2024-04-23_f99c745a5ce0f2463c17764ff277ccbd_gael_icedid

Sharing

Copy URL Twitter E-mail

General

Target

2024-04-23_f99c745a5ce0f2463c17764ff277ccbd_gael_icedid
Size

4.4MB
MD5

f99c745a5ce0f2463c17764ff277ccbd
SHA1

b6da6c8166099a5f80783761214c1530d9fc48c1
SHA256

07fa9694e54805628e6b3552ec79022c9c434b08fae4dd57f21c8d7d10827df6
SHA512

8c9b1994a2d976259b57b9545afc844a26adb9c00c443bec62451aadfbb46867a4f303883dd4ba686fc388fafc2aa67d3f3384c57bd71fce0e03e6d5b9fa963a
SSDEEP

49152:2toSZ7U4oNvzqXTnFQuKCEdcAeXkyse6Usv:0A4UvzqTnuuKCEdWHse6Usv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-04-23_f99c745a5ce0f2463c17764ff277ccbd_gael_icedid

Files

2024-04-23_f99c745a5ce0f2463c17764ff277ccbd_gael_icedid
.exe windows:4 windows x86 arch:x86

3d18a5733ae9c821530412f0d229755c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\works\project\Notch4_UpDate-070910\gui\Notch4_vc71_v21.0_20061212_박복만\vc71\Inp1x\Release\alsr1x.pdb

Imports

kernel32

lstrcmpiA
lstrcmpiW
GetStringTypeExA
GetStringTypeExW
lstrlenW
CompareStringA
CompareStringW
GetEnvironmentVariableA
MultiByteToWideChar
GetEnvironmentVariableW
GetVersion
lstrcatA
lstrlenA
WinExec
GetWindowsDirectoryA
WritePrivateProfileSectionA
WritePrivateProfileStringA
GetPrivateProfileSectionA
GetPrivateProfileSectionNamesA
_lread
_lopen
_lclose
LoadResource
LockResource
SizeofResource
FindResourceA
WideCharToMultiByte
GetThreadLocale
GetLocaleInfoA
GetACP
GetVersionExA
InterlockedExchange
WriteFile
EscapeCommFunction
ClearCommError
ReadFile
GetCommState
SetLastError
SetThreadPriority
ResumeThread
GetCurrentThreadId
WaitForSingleObject
SetEvent
SuspendThread
RaiseException
InitializeCriticalSection
DeleteCriticalSection
FreeResource
GlobalFree
GlobalUnlock
GlobalLock
GetModuleHandleA
lstrcpynA
lstrcmpW
GlobalDeleteAtom
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
MulDiv
InterlockedDecrement
LocalFree
FormatMessageA
GlobalAlloc
GlobalSize
CopyFileA
GetModuleFileNameA
MoveFileA
DeleteFileA
SetFilePointer
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
GetFileSize
DuplicateHandle
GetCurrentProcess
FindClose
FindFirstFileA
GetVolumeInformationA
GetFullPathNameA
GetShortPathNameA
EnumResourceLanguagesA
ConvertDefaultLocale
lstrcmpA
GetCurrentThread
FileTimeToSystemTime
FileTimeToLocalFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
SetFileTime
SetFileAttributesA
GetFileAttributesA
GetFileTime
LocalAlloc
LeaveCriticalSection
GlobalReAlloc
GlobalHandle
EnterCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
GlobalFlags
InterlockedIncrement
GetCPInfo
GetOEMCP
SetErrorMode
GetPrivateProfileIntA
GetPrivateProfileStringA
GetCurrentDirectoryA
LocalUnlock
LocalLock
GetTickCount
GetTempFileNameA
GetDiskFreeSpaceA
RtlUnwind
GetSystemTimeAsFileTime
HeapFree
HeapAlloc
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetStartupInfoA
GetCommandLineA
ExitProcess
ExitThread
CreateThread
HeapReAlloc
SetStdHandle
GetFileType
TerminateProcess
HeapSize
GetTimeZoneInformation
HeapDestroy
HeapCreate
VirtualFree
FatalAppExitA
IsBadWritePtr
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
QueryPerformanceCounter
GetCurrentProcessId
SetUnhandledExceptionFilter
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
SetConsoleCtrlHandler
SetEnvironmentVariableA
GetLocaleInfoW
SetCommState
lstrcpyA
CreateFileA
SetupComm
PurgeComm
SetCommTimeouts
CreateEventA
SetCommMask
WaitCommEvent
CloseHandle
Sleep
GetProcAddress
LoadLibraryA
GetLastError
FreeLibrary

user32

IsChild
SetFocus
SendDlgItemMessageA
RemovePropA
GetPropA
SetPropA
GetClassNameA
GetClassInfoExA
GetClassLongA
CreateWindowExA
WinHelpA
RegisterWindowMessageA
GetMenuCheckMarkDimensions
CheckMenuItem
EnableMenuItem
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckDlgButton
CheckRadioButton
GetDlgItemInt
GetDlgItemTextA
SetDlgItemInt
SetDlgItemTextA
IsDlgButtonChecked
IsDialogMessageA
SetWindowTextA
MoveWindow
ShowWindow
ScrollWindowEx
TabbedTextOutA
DrawTextA
DrawTextExA
GrayStringA
ClientToScreen
GetWindowDC
BeginPaint
EndPaint
RemoveMenu
InsertMenuA
GetMenuStringA
WindowFromPoint
PostQuitMessage
ShowOwnedPopups
MapDialogRect
SetWindowContextHelpId
GetMenuItemInfoA
DestroyMenu
GetDialogBaseUnits
GetSysColorBrush
GetWindowThreadProcessId
DeleteMenu
DestroyIcon
CharNextA
IsRectEmpty
SetRect
CopyAcceleratorTableA
InvalidateRgn
GetNextDlgGroupItem
IsClipboardFormatAvailable
GetTabbedTextExtentA
TranslateAcceleratorA
SetMenu
BringWindowToTop
SetRectEmpty
CreatePopupMenu
InsertMenuItemA
LoadAcceleratorsA
ReuseDDElParam
UnpackDDElParam
LoadMenuA
RegisterClipboardFormatA
UnionRect
PostThreadMessageA
GetDCEx
LockWindowUpdate
SetParent
TrackPopupMenuEx
TrackPopupMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
SetForegroundWindow
ShowScrollBar
GetTopWindow
GetMenu
GetWindowTextLengthA
GetMenuItemID
GetMenuItemCount
AdjustWindowRectEx
ScreenToClient
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
GetClassInfoA
RegisterClassA
SetWindowPlacement
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
SetWindowPos
OffsetRect
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GetWindow
MapVirtualKeyA
GetKeyNameTextA
CopyRect
GetDesktopWindow
SetActiveWindow
DestroyWindow
GetWindowLongA
GetDlgItem
IsWindowEnabled
GetNextDlgTabItem
EndDialog
UnregisterClassA
SetWindowsHookExA
CallNextHookEx
GetMessageA
TranslateMessage
GetActiveWindow
IsWindowVisible
GetKeyState
GetCursorPos
ValidateRect
WaitMessage
PostMessageA
PeekMessageA
DispatchMessageA
SendMessageA
MessageBoxA
wsprintfA
LoadBitmapA
EnableWindow
KillTimer
SetTimer
GetClientRect
RedrawWindow
GetFocus
FillRect
GetSysColor
MessageBeep
ReleaseCapture
PtInRect
SetCapture
GetCapture
SetCursor
SetWindowLongA
IsWindow
InvalidateRect
InflateRect
ReleaseDC
GetDC
GetParent
GetWindowRect
CopyIcon
LoadCursorA
LoadIconA
AppendMenuA
GetSystemMenu
DrawIcon
GetSystemMetrics
IsIconic
CharLowerW
CharLowerA
CharUpperW
CharUpperA
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
GetWindowTextA
GetForegroundWindow
GetLastActivePopup
BeginDeferWindowPos
GetSubMenu
EndDeferWindowPos
MapWindowPoints
UpdateWindow
ScrollWindow
CreateDialogIndirectParamA

gdi32

DPtoLP
GetBkColor
GetTextColor
GetRgnBox
GetCharWidthA
StartPage
EndPage
SetAbortProc
AbortDoc
EndDoc
StretchDIBits
CombineRgn
SetRectRgn
GetTextMetricsA
CreateDCA
CopyMetaFileA
CreateHatchBrush
ExtCreatePen
GetDeviceCaps
PlayMetaFile
EnumMetaFile
GetObjectType
PlayMetaFileRecord
SelectPalette
CreatePatternBrush
PatBlt
GetDCOrgEx
GetClipBox
SetTextColor
SetBkColor
SaveDC
RestoreDC
SetBkMode
CreateDIBPatternBrushPt
SetROP2
SetStretchBltMode
SetMapMode
ExcludeClipRect
IntersectClipRect
OffsetClipRgn
LineTo
MoveToEx
SetTextAlign
SetTextJustification
SetTextCharacterExtra
SetMapperFlags
SetArcDirection
SetColorAdjustment
DeleteObject
SelectClipRgn
GetClipRgn
CreateRectRgn
SelectClipPath
GetViewportExtEx
GetWindowExtEx
GetPixel
StartDocA
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
SelectObject
SetViewportOrgEx
BitBlt
CreateCompatibleDC
CreateSolidBrush
GetStockObject
CreateFontIndirectA
GetObjectA
GetTextExtentPoint32A
PathToRegion
EndPath
BeginPath
CreateCompatibleBitmap
CreateBitmap
GetMapMode
CreateFontA
CreatePen
DeleteDC
ExtSelectClipRgn
PolyBezierTo
PolylineTo
OffsetViewportOrgEx
PolyDraw
ArcTo
GetCurrentPositionEx
ScaleWindowExtEx
SetWindowExtEx
OffsetWindowOrgEx
SetWindowOrgEx
ScaleViewportExtEx
SetPolyFillMode
CreateRectRgnIndirect
SetViewportExtEx

advapi32

RegSetValueA
RegQueryValueExA
RegDeleteKeyA
RegEnumKeyA
RegCreateKeyExA
RegSetValueExA
RegDeleteValueA
RegCreateKeyA
GetFileSecurityA
RegOpenKeyExA
RegQueryValueA
RegCloseKey
RegOpenKeyA
SetFileSecurityA

shell32

ExtractIconA
DragFinish
DragQueryFileA
ShellExecuteA
SHGetFileInfoA

comctl32

ImageList_Draw
ImageList_GetImageInfo
ord17
ImageList_AddMasked
ord13
ImageList_Read
ImageList_Write
ord14
ImageList_Destroy
ImageList_Create
ImageList_LoadImageA
ImageList_Merge

shlwapi

PathFindExtensionA
PathStripToRootA
PathIsUNCA
PathFindFileNameA
PathRemoveExtensionA

oledlg

ord8

ws2_32

closesocket
accept
socket
select
htonl
htons
inet_addr
bind
WSAGetLastError
WSACleanup
getpeername
WSASetLastError
connect
sendto
recvfrom
WSAAsyncSelect
send
recv
gethostname
WSAStartup
inet_ntoa
ntohs
getsockname
listen
gethostbyname

winspool.drv

GetJobA
OpenPrinterA
DocumentPropertiesA
ClosePrinter

comdlg32

ReplaceTextA
FindTextA
PageSetupDlgA
GetSaveFileNameA
GetFileTitleA
GetOpenFileNameA
CommDlgExtendedError
PrintDlgA

ole32

CreateStreamOnHGlobal
CoRegisterMessageFilter
OleFlushClipboard
OleIsCurrentClipboard
OleSetClipboard
CoRevokeClassObject
CoRegisterClassObject
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
OleRun
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
StringFromGUID2
CoCreateInstance
CoDisconnectObject
CLSIDFromString
CLSIDFromProgID
OleDuplicateData
ReleaseStgMedium
CoTaskMemAlloc
CreateBindCtx
CoTreatAsClass
StringFromCLSID
ReadClassStg
ReadFmtUserTypeStg
OleRegGetUserType
WriteClassStg
WriteFmtUserTypeStg
SetConvertStg
CoTaskMemFree

oleaut32

VariantClear
VariantChangeType
VariantInit
SysAllocStringLen
SysStringLen
SysAllocStringByteLen
SysStringByteLen
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetElemsize
SafeArrayGetDim
SafeArrayCreate
SafeArrayRedim
VariantCopy
SafeArrayAllocData
SafeArrayAllocDescriptor
SafeArrayCopy
SafeArrayGetElement
SafeArrayPtrOfIndex
SafeArrayPutElement
SafeArrayLock
SafeArrayUnlock
SafeArrayDestroy
SafeArrayDestroyData
SafeArrayDestroyDescriptor
VariantTimeToSystemTime
SystemTimeToVariantTime
SysAllocString
SysReAllocStringLen
VarDateFromStr
VarBstrFromDec
VarDecFromStr
VarCyFromStr
VarBstrFromCy
VarBstrFromDate
OleCreateFontIndirect
LoadTypeLi
SysFreeString

Sections

.text
Size: 696KB - Virtual size: 694KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 168KB - Virtual size: 165KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3.6MB - Virtual size: 3.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3d18a5733ae9c821530412f0d229755c

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

comctl32

shlwapi

oledlg

ws2_32

winspool.drv

comdlg32

ole32

oleaut32

Sections

.text Size: 696KB - Virtual size: 694KB

.rdata Size: 168KB - Virtual size: 165KB

.data Size: 16KB - Virtual size: 28KB

.rsrc Size: 3.6MB - Virtual size: 3.6MB

.text
Size: 696KB - Virtual size: 694KB

.rdata
Size: 168KB - Virtual size: 165KB

.data
Size: 16KB - Virtual size: 28KB

.rsrc
Size: 3.6MB - Virtual size: 3.6MB