IcedID.zip
- SHA256 382e2d490717e2e314f3abc2d04ce6e8644ddf262878bf71fce50caeaeb1036e
Password
infected
Static task
static1
Behavioral task
behavioral1
Sample
33cc3816f98fa22354559711326a5ce1352d819c180be4328a72618d20a78632.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
General
- Target IcedID.zip
- Size 26KB
- Sample240416-v8lfeshh4s
- SHA256 382e2d490717e2e314f3abc2d04ce6e8644ddf262878bf71fce50caeaeb1036e
- MD5 29588684f0320748e56d0817caea172e
- SHA1 ca502062d1f3395bbb9b29dc5faf020cd445b2f9
- SHA512 d12ceb68abbddc5fc398fd48ffe31ff90dce074252cbe8f7a344f07e2e902a9f9f15071621d16fa0414bd90575eb4e1c21dc9d49d44d57e0e8beb9eb609c5337
- SSDEEP 768:AWXLHXDp1Bx1kKSsDOEu9ASdDjixCVYDmxInwfiOLnwbznO:A0dq9HbYKIYiOcbznO
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
File Explorer
-
IcedID.zip.zip 26KB
-
33cc3816f98fa22354559711326a5ce1352d819c180be4328a72618d20a78632.exe.dll 62KB
33cc3816f98fa22354559711326a5ce1352d819c180be4328a72618d20a78632.exe
- IMPHASH 001d993cb52b06dd86f1aafa1c13bed8
- SHA256 33cc3816f98fa22354559711326a5ce1352d819c180be4328a72618d20a78632
- MD5 3ddeea156606b2e5d19c86cedf3dec30
- SHA1 df75313a6c6af17bcfbaa55a693314b34cf97c1e
- SHA512 dc237628a739c6eda902a505cc7e547dd4d6a2c655685eb2bc495dfbc6555063af13a0425f92936c9ffda5ba050c37859c4431da07d663151bb721010712cf8d
- SSDEEP 768:2qLODVjNPDZUEix9i3Mb/pvj5ZzbQJbTfHUdV8VTkj7DjpqZMRQ:2DDVjqx9RZjvbQJPfEA4/DEZMRQ
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
a1:49:31:ca:89:02:2f:87:a6:b2:ab:3b:85:17:fb:cb:e7:7c:ac:17
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Amcert LLC,O=Amcert LLC,L=Yerevan,C=AM
Chains
Apr 15, 2024
Subject
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Serial Number
48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 25, 2021 - Dec 31, 2028
Subject
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Serial Number
62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Issuer
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
CN=Amcert LLC,O=Amcert LLC,L=Yerevan,C=AM
Serial Number
a7:58:50:4e:79:71:86:9d:0a:ec:27:75:ff:fa:03:d5
Issuer
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 14, 2021 - Jun 14, 2022
Minor OS version
0
Major OS version
6
Entry point
4896
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
GetThreadPriority
GetCurrentThread
CreateThread
WaitForSingleObject
DuplicateHandle
ResumeThread
DfcidmAgqxxIybvoovbd
DllGetClassObject
DllRegisterServer
FbyouxodmaAmblxtzonyr
GhjrgreaggXyoydphfea
NrmqrpckejMlzraxTtfncwsvfmhs
PluginInit
Name
.text
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
40KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
204B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=3, id=257, version=25203,
count=6, id=1, productName=Unmarked objects,
count=4, productName=Unmarked objects (old),
count=1, id=256, version=27045,
count=1, id=258, version=27045,