2024-06-24_8ba1178069a6136db817205d7018b7d3_icedid

Sharing

Copy URL Twitter E-mail

General

Target

2024-06-24_8ba1178069a6136db817205d7018b7d3_icedid
Size

456KB
MD5

8ba1178069a6136db817205d7018b7d3
SHA1

bb08a4af65ec1efbf8cd5b2e46840599824ba6b0
SHA256

697416e9a1580884ce172e84035d5bf07855f027693c77b3b9bc268d73c848ef
SHA512

641702475e841104f2dfa1983f37ae99d686e8bc06cd29ee11b71d6dc136d61f2a89206bc92e6ad4623bcea4505bcd3117ffdac360d4928f426f3e6b4a13e1fe
SSDEEP

6144:5G2QI15lBTEwrXCw3u6biiuaAm+ofUdAIKvN2ujHMIVhkTnHl0IuwxiigCh:5zT7TGw3u4JlEGIKl2ujQTnHj9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-24_8ba1178069a6136db817205d7018b7d3_icedid

Files

2024-06-24_8ba1178069a6136db817205d7018b7d3_icedid
.exe windows:4 windows x86 arch:x86

ffa1e648a9424b608108f109f3888ac0

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wsock32

setsockopt
listen
closesocket
send
connect
htons
gethostbyname
socket
shutdown
sendto
ioctlsocket
bind
htonl
recvfrom
select

kernel32

LocalReAlloc
TlsFree
lstrcmpW
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
WritePrivateProfileStringA
GlobalFlags
GetCPInfo
GetOEMCP
RtlUnwind
GetSystemTimeAsFileTime
HeapFree
RemoveDirectoryA
GetTimeFormatA
GetDateFormatA
ExitThread
HeapAlloc
VirtualProtect
TlsSetValue
GetSystemInfo
VirtualQuery
ExitProcess
HeapReAlloc
TerminateProcess
HeapSize
SetUnhandledExceptionFilter
GetTimeZoneInformation
HeapDestroy
HeapCreate
VirtualFree
IsBadWritePtr
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
UnhandledExceptionFilter
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
IsBadReadPtr
IsBadCodePtr
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
GetExitCodeProcess
CreateProcessA
SetStdHandle
SetEnvironmentVariableA
GetLocaleInfoW
TlsAlloc
TlsGetValue
GlobalHandle
GlobalReAlloc
LocalAlloc
InterlockedIncrement
InterlockedDecrement
GetCurrentThread
GlobalDeleteAtom
lstrcmpA
ConvertDefaultLocale
EnumResourceLanguagesA
SetErrorMode
lstrcatA
GetFileTime
GetFileAttributesA
SetFileAttributesA
SetFileTime
SystemTimeToFileTime
LocalFileTimeToFileTime
FileTimeToLocalFileTime
FileTimeToSystemTime
CreateFileA
GetFullPathNameA
GetVolumeInformationA
lstrcpyA
GetCurrentProcess
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
DeleteFileA
SetLastError
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
lstrcpynA
GetProcAddress
EnterCriticalSection
LeaveCriticalSection
CreateEventA
CreateSemaphoreA
WaitForSingleObject
ReleaseSemaphore
ResetEvent
ReleaseMutex
WaitForMultipleObjects
CompareStringW
CompareStringA
lstrcmpiA
GetVersion
MultiByteToWideChar
LoadLibraryA
FreeLibrary
OpenMutexA
GetCurrentThreadId
CloseHandle
FormatMessageA
lstrlenA
LocalFree
GetCommandLineA
GetModuleHandleA
GetModuleFileNameA
CreateMutexA
SetEvent
GetSystemDirectoryA
FindFirstFileA
FindNextFileA
FindClose
Sleep
WideCharToMultiByte
CreateThread
GetLastError
FindResourceA
LoadResource
LockResource
SizeofResource
DeleteCriticalSection
InitializeCriticalSection
RaiseException
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
VirtualAlloc

user32

SetCursor
SetMenuItemBitmaps
ModifyMenuA
EnableMenuItem
CheckMenuItem
GetMenuCheckMarkDimensions
LoadBitmapA
ShowWindow
SetWindowTextA
TranslateMessage
GetActiveWindow
GetCursorPos
ValidateRect
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
RegisterWindowMessageA
WinHelpA
GetCapture
CreateWindowExA
SetWindowsHookExA
CallNextHookEx
GetClassLongA
GetClassInfoExA
GetClassNameA
SetPropA
GetPropA
RemovePropA
GetFocus
GetWindowTextA
GetForegroundWindow
GetDlgItem
GetTopWindow
DestroyWindow
GetMessageTime
LoadIconA
MapWindowPoints
GetKeyState
SetForegroundWindow
IsWindowVisible
GetClientRect
GetMenu
AdjustWindowRectEx
GetClassInfoA
RegisterClassA
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
SetWindowLongA
SetWindowPos
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
CopyRect
PtInRect
GetWindow
SendMessageA
MessageBoxA
GetParent
GetWindowLongA
GetLastActivePopup
IsWindowEnabled
UnhookWindowsHookEx
LoadCursorA
GetDC
ReleaseDC
GetSysColor
GetSysColorBrush
PostQuitMessage
wsprintfA
GetSystemMetrics
EnableWindow
PostMessageA
PeekMessageA
GetMenuState
DestroyMenu
GetMenuItemID
GetMessagePos
GetMenuItemCount
GetSubMenu
CharUpperA
PostThreadMessageA
SetTimer
GetMessageA
DispatchMessageA
KillTimer
UnregisterClassA

gdi32

GetStockObject
TextOutA
RectVisible
PtVisible
CreateBitmap
ExtTextOutA
DeleteDC
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
SetMapMode
RestoreDC
SaveDC
SetBkColor
SetTextColor
GetClipBox
GetDeviceCaps
DeleteObject
Escape

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

ReportEventA
RegQueryValueA
RegEnumKeyA
RegDeleteKeyA
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegOpenKeyA
RegCreateKeyA
RegSetValueExA
RegCloseKey
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
SetServiceStatus
RegisterEventSourceA
CryptReleaseContext
DeregisterEventSource
OpenServiceA
ControlService
QueryServiceStatus
DeleteService
OpenSCManagerA
CreateServiceA
CloseServiceHandle
CryptGetUserKey
CryptGenKey
CryptAcquireContextA
CryptCreateHash
CryptHashData
CryptDeriveKey
CryptDecrypt
CryptDestroyKey
CryptDestroyHash

comctl32

ord17

shlwapi

PathStripToRootA
PathIsUNCA
PathFindFileNameA
PathFindExtensionA

oleaut32

SystemTimeToVariantTime
SysFreeString
VarBstrFromDate
VarUdateFromDate
VariantClear
VariantChangeType
VariantInit

ws2_32

recv
WSAAsyncSelect
WSASetLastError
WSAGetLastError
accept
WSACleanup
WSAStartup
inet_ntoa
ntohs
getpeername

Sections

.text
Size: 364KB - Virtual size: 362KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 76KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 160B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ffa1e648a9424b608108f109f3888ac0

Headers

File Characteristics

Imports

wsock32

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

comctl32

shlwapi

oleaut32

ws2_32

Sections

.text Size: 364KB - Virtual size: 362KB

.rdata Size: 76KB - Virtual size: 74KB

.data Size: 8KB - Virtual size: 23KB

.rsrc Size: 4KB - Virtual size: 160B

.text
Size: 364KB - Virtual size: 362KB

.rdata
Size: 76KB - Virtual size: 74KB

.data
Size: 8KB - Virtual size: 23KB

.rsrc
Size: 4KB - Virtual size: 160B