General

Malware Config

Signatures

Files

• 2024-05-22_8ec1a406372f6eea849aec0960c40d8f_floxif_icedid

  .exe windows:5 windows x86 arch:x86

  964d99ec0c0e5a03658f1714f812c1cf

  
  

  Code Sign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0d:dd:a3:fa:e1:5d:dc:b3:77:ef:dc:e3:aa:6b:c2:a5

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  10-01-2022 00:00

  Not After

  07-01-2023 23:59

  Subject

  SERIALNUMBER=110111-1138985,CN=AhnLab\, Inc.,O=AhnLab\, Inc.,L=Seongnam-si,ST=Gyeonggi-do,C=KR,1.3.6.1.4.1.311.60.2.1.1=#130b53656f6e676e616d2d7369,1.3.6.1.4.1.311.60.2.1.2=#130b4779656f6e6767692d646f,1.3.6.1.4.1.311.60.2.1.3=#13024b52,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

  Certificate

  Issuer

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Not Before

  21-09-2022 00:00

  Not After

  21-11-2033 23:59

  Subject

  CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  23-03-2022 00:00

  Not After

  22-03-2037 23:59

  Subject

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-08-2022 00:00

  Not After

  09-11-2031 23:59

  Subject

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  70:21:0f:ff:21:74:d9:54:ea:fa:ee:c3:a7:1d:b2:a7:88:90:f1:da:63:6f:fb:96:40:fb:1b:71:4d:36:2c:26

  Signer

  Actual PE Digest

  70:21:0f:ff:21:74:d9:54:ea:fa:ee:c3:a7:1d:b2:a7:88:90:f1:da:63:6f:fb:96:40:fb:1b:71:4d:36:2c:26

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  u:\AhnLab\Common\AhnRestore\Trunk\Src\V3Restore\Release\V3Restore.pdb

  Imports

  version

  GetFileVersionInfoW

  GetFileVersionInfoSizeW

  VerQueryValueW

  ws2_32

  WSAGetLastError

  getsockopt

  gethostbyname

  WSAStartup

  getaddrinfo

  ioctlsocket

  getsockname

  socket

  connect

  setsockopt

  bind

  listen

  getnameinfo

  ntohs

  freeaddrinfo

  WSACleanup

  send

  WSASetLastError

  recv

  accept

  closesocket

  kernel32

  InterlockedDecrement

  SetThreadPriority

  ResumeThread

  SetEvent

  SuspendThread

  CreateEventW

  GlobalAddAtomW

  GetFileAttributesExW

  LocalFileTimeToFileTime

  SystemTimeToFileTime

  SetFileTime

  SetFileAttributesW

  GetFileAttributesW

  GetFileSizeEx

  GetFileTime

  InterlockedIncrement

  CompareStringW

  GlobalReAlloc

  GlobalHandle

  InitializeCriticalSection

  LocalReAlloc

  GlobalGetAtomNameW

  GetAtomNameW

  GetThreadLocale

  GetPrivateProfileIntW

  WritePrivateProfileStringW

  GetPrivateProfileStringW

  GlobalFlags

  GetVersionExA

  LoadLibraryA

  GlobalFindAtomW

  FreeResource

  MoveFileW

  DeleteFileW

  GetStringTypeExW

  FlushFileBuffers

  LockFile

  UnlockFile

  DuplicateHandle

  GlobalDeleteAtom

  GetVolumeInformationW

  GetFullPathNameW

  GetShortPathNameW

  SetErrorMode

  GetStartupInfoW

  RtlUnwind

  HeapFree

  HeapAlloc

  GetDriveTypeW

  GetLocalTime

  HeapReAlloc

  GetFileInformationByHandle

  PeekNamedPipe

  Sleep

  ExitProcess

  SetConsoleCtrlHandler

  GetDriveTypeA

  FindFirstFileA

  RaiseException

  ExitThread

  CreateThread

  HeapSize

  SetUnhandledExceptionFilter

  GetModuleFileNameA

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  GetCommandLineW

  SetHandleCount

  GetStartupInfoA

  HeapCreate

  HeapDestroy

  VirtualFree

  GetTickCount

  TerminateProcess

  UnhandledExceptionFilter

  IsDebuggerPresent

  GetCPInfo

  GetACP

  GetOEMCP

  IsValidCodePage

  GetTimeZoneInformation

  FatalAppExitA

  VirtualAlloc

  GetConsoleCP

  GetCurrentDirectoryA

  SetCurrentDirectoryA

  SetStdHandle

  LCMapStringA

  LCMapStringW

  GetFullPathNameA

  CreateFileA

  GetStringTypeA

  GetStringTypeW

  GetTimeFormatA

  GetDateFormatA

  GetUserDefaultLCID

  GetLocaleInfoA

  EnumSystemLocalesA

  IsValidLocale

  WriteConsoleA

  GetConsoleOutputCP

  WriteConsoleW

  GetProcessHeap

  SetEnvironmentVariableA

  GetCurrentThread

  ConvertDefaultLocale

  EnumResourceLanguagesW

  GetLocaleInfoW

  CompareStringA

  InterlockedExchange

  GlobalFree

  CopyFileW

  GlobalSize

  GlobalAlloc

  GlobalLock

  GlobalUnlock

  MulDiv

  GetEnvironmentVariableW

  ReadConsoleW

  ReadConsoleA

  SetConsoleMode

  GetConsoleMode

  FindClose

  FindFirstFileW

  FindNextFileW

  QueryPerformanceCounter

  GetSystemTimeAsFileTime

  FormatMessageW

  GetStdHandle

  GetFileType

  InterlockedExchangeAdd

  GetCurrentThreadId

  TlsFree

  TlsSetValue

  TlsGetValue

  TlsAlloc

  DeleteCriticalSection

  LeaveCriticalSection

  EnterCriticalSection

  InitializeCriticalSectionAndSpinCount

  InterlockedCompareExchange

  SetLastError

  GetCurrentDirectoryW

  CreateProcessW

  WaitForSingleObject

  OutputDebugStringA

  GetCurrentProcessId

  SetCurrentDirectoryW

  GetModuleFileNameW

  GetTempPathW

  SetFilePointer

  WriteFile

  SetEndOfFile

  WideCharToMultiByte

  GetFileSize

  ReadFile

  MultiByteToWideChar

  CreateFileW

  LoadLibraryW

  GetWindowsDirectoryW

  GetSystemDirectoryW

  LoadLibraryExW

  GetUserDefaultLangID

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  FindResourceW

  LoadResource

  LockResource

  SizeofResource

  lstrcpyW

  lstrcatW

  CreateMutexW

  lstrcmpA

  CloseHandle

  lstrlenA

  lstrcpynW

  GetVersion

  GetModuleHandleA

  FreeLibrary

  LocalAlloc

  lstrcmpW

  lstrlenW

  LocalFree

  GetSystemInfo

  lstrcmpiW

  GetVersionExW

  GetLastError

  GetModuleHandleW

  GetProcAddress

  GetCurrentProcess

  user32

  MoveWindow

  ShowWindow

  ScrollWindowEx

  DestroyIcon

  CharUpperW

  InflateRect

  GetMenuItemInfoW

  DestroyMenu

  SystemParametersInfoW

  TranslateAcceleratorW

  BringWindowToTop

  SetRectEmpty

  CreatePopupMenu

  InsertMenuItemW

  InvalidateRect

  LoadAcceleratorsW

  GetMenuBarInfo

  LoadMenuW

  ReuseDDElParam

  UnpackDDElParam

  EndDialog

  GetNextDlgTabItem

  CreateDialogIndirectParamW

  GetKeyNameTextW

  MapVirtualKeyW

  IsRectEmpty

  GetSystemMenu

  SetParent

  UnionRect

  GetDialogBaseUnits

  SetRect

  SetTimer

  KillTimer

  GetDCEx

  LockWindowUpdate

  WinHelpW

  IsChild

  GetClassLongW

  SetPropW

  GetPropW

  RemovePropW

  IsWindow

  SetFocus

  GetForegroundWindow

  SetActiveWindow

  BeginDeferWindowPos

  EndDeferWindowPos

  GetDlgItem

  GetTopWindow

  DestroyWindow

  GetMessageTime

  GetMessagePos

  MapWindowPoints

  ScrollWindow

  TrackPopupMenuEx

  TrackPopupMenu

  SetMenu

  SetScrollRange

  GetScrollRange

  SetScrollPos

  GetScrollPos

  SetForegroundWindow

  ShowScrollBar

  UpdateWindow

  GetClientRect

  CreateWindowExW

  GetClassInfoExW

  GetClassInfoW

  RegisterClassW

  AdjustWindowRectEx

  EqualRect

  DeferWindowPos

  GetScrollInfo

  SetScrollInfo

  IsDialogMessageW

  DefWindowProcW

  CallWindowProcW

  CopyRect

  GetMenu

  SetWindowLongW

  SetWindowPos

  OffsetRect

  IntersectRect

  SystemParametersInfoA

  IsIconic

  GetWindowPlacement

  UnregisterClassW

  WaitMessage

  ReleaseCapture

  GetCapture

  WindowFromPoint

  SetCapture

  GetDesktopWindow

  GetWindow

  GetDlgCtrlID

  GetWindowRect

  GetClassNameW

  PtInRect

  SetWindowTextW

  EndPaint

  BeginPaint

  GetWindowDC

  ClientToScreen

  ScreenToClient

  GrayStringW

  DrawTextExW

  DrawTextW

  TabbedTextOutW

  FillRect

  DeleteMenu

  GetWindowTextLengthW

  GetWindowTextW

  LoadCursorW

  GetDC

  ReleaseDC

  GetSysColor

  GetSysColorBrush

  GetWindowThreadProcessId

  GetWindowLongW

  GetLastActivePopup

  IsWindowEnabled

  EnableWindow

  ShowOwnedPopups

  SetCursor

  SetWindowsHookExW

  CallNextHookEx

  GetMessageW

  TranslateMessage

  DispatchMessageW

  GetActiveWindow

  IsWindowVisible

  GetKeyState

  PeekMessageW

  GetCursorPos

  ValidateRect

  SetMenuItemBitmaps

  GetMenuCheckMarkDimensions

  LoadBitmapW

  GetFocus

  GetParent

  SendMessageW

  ModifyMenuW

  EnableMenuItem

  CheckMenuItem

  UnhookWindowsHookEx

  PostMessageW

  PostQuitMessage

  GetMenuState

  GetMenuStringW

  AppendMenuW

  GetMenuItemID

  IsDlgButtonChecked

  SetDlgItemTextW

  SetDlgItemInt

  GetDlgItemTextW

  GetDlgItemInt

  CheckRadioButton

  CheckDlgButton

  RegisterWindowMessageW

  LoadIconW

  SendDlgItemMessageW

  SetWindowPlacement

  SendDlgItemMessageA

  InsertMenuW

  GetMenuItemCount

  GetSubMenu

  RemoveMenu

  MessageBoxW

  GetProcessWindowStation

  GetUserObjectInformationW

  wsprintfW

  CharNextA

  CharPrevA

  GetSystemMetrics

  gdi32

  SetTextJustification

  SetTextCharacterExtra

  SetMapperFlags

  ExtTextOutW

  Escape

  SelectObject

  SetViewportOrgEx

  OffsetViewportOrgEx

  SetViewportExtEx

  ScaleViewportExtEx

  SetWindowOrgEx

  OffsetWindowOrgEx

  SetWindowExtEx

  ScaleWindowExtEx

  GetCurrentPositionEx

  ArcTo

  PolyDraw

  PolylineTo

  PolyBezierTo

  ExtSelectClipRgn

  DeleteDC

  CreateDIBPatternBrushPt

  CreatePatternBrush

  CreateCompatibleDC

  GetStockObject

  SetTextAlign

  PlayMetaFileRecord

  LineTo

  EnumMetaFile

  PlayMetaFile

  CreatePen

  ExtCreatePen

  CreateSolidBrush

  CreateHatchBrush

  GetDCOrgEx

  CreateFontIndirectW

  GetTextExtentPoint32W

  CreateRectRgnIndirect

  SetRectRgn

  RectVisible

  CombineRgn

  GetMapMode

  PatBlt

  DPtoLP

  CreateCompatibleBitmap

  GetCharWidthW

  CreateFontW

  StretchDIBits

  GetTextMetricsW

  GetBkColor

  SelectPalette

  MoveToEx

  PtVisible

  StartDocW

  GetPixel

  BitBlt

  OffsetClipRgn

  IntersectClipRect

  ExcludeClipRect

  GetClipBox

  SetMapMode

  ModifyWorldTransform

  SetWorldTransform

  SetGraphicsMode

  SetTextColor

  SetStretchBltMode

  SetROP2

  SetPolyFillMode

  SetBkMode

  SetBkColor

  RestoreDC

  SaveDC

  CreateBitmap

  CreateDCW

  CopyMetaFileW

  GetObjectType

  GetDeviceCaps

  GetWindowExtEx

  GetViewportExtEx

  GetObjectW

  SelectClipPath

  CreateRectRgn

  GetClipRgn

  SelectClipRgn

  DeleteObject

  SetColorAdjustment

  SetArcDirection

  TextOutW

  comdlg32

  GetFileTitleW

  winspool.drv

  DocumentPropertiesW

  OpenPrinterW

  ClosePrinter

  advapi32

  RegSetValueExW

  RegCreateKeyW

  RegCreateKeyExW

  RegQueryValueW

  RegOpenKeyW

  RegEnumKeyW

  RegDeleteKeyW

  RegSetValueW

  CryptAcquireContextW

  CryptGenRandom

  CryptReleaseContext

  RegisterEventSourceW

  ReportEventW

  DeregisterEventSource

  RegOpenKeyA

  RegQueryValueExA

  RegOpenKeyExW

  RegQueryValueExW

  RegCloseKey

  RegDeleteValueW

  shell32

  ExtractIconW

  DragFinish

  DragQueryFileW

  SHGetFileInfoW

  shlwapi

  PathFindFileNameW

  PathStripToRootW

  PathIsUNCW

  PathFindExtensionW

  PathRemoveExtensionW

  PathRemoveFileSpecW

  ole32

  CoTaskMemFree

  SetConvertStg

  WriteFmtUserTypeStg

  WriteClassStg

  OleRegGetUserType

  ReadFmtUserTypeStg

  ReadClassStg

  CreateBindCtx

  ReleaseStgMedium

  CoTaskMemAlloc

  StringFromCLSID

  CoInitializeEx

  CoUninitialize

  CLSIDFromString

  CoCreateInstance

  StringFromGUID2

  CoDisconnectObject

  OleDuplicateData

  CoTreatAsClass

  oleaut32

  SysStringLen

  VariantClear

  SafeArrayCreate

  SafeArrayGetDim

  SafeArrayGetElemsize

  SafeArrayGetLBound

  SafeArrayGetUBound

  SafeArrayAccessData

  SafeArrayUnaccessData

  LoadRegTypeLi

  LoadTypeLi

  RegisterTypeLi

  SysStringByteLen

  SysAllocStringByteLen

  SysFreeString

  SafeArrayRedim

  VariantChangeType

  VariantCopy

  SafeArrayAllocData

  SafeArrayAllocDescriptor

  SafeArrayCopy

  SafeArrayGetElement

  SafeArrayPtrOfIndex

  SafeArrayPutElement

  SafeArrayLock

  SafeArrayUnlock

  SafeArrayDestroy

  SafeArrayDestroyData

  SafeArrayDestroyDescriptor

  VariantTimeToSystemTime

  SystemTimeToVariantTime

  SysAllocStringLen

  VarDateFromStr

  SysReAllocStringLen

  VarCyFromStr

  VarBstrFromCy

  VarBstrFromDec

  VarDecFromStr

  VarBstrFromDate

  VariantInit

  Sections

  .text

  Size: 1.5MB - Virtual size: 1.5MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 414KB - Virtual size: 414KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 18KB - Virtual size: 46KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 15KB - Virtual size: 14KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ