C:\Users\khala\source\repos\PhoneRetail\PhoneRetail\SmartRetail\obj\x86\Debug\SmartRetail.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-16_47c1207f173ebfcd980fb8fea616f161_icedid.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-16_47c1207f173ebfcd980fb8fea616f161_icedid.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-16_47c1207f173ebfcd980fb8fea616f161_icedid
-
Size
11.1MB
-
MD5
47c1207f173ebfcd980fb8fea616f161
-
SHA1
f6fa521905adc885a1d51e4cbf3a59615d9aa0ae
-
SHA256
7812dc40411e65f9dd31b1e1ba57a5ed331e01c538fcff0efa186b70c9f56650
-
SHA512
6aadff4d7ec0f0c286ff0c42cc11b4716a698de309228498296a398b891e84d5804387db4c5526ff91042353cba18bf6d6e591e2e942e65894d8ecbcd86ae48e
-
SSDEEP
196608:XnW7RWtE7cWBWv90i5tth4if1IwmtlqdCemdxwAyXCs6BocvL0eh1iflt4uhLOVu:XsI3QCb
Malware Config
Signatures
-
Detects executables calling ClearMyTracksByProcess 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-05-16_47c1207f173ebfcd980fb8fea616f161_icedid
Files
-
2024-05-16_47c1207f173ebfcd980fb8fea616f161_icedid.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
mscoree
_CorExeMain
Sections
.text Size: 11.1MB - Virtual size: 11.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ