2024-04-10_0b1a4805fe1ed99ed4a537ea646bf605_icedid

Sharing

Copy URL Twitter E-mail

General

Target

2024-04-10_0b1a4805fe1ed99ed4a537ea646bf605_icedid
Size

4.0MB
MD5

0b1a4805fe1ed99ed4a537ea646bf605
SHA1

3ca02e6b7fcfd402179901a720b0afa841fcef41
SHA256

65b14e9ce03fdba89053c2f8255d99c36ff5df71eb36666f3be7f351c868ebc3
SHA512

1cf032607e159654f0d3feeeeb5269ab6b806fc9059ac9641c578a538ea2e8e60af2b717ddb7f20b3e5bdd9cb330e33a8406151b7ae8cbc034ba4ffb257b2c95
SSDEEP

98304:Yc0zUTysWy7lAp6bycm22qwnOxIzCz75Co/thNEYmEgi0KpCsVpIw8rHlbUPHF:WkWy7lXQfOxEUlJgi0KpCsV6/Lgl

Score

1^/10

Malware Config

Signatures

Files

2024-04-10_0b1a4805fe1ed99ed4a537ea646bf605_icedid
.exe windows:6 windows x86 arch:x86

9a414ccbfb214ce1db835be0b7b6cb00

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

bc:27:f7:a5:95:d3:b7:b7:ef:54:1a:d6:13:7a:81:2f
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

06/12/2010, 00:00

Not After

06/12/2015, 23:59

Subject

CN=Dillobits Software\, Inc.,O=Dillobits Software\, Inc.,POSTALCODE=30041,STREET=2150 Arbor Chase,L=Cumming,ST=Georgia,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

95:ee:3a:62:57:e5:5c:71:65:42:a2:ab:b7:2b:8c:7b:ec:89:d6:53
Signer

Actual PE Digest

95:ee:3a:62:57:e5:5c:71:65:42:a2:ab:b7:2b:8c:7b:ec:89:d6:53

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\users\jcyr\data\dillobits\Projects\dev\InSync\exe\InSync.pdb

Imports

kernel32

LCMapStringW
IsValidLocale
EnumSystemLocalesW
GetConsoleCP
GetConsoleMode
ReadConsoleW
SetFilePointerEx
WriteConsoleW
GetTimeFormatW
GetDriveTypeW
GetStringTypeW
GetCPInfo
GetOEMCP
GetACP
GetDateFormatW
GetTimeZoneInformation
SetEnvironmentVariableA
IsValidCodePage
TerminateProcess
UnhandledExceptionFilter
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetStartupInfoW
GetStdHandle
GetFileType
SetStdHandle
VirtualQuery
HeapQueryInformation
SizeofResource
IsProcessorFeaturePresent
GetModuleHandleExW
ExitProcess
RtlUnwind
ExitThread
GetSystemTimeAsFileTime
GetCommandLineW
FindResourceExW
GetUserDefaultLCID
VirtualProtect
GetProfileIntW
SearchPathW
GetTickCount
GetFileTime
GetFileSizeEx
GetFileAttributesExW
FileTimeToLocalFileTime
GetTempPathW
GetTempFileNameW
GetWindowsDirectoryW
lstrcmpiW
DuplicateHandle
UnlockFile
GetFullPathNameW
FlushFileBuffers
GetCurrentDirectoryW
lstrcpyW
GlobalFlags
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
CompareStringW
GetThreadLocale
GlobalGetAtomNameW
FileTimeToSystemTime
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
SetThreadPriority
LocalReAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSection
CompareStringA
lstrcmpA
GetVersionExW
GlobalFindAtomW
GlobalAddAtomW
LoadLibraryA
lstrcmpW
GlobalDeleteAtom
LoadLibraryExW
GetModuleHandleW
GetModuleHandleA
FreeResource
GetSystemDirectoryW
EncodePointer
OutputDebugStringA
CopyFileW
MulDiv
GlobalFree
GlobalSize
GlobalAlloc
IsWow64Process
GetVolumeInformationW
SetErrorMode
GetErrorMode
GetLogicalDrives
GetNumberFormatW
GetFileAttributesW
RemoveDirectoryW
GetOverlappedResult
CancelIo
FindNextFileW
FindClose
FindFirstFileW
MoveFileW
LocalAlloc
DeleteFileW
Sleep
DecodePointer
HeapSize
GetProcessHeap
HeapFree
HeapAlloc
HeapReAlloc
GetCurrentThread
lstrlenW
GetQueuedCompletionStatus
ResetEvent
RaiseException
PostQueuedCompletionStatus
TerminateThread
GetExitCodeThread
CreateIoCompletionPort
InitializeCriticalSectionEx
GlobalUnlock
GlobalLock
GetCurrentProcessId
GetCurrentThreadId
SetUnhandledExceptionFilter
GetLocaleInfoW
GetSystemInfo
GetEnvironmentVariableW
LocalFree
FormatMessageW
GetFileSize
GetLocalTime
WideCharToMultiByte
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
SetEvent
ResumeThread
CreateThread
VerSetConditionMask
VerifyVersionInfoW
SystemTimeToFileTime
GetSystemTime
CreateDirectoryW
GetComputerNameW
GetModuleFileNameW
IsDebuggerPresent
FreeLibrary
GetProcAddress
LoadLibraryW
GetCurrentProcess
VirtualFree
SetLastError
SetFileTime
SetFileAttributesW
VirtualAlloc
WriteFile
GetLastError
ReadFile
CreateEventW
LockFile
SetEndOfFile
SetFilePointer
CreateFileW
WaitForSingleObject
CreateMutexW
CloseHandle
ReleaseMutex
MultiByteToWideChar
FindResourceW
LoadResource
LockResource
OutputDebugStringW

user32

RegisterClipboardFormatW
EnumChildWindows
DestroyAcceleratorTable
CreateAcceleratorTableW
GetKeyboardState
GetKeyboardLayout
ToUnicodeEx
WaitMessage
PostThreadMessageW
ModifyMenuW
NotifyWinEvent
CharUpperW
TrackMouseEvent
SetParent
ReuseDDElParam
UnpackDDElParam
InsertMenuItemW
CreatePopupMenu
TranslateAcceleratorW
LoadAcceleratorsW
SetRect
InvalidateRgn
CopyAcceleratorTableW
CharNextW
DeleteMenu
MonitorFromPoint
EnableScrollBar
GetAsyncKeyState
UpdateLayeredWindow
IsMenu
UnionRect
EmptyClipboard
SetClipboardData
IntersectRect
EnumDisplayMonitors
SetLayeredWindowAttributes
RealChildWindowFromPoint
LoadCursorW
GetMenuItemInfoW
DestroyMenu
MapVirtualKeyW
GetKeyNameTextW
GetWindowThreadProcessId
ShowOwnedPopups
TranslateMessage
GetMessageW
GetSysColorBrush
SetWindowRgn
DrawStateW
GetSystemMetrics
DrawFrameControl
DrawEdge
SystemParametersInfoW
MessageBeep
IsZoomed
MapDialogRect
SetWindowContextHelpId
EndPaint
BeginPaint
GetWindowDC
TabbedTextOutW
GrayStringW
DrawTextExW
DrawTextW
PostQuitMessage
GetDesktopWindow
GetActiveWindow
GetNextDlgTabItem
LockWindowUpdate
CreateDialogIndirectParamW
SendDlgItemMessageA
GetIconInfo
CopyImage
IsRectEmpty
OffsetRect
SetRectEmpty
FillRect
ClientToScreen
GetCursorPos
SetCursor
ReleaseCapture
SetCapture
GetNextDlgGroupItem
InflateRect
LoadBitmapW
SetMenuItemInfoW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
CheckMenuItem
IsDialogMessageW
SetWindowTextW
IsWindowEnabled
CheckDlgButton
SetDlgItemTextW
EnableWindow
SendMessageW
SetTimer
KillTimer
PostMessageW
MoveWindow
ShowWindow
GetMonitorInfoW
MonitorFromWindow
WinHelpW
GetScrollInfo
SetScrollInfo
LoadIconW
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
GetWindow
GetLastActivePopup
GetTopWindow
GetClassNameW
GetClassLongW
SetWindowLongW
GetWindowLongW
PtInRect
EqualRect
CopyRect
MapWindowPoints
ScreenToClient
AdjustWindowRectEx
GetClientRect
GetWindowTextLengthW
GetWindowTextW
RemovePropW
GetPropW
SetPropW
SetClassLongW
SetCursorPos
GetDoubleClickTime
CopyIcon
GetMenuDefaultItem
SetMenuDefaultItem
GetUpdateRect
HideCaret
InvertRect
CharUpperBuffW
FrameRect
IsClipboardFormatAvailable
DrawMenuBar
DefFrameProcW
DefMDIChildProcW
TranslateMDISysAccel
ShowScrollBar
GetScrollRange
IsCharLowerW
MapVirtualKeyExW
SubtractRect
GetComboBoxInfo
CreateMenu
DestroyCursor
DrawIcon
GetWindowRgn
EndDialog
DestroyIcon
GetDC
ReleaseDC
GetParent
GetSysColor
DrawIconEx
LoadImageW
DrawFocusRect
InvalidateRect
BringWindowToTop
GetSystemMenu
AppendMenuW
EnableMenuItem
IsIconic
MessageBoxW
SetClipboardViewer
OpenClipboard
GetClipboardData
WindowFromPoint
CloseClipboard
UnregisterClassW
GetMenuStringW
GetMenuState
GetSubMenu
GetMenuItemID
GetMenuItemCount
InsertMenuW
RemoveMenu
LoadMenuW
GetWindowRect
RegisterWindowMessageW
DispatchMessageW
PeekMessageW
GetMessagePos
GetMessageTime
DefWindowProcW
CallWindowProcW
RegisterClassW
GetClassInfoW
GetClassInfoExW
CreateWindowExW
IsWindow
IsChild
DestroyWindow
SetWindowPos
GetWindowPlacement
SetWindowPlacement
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
IsWindowVisible
GetDlgItem
GetDlgCtrlID
SetFocus
GetFocus
GetKeyState
GetCapture
GetMenu
SetMenu
TrackPopupMenu
UpdateWindow
SetActiveWindow
GetForegroundWindow
SetForegroundWindow
ValidateRect
RedrawWindow
ScrollWindow
SetScrollPos
GetScrollPos
SetScrollRange

gdi32

CreateRoundRectRgn
OffsetRgn
RoundRect
CreatePalette
GetPaletteEntries
GetNearestPaletteIndex
GetSystemPaletteEntries
EnumFontFamiliesExW
ExtFloodFill
SetPaletteEntries
GetViewportOrgEx
LPtoDP
GetWindowOrgEx
FillRgn
FrameRgn
GetBoundsRect
PtInRegion
SetPixelV
GetTextFaceW
GetDIBits
DPtoLP
SetRectRgn
GetMapMode
GetTextCharsetInfo
EnumFontFamiliesW
CreateDIBitmap
CreateCompatibleBitmap
Polyline
Polygon
CreatePolygonRgn
PatBlt
GetTextColor
GetBkColor
Ellipse
CreateRectRgnIndirect
CreateEllipticRgn
CombineRgn
ScaleWindowExtEx
ScaleViewportExtEx
GetRgnBox
OffsetViewportOrgEx
SetWindowOrgEx
SetWindowExtEx
SetViewportOrgEx
SetViewportExtEx
ExtTextOutW
TextOutW
MoveToEx
Rectangle
SetDIBColorTable
SetTextAlign
SetROP2
SetPolyFillMode
GetLayout
SetLayout
SetMapMode
SetBkMode
SelectPalette
ExtSelectClipRgn
SelectClipRgn
SaveDC
RestoreDC
RectVisible
PtVisible
LineTo
IntersectClipRect
GetWindowExtEx
GetViewportExtEx
GetStockObject
GetPixel
GetClipBox
ExcludeClipRect
Escape
CreateRectRgn
CreatePatternBrush
CreatePen
CreateHatchBrush
BitBlt
SelectObject
GetObjectType
CreateCompatibleDC
CreateBitmap
GetTextExtentPoint32W
CreateSolidBrush
DeleteObject
GetTextMetricsW
GetObjectW
CreateDIBSection
StretchBlt
SetPixel
OffsetWindowOrgEx
RealizePalette
CreateFontIndirectW
DeleteDC
CopyMetaFileW
CreateDCW
SetTextColor
GetDeviceCaps
SetBkColor

msimg32

TransparentBlt
AlphaBlend

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

advapi32

InitiateSystemShutdownExW
RegEnumKeyExW
RegEnumValueW
RegQueryValueW
RegEnumKeyW
RegDeleteValueW
RegDeleteKeyW
SetNamedSecurityInfoW
SetSecurityInfo
GetSecurityInfo
EqualSid
DeleteAce
GetAce
GetNamedSecurityInfoW
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
RegOpenKeyExW
LookupAccountSidW
GetTokenInformation
OpenThreadToken
RegQueryValueExW
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
RegCloseKey
RegSetValueExW
RegCreateKeyExW

shell32

ShellExecuteExW
SHGetFolderPathW
ShellExecuteW
SHGetKnownFolderPath
DragFinish
SHAppBarMessage
SHGetMalloc
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetFileInfoW
DragQueryFileW
SHGetDesktopFolder
SHBrowseForFolderW

comctl32

InitCommonControlsEx

shlwapi

PathIsDirectoryW
ord191
SHStrDupW
PathFileExistsW
PathFindExtensionW
PathFindFileNameW
PathRemoveFileSpecW
PathIsUNCW
PathStripToRootW
StrFormatKBSizeW

uxtheme

DrawThemeText
GetWindowTheme
GetThemeSysColor
GetThemePartSize
IsThemeBackgroundPartiallyTransparent
OpenThemeData
CloseThemeData
DrawThemeBackground
GetThemeColor
GetCurrentThemeName
IsAppThemed
DrawThemeParentBackground

ole32

CLSIDFromProgID
CLSIDFromString
CoCreateGuid
CoUninitialize
CoDisconnectObject
CreateStreamOnHGlobal
CoGetClassObject
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CreateILockBytesOnHGlobal
CoFreeUnusedLibraries
OleInitialize
OleUninitialize
OleFlushClipboard
OleIsCurrentClipboard
DoDragDrop
OleGetClipboard
OleLockRunning
CoLockObjectExternal
RegisterDragDrop
RevokeDragDrop
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
OleTranslateAccelerator
IsAccelerator
ReleaseStgMedium
CoRevokeClassObject
CoRegisterMessageFilter
OleDuplicateData
CoTaskMemAlloc
StringFromCLSID
OleRun
CoInitialize
CoTaskMemFree
CoCreateInstance
CoInitializeEx

oleaut32

SafeArrayDestroy
SysAllocStringLen
SysStringLen
VariantCopy
VarBstrFromDate
LoadTypeLi
OleCreateFontIndirect
VariantTimeToSystemTime
VariantClear
SysAllocString
SysFreeString
SystemTimeToVariantTime
VariantChangeType
VariantInit
GetErrorInfo

oledlg

OleUIBusyW

gdiplus

GdipDrawImageRectI
GdipSetInterpolationMode
GdipCreateFromHDC
GdipCreateBitmapFromHBITMAP
GdipDrawImageI
GdipDeleteGraphics
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdiplusStartup
GdipFree
GdipAlloc
GdiplusShutdown

dbghelp

MiniDumpWriteDump

netapi32

NetApiBufferFree
NetWkstaGetInfo

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

mpr

WNetCancelConnection2W
WNetOpenEnumW
WNetCloseEnum
WNetEnumResourceW
WNetAddConnection2W

powrprof

SetSuspendState

vssapi

CreateVssBackupComponentsInternal

crypt32

CryptQueryObject
CryptMsgGetParam
CertFindCertificateInStore
CertFreeCertificateContext

wintrust

WinVerifyTrust

oleacc

LresultFromObject
AccessibleObjectFromWindow
CreateStdAccessibleObject

imm32

ImmGetContext
ImmGetOpenStatus
ImmReleaseContext

winmm

PlaySoundW

Sections

.text
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 395KB - Virtual size: 395KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 27KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9a414ccbfb214ce1db835be0b7b6cb00

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

bc:27:f7:a5:95:d3:b7:b7:ef:54:1a:d6:13:7a:81:2fCertificate

Extended Key Usages

Key Usages

95:ee:3a:62:57:e5:5c:71:65:42:a2:ab:b7:2b:8c:7b:ec:89:d6:53Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

uxtheme

ole32

oleaut32

oledlg

gdiplus

dbghelp

netapi32

version

mpr

powrprof

vssapi

crypt32

wintrust

oleacc

imm32

winmm

Sections

.text Size: 2.3MB - Virtual size: 2.3MB

.rdata Size: 395KB - Virtual size: 395KB

.data Size: 27KB - Virtual size: 58KB

.rsrc Size: 1.3MB - Virtual size: 1.3MB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

bc:27:f7:a5:95:d3:b7:b7:ef:54:1a:d6:13:7a:81:2f
Certificate

95:ee:3a:62:57:e5:5c:71:65:42:a2:ab:b7:2b:8c:7b:ec:89:d6:53
Signer

.text
Size: 2.3MB - Virtual size: 2.3MB

.rdata
Size: 395KB - Virtual size: 395KB

.data
Size: 27KB - Virtual size: 58KB

.rsrc
Size: 1.3MB - Virtual size: 1.3MB