d:\TeamCityAgents\B\work\1f3fdff0fdadaa86\build\release\NativeInstaller.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-21_44b95f3fa0963a4e4aab2901a2044b9c_icedid.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-21_44b95f3fa0963a4e4aab2901a2044b9c_icedid.exe
Resource
win10v2004-20240412-en
General
-
Target
2024-04-21_44b95f3fa0963a4e4aab2901a2044b9c_icedid
-
Size
4.8MB
-
MD5
44b95f3fa0963a4e4aab2901a2044b9c
-
SHA1
7b512031624864b0845ccc5429ae78b3af050452
-
SHA256
4a71129099e35adb97260a24acb1e1559d19b8dea43135b473bae7a929a7493c
-
SHA512
72877cc3c1f33c0e9335e61c1e8fb79b65e1b1bc1d27d2f5beec8aa5d90ec4b65886ab1cf0e6b6f31d04f8de153f0cb7abac857d80dc8396340a054e94f34d99
-
SSDEEP
98304:scWqXmWvDP2V+gBNYQCoLIV5K0EGrJpc1bgcKpPHQgTeX6U:cfwmOQ/IVbI1i98P
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-04-21_44b95f3fa0963a4e4aab2901a2044b9c_icedid
Files
-
2024-04-21_44b95f3fa0963a4e4aab2901a2044b9c_icedid.exe windows:5 windows x86 arch:x86
23cd75c04573717bae0f0f727b2a61a0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
version
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
kernel32
SetErrorMode
GetStartupInfoW
SetEnvironmentVariableW
HeapAlloc
HeapFree
HeapReAlloc
RtlUnwind
RaiseException
Sleep
ExitProcess
ExitThread
CreateThread
HeapSize
SetUnhandledExceptionFilter
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
HeapCreate
QueryPerformanceCounter
GetSystemTimeAsFileTime
UnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
LCMapStringA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
GetCurrentDirectoryA
GetDriveTypeA
CreateFileA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
GetProcessHeap
MultiByteToWideChar
SizeofResource
LockResource
LoadResource
FindResourceW
LoadLibraryW
GetProcAddress
FreeLibrary
CloseHandle
WaitForSingleObject
TerminateProcess
FindFirstFileExW
DeleteFileW
FindNextFileW
FindClose
RemoveDirectoryW
SetEvent
GetEnvironmentVariableW
GetTempPathW
lstrlenW
WideCharToMultiByte
SetCurrentDirectoryW
CreateProcessW
GetExitCodeProcess
GetLastError
GetVersionExW
GetDiskFreeSpaceExW
ResetEvent
GetModuleFileNameW
VirtualFree
GetTickCount
CreateEventW
CreateFileW
GetFileSize
SetFilePointer
ReadFile
lstrlenA
WriteFile
CreateDirectoryW
GetFullPathNameW
SetEndOfFile
FlushFileBuffers
GlobalFlags
GetCurrentDirectoryW
WritePrivateProfileStringW
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
InterlockedIncrement
InterlockedDecrement
GlobalFindAtomW
CompareStringW
LoadLibraryA
GetVersionExA
SuspendThread
ResumeThread
SetThreadPriority
FreeResource
GlobalAddAtomW
GetModuleHandleA
GetCurrentProcessId
GlobalDeleteAtom
GetCurrentThread
GetCurrentThreadId
ConvertDefaultLocale
EnumResourceLanguagesW
GetLocaleInfoW
LoadLibraryExW
CompareStringA
InterlockedExchange
lstrcmpW
GetModuleHandleW
SetLastError
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
FormatMessageW
MulDiv
GetCurrentProcess
lstrcmpA
lstrcpyW
VirtualAlloc
LocalFree
LocalAlloc
lstrcpynW
EnumResourceNamesW
user32
GetSysColorBrush
DestroyMenu
RegisterWindowMessageW
SendDlgItemMessageA
WinHelpW
GetCapture
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
GetForegroundWindow
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
MapWindowPoints
SetMenu
SetForegroundWindow
UpdateWindow
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
DefWindowProcW
CallWindowProcW
CopyRect
PtInRect
SystemParametersInfoA
GetWindowPlacement
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuW
EnableMenuItem
CheckMenuItem
SetWindowsHookExW
CallNextHookEx
GetMessageW
TranslateMessage
IsWindowVisible
GetKeyState
GetCursorPos
ValidateRect
GetWindowTextW
GetFocus
SetWindowPos
SetFocus
ShowWindow
SetWindowLongW
GetDlgCtrlID
SetWindowTextW
IsDialogMessageW
SendDlgItemMessageW
GetWindow
GetDesktopWindow
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamW
DestroyWindow
IsWindow
GetDlgItem
GetNextDlgTabItem
EndDialog
GetSysColor
EndPaint
BeginPaint
ReleaseDC
GetDC
ClientToScreen
ScreenToClient
GrayStringW
DrawTextExW
DrawTextW
UnregisterClassW
GetMenu
TabbedTextOutW
GetLastActivePopup
IsWindowEnabled
MessageBoxW
PostQuitMessage
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
DrawFocusRect
InflateRect
OffsetRect
SetRectEmpty
GetWindowRect
GetParent
SetCursor
LoadCursorW
InvalidateRect
MessageBeep
DrawIcon
GetClientRect
IsIconic
SendMessageW
AppendMenuW
GetSystemMenu
LoadIconW
EnableWindow
MsgWaitForMultipleObjects
DispatchMessageW
PeekMessageW
PostMessageW
GetWindowThreadProcessId
GetWindowLongW
EnumWindows
GetSystemMetrics
GetWindowTextLengthW
gdi32
DeleteObject
PtVisible
RectVisible
TextOutW
ExtTextOutW
Escape
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
DeleteDC
CreateBitmap
GetClipBox
SetMapMode
SetTextColor
SetBkColor
RestoreDC
SaveDC
GetDeviceCaps
GetObjectW
GetStockObject
SetBkMode
SelectObject
CreateFontIndirectW
winspool.drv
ClosePrinter
OpenPrinterW
DocumentPropertiesW
advapi32
RegEnumKeyW
RegOpenKeyExW
RegQueryValueExW
AllocateAndInitializeSid
CheckTokenMembership
RegSetValueExW
RegCreateKeyExW
RegQueryValueW
RegOpenKeyW
RegDeleteKeyW
FreeSid
RegCloseKey
shell32
SHGetPathFromIDListW
SHGetMalloc
SHCreateDirectoryExW
ShellExecuteW
SHGetSpecialFolderLocation
comctl32
InitCommonControlsEx
shlwapi
PathRemoveFileSpecW
PathFindFileNameW
PathFindExtensionW
PathAppendW
ole32
StringFromGUID2
CoCreateGuid
CoUninitialize
CoInitialize
oleaut32
VariantClear
VariantChangeType
VariantInit
wintrust
WinVerifyTrust
crypt32
CertGetNameStringW
CryptMsgGetParam
CertCloseStore
CryptMsgClose
CryptDecodeObject
CertFreeCertificateContext
CertFindCertificateInStore
CryptQueryObject
Sections
.text Size: 190KB - Virtual size: 190KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 53KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 136.0MB - Virtual size: 136.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ