2024-04-19_42418a0c7b1c88f885a2e5e0fb3c1ac6_icedid

Sharing

Copy URL Twitter E-mail

General

Target

2024-04-19_42418a0c7b1c88f885a2e5e0fb3c1ac6_icedid
Size

1.5MB
MD5

42418a0c7b1c88f885a2e5e0fb3c1ac6
SHA1

a0d3166ad36326491347e813b8c13b5785aca587
SHA256

d67cb4ebbff358a72f9be963f39e9ff96a477b518f71211ed311cd1166c5abea
SHA512

07d35651d03524e7ee66406519347ac9042ee2d129ce0c938ecb0a714ebb4f2e82a4334460dc2e24353b35bce8816ebb724c22d5791b06ee901795be32732905
SSDEEP

24576:6rxNfTHXqCKxoZf9tqxJ13zqv010LT8V+2fSy0vLCPpYgF8wfo1j8/VveTeCgY:ieVG9tq9K0uLT8o/TCPpfZfo1jCmT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-04-19_42418a0c7b1c88f885a2e5e0fb3c1ac6_icedid

Files

2024-04-19_42418a0c7b1c88f885a2e5e0fb3c1ac6_icedid
.exe windows:4 windows x86 arch:x86

fae4eb79439e3850c34a29b05e25bf53

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\Users\סהר בן עטר\Desktop\Extra V4\Source\Source_Code\Stable\MatchServer\Runtime\MatchServer.pdb

Imports

libcomservice2

tdesDecryptString

kernel32

GetVolumeInformationA
GetShortPathNameA
FileTimeToLocalFileTime
LocalFileTimeToFileTime
lstrcpynW
RtlUnwind
ExitProcess
GetSystemTimeAsFileTime
GetTimeFormatA
GetDateFormatA
HeapAlloc
HeapFree
VirtualProtect
VirtualAlloc
VirtualQuery
GetStartupInfoA
GetCommandLineA
HeapReAlloc
HeapSize
QueryPerformanceCounter
GetTimeZoneInformation
HeapDestroy
HeapCreate
VirtualFree
IsBadWritePtr
LCMapStringA
LCMapStringW
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetDriveTypeA
GetStringTypeA
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
SetStdHandle
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
SetEnvironmentVariableA
GetLocaleInfoW
DuplicateHandle
GetModuleHandleA
TerminateThread
WaitForSingleObject
CreateThread
LoadLibraryA
FreeLibrary
CreateEventA
SetUnhandledExceptionFilter
GetPrivateProfileIntA
OutputDebugStringA
WaitForMultipleObjects
PostQueuedCompletionStatus
CreateIoCompletionPort
TerminateProcess
SetEvent
GetQueuedCompletionStatus
ResetEvent
GetSystemInfo
FileTimeToSystemTime
UnlockFile
SystemTimeToFileTime
GetCurrentThreadId
ExitThread
GlobalUnlock
GlobalLock
lstrcatA
GlobalMemoryStatusEx
GetCurrentProcess
GetCurrentProcessId
CreateFileA
InterlockedDecrement
OpenProcess
ReadFile
SetFileTime
GetFileAttributesA
GetCurrentThread
FindClose
FindNextFileA
FindFirstFileA
lstrcpynA
GlobalAddAtomA
GlobalGetAtomNameA
lstrcmpW
GlobalDeleteAtom
GlobalFindAtomA
FreeResource
RaiseException
lstrcpyA
SetErrorMode
LocalFree
GetFileSize
SetEndOfFile
CreateDirectoryA
SetCurrentDirectoryA
GetModuleFileNameA
GetTickCount
GetLocalTime
Sleep
CloseHandle
GetLastError
CreateMutexA
ReleaseMutex
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
SizeofResource
LockResource
LoadResource
FindResourceA
WideCharToMultiByte
MultiByteToWideChar
GetVersion
lstrcmpiA
lstrlenW
lstrlenA
CompareStringA
CompareStringW
FormatMessageA
GetStringTypeExA
GetCurrentDirectoryA
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetPrivateProfileStringA
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
DeleteFileA
MoveFileA
GetOEMCP
GetCPInfo
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
TlsGetValue
GlobalHandle
LocalAlloc
GlobalFlags
lstrcpyW
GlobalReAlloc
InterlockedIncrement
GetDiskFreeSpaceA
GetFullPathNameA
GetTempFileNameA
GetFileTime
WritePrivateProfileStringA
ConvertDefaultLocale
EnumResourceLanguagesA
lstrcmpA
SetLastError
GlobalFree
CopyFileA
MulDiv
GlobalSize
GlobalAlloc
GetProcAddress

user32

BeginPaint
GetWindowDC
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
CountClipboardFormats
IsClipboardFormatAvailable
SetCapture
ClientToScreen
MessageBeep
FillRect
LoadCursorA
DestroyCursor
SetRect
RegisterClipboardFormatA
SetWindowContextHelpId
MapDialogRect
GetMessageA
TranslateMessage
ValidateRect
ShowOwnedPopups
PostQuitMessage
CreateDialogIndirectParamA
GetNextDlgTabItem
EndDialog
SetParent
DeleteMenu
IsRectEmpty
GetMenuItemInfoA
InflateRect
GetMenuStringA
AppendMenuA
InsertMenuA
RemoveMenu
IsZoomed
ReleaseDC
GetDC
SetMenuItemBitmaps
ModifyMenuA
GetMenuState
CheckMenuItem
GetMenuCheckMarkDimensions
EndPaint
MoveWindow
CreateMenu
ShowWindow
SetMenu
GetLastActivePopup
CopyRect
SetRectEmpty
OffsetRect
IntersectRect
CreatePopupMenu
InsertMenuItemA
IsIconic
InvalidateRect
SetActiveWindow
LoadAcceleratorsA
ReleaseCapture
GetCapture
IsDialogMessageA
SetDlgItemTextA
SetWindowsHookExA
CallNextHookEx
GetClassLongA
GetClassInfoExA
SetPropA
GetPropA
RemovePropA
GetSysColorBrush
KillTimer
WindowFromPoint
GetDCEx
LockWindowUpdate
DestroyIcon
CharNextA
SendDlgItemMessageA
IsChild
GetWindowTextLengthA
GetWindowTextA
GetForegroundWindow
DispatchMessageA
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
CopyAcceleratorTableA
InvalidateRgn
GetNextDlgGroupItem
PostThreadMessageA
FindWindowA
DrawIcon
SetWindowRgn
LoadBitmapA
SetCursor
SendMessageA
EnableWindow
wsprintfA
GetSubMenu
LoadMenuA
GetTabbedTextExtentA
SendNotifyMessageA
SetWindowTextA
GetClassInfoA
ReuseDDElParam
UnpackDDElParam
GetDlgCtrlID
GetDlgItem
EqualRect
GetFocus
SetFocus
WinHelpA
GetSysColor
GetClassNameA
DestroyMenu
RegisterWindowMessageA
PtInRect
GetSystemMetrics
GetWindowPlacement
SystemParametersInfoA
CallWindowProcA
DefWindowProcA
UnregisterClassA
RegisterClassA
SetScrollInfo
GetScrollInfo
DeferWindowPos
ScreenToClient
ShowScrollBar
GetScrollPos
SetScrollPos
GetScrollRange
SetScrollRange
TrackPopupMenu
GetWindowRect
GetClientRect
IsWindowVisible
SetTimer
SetForegroundWindow
LoadIconA
GetCursorPos
UpdateWindow
PeekMessageA
GetKeyState
EnableMenuItem
GetSystemMenu
CharUpperA
PostMessageA
MessageBoxA
DefFrameProcA
GetMenu
DefMDIChildProcA
GetMenuItemID
GetMenuItemCount
GetParent
DrawMenuBar
GetActiveWindow
BringWindowToTop
CreateWindowExA
TranslateMDISysAccel
TranslateAcceleratorA
IsWindow
SetWindowLongA
GetWindowLongA
SetWindowPos
RedrawWindow
AdjustWindowRectEx
IsWindowEnabled
GetWindow
GetMessagePos
MapWindowPoints
ScrollWindow
GetDesktopWindow

gdi32

CreateBitmap
GetObjectA
SetBkColor
SetTextColor
GetClipBox
CreateCompatibleDC
ScaleWindowExtEx
SaveDC
RestoreDC
SetBkMode
SetPolyFillMode
SetROP2
SetStretchBltMode
SetMapMode
ExcludeClipRect
IntersectClipRect
LineTo
MoveToEx
SetTextAlign
SelectClipRgn
CreateRectRgn
GetViewportExtEx
GetWindowExtEx
GetPixel
PtVisible
RectVisible
TextOutA
Escape
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
CreateRectRgnIndirect
SetWindowOrgEx
SetWindowExtEx
GetCurrentPositionEx
ExtSelectClipRgn
CreatePatternBrush
CreateSolidBrush
SetRectRgn
CombineRgn
GetMapMode
GetBkColor
GetTextColor
GetRgnBox
CreateEllipticRgn
LPtoDP
Ellipse
GetNearestColor
GetBkMode
GetPolyFillMode
GetROP2
GetStretchBltMode
GetTextAlign
GetTextFaceA
GetWindowOrgEx
PatBlt
SelectObject
GetTextMetricsA
GetTextExtentPoint32A
DeleteDC
StretchDIBits
DeleteObject
GetCharWidthA
CreateFontA
GetDeviceCaps
CopyMetaFileA
CreateDCA
CreateFontIndirectA
BitBlt
ExtTextOutA
CreatePen
GetViewportOrgEx
DPtoLP
Rectangle
GetStockObject
StartDocA
StartPage
EndPage
SetAbortProc
AbortDoc
ScaleViewportExtEx
CreateCompatibleBitmap
EndDoc

comdlg32

CommDlgExtendedError
PrintDlgA
FindTextA
ReplaceTextA
ChooseFontA
GetOpenFileNameA
GetSaveFileNameA
GetFileTitleA

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter
GetJobA

advapi32

SetFileSecurityA
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyA
RegSetValueA
RegOpenKeyA
RegDeleteKeyA
RegEnumKeyA
RegQueryValueA
RegCreateKeyExA
GetFileSecurityA
RegCloseKey
RegDeleteValueA

shell32

Shell_NotifyIconA
DragFinish
DragQueryFileA
DragAcceptFiles
ExtractIconA
SHGetFileInfoA
ShellExecuteA

comctl32

ord17
ImageList_Draw
ImageList_GetImageInfo
ImageList_Destroy

shlwapi

PathFileExistsA
PathIsDirectoryA
PathRemoveFileSpecA
PathFindFileNameA
PathFindExtensionA
PathStripToRootA
PathIsUNCA

oledlg

ord8
ord11
ord4
ord3

ole32

OleGetClipboard
OleSetMenuDescriptor
GetHGlobalFromILockBytes
CreateGenericComposite
CreateItemMoniker
OleGetIconOfClass
OleLoad
OleCreate
OleCreateLinkToFile
OleCreateFromFile
OleCreateStaticFromData
OleCreateLinkFromData
OleCreateFromData
OleSetContainedObject
OleLockRunning
CreateStreamOnHGlobal
OleSaveToStream
WriteClassStm
OleSave
CreateFileMoniker
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
IsAccelerator
OleTranslateAccelerator
OleFlushClipboard
OleIsCurrentClipboard
CoRevokeClassObject
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CoDisconnectObject
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CLSIDFromString
CLSIDFromProgID
OleDuplicateData
ReleaseStgMedium
CoTaskMemAlloc
CreateBindCtx
CoTreatAsClass
StringFromCLSID
ReadClassStg
ReadFmtUserTypeStg
OleRegGetUserType
WriteClassStg
WriteFmtUserTypeStg
SetConvertStg
CoTaskMemFree
CoUninitialize
CoCreateInstance
OleRun
CoInitialize
CoRegisterMessageFilter

oleaut32

VariantTimeToSystemTime
SysFreeString
SystemTimeToVariantTime
VarDateFromStr
VarBstrFromDate
SysAllocString
SysAllocStringByteLen
SysStringByteLen
VariantCopy
VariantClear
VariantChangeType
SysAllocStringLen
SysStringLen
SafeArrayDestroy
OleCreateFontIndirect
GetErrorInfo
VariantInit

odbc32

ord75
ord24
ord36
ord29
ord76
ord20
ord19
ord11
ord60
ord66
ord65
ord70
ord56
ord67
ord40
ord47
ord53
ord54
ord12
ord9
ord72
ord4
ord39
ord48
ord43
ord13
ord5
ord51
ord50
ord45
ord44
ord59
ord18
ord46
ord8
ord16
ord61
ord3
ord14
ord15
ord1
ord2
ord10
ord17
ord7
ord41
ord31
ord49
ord68

winmm

timeGetTime

ws2_32

WSASocketA
listen
bind
htonl
htons
gethostbyname
WSASend
shutdown
WSARecv
closesocket
WSAGetLastError
connect
WSAStartup
socket
sendto
recvfrom
WSACloseEvent
setsockopt
WSAWaitForMultipleEvents
WSAEventSelect
WSACreateEvent
inet_addr
ntohs
WSACleanup
inet_ntoa
WSAEnumNetworkEvents

dbghelp

MiniDumpWriteDump

psapi

GetModuleFileNameExA
EnumProcessModules
EnumProcesses
GetModuleBaseNameA

mswsock

GetAcceptExSockaddrs
AcceptEx
TransmitFile

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 236KB - Virtual size: 232KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 6.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fae4eb79439e3850c34a29b05e25bf53

Headers

File Characteristics

PDB Paths

Imports

libcomservice2

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

odbc32

winmm

ws2_32

dbghelp

psapi

mswsock

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 236KB - Virtual size: 232KB

.data Size: 20KB - Virtual size: 6.7MB

.rsrc Size: 48KB - Virtual size: 47KB

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 236KB - Virtual size: 232KB

.data
Size: 20KB - Virtual size: 6.7MB

.rsrc
Size: 48KB - Virtual size: 47KB