2024-04-04_14104412bd92f7e917a3c9ee2288f98c_icedid

Sharing

Copy URL Twitter E-mail

General

Target

2024-04-04_14104412bd92f7e917a3c9ee2288f98c_icedid
Size

3.0MB
MD5

14104412bd92f7e917a3c9ee2288f98c
SHA1

3fbb707fe7d71d49cec9c381743766e885814534
SHA256

032ba11858a89fafe959522cda1b3d3d01c6d0ad742edc9472636d5937f60e3f
SHA512

f66a74cd5a534e1eb114804a38bfb82de7e39aa531ad9f19035e37b90da872c244f3c13e6a6779eadc67a31f3d42b7c9e484131e552f734ea6cc16d770f5c777
SSDEEP

24576:+6q8oQXmjCUOS2iXqyASn9BZuPpHGDHEv0nkSaZ:s8oQXmjQiXqyASVIHMEv0n9aZ

Score

1^/10

Malware Config

Signatures

Files

2024-04-04_14104412bd92f7e917a3c9ee2288f98c_icedid
.exe windows:4 windows x86 arch:x86

86285d7e9e60d784ba5c969f34797b02

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

20:41:ae:3e:ce:78:12:5e:ff:db:47:fb:b7:e2:b2:95
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

18/11/2013, 00:00

Not After

18/11/2014, 23:59

Subject

CN=Eye of Imagination,OU=IT Team,O=Eye of Imagination,L=Jung-gu,ST=Daegu,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

69:52:2a:9c:59:99:fd:dc:3a:e8:c9:37:66:5b:62:28:a0:71:08:d3
Signer

Actual PE Digest

69:52:2a:9c:59:99:fd:dc:3a:e8:c9:37:66:5b:62:28:a0:71:08:d3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

f:\project_2008\Swingmirror\Filebus\Bin\SwingmirrorDown.pdb

Imports

urlmon

URLDownloadToFileA

user32

InvalidateRect
CopyRect
GetSysColor
FillRect
GetDC
ReleaseDC
SetRect
GetClassInfoA
FindWindowA
SendMessageA
CharUpperA
EnableWindow
LoadIconA
DrawIconEx
GetWindowLongA
PtInRect
InflateRect
LoadBitmapA
DrawFocusRect
GetClientRect
LoadMenuA
ReuseDDElParam
UnpackDDElParam
RegisterClipboardFormatA
GetFocus
MessageBoxA
LoadAcceleratorsA
InsertMenuItemA
SetRectEmpty
SetMenu
TranslateAcceleratorA
UnregisterClassA
GetMenuItemInfoA
MessageBeep
GetNextDlgGroupItem
InvalidateRgn
CopyAcceleratorTableA
CharNextA
GetSysColorBrush
LoadCursorA
DrawIcon
IsRectEmpty
EndPaint
BeginPaint
GetWindowDC
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
MoveWindow
SetWindowTextA
IsDialogMessageA
PostMessageA
BringWindowToTop
AttachThreadInput
GetWindowThreadProcessId
GetForegroundWindow
RedrawWindow
SetTimer
KillTimer
ShowWindow
SetForegroundWindow
DestroyMenu
TrackPopupMenu
GetCursorPos
SetMenuDefaultItem
AppendMenuA
CreatePopupMenu
CloseWindow
GetSystemMetrics
ReleaseCapture
GetIconInfo
LoadImageA
DestroyIcon
OffsetRect
ClientToScreen
GetCapture
SetCapture
WindowFromPoint
SetCursor
UpdateWindow
CallWindowProcA
SetWindowLongA
IsWindow
GetWindowRect
GetParent
GetActiveWindow
SetWindowRgn
GetClassNameA
EnumChildWindows
MapWindowPoints
SetWindowPos
ReplyMessage
ExitWindowsEx
PostThreadMessageA
RegisterWindowMessageA
SendDlgItemMessageA
WinHelpA
IsChild
GetClassLongA
SetPropA
GetPropA
RemovePropA
SetFocus
GetWindowTextLengthA
GetWindowTextA
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetSubMenu
GetMenuItemCount
GetMenuItemID
GetMenuState
PostQuitMessage
CheckMenuItem
EnableMenuItem
ModifyMenuA
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
ValidateRect
PeekMessageA
GetKeyState
IsWindowVisible
DispatchMessageA
TranslateMessage
GetMessageA
CallNextHookEx
SetWindowsHookExA
ShowOwnedPopups
IsWindowEnabled
GetLastActivePopup
EndDialog
GetNextDlgTabItem
GetDlgItem
DestroyWindow
CreateDialogIndirectParamA
SetActiveWindow
GetDesktopWindow
MapDialogRect
SetWindowContextHelpId
GetWindow
GetWindowPlacement
IsIconic
SystemParametersInfoA
IntersectRect
DefWindowProcA
GetDlgCtrlID
SetScrollInfo
GetScrollInfo
DeferWindowPos
EqualRect
ScreenToClient
AdjustWindowRectEx
RegisterClassA
GetClassInfoExA
CreateWindowExA
GetMenu
ShowScrollBar
GetScrollPos
SetScrollPos
GetScrollRange
SetScrollRange
ScrollWindow
GetMessagePos

wininet

DeleteUrlCacheEntry

kernel32

GetSystemInfo
TerminateThread
GetExitCodeThread
GetVolumeInformationA
GetCurrentThreadId
GetModuleFileNameA
InterlockedDecrement
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
GlobalReAlloc
GetVersionExA
VirtualFreeEx
ReadProcessMemory
VirtualAllocEx
OpenProcess
GetDiskFreeSpaceExA
GetNumberFormatA
GetTickCount
CreateRemoteThread
GetExitCodeProcess
DuplicateHandle
GetCurrentProcess
GetSystemDirectoryA
GetProcessHeap
LocalFree
FormatMessageA
LoadLibraryExA
EnterCriticalSection
EnumResourceLanguagesA
ConvertDefaultLocale
GlobalDeleteAtom
GlobalAddAtomA
GetCurrentProcessId
lstrcmpW
GlobalFindAtomA
GlobalGetAtomNameA
FindClose
FindNextFileA
FileTimeToSystemTime
FileTimeToLocalFileTime
FindFirstFileA
GetThreadLocale
ReadFile
WriteFile
SetFilePointer
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
GetFileSize
GetFullPathNameA
CreateFileA
GetModuleFileNameW
InterlockedIncrement
LocalAlloc
TlsGetValue
GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
WritePrivateProfileStringA
GetCurrentDirectoryA
GlobalFlags
GetCPInfo
GetOEMCP
SetErrorMode
GetFileAttributesA
GetFileTime
RtlUnwind
VirtualProtect
VirtualAlloc
VirtualQuery
HeapReAlloc
ExitThread
CreateThread
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
GetSystemTimeAsFileTime
GetTimeFormatA
GetDateFormatA
GetStartupInfoA
ExitProcess
HeapSize
VirtualFree
GetStdHandle
GetACP
IsValidCodePage
GetStringTypeA
GetStringTypeW
GetTimeZoneInformation
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetDriveTypeA
GetConsoleCP
GetConsoleMode
LCMapStringA
LCMapStringW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetCurrentThread
SetThreadPriority
CreateDirectoryA
GetModuleHandleA
SetLastError
lstrcpynA
SetEvent
ResetEvent
FindResourceA
LoadResource
SizeofResource
FreeResource
LockResource
GlobalAlloc
ResumeThread
GlobalLock
GlobalUnlock
MulDiv
GlobalFree
CloseHandle
CreateEventA
LoadLibraryA
GetProcAddress
FreeLibrary
lstrcmpA
DeleteFileA
WaitForSingleObject
lstrcpyA
CreateMutexA
GetCommandLineA
GetLastError
Sleep
lstrlenA
WideCharToMultiByte
CompareStringA
CompareStringW
MultiByteToWideChar
InterlockedExchange
GetVersion
GetLocaleInfoA

gdi32

GetViewportExtEx
GetRgnBox
GetTextColor
GetBkColor
Ellipse
LPtoDP
CreateEllipticRgn
CreatePatternBrush
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetWindowExtEx
SelectClipRgn
SetBkMode
RestoreDC
SaveDC
SetTextColor
GetClipBox
CreateDCA
GetPixel
CreateRectRgn
CreateFontA
CreateDIBSection
ExtCreateRegion
CombineRgn
DPtoLP
CreateBitmap
GetMapMode
SetMapMode
SetBkColor
CreateFontIndirectA
GetStockObject
GetTextExtentPoint32A
StretchBlt
Rectangle
SetRectRgn
CreateRectRgnIndirect
GetObjectA
CreatePen
CreateSolidBrush
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
DeleteDC
DeleteObject
GetDeviceCaps

comdlg32

GetFileTitleA

winspool.drv

ClosePrinter
DocumentPropertiesA
OpenPrinterA

advapi32

LookupPrivilegeValueA
RegOpenKeyExA
RegEnumKeyA
RegQueryValueA
RegOpenKeyA
OpenProcessToken
RegConnectRegistryA
AdjustTokenPrivileges
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegQueryInfoKeyA
RegCloseKey
RegEnumValueA

shell32

SHGetSpecialFolderPathA
Shell_NotifyIconA
ShellExecuteA
SHGetFileInfoA
DragFinish
DragQueryFileA
ShellExecuteExA

comctl32

ord17

shlwapi

StrFormatByteSize64A
PathFindFileNameA
PathFindExtensionA
PathStripToRootA
PathIsUNCA
PathGetArgsA

oledlg

ord8

ole32

CoFreeUnusedLibraries
OleUninitialize
CreateILockBytesOnHGlobal
OleInitialize
StgOpenStorageOnILockBytes
CoGetClassObject
CLSIDFromString
CLSIDFromProgID
CoTaskMemAlloc
CoCreateInstance
CreateStreamOnHGlobal
CoTaskMemFree
CoRevokeClassObject
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter
StgCreateDocfileOnILockBytes

oleaut32

OleCreateFontIndirect
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroy
VariantCopy
SafeArrayCreate
SafeArrayGetDim
SafeArrayGetElemsize
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SysStringLen
VariantInit
VariantChangeType
SysAllocString
SysAllocStringLen
VariantClear
SysStringByteLen
SysAllocStringByteLen
OleLoadPicture
SysFreeString

ws2_32

WSASocketA
WSAGetLastError
select
__WSAFDIsSet
recv
WSAConnect
closesocket
inet_addr
htons
connect
WSACleanup
WSAStartup
setsockopt
WSAWaitForMultipleEvents
WSASend
WSARecv
socket

Sections

.text
Size: 440KB - Virtual size: 437KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 112KB - Virtual size: 111KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

86285d7e9e60d784ba5c969f34797b02

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

20:41:ae:3e:ce:78:12:5e:ff:db:47:fb:b7:e2:b2:95Certificate

Extended Key Usages

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

69:52:2a:9c:59:99:fd:dc:3a:e8:c9:37:66:5b:62:28:a0:71:08:d3Signer

Headers

File Characteristics

PDB Paths

Imports

urlmon

user32

wininet

kernel32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

ws2_32

Sections

.text Size: 440KB - Virtual size: 437KB

.rdata Size: 112KB - Virtual size: 111KB

.data Size: 16KB - Virtual size: 27KB

.rsrc Size: 2.5MB - Virtual size: 2.5MB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

20:41:ae:3e:ce:78:12:5e:ff:db:47:fb:b7:e2:b2:95
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

69:52:2a:9c:59:99:fd:dc:3a:e8:c9:37:66:5b:62:28:a0:71:08:d3
Signer

.text
Size: 440KB - Virtual size: 437KB

.rdata
Size: 112KB - Virtual size: 111KB

.data
Size: 16KB - Virtual size: 27KB

.rsrc
Size: 2.5MB - Virtual size: 2.5MB