2024-05-12_b740ea05aaac4bb8c5c8c2284c3bece4_icedid

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-12_b740ea05aaac4bb8c5c8c2284c3bece4_icedid
Size

4.4MB
MD5

b740ea05aaac4bb8c5c8c2284c3bece4
SHA1

735503efdb0f1807ec682aaa87ffd465959dc0ac
SHA256

5c9d789a066819be348334552acbbe7f7bc05ef664918773b451f3e07df041d4
SHA512

d8fb89365072d71ee8115c58a5d22f16b59dcebf5ff1293f60a67035f53541741e67260bbc9640e91f93bbe8deb1940ae431b3df6945f15fd32767b41ef9b17c
SSDEEP

98304:ab5g3FFhQpqvlHXy8Ysgq90NE6wHAxUI2IC96sUUg834:alg3FFGwDmwRI2YsUUg834

Score

1^/10

Malware Config

Signatures

Files

2024-05-12_b740ea05aaac4bb8c5c8c2284c3bece4_icedid
.exe windows:5 windows x86 arch:x86

6f854db210eb3ad183dd607f776e11d7

Code Sign

07
Certificate

Issuer

CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

03/05/2011, 07:00

Not After

03/05/2031, 07:00

Subject

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:0d:8e:7b:88:93:ab
Certificate

Issuer

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

04/04/2014, 09:08

Not After

04/04/2017, 09:08

Subject

CN=Parallels International GmbH,O=Parallels International GmbH,L=Schaffhausen,ST=Schaffhausen,C=CH

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

ed:6c:85:8e:64:95:34:6d:08:96:11:70:05:50:d7:c9:78:2b:39:b2
Signer

Actual PE Digest

ed:6c:85:8e:64:95:34:6d:08:96:11:70:05:50:d7:c9:78:2b:39:b2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Projects\2X\Bin\Release-Unicode\AppServer\Binaries\2XVDSAgent.pdb

Imports

kernel32

HeapValidate
LockFileEx
CreateFileMappingA
GetDiskFreeSpaceA
OutputDebugStringA
AreFileApisANSI
VirtualUnlock
VirtualLock
SetLastError
FormatMessageA
WaitForSingleObject
GetCurrentThread
DuplicateHandle
SetConsoleCtrlHandler
GetModuleFileNameW
GlobalMemoryStatusEx
InterlockedDecrement
InterlockedIncrement
lstrlenW
GetComputerNameW
GetLastError
DeleteFileW
GetFileAttributesW
FormatMessageW
LocalFree
GetTickCount
InterlockedCompareExchange
SetUnhandledExceptionFilter
LoadLibraryW
GetLocalTime
LoadLibraryA
GetProcAddress
CreateDirectoryW
CreateFileW
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
CloseHandle
CreateProcessW
FindResourceW
LoadResource
LockResource
SizeofResource
WideCharToMultiByte
Sleep
MultiByteToWideChar
GetFullPathNameA
SetEnvironmentVariableA
CreateFileA
PeekNamedPipe
GetFileInformationByHandle
GetFileAttributesA
WriteConsoleW
GetStartupInfoW
SetHandleCount
GetStringTypeW
GetStdHandle
HeapDestroy
HeapCreate
IsProcessorFeaturePresent
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
IsDebuggerPresent
UnhandledExceptionFilter
GetFileType
SetStdHandle
ExitProcess
ExitThread
HeapSize
HeapQueryInformation
VirtualQuery
VirtualAlloc
RtlUnwind
RaiseException
FindFirstFileExW
GetDriveTypeW
HeapSetInformation
GetCommandLineW
GetConsoleMode
GetConsoleCP
GetCPInfo
GetDateFormatW
GetTimeFormatW
HeapReAlloc
GetSystemTimeAsFileTime
DecodePointer
EncodePointer
FindResourceExW
GetDiskFreeSpaceW
VirtualProtect
SearchPathW
GetProfileIntW
InitializeCriticalSectionAndSpinCount
GetNumberFormatW
GetWindowsDirectoryW
lstrcpyW
GetUserDefaultUILanguage
GetLocaleInfoW
InterlockedExchange
UnlockFileEx
OutputDebugStringW
HeapCompact
QueryPerformanceCounter
ResumeThread
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
WaitForSingleObjectEx
ReleaseMutex
CreateMutexW
OpenEventW
SetEvent
GetModuleHandleW
GetPrivateProfileStringW
WritePrivateProfileStringW
GetSystemTime
MoveFileW
CreateThread
TlsAlloc
TlsSetValue
TlsGetValue
TlsFree
GetVersionExW
GetTempPathW
GetTempFileNameW
FindFirstFileW
FindClose
CopyFileW
CreateEventW
GetVersionExA
VerSetConditionMask
VerifyVersionInfoW
CreateFileMappingW
MapViewOfFile
OpenFileMappingW
UnmapViewOfFile
lstrlenA
GetTimeZoneInformation
LocalAlloc
FreeLibrary
GetSystemDefaultLangID
GlobalLock
GlobalUnlock
GlobalFree
GlobalAlloc
HeapAlloc
GetProcessHeap
HeapFree
GetFileSize
GetCurrentDirectoryW
lstrcmpiW
GetEnvironmentStringsW
FreeEnvironmentStringsW
TerminateProcess
GetTempPathA
DeleteFileA
GetSystemInfo
GetTempFileNameA
MulDiv
GlobalSize
lstrcmpA
DeactivateActCtx
ActivateActCtx
ReadFile
WriteFile
SetFilePointer
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
GetVolumeInformationW
GetFullPathNameW
lstrcmpW
CompareStringW
GlobalDeleteAtom
GlobalFindAtomW
GlobalAddAtomW
FreeResource
ReleaseActCtx
GlobalGetAtomNameW
FileTimeToSystemTime
SystemTimeToFileTime
GlobalReAlloc
GlobalHandle
LocalReAlloc
GetFileAttributesExW
FileTimeToLocalFileTime
GetFileSizeEx
GetFileTime
GlobalFlags
SetThreadPriority

user32

WaitMessage
DefFrameProcW
DefMDIChildProcW
DrawMenuBar
TranslateMDISysAccel
CreateMenu
SetMenuDefaultItem
IsClipboardFormatAvailable
FrameRect
GetUpdateRect
RegisterClipboardFormatW
CopyIcon
CharUpperBuffW
GetDoubleClickTime
SubtractRect
MapDialogRect
DrawIcon
DestroyCursor
GetWindowRgn
GetKeyState
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
ShowScrollBar
UpdateWindow
GetClientRect
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
ScreenToClient
EqualRect
PostThreadMessageW
GetScrollInfo
SetScrollInfo
SetWindowPlacement
GetWindowPlacement
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
GetMenu
SetWindowLongW
RedrawWindow
NotifyWinEvent
GetParent
InvalidateRect
DrawFocusRect
FillRect
LoadBitmapW
CharUpperW
GetMenuState
GetMenuStringW
AppendMenuW
GetMenuItemID
InsertMenuW
GetMenuItemCount
GetSubMenu
RemoveMenu
KillTimer
SetTimer
DeleteMenu
LoadIconW
LoadCursorW
SetCursor
PtInRect
GetWindowRect
GetWindowLongW
GetSysColor
CopyRect
DestroyIcon
SendDlgItemMessageW
PostMessageW
IsMenu
MonitorFromPoint
UpdateLayeredWindow
UnionRect
MapVirtualKeyExW
IsCharLowerW
EmptyClipboard
CloseClipboard
SetClipboardData
OpenClipboard
GetMenuDefaultItem
LockWindowUpdate
SetCursorPos
CreateAcceleratorTableW
GetKeyboardState
GetKeyboardLayout
ToUnicodeEx
CopyAcceleratorTableW
DrawFrameControl
DrawEdge
DrawStateW
TrackPopupMenu
SetClassLongW
DestroyAcceleratorTable
SetParent
SetWindowRgn
IsZoomed
WindowFromPoint
SetRect
UnpackDDElParam
ReuseDDElParam
LoadAcceleratorsW
InsertMenuItemW
TranslateAcceleratorW
IsIconic
DrawIconEx
GetNextDlgGroupItem
LoadImageW
CopyImage
GetIconInfo
OffsetRect
MessageBeep
EnableScrollBar
HideCaret
InvertRect
ReleaseCapture
GetAsyncKeyState
SetCapture
IsRectEmpty
CreatePopupMenu
DeferWindowPos
SetLayeredWindowAttributes
EnumDisplayMonitors
ShowOwnedPopups
SetRectEmpty
IntersectRect
GetClassNameW
GetWindowThreadProcessId
ReleaseDC
GetDC
EnableWindow
GetDlgItem
BringWindowToTop
SetForegroundWindow
SetWindowPos
GetLastActivePopup
MessageBoxW
IsWindowVisible
IsWindow
SendMessageW
GetSystemMetrics
DispatchMessageW
PeekMessageW
PostQuitMessage
GetMessageW
TranslateMessage
GetCursorPos
ValidateRect
RealChildWindowFromPoint
SystemParametersInfoW
DestroyMenu
GetMenuItemInfoW
InflateRect
GetSysColorBrush
LoadMenuW
MapVirtualKeyW
GetKeyNameTextW
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
ModifyMenuW
EnableMenuItem
CheckMenuItem
ShowWindow
MoveWindow
SetWindowTextW
IsDialogMessageW
CheckDlgButton
GetDesktopWindow
GetActiveWindow
CreateDialogIndirectParamW
IsWindowEnabled
GetNextDlgTabItem
EndDialog
RegisterWindowMessageW
SendDlgItemMessageA
WinHelpW
IsChild
GetCapture
SetWindowsHookExW
CallNextHookEx
GetClassLongW
SetPropW
GetPropW
RemovePropW
GetFocus
SetFocus
GetWindowTextLengthW
GetWindowTextW
GetForegroundWindow
SetActiveWindow
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
MonitorFromWindow
GetMonitorInfoW
MapWindowPoints
ScrollWindow
GetWindow
wsprintfW
GetSystemMenu

oleaut32

SysFreeString
GetErrorInfo
VarBstrFromDate
SysStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
VariantInit
VariantClear
SysAllocStringLen
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayLock
SafeArrayUnlock
SysAllocString
SafeArrayCreate
SafeArrayDestroy
VariantChangeType

vdiprovider

VDIFreePoolList
VDIGetHostInfo
VDICreateFolderList
VDIGetPhysicalHostList
VDIIsValidCloneFolder
VDIGetProviderAvailableRemotely
VDICreatePhysicalHostList
VDIGetFolderList
VDIFreeFolderList
VDIFreePhysicalHostList
VDIGetProvidersAvailable
VDIInit
VDIConvertGuest
VDICloneGuest
VDIControlGuest
VDIConnectToHost
VDIGetPoolList
VDICreatePoolList
VDIDisConnectFromHost
VDIGetLastError
VDISetHostEventCallback
VDIGetGuestOSInfo
VDISetGuestOSEventCallback
CloseVDICacheThread
VDIRemoveGuestOSEventCallback
VDIFreeGuestOSList
VDIGetGuestOSList

msimg32

AlphaBlend
TransparentBlt

comctl32

ImageList_GetIconSize

shlwapi

PathRemoveFileSpecW
PathFindExtensionW
PathFindFileNameW
PathIsUNCW
PathStripToRootW
StrCpyW
PathAppendW

gdiplus

GdipCreateBitmapFromHBITMAP
GdiplusStartup
GdiplusShutdown
GdipCreateFromHDC
GdipSetInterpolationMode
GdipDisposeImage
GdipCloneImage
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipGetImagePaletteSize
GdipGetImagePalette
GdipDeleteGraphics
GdipDrawImageRectI
GdipAlloc
GdipFree
GdipDrawImageI
GdipGetImageGraphicsContext
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream

ws2_32

send
closesocket
__WSAFDIsSet
socket
getsockopt
listen
accept
bind
recv
sendto
gethostbyname
getnameinfo
freeaddrinfo
getaddrinfo
getpeername
getsockname
setsockopt
ntohs
WSAIoctl
WSASetLastError
inet_addr
connect
WSAStartup
recvfrom
ntohl
select
inet_ntoa
shutdown
WSAGetLastError
WSAStringToAddressW
ioctlsocket
htonl
htons

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

pdh

PdhOpenQueryW
PdhCollectQueryData
PdhRemoveCounter
PdhCloseQuery
PdhAddCounterW
PdhGetFormattedCounterValue
PdhLookupPerfNameByIndexW

iphlpapi

GetAdaptersInfo

ssleay32

ord314
ord157
ord111
ord6
ord35
ord182
ord61
ord58
ord141
ord75
ord222
ord17
ord96
ord24
ord235
ord12
ord108
ord48
ord8
ord78
ord225
ord183
ord142
ord73
ord242
ord76
ord83
ord42
ord74
ord90
ord16
ord43
ord21
ord166
ord87
ord52
ord84
ord77
ord110
ord341
ord172
ord116
ord5
ord30
ord343
ord315
ord171
ord118
ord112
ord31

libeay32

ord395
ord965
ord2201
ord3836
ord3846
ord107
ord3823
ord286
ord1010
ord576
ord567
ord639
ord653
ord585
ord3205
ord654
ord2784
ord2747
ord3019
ord3873
ord3212
ord964
ord258
ord464
ord257
ord3816
ord3844
ord259
ord256
ord1795
ord315
ord298
ord3877
ord2572
ord2623
ord2254
ord485
ord2291
ord202
ord200
ord66
ord223
ord3050
ord680
ord484
ord2442
ord364
ord1178
ord909
ord566
ord89
ord1653
ord82
ord1654
ord248
ord469
ord656
ord109
ord578
ord1186
ord204
ord84
ord648
ord579
ord222
ord181
ord544
ord467
ord254
ord227
ord641
ord652
ord2206
ord657
ord363
ord333

oleacc

AccessibleObjectFromWindow
CreateStdAccessibleObject
LresultFromObject

imm32

ImmReleaseContext
ImmGetOpenStatus
ImmGetContext

winmm

PlaySoundW

gdi32

GetLayout
SetTextAlign
MoveToEx
LineTo
IntersectClipRect
ExcludeClipRect
GetClipBox
SetMapMode
SetROP2
SetPolyFillMode
SetBkMode
RestoreDC
SaveDC
CreateBitmap
GetTextMetricsW
BitBlt
GetObjectW
CreateDCW
CopyMetaFileW
GetDeviceCaps
SetBkColor
SetTextColor
CreateSolidBrush
DeleteObject
SetLayout
SelectObject
CreateDIBSection
CreateCompatibleDC
SelectClipRgn
GetTextFaceW
SetPixelV
SetPaletteEntries
ExtFloodFill
GetBoundsRect
CreateRectRgn
GetViewportExtEx
GetWindowExtEx
FrameRgn
FillRgn
PtInRegion
GetViewportOrgEx
GetWindowOrgEx
LPtoDP
EnumFontFamiliesExW
GetRgnBox
OffsetRgn
PtVisible
RectVisible
Rectangle
SetPixel
StretchBlt
GetPixel
SetDIBColorTable
Polygon
Ellipse
Polyline
CreateEllipticRgn
GetTextColor
CreatePolygonRgn
CreateRoundRectRgn
GetSystemPaletteEntries
RealizePalette
GetNearestPaletteIndex
GetPaletteEntries
CreatePalette
GetBkColor
GetTextCharsetInfo
EnumFontFamiliesW
CreateDIBitmap
CreateCompatibleBitmap
DPtoLP
CombineRgn
SetRectRgn
GetTextExtentPoint32W
CreateFontIndirectW
PatBlt
CreateRectRgnIndirect
CreateHatchBrush
CreatePen
GetObjectType
SelectPalette
GetStockObject
CreatePatternBrush
DeleteDC
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
OffsetWindowOrgEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
Escape
ExtTextOutW
TextOutW

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

comdlg32

GetFileTitleW

advapi32

InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegisterEventSourceW
ReportEventW
DeregisterEventSource
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
RegSetValueExW
GetUserNameA
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
SetServiceStatus
RegisterServiceCtrlHandlerW
StartServiceCtrlDispatcherW
DeleteService
ControlService
OpenServiceW
CloseServiceHandle
StartServiceW
ChangeServiceConfig2W
CreateServiceW
OpenSCManagerW

shell32

SHAppBarMessage
SHBrowseForFolderW
DragQueryFileW
DragFinish
SHGetSpecialFolderLocation
SHGetDesktopFolder
ShellExecuteW
SHGetFileInfoW
SHGetPathFromIDListW

ole32

CoCreateInstance
CoInitialize
RevokeDragDrop
CoLockObjectExternal
RegisterDragDrop
OleGetClipboard
DoDragDrop
OleLockRunning
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
CreateStreamOnHGlobal
OleDuplicateData
CoTaskMemAlloc
ReleaseStgMedium
CoInitializeEx
CoInitializeSecurity
CoUninitialize
CoTaskMemFree

Sections

.text
Size: 3.8MB - Virtual size: 3.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 555KB - Virtual size: 555KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 30KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6f854db210eb3ad183dd607f776e11d7

Code Sign

07Certificate

Key Usages

04:0d:8e:7b:88:93:abCertificate

Extended Key Usages

Key Usages

ed:6c:85:8e:64:95:34:6d:08:96:11:70:05:50:d7:c9:78:2b:39:b2Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

oleaut32

vdiprovider

msimg32

comctl32

shlwapi

gdiplus

ws2_32

version

pdh

iphlpapi

ssleay32

libeay32

oleacc

imm32

winmm

gdi32

winspool.drv

comdlg32

advapi32

shell32

ole32

Sections

.text Size: 3.8MB - Virtual size: 3.8MB

.rdata Size: 555KB - Virtual size: 555KB

.data Size: 30KB - Virtual size: 66KB

.rsrc Size: 1KB - Virtual size: 1KB

07
Certificate

04:0d:8e:7b:88:93:ab
Certificate

ed:6c:85:8e:64:95:34:6d:08:96:11:70:05:50:d7:c9:78:2b:39:b2
Signer

.text
Size: 3.8MB - Virtual size: 3.8MB

.rdata
Size: 555KB - Virtual size: 555KB

.data
Size: 30KB - Virtual size: 66KB

.rsrc
Size: 1KB - Virtual size: 1KB