Static task
static1
Behavioral task
behavioral1
Sample
2024-06-19_3ad893621cd94451e4934f096b269a87_icedid.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-06-19_3ad893621cd94451e4934f096b269a87_icedid.exe
Resource
win10v2004-20240611-en
General
-
Target
2024-06-19_3ad893621cd94451e4934f096b269a87_icedid
-
Size
27.0MB
-
MD5
3ad893621cd94451e4934f096b269a87
-
SHA1
ee9e90cee84ffb53208f870991ff04cc4c9a5933
-
SHA256
c8190a53ae18b0512d34f6c41fb2f80c9ba62ca92bd64b923c3ab7223d9b66c2
-
SHA512
5eccfb3aeab875332598ad19eddbeab1155d0638bd953e5382402db5b9d5dcd7d7e0a39394340418ebb2b48fcf07b4b8b10e341d872c8c91758826a5e28c85cd
-
SSDEEP
393216:Z1ReC6/qBINmlFfCwXe3QcMzFZGwWR1IA/Qja+nVOzOVW4UQwvResADE7au7:xe+lFfCwXerk7VnVOSVFUj7H
Malware Config
Signatures
-
Detects executables with modified PE resources using the unpaid version of Resource Tuner 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_EXE_PE_ResourceTuner -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-06-19_3ad893621cd94451e4934f096b269a87_icedid
Files
-
2024-06-19_3ad893621cd94451e4934f096b269a87_icedid.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 49KB - Virtual size: 361KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 22.8MB - Virtual size: 22.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 222KB - Virtual size: 222KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ