2024-05-11_0d0275b1b7a3388846dfd7dece33b5f4_icedid

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-11_0d0275b1b7a3388846dfd7dece33b5f4_icedid
Size

276KB
MD5

0d0275b1b7a3388846dfd7dece33b5f4
SHA1

bda6cbfc860e6fb1ee705328df27b77047fe9930
SHA256

a3839f566fef011da37977e940ff1e739087da618023e068508edc6a719003e2
SHA512

ba167634b50caf7732a6cbf2a6b00db6236362406a9a44dca1d936e7875b2a910eeee12ad1d25d4c57e8ce3273ec6a4bd3383d50b4bfb81c640e63371b21eb5f
SSDEEP

6144:S5A9qzzzLBd9NL49zid4f0VNPe17sUOFuV5:b9OzzLBd3s9+d8sUOF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-11_0d0275b1b7a3388846dfd7dece33b5f4_icedid

Files

2024-05-11_0d0275b1b7a3388846dfd7dece33b5f4_icedid
.exe windows:4 windows x86 arch:x86

aea75e15f7d5f81196dc895d649b85a9

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\JinZQ\源代码-工作欢熊\工作源代码-翟文君\Sdk22\Captiv8\bin\Release\C8HookGame.pdb

Imports

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

wininet

InternetCrackUrlA
InternetReadFile
HttpQueryInfoA
InternetOpenUrlA
InternetCloseHandle
InternetOpenA
InternetGetConnectedState
InternetCanonicalizeUrlA

winmm

timeGetTime

c8gamesdk

c8GameSDK_QueryAdEx
c8GameSDK_Init
c8GameSDK_Close

kernel32

TlsFree
FlushFileBuffers
SetEndOfFile
GetCurrentProcess
GetFullPathNameA
GetCPInfo
GetOEMCP
SetErrorMode
RtlUnwind
ExitProcess
HeapFree
HeapAlloc
VirtualProtect
LocalReAlloc
GetSystemInfo
VirtualQuery
GetSystemTimeAsFileTime
GetStartupInfoA
GetCommandLineA
TerminateProcess
HeapReAlloc
HeapSize
SetStdHandle
GetFileType
QueryPerformanceCounter
SetUnhandledExceptionFilter
HeapDestroy
HeapCreate
VirtualFree
IsBadWritePtr
LCMapStringA
LCMapStringW
GetTimeZoneInformation
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetDriveTypeA
GetStringTypeA
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
GetLocaleInfoW
SetEnvironmentVariableA
TlsSetValue
TlsAlloc
TlsGetValue
GlobalHandle
GlobalReAlloc
GlobalFlags
InterlockedIncrement
LeaveCriticalSection
EnterCriticalSection
LocalAlloc
GlobalGetAtomNameA
GlobalFindAtomA
lstrcmpW
InterlockedDecrement
MulDiv
FormatMessageA
LocalFree
GlobalFree
FreeResource
WaitForSingleObject
GlobalAddAtomA
GetCurrentThread
GetCurrentThreadId
GlobalAlloc
GlobalDeleteAtom
lstrcmpA
GetModuleHandleA
ConvertDefaultLocale
EnumResourceLanguagesA
CopyFileA
FindFirstFileA
SetLastError
lstrcpynA
FindNextFileA
FindClose
GetFileAttributesA
SetFilePointer
ReadFile
CreateFileA
GlobalLock
WriteFile
GlobalUnlock
GetCurrentDirectoryA
SetCurrentDirectoryA
FreeLibrary
CreateDirectoryA
DeleteFileA
GetPrivateProfileStringA
SetFileAttributesA
CreateProcessA
RemoveDirectoryA
MoveFileExA
CompareStringW
CompareStringA
lstrcmpiA
GetVersion
DeleteCriticalSection
InitializeCriticalSection
RaiseException
MultiByteToWideChar
lstrcatA
lstrlenA
WinExec
lstrcpyA
Sleep
GetCurrentProcessId
GetTickCount
CreateThread
WritePrivateProfileStringA
GetPrivateProfileIntA
CloseHandle
GetModuleFileNameA
WideCharToMultiByte
FindResourceA
LoadResource
LockResource
SizeofResource
LoadLibraryA
GetLastError
GetProcAddress
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
VirtualAlloc

user32

LoadCursorA
EndPaint
BeginPaint
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
ShowWindow
SetWindowTextA
IsDialogMessageA
RegisterWindowMessageA
WinHelpA
GetCapture
CreateWindowExA
GetClassLongA
GetClassInfoExA
GetClassNameA
SetPropA
GetPropA
RemovePropA
SetFocus
GetWindowTextA
GetForegroundWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetForegroundWindow
GetMenu
GetSysColor
AdjustWindowRectEx
ScreenToClient
GetClassInfoA
RegisterClassA
SetWindowPlacement
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
SetWindowLongA
SetWindowPos
SystemParametersInfoA
GetWindowPlacement
CopyRect
PtInRect
UnhookWindowsHookEx
GetMenuItemID
GetMenuItemCount
GetSubMenu
wsprintfA
GetDesktopWindow
SetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
GetDlgItem
GetNextDlgTabItem
EndDialog
SetMenuItemBitmaps
GetFocus
ModifyMenuA
GetMenuState
EnableMenuItem
CheckMenuItem
GetMenuCheckMarkDimensions
LoadBitmapA
SetWindowsHookExA
CallNextHookEx
GetMessageA
TranslateMessage
DispatchMessageA
GetActiveWindow
GetKeyState
PeekMessageA
GetCursorPos
ValidateRect
MessageBoxA
GetParent
GetWindowLongA
GetLastActivePopup
IsWindowEnabled
SetCursor
PostQuitMessage
PostMessageA
UpdateWindow
SendDlgItemMessageA
SetDlgItemTextA
UnregisterClassA
DestroyMenu
GetTopWindow
IsWindowVisible
InvalidateRect
ReleaseDC
GetDC
GetWindowRect
GetWindow
IsWindow
GetSystemMetrics
GetSysColorBrush
EnableWindow
LoadIconA
GetClientRect
IsIconic
SendMessageA
DrawIcon

gdi32

ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
DeleteDC
GetStockObject
SetViewportExtEx
DeleteObject
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
RestoreDC
SaveDC
SetBkColor
SetTextColor
GetClipBox
GetDeviceCaps
CreateBitmap
GetRgnBox
GetPixel
CreateCompatibleDC
CombineRgn
CreateRectRgn
GetObjectA
SetMapMode

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter

advapi32

RegQueryValueA
RegOpenKeyExA
RegQueryValueExA
RegDeleteKeyA
RegEnumKeyA
RegOpenKeyA
RegCreateKeyExA
RegSetValueExA
RegCloseKey

shell32

ShellExecuteA

comctl32

ord17

shlwapi

PathFindFileNameA
UrlUnescapeA
PathFindExtensionA

oleaut32

VariantInit
VariantChangeType
VariantClear

ws2_32

WSAGetLastError
select
sendto
socket
recvfrom
closesocket
gethostbyname
WSAStartup
getprotobyname
setsockopt
connect
htons
recv
send
inet_addr
WSACleanup

Sections

.text
Size: 164KB - Virtual size: 161KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 60KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

aea75e15f7d5f81196dc895d649b85a9

Headers

File Characteristics

PDB Paths

Imports

version

wininet

winmm

c8gamesdk

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oleaut32

ws2_32

Sections

.text Size: 164KB - Virtual size: 161KB

.rdata Size: 40KB - Virtual size: 39KB

.data Size: 8KB - Virtual size: 22KB

.rsrc Size: 60KB - Virtual size: 57KB

.text
Size: 164KB - Virtual size: 161KB

.rdata
Size: 40KB - Virtual size: 39KB

.data
Size: 8KB - Virtual size: 22KB

.rsrc
Size: 60KB - Virtual size: 57KB