2024-05-28_b1dc364df508a18010f1e846c2f586f6_icedid_nymaim

Sharing

Copy URL Twitter E-mail

General

Target
2024-05-28_b1dc364df508a18010f1e846c2f586f6_icedid_nymaim
Size 7.0MB
Sample240528-y2lpdsaf4t
SHA256 153176d139e2e285c80b98fc7784a64b4fa36adc6c4266c91980d404f556a20a
MD5 b1dc364df508a18010f1e846c2f586f6
SHA1 17f869b4c0b3ffa126bb6c7c8df4a0af291f2562
SHA512 38eda5b8c69b1a7ce62b2a1381a23ea9bff6ae4ca0eab3808d8d00b2704d14416e961a3b63de10908481c8e57d3d0cc6c094c5921581c2923b0ed3e3af668b6c
SSDEEP 98304:JKRYHwUPOIR8JP7n26x3NfnoaL5PCG04R5pCN7efSUEStWRZUfCNuICC4a4D5:1vWIR8JPKEdBJCSYStWRZUK4ICC4a
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-28_b1dc364df508a18010f1e846c2f586f6_icedid_nymaim

File Explorer

2024-05-28_b1dc364df508a18010f1e846c2f586f6_icedid_nymaim

.exe 7.0MB

2024-05-28_b1dc364df508a18010f1e846c2f586f6_icedid_nymaim

IMPHASH cf4ca1e09842c2609fab46703419480c
SHA256 153176d139e2e285c80b98fc7784a64b4fa36adc6c4266c91980d404f556a20a
MD5 b1dc364df508a18010f1e846c2f586f6
SHA1 17f869b4c0b3ffa126bb6c7c8df4a0af291f2562
SHA512 38eda5b8c69b1a7ce62b2a1381a23ea9bff6ae4ca0eab3808d8d00b2704d14416e961a3b63de10908481c8e57d3d0cc6c094c5921581c2923b0ed3e3af668b6c
SSDEEP 98304:JKRYHwUPOIR8JP7n26x3NfnoaL5PCG04R5pCN7efSUEStWRZUfCNuICC4a4D5:1vWIR8JPKEdBJCSYStWRZUK4ICC4a
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10960

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

mfc42

ord6052 ord4078 ord1775 ord4407 ord5241 ord2385 ord5163 ord6374 ord4353 ord5280 ord3798 ord4837 ord4441 ord2648 ord2055 ord6376 ord3749 ord5065 ord1727 ord5261 ord2446 ord5199 ord5277 ord4627 ord4425 ord4710 ord324 ord4234 ord1146 ord1168 ord2764 ord537 ord800 ord4160 ord540 ord2863 ord2379 ord755 ord470 ord4224 ord823 ord1576 ord4998 ord4853 ord4376 ord5265 ord1134 ord2621 ord2514 ord641 ord815 ord825 ord1089 ord3922 ord5731 ord2512 ord2554 ord4486 ord6375 ord4274 ord561 ord3738 ord4424 ord4622 ord4080 ord3079 ord3825 ord3831 ord3830 ord2976 ord3081 ord2985 ord3262 ord3136 ord4465 ord3259 ord3147 ord2982 ord5714 ord5289 ord5307 ord4698 ord4079 ord2725 ord5302 ord5300 ord3346 ord3597 ord2396 ord2124 ord4673

msvcrt

_adjust_fdiv _setmbcp atol strstr __dllonexit _onexit _exit _XcptFilter exit _acmdln __getmainargs _initterm __setusermatherr __CxxFrameHandler _controlfp _except_handler3 __set_app_type __p__fmode __p__commode

kernel32

Sleep FindResourceA LoadResource LockResource SizeofResource GetTempPathA lstrcatA CreateDirectoryA FreeLibrary WriteFile CloseHandle lstrcpyA FindFirstFileA FindClose GetModuleHandleA GetProcAddress GetCurrentProcess GetCommandLineA LoadLibraryA GetSystemDirectoryA GetWindowsDirectoryA ReadFile GetFileSize MultiByteToWideChar GetLastError GetModuleFileNameA CreateFileA GetStartupInfoA

user32

SendMessageA LoadIconA GetSystemMenu DrawIcon GetClientRect GetSystemMetrics wsprintfA MessageBoxA EnableWindow LoadCursorA SetCursor IsIconic AppendMenuA

advapi32

RegCloseKey ControlService CloseServiceHandle OpenServiceA OpenSCManagerA StartServiceA DeleteService CreateServiceA RegCreateKeyExA

shell32

SHFileOperationA ShellExecuteExA

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

crypt32

CertCreateCertificateContext CertAddCertificateContextToStore PFXImportCertStore CryptMemFree CertEnumCertificatesInStore CertFreeCertificateContext CertCloseStore CryptMemAlloc CertOpenStore

Sharing

General

Malware Config

Signatures

File Explorer

2024-05-28_b1dc364df508a18010f1e846c2f586f6_icedid_nymaim

mfc42

msvcrt

kernel32

user32

advapi32

shell32

version

crypt32

generic