c:\Program Files\Microsoft Visual Studio\passcape\Network\Release\nprw.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-29_66601c26854b1edf60b84135c868e4f6_icedid_vidar.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-04-29_66601c26854b1edf60b84135c868e4f6_icedid_vidar.exe
Resource
win10v2004-20240419-en
General
-
Target
2024-04-29_66601c26854b1edf60b84135c868e4f6_icedid_vidar
-
Size
3.5MB
-
MD5
66601c26854b1edf60b84135c868e4f6
-
SHA1
b5d7bbc4bf798a4f0db0c488c8311f5e639c4689
-
SHA256
5edecfec055385cea6f3fd54e7e78cd095cd011182c2cfa6bee128f1b3258e84
-
SHA512
57b4cfbef4abdf32206e9fe7a15e1f1296ef21b7a68bf7a754989e174943ef99305cdd3fc754e88d001cf0f7a86c337296ed5e4e522ad71a0d7d74f41588275c
-
SSDEEP
98304:lthfz1E1voCE4fDm8Qbx4RL3I+FVdP5T4OFLc8YKR+Z8sk:lXfz1Gf0S3jP5TeK8zk
Malware Config
Signatures
-
Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-04-29_66601c26854b1edf60b84135c868e4f6_icedid_vidar
Files
-
2024-04-29_66601c26854b1edf60b84135c868e4f6_icedid_vidar.exe windows:5 windows x86 arch:x86
b2888f0a5a47dad974714474e08bd112
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
query
LoadIFilter
version
VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
kernel32
SuspendThread
CreateSemaphoreA
ReleaseSemaphore
CreateMutexA
ReleaseMutex
WaitForMultipleObjects
GetStringTypeExA
GetThreadLocale
DuplicateHandle
GetShortPathNameA
GetFileAttributesExA
LocalFileTimeToFileTime
GetFileSizeEx
GetModuleHandleW
InterlockedIncrement
TlsGetValue
GlobalReAlloc
GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
GetAtomNameA
GlobalFlags
GetCPInfo
GetOEMCP
GetSystemDirectoryW
RtlUnwind
ResumeThread
ExitProcess
SetConsoleCtrlHandler
ExitThread
CreateThread
IsDebuggerPresent
RaiseException
VirtualProtect
SetStdHandle
GetFileType
GetConsoleCP
GetConsoleMode
GetStartupInfoA
SetEnvironmentVariableA
GetACP
IsValidCodePage
LCMapStringA
LCMapStringW
GetStdHandle
FatalAppExitA
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetStringTypeA
GetStringTypeW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoW
ConvertDefaultLocale
EnumResourceLanguagesA
GetCurrentThreadId
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
InterlockedDecrement
GetModuleFileNameW
GlobalSize
SetVolumeLabelA
GetDiskFreeSpaceExA
InterlockedCompareExchange
AreFileApisANSI
CreateFileW
CreateFileMappingW
CreateMutexW
DeleteFileW
FlushFileBuffers
FormatMessageW
GetDiskFreeSpaceW
GetFileAttributesW
GetFileAttributesExW
GetFullPathNameA
GetFullPathNameW
GetSystemTimeAsFileTime
GetTempPathW
HeapCreate
HeapDestroy
HeapReAlloc
HeapSize
HeapValidate
LoadLibraryW
LockFile
LockFileEx
QueryPerformanceCounter
UnlockFile
UnlockFileEx
OutputDebugStringW
GetUserDefaultLCID
FlushViewOfFile
UnmapViewOfFile
SetEndOfFile
CreateFileMappingA
MapViewOfFile
GetTempFileNameA
SetFilePointer
GetLongPathNameA
GetPrivateProfileSectionA
VirtualQuery
GlobalMemoryStatus
GetLocaleInfoA
IsBadReadPtr
SetUnhandledExceptionFilter
TerminateProcess
GetTimeZoneInformation
ResetEvent
CompareFileTime
GetFileTime
GetSystemTime
GetDateFormatA
GetTimeFormatA
SetFileTime
DosDateTimeToFileTime
FileTimeToDosDateTime
FreeResource
DeviceIoControl
GetTempPathA
GetDriveTypeA
SetCurrentDirectoryA
RemoveDirectoryA
FindFirstFileA
FindNextFileA
FindClose
MoveFileA
SetFileAttributesA
CopyFileA
GetFileAttributesA
GetSystemDirectoryA
GetWindowsDirectoryA
GetCurrentDirectoryA
CreateDirectoryA
lstrcmpA
lstrcmpiA
GetSystemInfo
VirtualQueryEx
lstrcmpiW
GetProcessHeap
HeapAlloc
HeapFree
GetEnvironmentVariableW
GetPrivateProfileIntA
SetErrorMode
CompareStringW
GetComputerNameA
GetCurrentThread
lstrcmpW
lstrcatW
lstrcpyW
ReadProcessMemory
WriteProcessMemory
MulDiv
GetVolumeInformationA
OutputDebugStringA
WritePrivateProfileStringA
GetPrivateProfileStringA
SystemTimeToFileTime
ExpandEnvironmentStringsA
GetCurrentProcessId
SystemTimeToTzSpecificLocalTime
lstrcpynW
WriteFile
ReadFile
CreateFileA
VirtualAlloc
VirtualFree
GetDiskFreeSpaceA
GetFileSize
LocalAlloc
LocalFree
DeleteFileA
InterlockedExchange
FileTimeToLocalFileTime
FileTimeToSystemTime
GetCommandLineA
GetLocalTime
FindResourceA
LoadResource
LockResource
SizeofResource
InitializeCriticalSection
DeleteCriticalSection
CreateEventA
GetTickCount
SetEvent
Sleep
SetThreadPriority
EnterCriticalSection
LeaveCriticalSection
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetVersionExA
CreateProcessA
WaitForSingleObject
GetExitCodeProcess
CompareStringA
GetPrivateProfileSectionNamesA
GetModuleFileNameA
DebugBreak
SetLastError
LoadLibraryExA
lstrcatA
OpenProcess
CloseHandle
GetCurrentProcess
GetModuleHandleA
GetLastError
FormatMessageA
MultiByteToWideChar
lstrlenW
WideCharToMultiByte
lstrcpynA
lstrlenA
lstrcpyA
LoadLibraryA
GetProcAddress
FreeLibrary
UnhandledExceptionFilter
user32
GetDlgItemTextA
GetDlgItemInt
CheckRadioButton
CheckDlgButton
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
ModifyMenuA
EnableMenuItem
CheckMenuItem
SendDlgItemMessageA
WinHelpA
SetWindowsHookExA
CallNextHookEx
SetPropA
GetPropA
RemovePropA
GetForegroundWindow
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
GetMessageTime
GetMessagePos
MapWindowPoints
ScrollWindow
TrackPopupMenuEx
TrackPopupMenu
SetMenu
SetScrollRange
GetScrollRange
ShowScrollBar
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
DeferWindowPos
GetScrollInfo
SetScrollInfo
SetWindowPlacement
DefWindowProcA
CallWindowProcA
GetMenu
IntersectRect
GetWindowPlacement
GetDesktopWindow
SetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
GetNextDlgTabItem
EndPaint
BeginPaint
GetLastActivePopup
IsWindowEnabled
GetWindowTextLengthA
GetScrollPos
SetScrollPos
UnhookWindowsHookEx
GetMenuState
GetMenuStringA
InsertMenuA
RemoveMenu
GetActiveWindow
DialogBoxParamA
SetDlgItemTextA
SetWindowTextA
EndDialog
SetFocus
GetDlgCtrlID
LoadStringA
IsChild
ChildWindowFromPointEx
MsgWaitForMultipleObjects
GetIconInfo
CreateIconIndirect
CreateIconFromResource
GetCapture
FrameRect
EqualRect
UnionRect
SetDlgItemInt
IsRectEmpty
CharLowerBuffW
GrayStringA
DrawTextExA
DrawTextA
GetClassLongA
WindowFromDC
SetWindowLongA
ReuseDDElParam
UnpackDDElParam
LockWindowUpdate
ScreenToClient
GetClipboardData
OemToCharBuffA
GetFocus
PostQuitMessage
SetParent
GetDC
DrawFocusRect
DrawFrameControl
DrawStateA
DrawIconEx
SystemParametersInfoA
GetSubMenu
GetMenuItemInfoA
GetMenuItemID
GetMenuItemCount
DrawEdge
InflateRect
CopyRect
EnumWindows
GetWindowTextA
EnumChildWindows
GetKeyState
FlashWindow
KillTimer
SetTimer
FillRect
OffsetRect
IsCharLowerA
MapVirtualKeyA
GetKeyNameTextA
GetKeyboardLayoutList
MapVirtualKeyExW
ToUnicodeEx
MapVirtualKeyExA
ToAsciiEx
VkKeyScanExW
GetKeyboardLayout
VkKeyScanExA
wsprintfW
LoadAcceleratorsA
TranslateAcceleratorA
PeekMessageA
TranslateMessage
DispatchMessageA
CharLowerBuffA
CharUpperBuffA
GetQueueStatus
CharLowerA
GetCursorPos
GetSysColor
CreatePopupMenu
OemToCharA
CharLowerW
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
GetWindowLongA
GetClassNameA
SendMessageTimeoutA
SetWindowPos
ReleaseCapture
SetCursor
LoadImageA
RegisterWindowMessageA
SetForegroundWindow
ChildWindowFromPoint
IsDlgButtonChecked
IsDialogMessageA
MoveWindow
ShowWindow
ScrollWindowEx
DestroyMenu
ValidateRect
GetMessageA
ShowOwnedPopups
GetSysColorBrush
UnregisterClassA
GetDialogBaseUnits
DeleteMenu
BringWindowToTop
InsertMenuItemA
GetMenuBarInfo
SetRectEmpty
LoadMenuA
SetCapture
ClientToScreen
GetClientRect
IsIconic
GetSystemMenu
AppendMenuA
DrawIcon
WindowFromPoint
GetParent
GetWindow
PtInRect
IsWindowVisible
IsWindow
GetWindowRect
GetWindowDC
GetSystemMetrics
ReleaseDC
DestroyIcon
DestroyCursor
FindWindowA
MessageBeep
MessageBoxA
GetWindowThreadProcessId
IsCharAlphaNumericA
CharUpperA
wsprintfA
InvalidateRgn
InvalidateRect
UpdateWindow
PostMessageA
GetDlgItem
LoadBitmapA
LoadCursorA
EnableWindow
LoadIconA
SendMessageA
RedrawWindow
SetRect
GetDCEx
TabbedTextOutA
gdi32
PtVisible
Escape
CombineRgn
SetRectRgn
CreateRectRgnIndirect
GetDCOrgEx
CreateHatchBrush
ExtCreatePen
PlayMetaFile
EnumMetaFile
GetObjectType
PlayMetaFileRecord
CreatePatternBrush
CreateDIBPatternBrushPt
ExtSelectClipRgn
PolyBezierTo
PolylineTo
PolyDraw
ArcTo
GetCurrentPositionEx
ScaleWindowExtEx
SetWindowExtEx
OffsetWindowOrgEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
GetPixel
SelectClipPath
GetClipRgn
SelectClipRgn
RectVisible
SetArcDirection
SetMapperFlags
SetTextCharacterExtra
SetTextJustification
SetTextAlign
MoveToEx
LineTo
OffsetClipRgn
IntersectClipRect
ExcludeClipRect
GetClipBox
SetMapMode
ModifyWorldTransform
SetWorldTransform
SetTextColor
SetStretchBltMode
SetPolyFillMode
SetBkMode
SetBkColor
RestoreDC
SaveDC
CreateDCA
CopyMetaFileA
Polygon
SetGraphicsMode
GetNearestColor
GetCurrentObject
Ellipse
SetROP2
CreatePen
SelectObject
GetStockObject
Rectangle
SetColorAdjustment
DeleteObject
ExtTextOutA
LPtoDP
DPtoLP
GetWindowExtEx
GetViewportExtEx
GetMapMode
GetBkColor
CreateRectRgn
SelectPalette
RealizePalette
StretchDIBits
GetTextMetricsA
SetAbortProc
StartDocA
StartPage
TextOutA
EndPage
EndDoc
DeleteDC
CreateDIBSection
GetDeviceCaps
GetSystemPaletteEntries
CreatePalette
GetTextExtentPoint32A
PatBlt
GetTextColor
CreateBitmap
CreateFontA
CreateDIBitmap
GetViewportOrgEx
SetViewportOrgEx
CreateSolidBrush
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
CreateFontIndirectA
GetObjectA
GetCharWidthA
comdlg32
GetFileTitleA
PrintDlgA
winspool.drv
DocumentPropertiesA
ClosePrinter
OpenPrinterA
advapi32
RegOpenKeyA
RegSetValueA
RegDeleteKeyA
RegEnumValueA
RegEnumKeyA
RegQueryInfoKeyA
RegDeleteValueA
RegFlushKey
RegSetValueExA
RegCreateKeyA
RegQueryValueExA
GetUserNameW
RegConnectRegistryA
GetFileSecurityA
SetFileSecurityA
RegCreateKeyExA
RegSaveKeyA
GetSecurityDescriptorDacl
DeleteAce
GetSecurityDescriptorOwner
RegSetKeySecurity
RegOpenKeyExA
RegGetKeySecurity
RegCloseKey
InitializeSecurityDescriptor
SetSecurityDescriptorOwner
InitializeAcl
AddAccessAllowedAce
GetAce
SetSecurityDescriptorDacl
LookupPrivilegeValueA
AdjustTokenPrivileges
LookupAccountSidA
LookupAccountNameA
LookupAccountSidW
OpenThreadToken
OpenProcessToken
GetTokenInformation
EqualSid
AllocateAndInitializeSid
GetUserNameA
CryptExportKey
CryptDecrypt
CryptDeriveKey
CryptSetHashParam
CryptEnumProvidersA
CryptGetKeyParam
CryptGetProvParam
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptAcquireContextA
CryptImportKey
CryptReleaseContext
CryptSetKeyParam
CryptEncrypt
CryptDestroyKey
IsValidSid
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
FreeSid
GetLengthSid
CopySid
RegQueryValueA
shell32
DragQueryFileA
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetDesktopFolder
SHFileOperationA
SHGetFileInfoA
ExtractIconA
ShellExecuteA
DragFinish
shlwapi
PathFindExtensionA
PathRemoveExtensionA
UrlUnescapeA
PathFindFileNameA
PathStripToRootA
PathRemoveFileSpecW
PathIsUNCA
ole32
CoUninitialize
CoInitialize
CLSIDFromString
CoTaskMemFree
CoCreateInstance
CoTaskMemAlloc
CoInitializeEx
PropVariantClear
SetConvertStg
WriteFmtUserTypeStg
WriteClassStg
OleRegGetUserType
ReadFmtUserTypeStg
ReadClassStg
StringFromCLSID
CoTreatAsClass
CreateBindCtx
ReleaseStgMedium
OleDuplicateData
StringFromGUID2
CoDisconnectObject
oleaut32
SafeArrayAccessData
VarCyFromStr
VarDecFromStr
VarBstrFromDec
VarBstrFromCy
SysReAllocStringLen
SafeArrayDestroyDescriptor
SafeArrayDestroyData
SafeArrayDestroy
SafeArrayUnlock
SafeArrayLock
SafeArrayPutElement
SafeArrayPtrOfIndex
SafeArrayGetElement
SafeArrayCopy
SafeArrayAllocDescriptor
SafeArrayAllocData
VariantCopy
SafeArrayRedim
SafeArrayCreate
SafeArrayGetDim
SafeArrayGetElemsize
SafeArrayGetLBound
SafeArrayGetUBound
SysStringLen
VarBstrCmp
SysFreeString
VariantClear
SysAllocStringLen
VarDateFromStr
VarBstrFromDate
VariantTimeToSystemTime
SystemTimeToVariantTime
SysAllocString
SysAllocStringByteLen
SysStringByteLen
VariantChangeType
VariantInit
RegisterTypeLi
LoadTypeLi
LoadRegTypeLi
SafeArrayUnaccessData
GetErrorInfo
SetErrorInfo
CreateErrorInfo
rasapi32
RasGetErrorStringA
RasEnumEntriesA
RasGetEntryPropertiesA
RasGetEntryDialParamsA
ws2_32
gethostname
socket
htons
bind
getsockname
listen
inet_ntoa
accept
closesocket
send
inet_addr
gethostbyaddr
WSAStartup
gethostbyname
WSACleanup
connect
WSAGetLastError
ioctlsocket
setsockopt
recv
getservbyname
wininet
GopherOpenFileA
InternetConnectA
FtpFindFirstFileA
GopherCreateLocatorA
FtpCommandA
FtpOpenFileA
GopherGetAttributeA
HttpSendRequestExA
HttpEndRequestA
HttpSendRequestA
InternetOpenUrlA
InternetWriteFile
InternetSetFilePointer
InternetSetStatusCallback
InternetOpenA
InternetGetLastResponseInfoA
GopherFindFirstFileA
InternetCloseHandle
HttpAddRequestHeadersA
InternetErrorDlg
FtpGetFileA
FtpPutFileA
HttpOpenRequestA
InternetReadFile
FtpGetCurrentDirectoryA
FtpSetCurrentDirectoryA
FtpRemoveDirectoryA
FtpCreateDirectoryA
FtpRenameFileA
FtpDeleteFileA
HttpQueryInfoA
InternetQueryDataAvailable
InternetGetCookieA
InternetSetCookieA
InternetSetOptionExA
InternetQueryOptionA
InternetCanonicalizeUrlA
InternetCrackUrlA
InternetAutodial
InternetFindNextFileA
Sections
.text Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 504KB - Virtual size: 503KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 28KB - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 748KB - Virtual size: 747KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ