2024-04-17_d594a7785a0630918ab47e941d129adb_icedid

Sharing

Copy URL Twitter E-mail

General

Target

2024-04-17_d594a7785a0630918ab47e941d129adb_icedid
Size

1.9MB
MD5

d594a7785a0630918ab47e941d129adb
SHA1

484b9552866213d3f54240bcd880d60aa730ed0c
SHA256

64e31ee38c2a47ff0ec53517bf3420ab2026e6905e6df452f9a689da827652ae
SHA512

cb18aac8cd909bcd85a54f7ba9f606b58125c09ca253d5d527553960530441558ff4032866c8c26f5e05ac50bca6242f54f9d87b905e877e98fad87f73d23379
SSDEEP

24576:s0/ZLvDDg/2JDDg/2JDDg/2JDDg/2JDDg/2JDDg/2JDDg/2JDDg/2JDDg/2JDDgJ:s0/JvgqgqgqgqgqgqgqgqgqgJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-04-17_d594a7785a0630918ab47e941d129adb_icedid

Files

2024-04-17_d594a7785a0630918ab47e941d129adb_icedid
.exe windows:4 windows x86 arch:x86

5b308f09d00bd9d4c346f2e260c354e0

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\Products\software\Tablerock\R2046\WinInstaller\WinInstallerSrc\uninstall\Release\uninstall.pdb

Imports

winspool.drv

EnumPrintProcessorsW
DeleteMonitorW
DeletePrinterDriverExW
EnumPrinterDriversW
ClosePrinter
DeletePrinter
SetPrinterW
OpenPrinterW
EnumPrintersW
DocumentPropertiesW
GetPrinterDriverDirectoryW

setupapi

SetupFindNextLine
SetupGetLineCountW
SetupGetIntField
SetupDiRemoveDevice
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceRegistryPropertyW
SetupGetLineTextW
SetupDiGetClassDevsW
CM_Get_DevNode_Status
SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces
SetupCloseInfFile
SetupOpenInfFileW
SetupFindFirstLineW
SetupDiEnumDeviceInfo
SetupGetStringFieldW
SetupGetFieldCount

msi

ord94
ord72
ord113
ord88
ord141
ord8

psapi

EnumProcessModules
GetModuleBaseNameW
EnumProcesses

kernel32

ReadFile
SetFilePointer
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
GetFileSize
DuplicateHandle
GetVolumeInformationW
GetFullPathNameW
FileTimeToSystemTime
SetErrorMode
FileTimeToLocalFileTime
GetFileTime
GetStartupInfoW
RtlUnwind
ExitProcess
HeapReAlloc
HeapSize
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetStdHandle
GetModuleFileNameA
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
IsBadWritePtr
LCMapStringA
LCMapStringW
SetUnhandledExceptionFilter
GetTimeZoneInformation
GetOEMCP
GetCPInfo
IsBadReadPtr
IsBadCodePtr
GetStringTypeA
GetStringTypeW
GetExitCodeProcess
CreateProcessA
GetFileAttributesA
CreateProcessW
SetStdHandle
CompareStringA
CompareStringW
SetEnvironmentVariableA
InterlockedIncrement
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
TlsGetValue
EnterCriticalSection
GlobalHandle
GlobalReAlloc
LeaveCriticalSection
LocalAlloc
FormatMessageW
LocalFree
GlobalFlags
lstrcmpiW
MulDiv
SetLastError
InterlockedDecrement
WritePrivateProfileStringW
GlobalAlloc
GetModuleFileNameW
ConvertDefaultLocale
GetVersion
EnumResourceLanguagesW
lstrcpyW
LoadLibraryW
GetLocaleInfoW
SizeofResource
lstrcpynW
GetCurrentThreadId
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
lstrlenA
GetModuleHandleA
LoadLibraryA
FreeLibrary
lstrlenW
lstrcmpW
GetModuleHandleW
GetProcAddress
GetVersionExA
GlobalLock
GlobalUnlock
GlobalFree
FindResourceW
LoadResource
LockResource
FreeResource
CreateDirectoryW
GetSystemDefaultLangID
LoadLibraryExW
GetCurrentThread
GetEnvironmentVariableW
DeleteCriticalSection
InitializeCriticalSection
RaiseException
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
WaitForSingleObject
CreateEventW
CreateThread
SetCurrentDirectoryW
TerminateProcess
SetEvent
GetWindowsDirectoryW
GetSystemDirectoryW
GetFileAttributesW
GetPrivateProfileStringW
OpenProcess
MultiByteToWideChar
WideCharToMultiByte
GetVersionExW
lstrcatW
FindNextFileW
RemoveDirectoryW
GetProcessHeap
HeapAlloc
HeapFree
FindFirstFileW
FindClose
SetFileAttributesW
DeleteFileW
MoveFileExW
GetCurrentDirectoryW
GetTickCount
Sleep
CreateFileW
WriteFile
CloseHandle
GetCurrentProcess
GetLastError

user32

LoadCursorW
GetSysColorBrush
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
SetWindowContextHelpId
MapDialogRect
GetMessageW
TranslateMessage
GetCursorPos
ValidateRect
SetCursor
PostQuitMessage
wsprintfW
ReleaseDC
GetDC
SetMenuItemBitmaps
ModifyMenuW
GetMenuState
EnableMenuItem
CheckMenuItem
GetMenuCheckMarkDimensions
LoadBitmapW
ShowWindow
MoveWindow
IsDialogMessageW
SetDlgItemTextW
RegisterWindowMessageW
WinHelpW
GetCapture
CreateWindowExW
SetWindowsHookExW
CallNextHookEx
GetClassInfoExW
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
SendDlgItemMessageW
SendDlgItemMessageA
GetFocus
SetFocus
IsChild
GetWindowTextW
GetForegroundWindow
GetLastActivePopup
DispatchMessageW
PostThreadMessageW
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageW
MapWindowPoints
MessageBoxW
GetKeyState
SetForegroundWindow
IsWindowVisible
UpdateWindow
GetClientRect
GetMenu
PostMessageW
GetSubMenu
GetMenuItemID
GetMenuItemCount
GetSysColor
AdjustWindowRectEx
EqualRect
GetClassInfoW
RegisterClassW
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
SetWindowLongW
SetWindowPos
OffsetRect
IntersectRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
CopyRect
PtInRect
GetWindow
GetDesktopWindow
GetActiveWindow
SetActiveWindow
GetSystemMetrics
CreateDialogIndirectParamW
DestroyWindow
IsWindow
GetWindowLongW
GetDlgItem
IsWindowEnabled
GetParent
GetNextDlgTabItem
EndDialog
LoadIconW
UnregisterClassW
SendMessageW
KillTimer
RegisterClipboardFormatW
SetTimer
EnableWindow
LoadStringW
MessageBeep
GetNextDlgGroupItem
InvalidateRgn
InvalidateRect
CopyAcceleratorTableW
SetRect
IsRectEmpty
CharNextW
CharUpperW
ReleaseCapture
SetCapture
DestroyMenu
GetTopWindow
SetWindowTextW

gdi32

ExtSelectClipRgn
DeleteDC
GetStockObject
GetDeviceCaps
Escape
GetMapMode
GetBkColor
GetTextColor
GetRgnBox
ExtTextOutW
TextOutW
RectVisible
PtVisible
GetWindowExtEx
GetViewportExtEx
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
DeleteObject
SetMapMode
RestoreDC
SaveDC
CreateRectRgnIndirect
CreateBitmap
GetObjectW
SetBkColor
SetTextColor
GetClipBox
SelectObject

comdlg32

GetFileTitleW

advapi32

InitiateSystemShutdownW
LookupPrivilegeValueW
RegSetValueExW
RegCreateKeyExW
RegQueryValueW
RegOpenKeyW
RegEnumKeyW
OpenThreadToken
GetTokenInformation
EqualSid
RegQueryValueExW
RegEnumValueW
RegDeleteValueW
RegEnumKeyExW
RegDeleteKeyW
RegOpenKeyExW
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AdjustTokenPrivileges
OpenProcessToken
QueryServiceStatus
StartServiceW
OpenServiceW
AddAccessAllowedAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegSetKeySecurity
RegCloseKey
FreeSid
CloseServiceHandle
OpenSCManagerW

comctl32

ord17

shlwapi

PathFindFileNameW
PathStripToRootW
PathFindExtensionW
PathIsUNCW

oledlg

OleUIBusyW

ole32

OleInitialize
CLSIDFromProgID
CoFreeUnusedLibraries
OleUninitialize
CoTaskMemAlloc
CoRegisterMessageFilter
OleFlushClipboard
OleIsCurrentClipboard
CoRevokeClassObject
CLSIDFromString
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CoTaskMemFree

oleaut32

SysAllocStringLen
VariantCopy
SysAllocString
SafeArrayDestroy
SystemTimeToVariantTime
OleCreateFontIndirect
SysStringLen
VariantInit
VariantChangeType
VariantClear
SysFreeString

Sections

.text
Size: 184KB - Virtual size: 180KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 64KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5b308f09d00bd9d4c346f2e260c354e0

Headers

File Characteristics

PDB Paths

Imports

winspool.drv

setupapi

msi

psapi

kernel32

user32

gdi32

comdlg32

advapi32

comctl32

shlwapi

oledlg

ole32

oleaut32

Sections

.text Size: 184KB - Virtual size: 180KB

.rdata Size: 56KB - Virtual size: 53KB

.data Size: 16KB - Virtual size: 36KB

.rsrc Size: 64KB - Virtual size: 62KB

.text
Size: 184KB - Virtual size: 180KB

.rdata
Size: 56KB - Virtual size: 53KB

.data
Size: 16KB - Virtual size: 36KB

.rsrc
Size: 64KB - Virtual size: 62KB