2024-04-17_c9b13f65f4bf3ff7cd7024e9ff356930_icedid

Sharing

Copy URL Twitter E-mail

General

Target

2024-04-17_c9b13f65f4bf3ff7cd7024e9ff356930_icedid
Size

439KB
MD5

c9b13f65f4bf3ff7cd7024e9ff356930
SHA1

6f0632f2d78651a9611dd88751ca518140b5199b
SHA256

b8d376b59ba7511dd45eb1f3549b33d0294a396be4762b9c695069b1423b44f9
SHA512

63e262d7390614158ec5b2aa8927b450866f9d268cbdeaf09859ad8d7bae4b5cf466d3e3ac16bd9fa0519bce255a12589b605d34913e889bf012a531de983445
SSDEEP

6144:ry3ogtorZiarKWa8ocO6c3u29JkLKMoZ1gOHg:LgKVA6c3u29JkLKMog

Score

1^/10

Malware Config

Signatures

Files

2024-04-17_c9b13f65f4bf3ff7cd7024e9ff356930_icedid
.exe windows:5 windows x86 arch:x86

de721a7d8de417020e69a5b3300cde09

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4b:74:bf:a0:f2:07:7b:1e:a3:60:09:b8:a1:53:36:4d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

19/09/2007, 00:00

Not After

18/09/2009, 23:59

Subject

CN=Syntek Semiconductor Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Syntek Semiconductor Ltd.,L=Taipei,ST=Taipei,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7a:41:b1:28:98:a2:1e:70:5f:78:a4:1b:97:c2:85:fe:5b:99:d4:b6
Signer

Actual PE Digest

7a:41:b1:28:98:a2:1e:70:5f:78:a4:1b:97:c2:85:fe:5b:99:d4:b6

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

winmm

timeGetTime
timeEndPeriod
timeBeginPeriod

msacm32

acmMetrics
acmFormatChooseW

olepro32

ord250

kernel32

lstrcmpiW
LoadLibraryExW
FindResourceW
LoadResource
SizeofResource
MultiByteToWideChar
EnterCriticalSection
LeaveCriticalSection
RaiseException
GetLastError
GetModuleFileNameW
DeleteCriticalSection
InterlockedDecrement
InterlockedIncrement
InitializeCriticalSection
GetSystemTime
WriteFile
Sleep
GetCurrentProcessId
WriteProfileStringW
GetFullPathNameW
FreeLibrary
GetDiskFreeSpaceW
MulDiv
LoadLibraryW
WideCharToMultiByte
OpenFile
lstrlenW
GlobalAlloc
GlobalLock
GlobalHandle
GlobalUnlock
GlobalFree
lstrcpyW
GetVersionExW
CreateFileW
GetFileSize
CloseHandle
ReadFile
CopyFileW
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetProfileStringW
GetProfileIntW
GetModuleHandleW
GetProcAddress
lstrcpynW
lstrcatW
CreateFileA
SetStdHandle
GetStringTypeW
LockResource
SetLastError
LocalFree
FormatMessageW
GetVersionExA
lstrcmpW
LoadLibraryA
CompareStringW
GlobalDeleteAtom
GlobalFindAtomW
GlobalAddAtomW
GetCurrentThreadId
FreeResource
lstrcmpA
lstrlenA
LocalAlloc
TlsGetValue
GlobalReAlloc
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
GlobalFlags
GetModuleHandleA
SetFilePointer
FlushFileBuffers
GetCurrentProcess
HeapFree
HeapAlloc
RtlUnwind
GetCommandLineA
GetStartupInfoA
HeapReAlloc
HeapSize
ExitProcess
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
VirtualFree
VirtualAlloc
GetStdHandle
GetModuleFileNameA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
GetConsoleCP
GetConsoleMode
LCMapStringA
LCMapStringW
GetStringTypeA
GetLocaleInfoA

user32

SetActiveWindow
GetLastActivePopup
GetForegroundWindow
RemovePropW
GetPropW
SetPropW
GetClassNameW
GetClassLongW
CallNextHookEx
SetWindowsHookExW
GetCapture
WinHelpW
SendDlgItemMessageA
SendDlgItemMessageW
GetNextDlgTabItem
CreateDialogIndirectParamW
GetActiveWindow
GetDesktopWindow
IsDialogMessageW
GetSysColorBrush
GetWindowThreadProcessId
ClientToScreen
DestroyMenu
ValidateRect
GetMessageW
TabbedTextOutW
DrawTextW
DrawTextExW
GrayStringW
SetForegroundWindow
GetClassInfoExW
GetClassInfoW
GetDlgCtrlID
CallWindowProcW
CopyRect
PtInRect
SetWindowLongW
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindow
UnhookWindowsHookEx
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuW
RegisterWindowMessageW
GetMenuState
GetMenuItemID
GetFocus
IsWindowEnabled
IsWindow
GetParent
SendMessageW
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetWindowTextW
ShowWindow
CreateWindowExW
ReleaseDC
GetDC
RegisterClassW
LoadIconW
LoadCursorW
LoadAcceleratorsW
GetWindowTextW
GetWindowLongW
GetSysColor
CharNextW
CheckDlgButton
IsDlgButtonChecked
SetDlgItemInt
GetDlgItem
EnableWindow
GetDlgItemInt
SetFocus
MessageBeep
GetDlgItemTextW
IsCharAlphaW
IsCharAlphaNumericW
SetDlgItemTextW
UpdateWindow
EndDialog
WaitMessage
DispatchMessageW
TranslateMessage
TranslateAcceleratorW
MessageBoxW
DialogBoxParamW
PostMessageW
GetMenuItemCount
RemoveMenu
AppendMenuW
CreatePopupMenu
GetKeyState
SetMenu
AdjustWindowRectEx
PeekMessageW
DefWindowProcW
MoveWindow
GetSystemMetrics
GetClientRect
EndPaint
BeginPaint
GetAsyncKeyState
wsprintfW
PostQuitMessage
GetSubMenu
GetMenu
DeleteMenu
KillTimer
SetTimer
InvalidateRect
GetWindowRect
SetWindowPos
EnableMenuItem
CheckMenuItem

gdi32

ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
Escape
TextOutW
RectVisible
SetBkColor
SetTextColor
ExtTextOutW
PatBlt
DeleteObject
CreateSolidBrush
CreateFontW
StretchDIBits
GetStockObject
GetObjectW
GetTextMetricsW
DeleteDC
SaveDC
RestoreDC
SetMapMode
GetClipBox
CreateBitmap
SelectObject
GetDeviceCaps
PtVisible

comdlg32

GetOpenFileNameW

advapi32

RegQueryInfoKeyW
RegSetValueExW
RegEnumKeyExW
GetUserNameW
RegDeleteValueW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegCreateKeyExW

ole32

CoInitializeEx
CoUninitialize
CoCreateInstance
CoTaskMemFree
MkParseDisplayName
CreateBindCtx
CoTaskMemAlloc
CoTaskMemRealloc

oleaut32

VariantClear
VariantChangeType
VariantInit
SysFreeString
VarUI4FromStr

shlwapi

PathRemoveFileSpecW
PathFindExtensionW

oleacc

CreateStdAccessibleObject
LresultFromObject

winspool.drv

ClosePrinter
DocumentPropertiesW
OpenPrinterW

Sections

.text
Size: 210KB - Virtual size: 210KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 9KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 66KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

de721a7d8de417020e69a5b3300cde09

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

4b:74:bf:a0:f2:07:7b:1e:a3:60:09:b8:a1:53:36:4dCertificate

Extended Key Usages

Key Usages

61:0c:12:06:00:00:00:00:00:1bCertificate

Key Usages

7a:41:b1:28:98:a2:1e:70:5f:78:a4:1b:97:c2:85:fe:5b:99:d4:b6Signer

Headers

DLL Characteristics

File Characteristics

Imports

winmm

msacm32

olepro32

kernel32

user32

gdi32

comdlg32

advapi32

ole32

oleaut32

shlwapi

oleacc

winspool.drv

Sections

.text Size: 210KB - Virtual size: 210KB

.rdata Size: 45KB - Virtual size: 45KB

.data Size: 9KB - Virtual size: 29KB

.rsrc Size: 66KB - Virtual size: 66KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

4b:74:bf:a0:f2:07:7b:1e:a3:60:09:b8:a1:53:36:4d
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

7a:41:b1:28:98:a2:1e:70:5f:78:a4:1b:97:c2:85:fe:5b:99:d4:b6
Signer

.text
Size: 210KB - Virtual size: 210KB

.rdata
Size: 45KB - Virtual size: 45KB

.data
Size: 9KB - Virtual size: 29KB

.rsrc
Size: 66KB - Virtual size: 66KB