2024-05-17_c335ad80c4e4e9585a98f2bdba2f1346_icedid

Sharing

Copy URL

Twitter E-mail

General

Target

2024-05-17_c335ad80c4e4e9585a98f2bdba2f1346_icedid
Size

2.5MB
MD5

c335ad80c4e4e9585a98f2bdba2f1346
SHA1

5899050b7a6a27c5a6f83f6a445c63e17ad7fd43
SHA256

451e78b3954fe3c2f7f518e8c2f3548da988565f1e252e2f9af01334ec231fc1
SHA512

7231e1574c22e5983bc17c6a7067d12b6d8b63d8cfd91b24598172283c8598579d15e37fbdbb5eb3af6c15816a8c3c5ba559fae345fe83a5cf7e59d22204a143
SSDEEP

49152:NzLyyqrp5a+sX7JSMJPAkzWJpXfS9Ep/B3B:NG6JNJvzW7vX5B

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-17_c335ad80c4e4e9585a98f2bdba2f1346_icedid

Files

2024-05-17_c335ad80c4e4e9585a98f2bdba2f1346_icedid
.exe windows:4 windows x86 arch:x86

bb1b22c49c8ff1f476d15e73c0fc04d7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

p:\Projects\PCEFTPOS\EFTSRV-4-3-0-3\EftSrv\Release\Eftsrv.pdb

Imports

iphlpapi

GetAdaptersInfo

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

kernel32

WritePrivateProfileStringA
GetPrivateProfileStringA
GetModuleFileNameW
InterlockedDecrement
InterlockedIncrement
LocalAlloc
LeaveCriticalSection
TlsGetValue
EnterCriticalSection
GlobalReAlloc
GlobalHandle
InitializeCriticalSection
TlsAlloc
TlsSetValue
LocalReAlloc
DeleteCriticalSection
TlsFree
GetAtomNameA
GetThreadLocale
GlobalFlags
GetCPInfo
GetOEMCP
GetCurrentDirectoryA
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
GetVolumeInformationA
GetShortPathNameA
FindResourceExA
FileTimeToLocalFileTime
LocalFileTimeToFileTime
SetFileTime
SetFileAttributesA
GetFileTime
RtlUnwind
GetTimeFormatA
GetDateFormatA
VirtualAlloc
GetSystemInfo
VirtualQuery
GetPrivateProfileIntA
HeapFree
HeapReAlloc
RaiseException
ExitThread
GetCommandLineA
GetProcessHeap
GetStartupInfoA
UnhandledExceptionFilter
GetTimeZoneInformation
ExitProcess
SetConsoleCtrlHandler
GetDriveTypeA
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
PeekConsoleInputA
GetNumberOfConsoleInputEvents
HeapSize
TerminateProcess
IsDebuggerPresent
GetACP
GetStringTypeA
GetStringTypeW
FatalAppExitA
VirtualFree
HeapDestroy
HeapCreate
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetConsoleCP
SetStdHandle
LCMapStringA
LCMapStringW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
GetLocaleInfoW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileW
SetEnvironmentVariableA
VirtualProtect
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
lstrcmpW
lstrcmpA
SuspendThread
ResumeThread
FreeResource
GlobalFree
GlobalSize
GlobalAlloc
GlobalLock
GlobalUnlock
MulDiv
WaitForMultipleObjects
FlushConsoleInputBuffer
GlobalMemoryStatus
GetStdHandle
lstrcpynA
GetVersionExA
GetComputerNameA
WaitCommEvent
ClearCommError
EscapeCommFunction
GetOverlappedResult
GetCommConfig
SetCommConfig
SetCommMask
PurgeComm
SetPriorityClass
SystemTimeToFileTime
UnmapViewOfFile
DuplicateHandle
CreateFileMappingA
MapViewOfFile
GetFileType
GetFileInformationByHandle
GetFileSize
FileTimeToDosDateTime
FileTimeToSystemTime
QueryPerformanceCounter
QueryPerformanceFrequency
SetUnhandledExceptionFilter
GetLocalTime
GetCurrentProcessId
LoadLibraryA
GetCurrentProcess
GetThreadPriority
SetThreadPriority
TerminateThread
GetCurrentThreadId
CreateThread
ReleaseSemaphore
CreateSemaphoreA
ResetEvent
SetEvent
WaitForSingleObject
FindNextFileA
FindClose
GetFullPathNameA
CreateDirectoryA
GetSystemTimeAsFileTime
SetLastError
OutputDebugStringA
lstrcmpiA
lstrcmpiW
GetStringTypeExA
GetStringTypeExW
lstrlenW
CompareStringA
CompareStringW
GetEnvironmentVariableA
MultiByteToWideChar
InterlockedExchange
GetVersion
GetEnvironmentVariableW
LoadLibraryExA
FreeLibrary
GetFileAttributesA
CreateMutexA
SetCurrentDirectoryA
ReleaseMutex
PulseEvent
CopyFileA
ReadFile
MoveFileA
FindFirstFileA
WriteFile
CreateFileA
SetFilePointer
CloseHandle
DeleteFileA
SetErrorMode
CreateEventA
FormatMessageA
lstrlenA
LocalFree
GetModuleFileNameA
GetLastError
GetModuleHandleA
GetProcAddress
WideCharToMultiByte
LoadResource
LockResource
SizeofResource
FindResourceA
GetCommTimeouts
SetCommTimeouts
GetCommModemStatus
GetCommMask
Sleep
GetTickCount
HeapAlloc

user32

SetParent
UnionRect
SetRect
GetDCEx
LockWindowUpdate
DestroyIcon
ReleaseCapture
WindowFromPoint
SetCapture
DeleteMenu
GetDialogBaseUnits
LoadCursorA
GetSysColorBrush
MapVirtualKeyA
GetKeyNameTextA
DestroyMenu
GetMenuItemInfoA
InflateRect
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
FillRect
WaitMessage
MapDialogRect
GetAsyncKeyState
GetWindowThreadProcessId
ShowOwnedPopups
SetCursor
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
ModifyMenuA
EnableMenuItem
CheckMenuItem
PostQuitMessage
RegisterWindowMessageA
WinHelpA
IsChild
GetCapture
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
GetLastActivePopup
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
MapWindowPoints
ScrollWindow
TrackPopupMenuEx
TrackPopupMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
ShowScrollBar
IsRectEmpty
GetClientRect
GetMenu
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
GetSysColor
AdjustWindowRectEx
ScreenToClient
EqualRect
DeferWindowPos
CopyRect
GetScrollInfo
SetScrollInfo
PtInRect
SetWindowPlacement
DefWindowProcA
CallWindowProcA
OffsetRect
IntersectRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
SetWindowsHookExA
CallNextHookEx
GetMessageA
TranslateMessage
IsWindowVisible
GetKeyState
PeekMessageA
GetCursorPos
ValidateRect
GetWindowTextLengthA
GetFocus
SetWindowPos
ScrollWindowEx
SetFocus
MoveWindow
SetWindowLongA
GetDlgCtrlID
SetWindowTextA
IsDialogMessageA
IsDlgButtonChecked
SetDlgItemTextA
SetDlgItemInt
SendDlgItemMessageA
GetDlgItemTextA
GetDlgItemInt
CheckRadioButton
CheckDlgButton
GetWindow
GetActiveWindow
SetActiveWindow
GetSystemMetrics
CreateDialogIndirectParamA
DestroyWindow
IsWindow
GetWindowLongA
GetDlgItem
IsWindowEnabled
GetParent
GetNextDlgTabItem
EndDialog
GetMenuState
GetMenuStringA
GetMenuItemID
InsertMenuA
GetMenuItemCount
GetSubMenu
UnpackDDElParam
ReuseDDElParam
LoadMenuA
LoadAcceleratorsA
InvalidateRect
InsertMenuItemA
CreatePopupMenu
SetRectEmpty
BringWindowToTop
SetMenu
TranslateAcceleratorA
UpdateWindow
UnregisterClassA
RemoveMenu
MsgWaitForMultipleObjects
GetProcessWindowStation
GetUserObjectInformationW
LoadIconA
GetWindowRect
GetSystemMenu
AppendMenuA
GetForegroundWindow
SendMessageA
KillTimer
SetTimer
CharUpperA
CharUpperW
CharLowerA
CharLowerW
GetWindowTextA
EnableWindow
SetForegroundWindow
ShowWindow
EnumWindows
PostMessageA
GetDesktopWindow
MessageBoxA
DispatchMessageA

gdi32

SelectPalette
PlayMetaFileRecord
GetObjectType
EnumMetaFile
PlayMetaFile
CreatePen
ExtCreatePen
CreateSolidBrush
CreateHatchBrush
CreateFontIndirectA
GetTextExtentPoint32A
CreateRectRgnIndirect
PatBlt
GetTextMetricsA
EnumFontFamiliesExA
GetStockObject
CombineRgn
GetMapMode
DPtoLP
GetCharWidthA
CreateFontA
StretchDIBits
GetBkColor
SelectClipRgn
SetColorAdjustment
SetArcDirection
SetMapperFlags
SetTextCharacterExtra
SetTextJustification
SetTextAlign
MoveToEx
CreatePatternBrush
CreateDIBPatternBrushPt
ExtSelectClipRgn
PolyBezierTo
PolylineTo
PolyDraw
ArcTo
GetCurrentPositionEx
ScaleWindowExtEx
SetWindowExtEx
OffsetWindowOrgEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
StartDocA
GetPixel
GetWindowExtEx
GetViewportExtEx
SelectClipPath
CreateRectRgn
SelectObject
GetObjectA
BitBlt
GetBitmapBits
DeleteObject
SetRectRgn
DeleteDC
LineTo
OffsetClipRgn
IntersectClipRect
ExcludeClipRect
SetMapMode
ModifyWorldTransform
SetWorldTransform
SetGraphicsMode
SetStretchBltMode
SetROP2
SetPolyFillMode
SetBkMode
RestoreDC
SaveDC
CreateBitmap
SetBkColor
SetTextColor
GetClipBox
GetDCOrgEx
CopyMetaFileA
CreateDCA
CreateCompatibleDC
GetDeviceCaps
CreateCompatibleBitmap
GetClipRgn

comdlg32

GetFileTitleA

winspool.drv

EnumPortsA
ClosePrinter
DocumentPropertiesA
OpenPrinterA

advapi32

RegQueryValueA
RegEnumKeyA
RegOpenKeyA
RegSetValueA
RegEnumKeyExA
GetUserNameA
RegLoadKeyA
RegRestoreKeyA
RegSaveKeyA
RegDeleteKeyA
RegQueryValueExA
RegFlushKey
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegisterEventSourceA
ReportEventA
DeregisterEventSource
OpenServiceA
ControlService
QueryServiceStatus
DeleteService
OpenSCManagerA
CreateServiceA
CloseServiceHandle
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegDeleteValueA
RegCloseKey
SetServiceStatus
RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA
RegCreateKeyA

shell32

DragQueryFileA
Shell_NotifyIconA
ExtractIconA
SHGetFileInfoA
DragFinish
ShellExecuteA

shlwapi

PathRemoveExtensionA
PathFindFileNameA
PathStripToRootA
PathFindExtensionA
PathIsUNCA

ws2_32

WSAAsyncSelect
WSASetLastError
shutdown
getsockopt
ntohs
WSAStartup
inet_ntoa
gethostbyname
gethostname
ntohl
htonl
inet_addr
setsockopt
closesocket
ioctlsocket
socket
WSACleanup
__WSAFDIsSet
getsockname
accept
recv
send
recvfrom
sendto
select
connect
WSAGetLastError
getpeername
htons
bind
listen

ole32

CoDisconnectObject
OleDuplicateData
CoTaskMemAlloc
ReleaseStgMedium
CreateBindCtx
CoTreatAsClass
StringFromCLSID
CoCreateInstance
ReadFmtUserTypeStg
OleRegGetUserType
WriteClassStg
StringFromGUID2
CLSIDFromString
WriteFmtUserTypeStg
SetConvertStg
CoTaskMemFree
CoCreateGuid
ReadClassStg

oleaut32

SysStringLen
VarDateFromStr
SysReAllocStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroyDescriptor
SafeArrayDestroyData
SafeArrayDestroy
SafeArrayUnlock
SafeArrayLock
SafeArrayPutElement
SafeArrayPtrOfIndex
SafeArrayGetElement
SafeArrayCopy
SafeArrayAllocDescriptor
SafeArrayAllocData
VariantCopy
SafeArrayRedim
SafeArrayCreate
SafeArrayGetDim
SafeArrayGetElemsize
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SysAllocStringLen
VariantInit
VariantChangeType
VariantClear
SysStringByteLen
SysAllocStringByteLen
SysFreeString
VarBstrFromCy
VarBstrFromDec
VarDecFromStr
VarCyFromStr
VarBstrFromDate

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 480KB - Virtual size: 478KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 56KB - Virtual size: 206KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 44KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bb1b22c49c8ff1f476d15e73c0fc04d7

Headers

File Characteristics

PDB Paths

Imports

iphlpapi

version

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

shlwapi

ws2_32

ole32

oleaut32

Sections

.text Size: 1.9MB - Virtual size: 1.9MB

.rdata Size: 480KB - Virtual size: 478KB

.data Size: 56KB - Virtual size: 206KB

.rsrc Size: 44KB - Virtual size: 40KB

.text
Size: 1.9MB - Virtual size: 1.9MB

.rdata
Size: 480KB - Virtual size: 478KB

.data
Size: 56KB - Virtual size: 206KB

.rsrc
Size: 44KB - Virtual size: 40KB