2024-04-06_97ec8fd4f4d6135fc90274c663f239c5_icedid

Sharing

Copy URL Twitter E-mail

General

Target

2024-04-06_97ec8fd4f4d6135fc90274c663f239c5_icedid
Size

520KB
MD5

97ec8fd4f4d6135fc90274c663f239c5
SHA1

7255e0f3573a1525ff07f97be566b28b2a0fb5bc
SHA256

847fbc85ca29142116fcabd1cf8dfe3fdd68d495e66b865afe716fbb298b3183
SHA512

f990a6f2c8a8796e547a591e64792fbbbfd671d85934bca329f8fc4de8e6dab0a9b14bad74211073b2b54c795ad7fe60cf8e7c62ac95ed29f7b1864620244028
SSDEEP

12288:+EiVLzL8kQM3+wT5M5kYZp/9Sac7cVurgmoV:+TLzwkQY+wKkc9hV6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-04-06_97ec8fd4f4d6135fc90274c663f239c5_icedid

Files

2024-04-06_97ec8fd4f4d6135fc90274c663f239c5_icedid
.exe windows:4 windows x86 arch:x86

9c220410374549ac571895da5a083644

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\Buildsrc\Wis_7.0\WiseComCapture\Release\WiseComCapture.pdb

Imports

kernel32

SystemTimeToFileTime
LeaveCriticalSection
EnterCriticalSection
GlobalFlags
LocalAlloc
GlobalReAlloc
GlobalHandle
TlsGetValue
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
GetCPInfo
GetOEMCP
WritePrivateProfileStringA
SetErrorMode
RtlUnwind
ExitProcess
HeapAlloc
HeapFree
VirtualProtect
VirtualAlloc
VirtualQuery
GetStartupInfoA
HeapReAlloc
TerminateProcess
LocalFileTimeToFileTime
GetFileType
HeapSize
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringA
LCMapStringW
HeapDestroy
HeapCreate
VirtualFree
IsBadWritePtr
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetTimeZoneInformation
GetStringTypeA
GetStringTypeW
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
SetEnvironmentVariableA
FileTimeToLocalFileTime
FileTimeToSystemTime
GetShortPathNameA
DuplicateHandle
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
FreeResource
GetCurrentThreadId
GlobalFindAtomA
GlobalDeleteAtom
lstrcatA
lstrcmpW
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFree
MulDiv
lstrcpynA
InterlockedIncrement
InterlockedDecrement
GetDiskFreeSpaceA
GetFileTime
SetFileTime
GetStdHandle
SetFilePointer
WriteFile
MoveFileA
ReadFile
GetFullPathNameA
CreateFileA
GetFileSize
GetSystemInfo
FindFirstFileA
FindClose
GetCommandLineA
GetCurrentProcess
SetLastError
QueryPerformanceFrequency
GetTickCount
QueryPerformanceCounter
LocalFree
GetVolumeInformationA
GetFileAttributesA
FormatMessageA
GlobalAlloc
GlobalLock
GlobalUnlock
lstrcmpA
CreateProcessA
ResumeThread
FreeLibrary
DeleteFileA
GetTempPathA
GetTempFileNameA
GetStringTypeExA
CompareStringW
CompareStringA
lstrlenW
lstrcmpiA
GetVersion
DeleteCriticalSection
InitializeCriticalSection
GetLastError
RaiseException
MultiByteToWideChar
GetModuleHandleA
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
WaitForSingleObject
GetExitCodeThread
CloseHandle
VirtualFreeEx
lstrlenA
GetModuleFileNameA
LoadLibraryA
GetProcAddress
lstrcpyA
WideCharToMultiByte
FindResourceA
GetProcessHeap
LoadResource
LockResource
SizeofResource
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
SetStdHandle
InterlockedExchange

user32

GetClassLongA
GetClassInfoExA
SetPropA
RemovePropA
SendDlgItemMessageA
GetWindowTextLengthA
GetWindowTextA
GetForegroundWindow
DispatchMessageA
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
MapWindowPoints
TrackPopupMenu
SetForegroundWindow
GetClientRect
ScreenToClient
DeferWindowPos
RegisterClassA
DefWindowProcA
CallWindowProcA
SystemParametersInfoA
GetWindowPlacement
GetWindowRect
GetSystemMetrics
PtInRect
RegisterWindowMessageA
LoadMenuA
DestroyMenu
GetClassNameA
GetSysColor
SetWindowPos
WinHelpA
SetFocus
GetActiveWindow
EqualRect
GetDlgItem
SetWindowLongA
GetKeyState
GetMenu
UnpackDDElParam
ReuseDDElParam
LoadIconA
GetClassInfoA
SetCursor
LockWindowUpdate
GetCapture
ReleaseCapture
LoadAcceleratorsA
SetActiveWindow
InsertMenuItemA
CreatePopupMenu
CallNextHookEx
OffsetRect
SetRectEmpty
CopyRect
GetLastActivePopup
BringWindowToTop
PostMessageA
SetMenu
ShowWindow
GetWindowLongA
IsWindow
GetWindow
IsWindowEnabled
TranslateAcceleratorA
GetDlgCtrlID
IsChild
InvalidateRect
UpdateWindow
IsIconic
AdjustWindowRectEx
GetDCEx
PostThreadMessageA
DestroyIcon
SetCapture
WindowFromPoint
KillTimer
SetTimer
SetRect
UnhookWindowsHookEx
GetMenuItemID
GetMenuItemCount
GetSubMenu
IsWindowVisible
SetMenuItemBitmaps
GetFocus
GetParent
SendMessageA
ModifyMenuA
GetMenuState
EnableMenuItem
CheckMenuItem
GetMenuCheckMarkDimensions
LoadBitmapA
SetWindowsHookExA
CreateWindowExA
SetParent
wsprintfA
GetDesktopWindow
MessageBoxA
UnregisterClassA
CharUpperA
EnableWindow
CreateDialogIndirectParamA
GetNextDlgTabItem
IntersectRect
EndDialog
GetMenuItemInfoA
InflateRect
EndPaint
BeginPaint
GetWindowDC
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
FillRect
ClientToScreen
LoadCursorA
GetSysColorBrush
RegisterClipboardFormatA
GetMessageA
TranslateMessage
GetCursorPos
ValidateRect
ShowOwnedPopups
PostQuitMessage
GetDC
ReleaseDC
IsZoomed
SetWindowTextA
IsDialogMessageA
PeekMessageA
GetPropA

gdi32

SelectClipRgn
CreateRectRgn
BitBlt
GetPixel
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
CreatePatternBrush
GetStockObject
CreateSolidBrush
CreateFontIndirectA
CreateRectRgnIndirect
PatBlt
SetRectRgn
CombineRgn
GetBkColor
IntersectClipRect
ExcludeClipRect
SetMapMode
SetBkMode
RestoreDC
SaveDC
CreateFontA
GetCharWidthA
DeleteObject
StretchDIBits
DeleteDC
GetTextExtentPoint32A
GetTextMetricsA
SelectObject
GetObjectA
SetBkColor
SetTextColor
GetClipBox
CreateCompatibleDC
CreateCompatibleBitmap
CreateBitmap
GetDeviceCaps

comdlg32

GetSaveFileNameA
GetFileTitleA
GetOpenFileNameA

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

GetFileSecurityA
RegOpenKeyExA
RegQueryValueExA
RegOpenKeyA
RegCreateKeyExA
RegSetValueExA
RegDeleteValueA
RegEnumKeyA
RegCreateKeyA
RegQueryValueA
RegDeleteKeyA
RegSetValueA
RegCloseKey
SetFileSecurityA

shell32

ExtractIconA
DragFinish
DragQueryFileA
ShellExecuteA
SHGetFileInfoA

comctl32

ImageList_Draw
ImageList_GetImageInfo
ord17
ImageList_Destroy

shlwapi

PathFindExtensionA
PathFindFileNameA
PathStripToRootA
PathIsUNCA

oledlg

ord8

ole32

CoRegisterClassObject
CoTaskMemAlloc
StringFromCLSID
CoRevokeClassObject
CoTaskMemFree
CoDisconnectObject
StringFromGUID2
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter

oleaut32

CreateErrorInfo
VariantClear
VariantCopy
VariantChangeType
SysFreeString
SysAllocStringLen
SysStringLen
SysAllocStringByteLen
SysStringByteLen
VariantInit
RegisterTypeLi
LoadTypeLi
LoadRegTypeLi
SysAllocString
SysReAllocString
SetErrorInfo

Sections

.text
Size: 188KB - Virtual size: 186KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 272KB - Virtual size: 270KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9c220410374549ac571895da5a083644

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

Sections

.text Size: 188KB - Virtual size: 186KB

.rdata Size: 48KB - Virtual size: 46KB

.data Size: 8KB - Virtual size: 22KB

.rsrc Size: 272KB - Virtual size: 270KB

.text
Size: 188KB - Virtual size: 186KB

.rdata
Size: 48KB - Virtual size: 46KB

.data
Size: 8KB - Virtual size: 22KB

.rsrc
Size: 272KB - Virtual size: 270KB