2024-05-03_d3c11a926f4bbcb20b5d6520a4fccfc5_icedid

General

Target

2024-05-03_d3c11a926f4bbcb20b5d6520a4fccfc5_icedid
Size

3.6MB
MD5

d3c11a926f4bbcb20b5d6520a4fccfc5
SHA1

280f211e9f0cc2e1ff6b2b82f5b9008983df81c3
SHA256

dba109ec599a64127abd5ca60f3ca392c03dd5025d399cc7c5df119ff393252e
SHA512

6671abed79dd94043ef376f094f986b0e3b2021bba0817696670a9e2086c251d761e7bf42b9848452b366f75aaae41a5c69e676a6d56f39a3eef686343cae4b8
SSDEEP

49152:7tBGSVDGEakouOgWs3Ho2f+5D1TU+SxbKxWIqwLn45+u+InoDw49CTO7dzT1:RBGgDGEakouJWsHW5Dd9xPDvTqeCTO7

Score

10^/10

Detects executables packed with VMProtect. 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_VMProtect

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

Patched UPX-packed file 1 IoCs

Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.

resource	yara_rule
sample	patched_upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-03_d3c11a926f4bbcb20b5d6520a4fccfc5_icedid