2024-06-04_301e99dfe66ac5c4f9c4e0e2fe560505_icedid

Sharing

Copy URL Twitter E-mail

General

Target

2024-06-04_301e99dfe66ac5c4f9c4e0e2fe560505_icedid
Size

1.9MB
MD5

301e99dfe66ac5c4f9c4e0e2fe560505
SHA1

2f1e8114244a68a0e525548b332d0a58dedf15b1
SHA256

054b31dfeffaa27f298a9a0e524ee7f442ed8d6584fb8151ac9961f3a73104e6
SHA512

0df5806949c257a874abae348f083db75c44433207af638960b7b8591691bb9a1d37073b92d44be900464adcfae749fb8afe1713e4999112b2323c462e68f56e
SSDEEP

49152:CeulB1NCa4QQaEY1TplJA0Jd1YZx4UzGJ800+HyVQZ23sj1tVeoduZ103G8jv4Da:2lbNCaL5EmO+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-04_301e99dfe66ac5c4f9c4e0e2fe560505_icedid

Files

2024-06-04_301e99dfe66ac5c4f9c4e0e2fe560505_icedid
.exe windows:4 windows x86 arch:x86

fbffb023e15c3fe86ad2a28b411221a9

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

imm32

ImmDisableIME

ws2_32

WSAStartup
WSACleanup
WSAWaitForMultipleEvents
WSAEnumNetworkEvents
connect
socket
recv
send
htons
listen
bind
htonl
gethostbyname
WSACreateEvent
WSACloseEvent
WSAEventSelect
gethostname
closesocket
inet_addr
inet_ntoa
accept
shutdown
WSAGetLastError

winmm

timeGetTime

d3d9

Direct3DCreate9

ddraw

DirectDrawCreateEx

mss32

_AIL_last_error@0
_AIL_set_sample_loop_count@8
_AIL_close_digital_driver@4
_AIL_set_named_sample_file@20
_AIL_stop_sample@4
_AIL_allocate_sample_handle@4
_AIL_release_sample_handle@4
_AIL_mem_free_lock@4
_AIL_set_sample_volume_pan@12
_AIL_startup@0
_AIL_set_preference@8
_AIL_open_digital_driver@16
_AIL_shutdown@0
_AIL_init_sample@4
_AIL_start_sample@4
_AIL_file_read@8

kernel32

SetVolumeLabelA
GetTempFileNameA
GetTempPathA
MapViewOfFile
CreateFileMappingA
UnmapViewOfFile
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetLastError
FreeResource
GetModuleHandleA
lstrcmpW
GlobalDeleteAtom
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
GetCurrentThreadId
GetCurrentProcessId
InterlockedIncrement
GetModuleFileNameW
InterlockedDecrement
GetThreadLocale
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
GetFileSize
DuplicateHandle
GetCurrentProcess
GetVolumeInformationA
GetFullPathNameA
LocalAlloc
TlsGetValue
GlobalReAlloc
GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
lstrcmpA
LoadLibraryExA
GetLocaleInfoA
EnumResourceLanguagesA
ConvertDefaultLocale
GetCurrentThread
SetThreadPriority
SuspendThread
GlobalFlags
GetCPInfo
GetOEMCP
SetErrorMode
HeapAlloc
GetDiskFreeSpaceExA
HeapReAlloc
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
ExitProcess
ExitThread
CreateThread
GetSystemTimeAsFileTime
GetLocalTime
GetConsoleCP
GetConsoleMode
GetCommandLineA
GetProcessHeap
GetStartupInfoA
SetCurrentDirectoryA
HeapSize
VirtualFree
HeapDestroy
HeapCreate
GetStdHandle
GetACP
IsValidCodePage
LCMapStringA
LCMapStringW
SetHandleCount
GetFileType
GetTimeZoneInformation
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetStringTypeA
GetStringTypeW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
IsBadReadPtr
InterlockedExchange
GetDriveTypeA
LocalFree
QueryPerformanceCounter
GetSystemDirectoryA
QueryPerformanceFrequency
FormatMessageA
DosDateTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
RemoveDirectoryA
SystemTimeToFileTime
CompareFileTime
TerminateThread
CreateDirectoryA
MultiByteToWideChar
WideCharToMultiByte
GetLastError
SizeofResource
LockResource
LoadResource
FindResourceA
WriteFile
SetEnvironmentVariableA
CreateProcessA
SetFilePointer
ReadFile
GetFileTime
FileTimeToLocalFileTime
FileTimeToSystemTime
OutputDebugStringA
MoveFileA
GetProcAddress
GetPrivateProfileIntA
LoadLibraryA
FreeLibrary
GlobalLock
GlobalUnlock
GlobalFree
CreateEventA
ResumeThread
GlobalAlloc
SetEvent
GetVersion
ResetEvent
GetModuleFileNameA
GetCurrentDirectoryA
GetTickCount
MulDiv
DeleteFileA
GetFileAttributesA
SetFileAttributesA
WaitForSingleObject
GetVersionExA
GetPrivateProfileStringA
WritePrivateProfileStringA
FindFirstFileA
FindNextFileA
FindClose
Sleep
CreateFileA
CloseHandle
GetEnvironmentVariableA
lstrlenA
CompareStringW
CompareStringA
HeapFree

user32

DrawTextA
DrawTextExA
GrayStringA
GetWindowDC
BeginPaint
EndPaint
CheckMenuItem
EnableMenuItem
ModifyMenuA
LoadBitmapA
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
CopyAcceleratorTableA
InvalidateRgn
MapDialogRect
SetWindowContextHelpId
GetNextDlgGroupItem
PostQuitMessage
ValidateRect
TranslateMessage
GetMessageA
CharNextA
GetSysColorBrush
DestroyMenu
RegisterClipboardFormatA
UnregisterClassA
PostThreadMessageA
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
MapWindowPoints
GetKeyState
GetScrollRange
SetForegroundWindow
UpdateWindow
GetMenu
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
EqualRect
GetScrollInfo
DefWindowProcA
CallWindowProcA
IntersectRect
SystemParametersInfoA
GetWindowPlacement
SetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
GetNextDlgTabItem
EndDialog
TabbedTextOutA
GetWindowTextLengthA
GetWindowTextA
SetWindowPos
SetFocus
IsWindowEnabled
ShowWindow
MoveWindow
GetDlgCtrlID
SetWindowTextA
IsDialogMessageA
SendDlgItemMessageA
GetDlgItem
GetWindow
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
wsprintfA
GetFocus
IsRectEmpty
MessageBeep
SetWindowLongA
IsWindow
GetMessagePos
ReleaseDC
GetDC
GetAsyncKeyState
IsChild
GetIconInfo
GetSysColor
PeekMessageA
ReleaseCapture
DestroyCursor
GetWindowLongA
WindowFromPoint
GetParent
SetCapture
GetCapture
GetActiveWindow
RedrawWindow
ClientToScreen
GetWindowRect
DrawFocusRect
FrameRect
FillRect
InflateRect
CopyRect
DrawStateA
GetDesktopWindow
GetCursorPos
SetCursor
LoadCursorA
OffsetRect
FindWindowA
LoadImageA
LoadIconA
IsIconic
DrawIcon
IsWindowVisible
SetRect
MessageBoxA
SendMessageA
ScreenToClient
PtInRect
GetClientRect
SetWindowRgn
PostMessageA
GetSystemMetrics
KillTimer
SetTimer
InvalidateRect
EnableWindow
CharUpperA
GetWindowThreadProcessId
RegisterWindowMessageA
WinHelpA
SetWindowsHookExA
CallNextHookEx
GetClassLongA
SetPropA
GetPropA
RemovePropA
GetForegroundWindow
GetLastActivePopup
DispatchMessageA
GetScrollPos
GetClassNameA

gdi32

CreatePalette
CreateCompatibleBitmap
GetStockObject
DeleteObject
DeleteDC
SetTextColor
SetBkColor
CreateBitmap
GetClipBox
SaveDC
RestoreDC
SetBkMode
SetStretchBltMode
SetDIBitsToDevice
SetMapMode
LineTo
MoveToEx
GetViewportExtEx
GetWindowExtEx
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
SelectPalette
CreateRectRgnIndirect
GetRgnBox
GetBkColor
GetTextColor
GetMapMode
StretchDIBits
GetDIBits
RealizePalette
GetObjectA
SelectObject
Rectangle
CreatePen
GetDeviceCaps
BitBlt
CreateCompatibleDC
CreateFontA
CreateSolidBrush
CreateRectRgn

comdlg32

GetFileTitleA

winspool.drv

ClosePrinter
OpenPrinterA
DocumentPropertiesA

advapi32

RegEnumKeyA
RegDeleteKeyA
RegCreateKeyExA
RegOpenKeyA
RegQueryValueExA
RegSetValueExA
RegOpenKeyExA
RegQueryValueA
RegCloseKey

shell32

ShellExecuteA

shlwapi

PathIsUNCA
PathFindFileNameA
PathFindExtensionA
PathStripToRootA

oledlg

ord8

ole32

CLSIDFromProgID
CoRegisterMessageFilter
OleFlushClipboard
OleIsCurrentClipboard
CoRevokeClassObject
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CLSIDFromString
CoTaskMemFree
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CoTaskMemAlloc

oleaut32

SysAllocStringLen
SysFreeString
VariantClear
VariantTimeToSystemTime
SystemTimeToVariantTime
SafeArrayDestroy
OleCreateFontIndirect
VariantChangeType
VariantCopy
SysAllocStringByteLen
SysStringLen
SysAllocString
VariantInit

urlmon

URLDownloadToFileA

wininet

FtpOpenFileA
InternetCloseHandle
DeleteUrlCacheEntry
InternetConnectA
InternetSetOptionA
InternetOpenA
InternetReadFile
InternetQueryDataAvailable
FtpGetFileSize
HttpQueryInfoA
InternetOpenUrlA

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 280KB - Virtual size: 279KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 132KB - Virtual size: 252KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 528KB - Virtual size: 524KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fbffb023e15c3fe86ad2a28b411221a9

Headers

File Characteristics

Imports

imm32

ws2_32

winmm

d3d9

ddraw

mss32

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

shlwapi

oledlg

ole32

oleaut32

urlmon

wininet

version

Sections

.text Size: 1.0MB - Virtual size: 1.0MB

.rdata Size: 280KB - Virtual size: 279KB

.data Size: 132KB - Virtual size: 252KB

.rsrc Size: 528KB - Virtual size: 524KB

.text
Size: 1.0MB - Virtual size: 1.0MB

.rdata
Size: 280KB - Virtual size: 279KB

.data
Size: 132KB - Virtual size: 252KB

.rsrc
Size: 528KB - Virtual size: 524KB