2024-04-25_0039509c7dc5e29b999d65024c68e59d_icedid

Sharing

Copy URL Twitter E-mail

General

Target

2024-04-25_0039509c7dc5e29b999d65024c68e59d_icedid
Size

528KB
MD5

0039509c7dc5e29b999d65024c68e59d
SHA1

f4ed4534a3bee3529b36d5ebe8059298907cf281
SHA256

d750ab934f58a7a8fd11a69ff63cd6dfc628985d990990f2b2b84a91425e6bc7
SHA512

ebac1937f18307969c205b77a250316346c865533e987b6e9687ef3ca6ff7bc0e133ad96a84fca6ecf40bd2709ffb6250372bc0e217a63e2ee5f90d8be4baea6
SSDEEP

6144:tKWFXcYQqSg2hBCbK2Df50qX8CTEcAa/DSeo348d+1lut+kMMQ1iHeW:tKSX0g2hBCb1DR7XlENa/DFoI8k67Q1

Score

1^/10

Malware Config

Signatures

Files

2024-04-25_0039509c7dc5e29b999d65024c68e59d_icedid
.exe windows:4 windows x86 arch:x86

bca2405ec8ae507d27024ec39231fd2f

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:67:fc:75:d5:6e:31:a0:75:37:88:88:40:79:c8:b1
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

17/02/2012, 00:00

Not After

17/04/2015, 23:59

Subject

CN=Tendyron Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=ADS,O=Tendyron Corporation,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

bb:bd:5d:30:d3:39:88:4e:04:78:bc:44:5e:92:11:e3:be:dc:90:15
Signer

Actual PE Digest

bb:bd:5d:30:d3:39:88:4e:04:78:bc:44:5e:92:11:e3:be:dc:90:15

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTimeZoneInformation
IsBadReadPtr
IsBadCodePtr
GetFileType
SetStdHandle
SetEnvironmentVariableA
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetStdHandle
SetUnhandledExceptionFilter
LCMapStringW
LCMapStringA
IsBadWritePtr
VirtualFree
HeapCreate
HeapDestroy
GetStringTypeW
GetStringTypeA
GetSystemTimeAsFileTime
QueryPerformanceCounter
HeapSize
HeapReAlloc
GetCommandLineA
GetStartupInfoA
VirtualQuery
GetSystemInfo
VirtualAlloc
VirtualProtect
HeapFree
HeapAlloc
TerminateProcess
ExitProcess
RtlUnwind
GetTickCount
GetFileTime
GetFileAttributesA
SetErrorMode
GetFullPathNameA
GetVolumeInformationA
FindFirstFileA
FindClose
GetCurrentProcess
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
ReadFile
GetOEMCP
GetCPInfo
InterlockedIncrement
GlobalFlags
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
TlsGetValue
EnterCriticalSection
GlobalHandle
GlobalReAlloc
LeaveCriticalSection
LocalAlloc
WritePrivateProfileStringA
InterlockedDecrement
GetCurrentThread
GetModuleFileNameA
ConvertDefaultLocale
EnumResourceLanguagesA
GlobalFree
MulDiv
GlobalAlloc
GlobalLock
GlobalUnlock
FormatMessageA
LocalFree
FreeResource
GetCurrentThreadId
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
lstrcpynA
GetModuleHandleA
FileTimeToLocalFileTime
FileTimeToSystemTime
CreateThread
lstrcpyW
lstrcmpW
SetLastError
CreateFileA
WriteFile
FindResourceA
LoadResource
LockResource
SizeofResource
CompareStringW
CompareStringA
lstrlenA
lstrlenW
lstrcmpiA
GetVersion
DeleteCriticalSection
InitializeCriticalSection
GetLastError
RaiseException
WideCharToMultiByte
MultiByteToWideChar
lstrcatA
CreateProcessA
FreeLibrary
LoadLibraryA
GetProcAddress
lstrcmpA
GetPrivateProfileStringA
GetSystemDefaultLangID
lstrcpyA
WaitForSingleObject
InterlockedExchange
CreateMutexA
GetCurrentProcessId
ProcessIdToSessionId
ReleaseMutex
CloseHandle
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP

user32

SetWindowTextA
IsDialogMessageA
SetDlgItemTextA
WinHelpA
GetCapture
SetWindowsHookExA
CallNextHookEx
GetClassLongA
GetClassInfoExA
SetPropA
GetPropA
RemovePropA
SendDlgItemMessageA
GetFocus
IsWindow
SetFocus
IsChild
GetWindowTextLengthA
GetWindowTextA
GetForegroundWindow
GetLastActivePopup
SetActiveWindow
DispatchMessageA
GetTopWindow
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageA
MapWindowPoints
TrackPopupMenu
GetKeyState
GetScrollRange
SetScrollPos
GetScrollPos
IsWindowVisible
AdjustWindowRectEx
SetScrollInfo
GetClassInfoA
RegisterClassA
GetDlgCtrlID
CallWindowProcA
SetWindowPos
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GetWindow
GetClassNameA
SetWindowLongA
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
MoveWindow
IsZoomed
DrawFrameControl
EqualRect
GetScrollInfo
GrayStringA
DrawTextExA
DrawEdge
LoadBitmapA
SetRectEmpty
PtInRect
LoadCursorA
DrawTextA
LoadImageA
GetSysColor
TrackPopupMenuEx
SetCursor
SendMessageA
EnableWindow
PostMessageA
SetForegroundWindow
wsprintfA
DefWindowProcA
RegisterClassExA
CreateWindowExA
UpdateWindow
FindWindowA
SetRect
DrawIcon
CreatePopupMenu
DeleteMenu
DestroyCursor
DestroyMenu
GetWindowLongA
WindowFromPoint
GetNextDlgTabItem
GetActiveWindow
ClientToScreen
DrawFocusRect
FrameRect
FillRect
OffsetRect
InflateRect
CopyRect
GetIconInfo
CreateIconIndirect
ShowWindow
IsWindowEnabled
CheckMenuItem
EnableMenuItem
GetMenuState
GetDC
ReleaseDC
DrawStateA
DestroyIcon
UnregisterClassA
CharUpperA
RegisterWindowMessageA
EnumWindows
MessageBoxA
GetParent
GetWindowThreadProcessId
EndDialog
GetCursorPos
ModifyMenuA
SetMenuItemBitmaps
ValidateRect
TranslateMessage
ScreenToClient
GetMessageA
AppendMenuA
GetMenuItemCount
GetMenuItemID
GetSubMenu
RemoveMenu
GetMenu
GetSystemMenu
IsIconic
GetWindowRect
GetClientRect
InvalidateRect
LoadIconA
GetDlgItem
GetSystemMetrics
PostThreadMessageA
RegisterClipboardFormatA
MessageBeep
GetNextDlgGroupItem
InvalidateRgn
CopyAcceleratorTableA
IsRectEmpty
CharNextA
ReleaseCapture
SetCapture
GetSysColorBrush
EndPaint
BeginPaint
GetWindowDC
SetWindowContextHelpId
MapDialogRect
PostQuitMessage
GetDesktopWindow
TabbedTextOutA
CreateDialogIndirectParamA
GetMenuCheckMarkDimensions

gdi32

ScaleViewportExtEx
SetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
SetViewportExtEx
CreateSolidBrush
GetBkColor
GetRgnBox
OffsetViewportOrgEx
SetViewportOrgEx
GetWindowExtEx
GetViewportExtEx
MoveToEx
LineTo
SetMapMode
SetBkMode
CreateRectRgnIndirect
GetClipBox
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetMapMode
CreatePen
GetCurrentPositionEx
GetDeviceCaps
SaveDC
GetTextExtentPoint32A
RestoreDC
CreateFontIndirectA
GetTextColor
CreateDIBSection
GetObjectA
CreateCompatibleBitmap
GetPixel
SetPixel
CreateBitmap
CreateCompatibleDC
SelectObject
SetBkColor
BitBlt
SetTextColor
DeleteDC
GetStockObject
DeleteObject

comdlg32

GetFileTitleA

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter

advapi32

RegCreateKeyExA
RegOpenKeyExA
RegCloseKey
RegQueryValueExA
RegSetValueExA
RegOpenKeyA
RegDeleteKeyA
RegEnumKeyA
RegQueryValueA
RegDeleteValueA

shell32

ShellExecuteExA

comctl32

ord17
ImageList_ReplaceIcon
_TrackMouseEvent
ImageList_GetImageCount
ImageList_AddMasked
ImageList_Draw
ImageList_GetImageInfo
ImageList_Destroy
ImageList_Create

shlwapi

PathFindExtensionA
PathFindFileNameA
PathStripToRootA
PathCompactPathA
wvnsprintfA
PathIsUNCA

oledlg

ord8

ole32

CLSIDFromString
CLSIDFromProgID
CoGetClassObject
StgOpenStorageOnILockBytes
CoTaskMemFree
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CoRevokeClassObject
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter
CoTaskMemAlloc

oleaut32

VariantCopy
SysAllocStringByteLen
SysStringLen
SysFreeString
SysAllocStringLen
VariantInit
VariantChangeType
VariantClear
SafeArrayDestroy
SystemTimeToVariantTime
SysAllocString
OleCreateFontIndirect

winmm

PlaySoundA

crypt32

CertFreeCertificateContext
CertGetNameStringA
CertCreateCertificateContext
CertCloseStore
CertFreeCertificateChain
CertGetCertificateChain
CertAddCertificateContextToStore
CertOpenStore
CertSetCertificateContextProperty
CertCompareCertificateName
CertNameToStrA

dbtoken_abc

OnKeyT_Login
OnKeyT_ChangePin
OnKeyT_GetDeviceInfo
OnKeyT_ManTokenParam
OnKeyT_WaitForSlotEvent
OnKeyT_ContextInit
OnKeyT_GetSlotList

Sections

.text
Size: 220KB - Virtual size: 219KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 64KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bca2405ec8ae507d27024ec39231fd2f

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

07:67:fc:75:d5:6e:31:a0:75:37:88:88:40:79:c8:b1Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

bb:bd:5d:30:d3:39:88:4e:04:78:bc:44:5e:92:11:e3:be:dc:90:15Signer

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

winmm

crypt32

dbtoken_abc

Sections

.text Size: 220KB - Virtual size: 219KB

.rdata Size: 60KB - Virtual size: 59KB

.data Size: 12KB - Virtual size: 22KB

.rsrc Size: 64KB - Virtual size: 62KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

07:67:fc:75:d5:6e:31:a0:75:37:88:88:40:79:c8:b1
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

bb:bd:5d:30:d3:39:88:4e:04:78:bc:44:5e:92:11:e3:be:dc:90:15
Signer

.text
Size: 220KB - Virtual size: 219KB

.rdata
Size: 60KB - Virtual size: 59KB

.data
Size: 12KB - Virtual size: 22KB

.rsrc
Size: 64KB - Virtual size: 62KB