHA256
e1d2c95eda751901a4bdae7ba381b85f5d7965b05afe245b5cbaccce9ecfb0bc
-
SHA512
7829bf03bcf5b79703a1ba35ca9ba785e879ab6bfb141f00436d043986511819625194cadf0d516128075e10b8d94c845d31965048f0679fdd236a72f34c215f
-
SSDEEP
6144:oZU+Q0/Xns9tMYN1fPdqTBNPenpNgpiF69:oS+Q289tMq1oPenPgpiF69
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource icedid_loader.dll
Files
-
icedid_loader.dll.dll windows:4 windows x64 arch:x64
a56f115ee5ef2625bd949acaeec66b76
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
GetModuleHandleA
Exports
Exports
t_gcc_deregister_frame
t_gcc_register_frame
tel_fn_complete
trl_abort_internal
trl_print_completions_horizontally
trl_qsort_string_compare
tdd_history
tppend_history
t__next_word
t__prev_word
t_delafter
t_delafter1
t_delbefore
t_delbefore1
t_gets
t_hmatch
t_hpos
t_insert
t_setpat
te__isword
te_inc_search
te_search_line
th_aliasfun
th_end
th_enlargebufs
th_init
th_reset
th_resizefun
tlear_history
tompletion_matches
tt_chr_class
tt_decode_argv
tt_decode_string
tt_enc_width
tt_encode_char
tt_encode_string
tt_visual_char
tt_visual_string
tt_visual_width
turrent_history
tv__endword
tv__isWord
tv__isword
tv_csearch
tv_delfini
tv_next_word
tv_prev_word
tv_repeat_srch
tv_search
tv_undo
tv_yank
td_argument_digit
td_clear_screen
td_command
td_delete_next_char
td_delete_prev_char
td_delete_prev_word
td_digit
td_end_of_file
td_ignore
td_insert
td_kill_line
td_move_to_beg
td_move_to_end
td_newline
td_next_char
td_next_history
td_next_line
td_prev_char
td_prev_history
td_prev_line
td_prev_word
td_quoted_insert
td_redisplay
td_search_next_history
td_search_prev_history
td_sequence_lead_in
td_start_over
td_transpose_chars
td_unassigned
tl_beep
tl_cursor
tl_deletestr
tl_editmode
tl_end
tl_get
tl_getc
tl_gets
tl_init
tl_init_fd
tl_init_internal
tl_insertstr
tl_line
tl_match
tl_parse
tl_push
tl_read_getfn
tl_read_setfn
tl_reset
tl_resize
tl_set
tl_source
tl_wget
tl_wgetc
tl_wgets
tl_winsertstr
tl_wline
tl_wparse
tl_wpush
tl_wset
tm_capitol_case
tm_copy_prev_word
tm_copy_region
tm_delete_next_word
tm_delete_or_list
tm_delete_prev_char
tm_exchange_mark
tm_gosmacs_transpose
tm_inc_search_next
tm_inc_search_prev
tm_kill_line
tm_kill_region
tm_lower_case
tm_meta_next
tm_next_word
tm_set_mark
tm_toggle_overwrite
tm_universal_argument
tm_upper_case
tm_yank
tmacs_ctlx_keymap
tmacs_meta_keymap
tmacs_standard_keymap
tilename_completion_function
tn_complete
tn_complete2
tn_display_match_list
tn_filename_completion_function
tn_tilde_expand
tet_history_event
tist_command
tist_convert
tist_end
tist_enlargebuf
tist_get
tist_init
tist_set
tistory
tistory_arg_extract
tistory_base
tistory_end
tistory_expand
tistory_expansion_char
tistory_get
tistory_get_history_state
tistory_inhibit_expansion_function
tistory_init
tistory_is_stifled
tistory_length
tistory_list
tistory_no_expand_chars
tistory_offset
tistory_search
tistory_search_pos
tistory_search_prefix
tistory_set_pos
tistory_subst_char
tistory_tokenize
tistory_total_bytes
tistory_truncate_file
tistory_w
tistory_wend
tistory_winit
teymacro__decode_str
teymacro_add
teymacro_clear
teymacro_delete
teymacro_end
teymacro_get
teymacro_init
teymacro_kprint
teymacro_map_cmd
teymacro_map_str
teymacro_print
teymacro_reset
titeral_add
titeral_clear
titeral_end
titeral_get
titeral_init
tap_addfunc
tap_bind
tap_end
tap_get_editor
tap_init
tap_init_emacs
tap_init_vi
tap_set_editor
tax_input_history
text_history
tvis
tarse__escape
tarse__string
tarse_cmd
tarse_line
trevious_history
trompt_end
trompt_get
trompt_init
trompt_print
trompt_set
te_clear_display
te_clear_lines
te_fastaddc
te_goto_bottom
te_putc
te_putliteral
te_refresh
te_refresh_cursor
tead_end
tead_finish
tead_history
tead_init
tead_prepare
teadline
teadline_echoing_p
temove_history
teplace_history_entry
tl_add_defun
tl_already_prompted
tl_attempted_completion_function
tl_attempted_completion_over
tl_basic_word_break_characters
tl_bind_key
tl_bind_key_in_map
tl_callback_handler_install
tl_callback_handler_remove
tl_callback_read_char
tl_catch_signals
tl_catch_sigwinch
tl_cleanup_after_signal
tl_complete
tl_completer_quote_characters
tl_completer_word_break_characters
tl_completion_append_character
tl_completion_display_matches_hook
tl_completion_entry_function
tl_completion_matches
tl_completion_query_items
tl_completion_type
tl_completion_word_break_hook
tl_deprep_term_function
tl_deprep_terminal
tl_did_startup_hook
tl_display_match_list
tl_done
tl_echo_signal_char
tl_end
tl_event_hook
tl_filename_completion_desired
tl_filename_completion_function
tl_forced_update_display
tl_free_line_state
tl_generic_bind
tl_get_keymap
tl_get_previous_history
tl_get_screen_size
tl_getc_function
tl_ignore_completion_duplicates
tl_inhibit_completion
tl_initialize
tl_insert
tl_insert_text
tl_instream
tl_kill_text
tl_library_version
tl_line_buffer
tl_linefunc
tl_make_bare_keymap
tl_newline
tl_on_new_line
tl_outstream
tl_parse_and_bind
tl_point
tl_pre_input_hook
tl_prep_term_function
tl_prep_terminal
tl_prompt
tl_read_init_file
tl_read_key
tl_readline_name
tl_readline_version
tl_redisplay
tl_redisplay_function
tl_reset_after_signal
tl_reset_terminal
tl_resize_terminal
tl_set_keyboard_input_timeout
tl_set_keymap
tl_set_prompt
tl_set_screen_size
tl_special_prefixes
tl_startup1_hook
tl_startup_hook
tl_stuff_char
tl_terminal_name
tl_variable_bind
tearch_end
tearch_init
tig_clr
tig_end
tig_init
tig_set
tnvis
ttifle_history
ttravis
ttrenvisx
ttrnunvis
ttrnunvisx
ttrnvis
ttrnvisx
ttrsenvisx
ttrsnvis
ttrsnvisx
ttrsvis
ttrsvisx
ttrunvis
ttrunvisx
ttrvis
ttrvisx
tvis
terminal__flush
terminal__putc
terminal_beep
terminal_bind_arrow
terminal_change_size
terminal_clear_EOL
terminal_clear_arrow
terminal_clear_screen
terminal_deletechars
terminal_echotc
terminal_end
terminal_get
terminal_get_size
terminal_gettc
terminal_init
terminal_insertwrite
terminal_move_to_char
terminal_move_to_line
terminal_overwrite
terminal_print_arrow
terminal_set
terminal_set_arrow
terminal_settc
terminal_telltc
terminal_writec
tilde_expand
tok_end
tok_init
tok_line
tok_reset
tok_str
tok_wend
tok_winit
tok_wline
tok_wreset
tok_wstr
tty_bind_char
tty_cookedmode
tty_end
tty_get_signal_character
tty_init
tty_noquotemode
tty_quotemode
tty_rawmode
tty_stty
tnstifle_history
tnvis
tsername_completion_function
tsing_history
ti_add
ti_add_at_eol
ti_alias
ti_change_case
ti_change_meta
ti_change_to_eol
ti_command_mode
ti_comment_out
ti_delete_meta
ti_delete_prev_char
ti_end_big_word
ti_end_word
ti_histedit
ti_history_word
ti_insert
ti_insert_at_bol
ti_kill_line_prev
ti_list_or_eof
ti_match
ti_next_big_word
ti_next_char
ti_next_word
ti_paste_next
ti_paste_prev
ti_prev_big_word
ti_prev_char
ti_prev_word
ti_redo
ti_repeat_next_char
ti_repeat_prev_char
ti_repeat_search_next
ti_repeat_search_prev
ti_replace_char
ti_replace_mode
ti_search_next
ti_search_prev
ti_substitute_char
ti_substitute_line
ti_to_column
ti_to_history_line
ti_to_next_char
ti_to_prev_char
ti_undo
ti_undo_line
ti_yank
ti_yank_end
ti_zero
tis
tcsdup
there_history
vcab
Sections
.text Size: 111KB - Virtual size: 110KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 288B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.buildid Size: 512B - Virtual size: 53B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 15KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ