2024-06-11_ad617688df00e6f4e1a383477db8284b_icedid

Sharing

Copy URL

Twitter E-mail

General

Target

2024-06-11_ad617688df00e6f4e1a383477db8284b_icedid
Size

1.6MB
MD5

ad617688df00e6f4e1a383477db8284b
SHA1

f7bfed18e9c3a7a70c7bc8069b843f46e1513c1f
SHA256

715abebc62ec6cc5411a93acc500f956e1d4b17159d9ae07661c044feb795104
SHA512

0f0d9060741fc0caba5e178e7331856a3f6f6ff10bfba29e8d9868499db3bcd8eb479fe1eb2e4eb28348e3509abea6c91b4db5d1725491e98c8037aa6b576f33
SSDEEP

49152:qsCR06+OHfsLkQbB+K7tYeHWPP9YskfqBA7MYX+8TViSGbOjI3CZjyVqv+:XCR06+efsLkQbB+K7tYeHWPP9YskfqBV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-11_ad617688df00e6f4e1a383477db8284b_icedid

Files

2024-06-11_ad617688df00e6f4e1a383477db8284b_icedid
.exe windows:5 windows x86 arch:x86

310b098d52bbcc9c638037800d135115

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

winmm

waveInGetDevCapsA
waveInGetNumDevs
waveInStart
waveInAddBuffer
waveInPrepareHeader
waveInOpen
waveInClose
waveInUnprepareHeader
waveInReset
sndPlaySoundA

avifil32

AVIFileOpenA
AVIFileExit
AVIFileInit
AVIStreamWrite
AVIStreamSetFormat
AVIFileRelease
AVIStreamRelease
AVIFileCreateStreamA

wininet

InternetQueryDataAvailable
HttpAddRequestHeadersA
HttpQueryInfoA
InternetGetLastResponseInfoA
InternetSetStatusCallback
InternetSetFilePointer
InternetWriteFile
InternetReadFile
HttpOpenRequestA
InternetOpenA
InternetConnectA
InternetCloseHandle
FtpSetCurrentDirectoryA
FtpPutFileA
HttpSendRequestA

mmapi

?MM_Start@@YAH_N@Z
?MM_End@@YAH_N@Z
?MM_ObjDelete@@YAHPAX@Z
?MM_MarkSetIcon@@YAHPAXH@Z
?MM_ObjRename@@YAHPAXPBD@Z
?MM_ObjGetName@@YAHPAXPADH@Z
?MM_MarkMove@@YAHPAXNN@Z
?MM_MarkCreate@@YAHPBDNNHPAPAX@Z
?MM_AddIcon@@YAHPBDH@Z

kernel32

GetFileSizeEx
GlobalFlags
TlsGetValue
GlobalReAlloc
GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
GetCPInfo
GetOEMCP
GetModuleHandleW
SetErrorMode
GetCurrentDirectoryA
RtlUnwind
GetTimeFormatA
GetDateFormatA
ExitThread
CreateThread
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
HeapFree
HeapAlloc
GetDriveTypeA
GetCommandLineA
GetStartupInfoA
ExitProcess
HeapReAlloc
VirtualProtect
VirtualAlloc
VirtualQuery
SetStdHandle
GetFileType
HeapSize
GetACP
IsValidCodePage
GetStdHandle
GetConsoleCP
GetConsoleMode
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
HeapCreate
VirtualFree
SetHandleCount
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
InitializeCriticalSectionAndSpinCount
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetProcessHeap
CompareStringW
SetEnvironmentVariableA
SystemTimeToFileTime
LocalFileTimeToFileTime
GetDiskFreeSpaceA
GetTempFileNameA
GetFileTime
SetFileTime
GetFileAttributesA
GetTickCount
GetPrivateProfileStringA
WritePrivateProfileStringA
GetPrivateProfileIntA
SuspendThread
SetThreadPriority
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
InterlockedExchange
lstrcmpA
GetShortPathNameA
GetFullPathNameA
GetVolumeInformationA
GetCurrentProcess
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
SetFilePointer
lstrcmpiA
GetThreadLocale
GetStringTypeExA
MoveFileA
LocalAlloc
FileTimeToLocalFileTime
FileTimeToSystemTime
InterlockedDecrement
GetModuleFileNameW
GetCurrentProcessId
GetModuleFileNameA
GlobalAlloc
FormatMessageA
LocalFree
MulDiv
lstrlenA
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
CompareStringA
lstrcmpW
GetModuleHandleA
GlobalLock
GlobalUnlock
GlobalFree
FreeResource
OutputDebugStringA
ResumeThread
CreateMutexA
SetLastError
ReleaseMutex
lstrcpynA
FindNextFileA
FindClose
CreateDirectoryA
MultiByteToWideChar
WinExec
GetSystemDirectoryA
CopyFileA
GetComputerNameA
GetSystemInfo
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
FlushFileBuffers
GetEnvironmentVariableA
FindFirstFileA
LoadLibraryA
GetProcAddress
FreeLibrary
BuildCommDCBA
CreateFileA
SetCommState
SetCommTimeouts
WriteFile
ReadFile
GetVersionExA
DeleteFileA
GetWindowsDirectoryA
GetCurrentThreadId
SetEvent
WaitForMultipleObjects
TerminateThread
GetLastError
Sleep
DeleteCriticalSection
InitializeCriticalSection
CreateEventA
ResetEvent
WaitForSingleObject
CloseHandle
InterlockedIncrement
EnterCriticalSection
LeaveCriticalSection
LoadResource
LockResource
SizeofResource
FindResourceA
WideCharToMultiByte
RaiseException

user32

CreateMenu
GetTabbedTextExtentA
SetRect
RegisterClipboardFormatA
SetWindowContextHelpId
ShowOwnedPopups
ValidateRect
CharUpperA
GetMessageA
WindowFromPoint
SetCapture
SetParent
GetSystemMenu
DeleteMenu
IsRectEmpty
IsZoomed
UnpackDDElParam
ReuseDDElParam
LoadMenuA
DestroyMenu
ReleaseCapture
LoadAcceleratorsA
InsertMenuItemA
CreatePopupMenu
BringWindowToTop
TranslateAcceleratorA
WaitMessage
GetWindowThreadProcessId
InflateRect
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
FillRect
GetMenuStringA
AppendMenuA
InsertMenuA
RemoveMenu
ShowWindow
MoveWindow
SetWindowTextA
IsDialogMessageA
SetDlgItemTextA
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
ModifyMenuA
GetMenuState
EnableMenuItem
CheckMenuItem
LoadIconA
SendDlgItemMessageA
WinHelpA
IsChild
SetWindowRgn
SetWindowsHookExA
CallNextHookEx
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
GetFocus
SetFocus
GetWindowTextLengthA
GetWindowTextA
GetForegroundWindow
GetLastActivePopup
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
MapWindowPoints
ScrollWindow
TrackPopupMenu
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
SetForegroundWindow
ShowScrollBar
IsWindowVisible
GetSubMenu
GetMenuItemID
GetMenuItemCount
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
ScreenToClient
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
CopyRect
SetWindowPlacement
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
GetMenu
SetWindowLongA
SetWindowPos
OffsetRect
IntersectRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindow
GetDesktopWindow
SetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
IsWindow
GetWindowLongA
GetDlgItem
IsWindowEnabled
GetNextDlgTabItem
EndDialog
GetActiveWindow
MessageBoxA
SendMessageTimeoutA
LoadBitmapA
GetCursorPos
GetWindowRect
SetRectEmpty
PtInRect
DrawIcon
PostThreadMessageA
MessageBeep
GetNextDlgGroupItem
InvalidateRgn
CopyAcceleratorTableA
CharNextA
DestroyIcon
UnregisterClassA
LockWindowUpdate
GetDCEx
GetSysColorBrush
GetMenuItemInfoA
GetCapture
DestroyCursor
GetKeyState
RegisterWindowMessageA
PostMessageA
GetSysColor
SetSysColors
GetParent
LoadCursorA
SetCursor
PeekMessageA
TranslateMessage
DispatchMessageA
PostQuitMessage
UpdateWindow
SetTimer
KillTimer
InvalidateRect
SendMessageA
wsprintfA
GetClientRect
GetSystemMetrics
EnableWindow
MapDialogRect

gdi32

Polyline
Arc
Ellipse
GetClipBox
SetTextColor
SetBkColor
CreateBitmap
GetDeviceCaps
PtVisible
RectVisible
TextOutA
Escape
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
GetCurrentPositionEx
ExtSelectClipRgn
DeleteDC
CreatePatternBrush
GetStockObject
SetPixel
CreatePen
ExtTextOutA
CreateSolidBrush
CreateFontIndirectA
CreateRectRgnIndirect
SetRectRgn
GetWindowExtEx
CombineRgn
GetMapMode
PatBlt
DPtoLP
GetTextMetricsA
GetCharWidthA
CreateFontA
StartPage
EndPage
SetAbortProc
AbortDoc
EndDoc
GetViewportOrgEx
Rectangle
GetBkColor
GetTextColor
GetRgnBox
CreateEllipticRgn
LPtoDP
GetNearestColor
GetBkMode
GetPolyFillMode
GetROP2
GetStretchBltMode
GetTextAlign
GetTextFaceA
GetTextExtentPointA
GetWindowOrgEx
GetPixel
Polygon
GetViewportExtEx
CreateRectRgn
SelectClipRgn
CreateDIBSection
GdiFlush
DeleteObject
SetStretchBltMode
StretchDIBits
GetObjectA
SetBitmapBits
StretchBlt
GetTextExtentPoint32A
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
SelectObject
SetTextAlign
MoveToEx
LineTo
IntersectClipRect
ExcludeClipRect
SetMapMode
SetROP2
SetPolyFillMode
SetBkMode
RestoreDC
SaveDC
CreateDCA
StartDocA

comdlg32

GetFileTitleA

winspool.drv

ClosePrinter
DocumentPropertiesA
OpenPrinterA
GetJobA

advapi32

GetFileSecurityA
SetFileSecurityA
RegDeleteValueA
RegQueryValueA
RegEnumKeyA
RegDeleteKeyA
RegOpenKeyA
RegSetValueA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegQueryValueExA
RegCloseKey
RegCreateKeyA

shell32

ExtractIconA
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetMalloc
DragFinish
DragQueryFileA
SHGetFileInfoA
ShellExecuteA

shlwapi

PathStripToRootA
PathIsUNCA
PathFindExtensionA
PathFindFileNameA
PathRemoveFileSpecW

oledlg

ord8

ole32

CLSIDFromString
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CoDisconnectObject
CoUninitialize
CoCreateInstance
CoInitializeEx
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter
OleTranslateAccelerator
IsAccelerator
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
CLSIDFromProgID
CoRevokeClassObject
CoRegisterClassObject
CoTaskMemAlloc
StringFromCLSID
CoTaskMemFree

oleaut32

SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
OleCreateFontIndirect
LoadTypeLi
SysAllocString
VariantCopy
SysStringByteLen
SysAllocStringByteLen
SysStringLen
VariantChangeType
VariantClear
SysAllocStringLen
VariantInit
SysFreeString
RevokeActiveObject
RegisterActiveObject

wsock32

inet_addr
WSASetLastError
WSAAsyncSelect
htonl
sendto
send
__WSAFDIsSet
select
recvfrom
recv
connect
socket
getpeername
shutdown
accept
gethostname
ioctlsocket
gethostbyname
getservbyname
ntohs
setsockopt
getsockopt
htons
WSAStartup
bind
listen
WSACleanup
closesocket
WSAGetLastError

ws2_32

WSARecv
WSASend
WSASocketA
WSACreateEvent
WSAEventSelect
WSAWaitForMultipleEvents
WSAEnumNetworkEvents
WSAAccept
WSACloseEvent

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 193KB - Virtual size: 192KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 150KB - Virtual size: 149KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

310b098d52bbcc9c638037800d135115

Headers

DLL Characteristics

File Characteristics

Imports

winmm

avifil32

wininet

mmapi

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

shlwapi

oledlg

ole32

oleaut32

wsock32

ws2_32

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.rdata Size: 193KB - Virtual size: 192KB

.data Size: 19KB - Virtual size: 39KB

.rsrc Size: 150KB - Virtual size: 149KB

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 193KB - Virtual size: 192KB

.data
Size: 19KB - Virtual size: 39KB

.rsrc
Size: 150KB - Virtual size: 149KB