2024-04-09_6edee1f439708ffad00e6effb08bcffb_icedid

Sharing

Copy URL Twitter E-mail

General

Target

2024-04-09_6edee1f439708ffad00e6effb08bcffb_icedid
Size

4.4MB
MD5

6edee1f439708ffad00e6effb08bcffb
SHA1

489b22cde6102a1daa9f996a9fa78632ed38d7f5
SHA256

2d8778387dff213b93cdde7ac23c943eb10f3717cfa519fced73c43aeb04d8ec
SHA512

602750ec45d663c202586f807853a51854a6f1a39e4d230d2eccea9105125b0b49e8f88fc7ff18b73113ee91891f3feb67fa0cc33ef76ae02f84c9713838b8f5
SSDEEP

98304:wvNY26GozobdKO9bGs8p4uDUGyaz/UamG0GyS8j7K9N:wvNYtP9BDAoE5S8j7K9N

Score

1^/10

Malware Config

Signatures

Files

2024-04-09_6edee1f439708ffad00e6effb08bcffb_icedid
.exe windows:5 windows x86 arch:x86

49e53767575197ae1db426b973e4bdc1

Code Sign

07
Certificate

Issuer

CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

03/05/2011, 07:00

Not After

03/05/2031, 07:00

Subject

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:0d:8e:7b:88:93:ab
Certificate

Issuer

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

04/04/2014, 09:08

Not After

04/04/2017, 09:08

Subject

CN=Parallels International GmbH,O=Parallels International GmbH,L=Schaffhausen,ST=Schaffhausen,C=CH

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

45:33:02:c6:1a:f7:1f:db:42:38:03:ea:69:03:e9:70:95:7d:17:50
Signer

Actual PE Digest

45:33:02:c6:1a:f7:1f:db:42:38:03:ea:69:03:e9:70:95:7d:17:50

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Projects\2X\Bin\Release-Unicode\AppServer\Binaries\2XVDSAgent.pdb

Imports

kernel32

LockFileEx
CreateFileMappingA
GetDiskFreeSpaceA
OutputDebugStringA
AreFileApisANSI
VirtualUnlock
VirtualLock
SetLastError
FormatMessageA
WaitForSingleObject
GetCurrentThread
DuplicateHandle
SetConsoleCtrlHandler
GetModuleFileNameW
GlobalMemoryStatusEx
InterlockedDecrement
InterlockedIncrement
lstrlenW
GetComputerNameW
GetLastError
DeleteFileW
GetFileAttributesW
FormatMessageW
LocalFree
GetTickCount
InterlockedCompareExchange
SetUnhandledExceptionFilter
LoadLibraryW
GetLocalTime
LoadLibraryA
GetProcAddress
CreateDirectoryW
CreateFileW
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
CloseHandle
CreateProcessW
FindResourceW
LoadResource
LockResource
SizeofResource
WideCharToMultiByte
GetFullPathNameA
SetEnvironmentVariableA
CreateFileA
PeekNamedPipe
GetFileInformationByHandle
QueryPerformanceCounter
WriteConsoleW
GetStartupInfoW
SetHandleCount
HeapValidate
GetStdHandle
HeapDestroy
HeapCreate
IsProcessorFeaturePresent
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
IsDebuggerPresent
UnhandledExceptionFilter
GetFileType
SetStdHandle
ExitProcess
HeapSize
HeapQueryInformation
ExitThread
VirtualQuery
VirtualAlloc
RtlUnwind
RaiseException
FindFirstFileExW
GetDriveTypeW
HeapSetInformation
GetCommandLineW
GetConsoleMode
GetConsoleCP
GetCPInfo
GetDateFormatW
GetTimeFormatW
HeapReAlloc
GetSystemTimeAsFileTime
MultiByteToWideChar
DecodePointer
EncodePointer
FindResourceExW
GetDiskFreeSpaceW
VirtualProtect
SearchPathW
GetProfileIntW
InitializeCriticalSectionAndSpinCount
GetNumberFormatW
GetWindowsDirectoryW
lstrcpyW
GetUserDefaultUILanguage
GetLocaleInfoW
InterlockedExchange
GlobalFlags
GetFileTime
GetFileSizeEx
GetFileAttributesA
UnlockFileEx
OutputDebugStringW
HeapCompact
Sleep
GetStringTypeW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
WaitForSingleObjectEx
ReleaseMutex
CreateMutexW
OpenEventW
SetEvent
GetModuleHandleW
GetPrivateProfileStringW
WritePrivateProfileStringW
GetSystemTime
MoveFileW
CreateThread
TlsAlloc
TlsSetValue
TlsGetValue
TlsFree
GetVersionExW
GetTempPathW
GetTempFileNameW
FindFirstFileW
FindClose
CopyFileW
CreateEventW
GetVersionExA
CreateFileMappingW
MapViewOfFile
OpenFileMappingW
UnmapViewOfFile
lstrlenA
GetTimeZoneInformation
LocalAlloc
FreeLibrary
GetSystemDefaultLangID
GlobalLock
GlobalUnlock
GlobalFree
GlobalAlloc
HeapAlloc
GetProcessHeap
HeapFree
GetFileSize
GetCurrentDirectoryW
lstrcmpiW
GetEnvironmentStringsW
FreeEnvironmentStringsW
TerminateProcess
GetTempPathA
DeleteFileA
GetSystemInfo
GetTempFileNameA
MulDiv
GlobalSize
lstrcmpA
DeactivateActCtx
ActivateActCtx
ReadFile
WriteFile
SetFilePointer
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
GetVolumeInformationW
GetFullPathNameW
lstrcmpW
CompareStringW
GlobalDeleteAtom
GlobalFindAtomW
GlobalAddAtomW
FreeResource
ReleaseActCtx
SetThreadPriority
ResumeThread
GlobalGetAtomNameW
FileTimeToSystemTime
SystemTimeToFileTime
GlobalReAlloc
GlobalHandle
LocalReAlloc
GetFileAttributesExW
FileTimeToLocalFileTime

user32

PostThreadMessageW
WaitMessage
DefFrameProcW
DefMDIChildProcW
DrawMenuBar
TranslateMDISysAccel
CreateMenu
SetMenuDefaultItem
IsClipboardFormatAvailable
FrameRect
GetUpdateRect
RegisterClipboardFormatW
CopyIcon
CharUpperBuffW
GetDoubleClickTime
SubtractRect
MapDialogRect
DrawIcon
DestroyCursor
GetWindowRgn
ShowWindow
MoveWindow
SetWindowTextW
IsDialogMessageW
CheckDlgButton
GetMessageW
TranslateMessage
GetCursorPos
ValidateRect
GetDesktopWindow
GetActiveWindow
CreateDialogIndirectParamW
IsWindowEnabled
GetNextDlgTabItem
EndDialog
RegisterWindowMessageW
SendDlgItemMessageA
WinHelpW
IsChild
GetCapture
SetWindowsHookExW
CallNextHookEx
GetClassLongW
SetPropW
GetPropW
RemovePropW
GetFocus
SetFocus
GetWindowTextLengthW
GetWindowTextW
GetForegroundWindow
SetActiveWindow
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
MonitorFromWindow
GetMonitorInfoW
MapWindowPoints
ScrollWindow
TrackPopupMenu
GetKeyState
IsMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
ShowScrollBar
UpdateWindow
GetClientRect
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
ScreenToClient
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
SetWindowPlacement
GetWindowPlacement
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
GetMenu
SetWindowLongW
GetWindow
NotifyWinEvent
GetParent
InvalidateRect
DrawFocusRect
LoadBitmapW
CopyRect
CharUpperW
GetMenuState
GetMenuStringW
AppendMenuW
GetMenuItemID
InsertMenuW
GetMenuItemCount
GetSubMenu
RemoveMenu
KillTimer
SetTimer
DeleteMenu
LoadIconW
LoadCursorW
SetCursor
PtInRect
GetWindowRect
GetWindowLongW
GetSysColor
DestroyIcon
SendDlgItemMessageW
PostMessageW
GetClassNameW
GetWindowThreadProcessId
ReleaseDC
GetDC
EnableWindow
GetDlgItem
BringWindowToTop
SetForegroundWindow
SetWindowPos
GetLastActivePopup
MessageBoxW
IsWindowVisible
IsWindow
SendMessageW
GetSystemMetrics
DispatchMessageW
PeekMessageW
wsprintfW
MonitorFromPoint
UpdateLayeredWindow
UnionRect
MapVirtualKeyExW
IsCharLowerW
EmptyClipboard
CloseClipboard
SetClipboardData
OpenClipboard
LockWindowUpdate
SetCursorPos
CreateAcceleratorTableW
GetKeyboardState
GetKeyboardLayout
ToUnicodeEx
CopyAcceleratorTableW
DrawFrameControl
DrawEdge
DrawStateW
GetSystemMenu
SetClassLongW
DestroyAcceleratorTable
SetParent
SetWindowRgn
IsZoomed
WindowFromPoint
SetRect
UnpackDDElParam
ReuseDDElParam
LoadAcceleratorsW
InsertMenuItemW
TranslateAcceleratorW
IsIconic
DrawIconEx
GetNextDlgGroupItem
LoadImageW
CopyImage
GetIconInfo
OffsetRect
MessageBeep
EnableScrollBar
HideCaret
InvertRect
ReleaseCapture
GetAsyncKeyState
SetCapture
IsRectEmpty
CreatePopupMenu
GetMenuDefaultItem
RedrawWindow
SetLayeredWindowAttributes
EnumDisplayMonitors
ShowOwnedPopups
SetRectEmpty
IntersectRect
PostQuitMessage
RealChildWindowFromPoint
SystemParametersInfoW
DestroyMenu
GetMenuItemInfoW
InflateRect
GetSysColorBrush
LoadMenuW
MapVirtualKeyW
GetKeyNameTextW
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
ModifyMenuW
EnableMenuItem
CheckMenuItem
SetMenu
FillRect

oleaut32

VariantTimeToSystemTime
SystemTimeToVariantTime
SysStringLen
VarBstrFromDate
GetErrorInfo
VariantChangeType
SafeArrayDestroy
SafeArrayCreate
SysAllocString
SafeArrayUnlock
SafeArrayLock
SafeArrayGetUBound
SafeArrayGetLBound
SysAllocStringLen
VariantClear
VariantInit
SysFreeString

vdiprovider

VDIGetGuestOSInfo
VDIGetHostInfo
VDICreateFolderList
VDIGetPhysicalHostList
VDIIsValidCloneFolder
VDIGetProviderAvailableRemotely
VDICreatePhysicalHostList
VDIGetFolderList
VDIFreeFolderList
VDIFreePhysicalHostList
VDIGetProvidersAvailable
VDIInit
VDIConvertGuest
VDICloneGuest
VDIControlGuest
VDIFreePoolList
VDIGetPoolList
VDICreatePoolList
VDIDisConnectFromHost
CloseVDICacheThread
VDIRemoveGuestOSEventCallback
VDISetHostEventCallback
VDIGetLastError
VDIConnectToHost
VDIGetGuestOSList
VDIFreeGuestOSList
VDISetGuestOSEventCallback

msimg32

TransparentBlt
AlphaBlend

comctl32

ImageList_GetIconSize

shlwapi

PathFindFileNameW
PathIsUNCW
PathStripToRootW
PathRemoveFileSpecW
PathFindExtensionW
PathAppendW
StrCpyW

gdiplus

GdipFree
GdipAlloc
GdipDeleteGraphics
GdipDisposeImage
GdipCreateBitmapFromHBITMAP
GdiplusStartup
GdiplusShutdown
GdipCreateFromHDC
GdipSetInterpolationMode
GdipDrawImageRectI
GdipCloneImage
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipGetImagePalette
GdipCreateBitmapFromStream
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipGetImageGraphicsContext
GdipDrawImageI
GdipGetImagePaletteSize

ws2_32

WSAStringToAddressW
getnameinfo
recv
sendto
setsockopt
ntohs
htonl
ntohl
recvfrom
WSAStartup
connect
ioctlsocket
WSASetLastError
WSAIoctl
getsockname
getpeername
getaddrinfo
htons
inet_addr
WSAGetLastError
shutdown
inet_ntoa
select
gethostbyname
accept
listen
getsockopt
send
closesocket
__WSAFDIsSet
socket
bind
freeaddrinfo

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

pdh

PdhLookupPerfNameByIndexW
PdhOpenQueryW
PdhAddCounterW
PdhCollectQueryData
PdhGetFormattedCounterValue
PdhRemoveCounter
PdhCloseQuery

iphlpapi

GetAdaptersInfo

ssleay32

ord157
ord6
ord35
ord182
ord61
ord58
ord141
ord75
ord222
ord17
ord96
ord24
ord235
ord12
ord108
ord48
ord8
ord78
ord225
ord183
ord142
ord73
ord242
ord76
ord83
ord42
ord74
ord90
ord43
ord31
ord111
ord21
ord166
ord87
ord52
ord84
ord77
ord110
ord341
ord314
ord172
ord116
ord5
ord30
ord343
ord315
ord171
ord118
ord112
ord16

libeay32

ord1186
ord2572
ord3877
ord298
ord3846
ord107
ord3823
ord286
ord1010
ord576
ord567
ord639
ord653
ord585
ord3205
ord654
ord656
ord333
ord363
ord657
ord2206
ord652
ord641
ord227
ord254
ord467
ord544
ord181
ord222
ord579
ord648
ord84
ord204
ord578
ord109
ord469
ord248
ord1654
ord82
ord1653
ord89
ord566
ord909
ord1178
ord364
ord2442
ord484
ord680
ord3050
ord315
ord223
ord66
ord200
ord202
ord395
ord2291
ord485
ord2254
ord2623
ord1795
ord256
ord259
ord3844
ord3816
ord257
ord464
ord258
ord964
ord3212
ord3873
ord3019
ord2747
ord2784
ord3836
ord2201
ord965

oleacc

CreateStdAccessibleObject
AccessibleObjectFromWindow
LresultFromObject

imm32

ImmGetOpenStatus
ImmGetContext
ImmReleaseContext

winmm

PlaySoundW

gdi32

MoveToEx
SetTextAlign
GetLayout
SetLayout
SelectClipRgn
CreateRectRgn
GetViewportExtEx
GetPixel
PtVisible
RectVisible
TextOutW
ExtTextOutW
Escape
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
DeleteDC
SelectPalette
LineTo
SetROP2
SetPolyFillMode
SetBkMode
RestoreDC
SaveDC
CreateBitmap
GetTextMetricsW
BitBlt
GetObjectW
CreateDCW
CopyMetaFileW
GetDeviceCaps
SetBkColor
SetTextColor
CreateSolidBrush
DeleteObject
SelectObject
CreateDIBSection
GetObjectType
IntersectClipRect
ExcludeClipRect
GetClipBox
CreatePen
CreateHatchBrush
CreateRectRgnIndirect
PatBlt
CreateFontIndirectW
GetTextExtentPoint32W
SetRectRgn
GetStockObject
CreatePatternBrush
ExtFloodFill
CreateCompatibleDC
CombineRgn
DPtoLP
SetMapMode
CreateCompatibleBitmap
CreateDIBitmap
EnumFontFamiliesW
GetTextCharsetInfo
GetBkColor
CreatePalette
GetPaletteEntries
GetNearestPaletteIndex
RealizePalette
GetSystemPaletteEntries
CreateRoundRectRgn
CreatePolygonRgn
GetTextColor
CreateEllipticRgn
Polyline
Ellipse
Polygon
SetDIBColorTable
StretchBlt
SetPixel
Rectangle
OffsetRgn
GetRgnBox
EnumFontFamiliesExW
LPtoDP
GetWindowOrgEx
GetViewportOrgEx
PtInRegion
FillRgn
GetBoundsRect
GetWindowExtEx
GetTextFaceW
SetPixelV
SetPaletteEntries
FrameRgn

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

comdlg32

GetFileTitleW

advapi32

InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegisterEventSourceW
ReportEventW
DeregisterEventSource
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
RegSetValueExW
GetUserNameA
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
OpenSCManagerW
CreateServiceW
ChangeServiceConfig2W
StartServiceW
CloseServiceHandle
OpenServiceW
ControlService
DeleteService
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerW
SetServiceStatus

shell32

ShellExecuteW
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHGetFileInfoW
DragQueryFileW
SHBrowseForFolderW
SHAppBarMessage
SHGetPathFromIDListW
DragFinish

ole32

DoDragDrop
OleLockRunning
IsAccelerator
OleTranslateAccelerator
CoCreateInstance
CoInitialize
RevokeDragDrop
CoLockObjectExternal
RegisterDragDrop
OleGetClipboard
CoInitializeEx
CoInitializeSecurity
CoUninitialize
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
CreateStreamOnHGlobal
OleDuplicateData
CoTaskMemAlloc
ReleaseStgMedium
CoTaskMemFree

Sections

.text
Size: 3.8MB - Virtual size: 3.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 557KB - Virtual size: 557KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 30KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

49e53767575197ae1db426b973e4bdc1

Code Sign

07Certificate

Key Usages

04:0d:8e:7b:88:93:abCertificate

Extended Key Usages

Key Usages

45:33:02:c6:1a:f7:1f:db:42:38:03:ea:69:03:e9:70:95:7d:17:50Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

oleaut32

vdiprovider

msimg32

comctl32

shlwapi

gdiplus

ws2_32

version

pdh

iphlpapi

ssleay32

libeay32

oleacc

imm32

winmm

gdi32

winspool.drv

comdlg32

advapi32

shell32

ole32

Sections

.text Size: 3.8MB - Virtual size: 3.8MB

.rdata Size: 557KB - Virtual size: 557KB

.data Size: 30KB - Virtual size: 66KB

.rsrc Size: 2KB - Virtual size: 1KB

07
Certificate

04:0d:8e:7b:88:93:ab
Certificate

45:33:02:c6:1a:f7:1f:db:42:38:03:ea:69:03:e9:70:95:7d:17:50
Signer

.text
Size: 3.8MB - Virtual size: 3.8MB

.rdata
Size: 557KB - Virtual size: 557KB

.data
Size: 30KB - Virtual size: 66KB

.rsrc
Size: 2KB - Virtual size: 1KB