2024-06-28_7882ecde1aab6c73bbf4e26d1e8dacc1_icedid

Sharing

Copy URL Twitter E-mail

General

Target

2024-06-28_7882ecde1aab6c73bbf4e26d1e8dacc1_icedid
Size

801KB
MD5

7882ecde1aab6c73bbf4e26d1e8dacc1
SHA1

c2649008e7c677a02baf073b8a3c09d9ec269258
SHA256

1dceec53c0a14711ff93ce2867d2348a1cdec058bc1e3e53db5e606cf639af37
SHA512

5608e66a46759b9de014b9fa958faa4b50620aa7f36b355940c8e7031dfc1bdcaed8fe77825d0097b53824f43669bb373bb981fc7f7d540819173aa886d4a498
SSDEEP

12288:6p3y+THYMe1OjYuf0KxRBBPdiQqQSvTM7lYydYr2J8daa7EE:6pkFxuMK/zqQTlYydYy3a7EE

Score

1^/10

Malware Config

Signatures

Files

2024-06-28_7882ecde1aab6c73bbf4e26d1e8dacc1_icedid
.exe windows:4 windows x86 arch:x86

417878308651126ae1b207910bdc6fd6

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29/01/1996, 00:00

Not After

01/08/2028, 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

56:26:c0:f3:da:fb:59:2f:94:a9:f1:e2:5a:d5:5d:68
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

23/07/2009, 00:00

Not After

23/07/2010, 23:59

Subject

CN=SEIKO EPSON Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Information Service & Support Department,O=SEIKO EPSON Corporation,L=Suwa-shi,ST=Nagano,C=JP

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

8f:e3:bf:48:09:09:b2:d1:21:b1:0c:33:f6:f9:49:28:dc:1c:b2:01
Signer

Actual PE Digest

8f:e3:bf:48:09:09:b2:d1:21:b1:0c:33:f6:f9:49:28:dc:1c:b2:01

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

setupapi

SetupDiGetDriverInfoDetailW
SetupDiCreateDeviceInfoList
SetupDiClassGuidsFromNameW
CM_Get_DevNode_Status
SetupDiGetDeviceRegistryPropertyW
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiEnumDriverInfoW
SetupDiGetINFClassW
SetupDiSetDeviceRegistryPropertyW
SetupDiGetClassDevsW
SetupDiGetDeviceInstallParamsW
SetupDiBuildDriverInfoList
SetupGetFileCompressionInfoW
SetupInitDefaultQueueCallbackEx
SetupCommitFileQueueW
SetupOpenFileQueue
SetupQueueCopyW
SetupCloseFileQueue
SetupTermDefaultQueueCallback
SetupDecompressOrCopyFileW
SetupDefaultQueueCallbackW
SetupDiSetDeviceInstallParamsW

wintrust

CryptCATAdminAcquireContext
CryptCATCatalogInfoFromContext
CryptCATAdminReleaseContext
CryptCATAdminCalcHashFromFileHandle
CryptCATAdminEnumCatalogFromHash

mscms

UninstallColorProfileW
EnumColorProfilesW
AssociateColorProfileWithDeviceW
InstallColorProfileW
GetColorDirectoryW
DisassociateColorProfileFromDeviceW

avifil32

AVIFileRelease
AVIFileOpenW
AVIFileInit
AVIFileInfoW
AVIFileExit

lz32

LZCopy
LZClose
LZOpenFileW
GetExpandedNameW

mpr

WNetEnumResourceW
WNetCloseEnum
WNetOpenEnumW

kernel32

UnmapViewOfFile
GetAtomNameW
DeleteAtom
TerminateThread
AddAtomW
lstrlenW
HeapSize
GlobalLock
GlobalUnlock
GetCommandLineW
OpenMutexW
CreateMutexW
ReleaseMutex
FileTimeToSystemTime
VirtualProtect
InterlockedDecrement
GetVersionExA
lstrcmpW
LoadLibraryA
CompareStringW
GlobalDeleteAtom
GlobalFindAtomW
GlobalAddAtomW
MulDiv
SetThreadPriority
SetEvent
SuspendThread
CreateEventW
GetModuleHandleA
lstrcmpA
lstrlenA
GlobalGetAtomNameW
GetCurrentProcessId
MapViewOfFile
InterlockedExchange
CompareStringA
GetLocaleInfoW
EnumResourceLanguagesW
ConvertDefaultLocale
GetCurrentThread
FindResourceExW
GetThreadLocale
LeaveCriticalSection
TlsGetValue
EnterCriticalSection
GlobalReAlloc
InitializeCriticalSection
TlsAlloc
TlsSetValue
LocalReAlloc
DeleteCriticalSection
TlsFree
GlobalFlags
InterlockedIncrement
GetFullPathNameW
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
DuplicateHandle
GetVolumeInformationW
WritePrivateProfileStringW
GetTickCount
SetErrorMode
GetProcessHeap
GetStartupInfoW
HeapReAlloc
RtlUnwind
RaiseException
ExitProcess
VirtualAlloc
GetSystemInfo
VirtualQuery
GetStdHandle
GetModuleFileNameA
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
SetHandleCount
GetFileType
GetStartupInfoA
VirtualFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
TerminateProcess
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
GetACP
GetOEMCP
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA
CreateFileMappingW
ResumeThread
GetUserDefaultLangID
GetLocalTime
FormatMessageW
ExitThread
GetCurrentThreadId
LocalAlloc
SetLastError
GetModuleHandleW
LocalFileTimeToFileTime
LocalFree
GlobalHandle
SetFileAttributesA
GetCurrentDirectoryW
GetFileAttributesA
WriteFile
GetCompressedFileSizeW
SetFileTime
SetFilePointer
CreateFileA
DosDateTimeToFileTime
DeleteFileW
GlobalFree
ReadFile
GlobalAlloc
CompareFileTime
WaitForSingleObject
CreateThread
CreateProcessW
GetProcAddress
GetSystemDirectoryW
GetSystemWindowsDirectoryW
GetCurrentProcess
FreeLibrary
LoadLibraryW
HeapFree
HeapAlloc
CreateDirectoryW
GetFileSize
FileTimeToLocalFileTime
GetFileTime
CopyFileW
Sleep
CloseHandle
CreateFileW
MoveFileExW
GetLastError
RemoveDirectoryW
SetFileAttributesW
GetFileAttributesW
FindClose
FindNextFileW
FindFirstFileW
MultiByteToWideChar
WideCharToMultiByte
HeapDestroy
HeapCreate
GetVersionExW
SetCurrentDirectoryW
GetModuleFileNameW
FreeResource
FindResourceW
LoadResource
LockResource
SizeofResource
GetDiskFreeSpaceExW
GetDriveTypeW
GetVersion

user32

BringWindowToTop
SetRectEmpty
CreatePopupMenu
InsertMenuItemW
LoadAcceleratorsW
LoadMenuW
ReuseDDElParam
UnpackDDElParam
PostQuitMessage
ShowOwnedPopups
UnregisterClassW
GetSysColorBrush
CopyAcceleratorTableW
SetRect
InvalidateRgn
SetWindowContextHelpId
CharUpperW
RegisterClipboardFormatW
GetNextDlgGroupItem
MessageBeep
CreateDialogIndirectParamW
GetNextDlgTabItem
EndDialog
RegisterWindowMessageW
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
IsChild
SetWindowsHookExW
CallNextHookEx
GetClassLongW
SetPropW
GetPropW
RemovePropW
GetWindowTextLengthW
GetWindowTextW
GetLastActivePopup
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
MapWindowPoints
ScrollWindow
UnregisterClassA
GetKeyState
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
ShowScrollBar
IsWindowVisible
GetMenu
GetSubMenu
GetMenuItemID
GetMenuItemCount
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
DrawTextW
ScreenToClient
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
PtInRect
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
SetMenu
OffsetRect
IntersectRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
UnhookWindowsHookEx
GetCapture
GetActiveWindow
MapDialogRect
ShowWindow
GetAsyncKeyState
SetFocus
GetDlgItem
IsWindowEnabled
LoadStringW
SetProcessDefaultLayout
GetSysColor
SetWindowTextW
GetWindow
PostThreadMessageW
GetMessageW
CharNextA
SetTimer
UpdateWindow
GetDesktopWindow
DispatchMessageW
TranslateMessage
PeekMessageW
LoadCursorW
SetCursor
KillTimer
IsWindow
DeleteMenu
EnableMenuItem
GetSystemMenu
LoadIconW
GetDialogBaseUnits
CopyRect
DestroyIcon
GetClassNameW
GetWindowRect
CharNextW
CharPrevW
SetForegroundWindow
SystemParametersInfoW
AttachThreadInput
GetForegroundWindow
GetWindowThreadProcessId
ReleaseDC
GetDC
SetWindowPos
GetWindowLongW
MessageBoxW
SetActiveWindow
GetProcessDefaultLayout
EnableWindow
SendMessageW
PostMessageW
GetSystemMetrics
GetClientRect
GetParent
TabbedTextOutW
InvalidateRect
DrawFocusRect
FillRect
GetCursorPos
ValidateRect
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuW
CheckMenuItem
GetMenuState
MoveWindow
IsDialogMessageW
TranslateAcceleratorW
ReleaseCapture
SetCapture
SetWindowRgn
DrawIcon
IsRectEmpty
FindWindowW
DestroyMenu
GetMenuItemInfoW
InflateRect
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
GrayStringW
SetWindowLongW
DrawTextExW
AdjustWindowRectEx
GetFocus
TrackPopupMenu

gdi32

GetDeviceCaps
CreateBitmap
CreateCompatibleDC
SetBkColor
DeleteObject
SelectObject
SaveDC
RestoreDC
SetBkMode
SetTextColor
GetStockObject
GetObjectW
BitBlt
GetClipBox
SetMapMode
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
CreateFontIndirectW
ScaleWindowExtEx
ExtSelectClipRgn
DeleteDC
CreatePatternBrush
Escape
CreateSolidBrush
CreateRectRgnIndirect
CreateEllipticRgn
LPtoDP
Ellipse
CreateCompatibleBitmap
EnumFontFamiliesExW
GetMapMode
GetRgnBox
GetBkColor
GetTextColor
ExtTextOutW
TextOutW
RectVisible
PtVisible
GetPixel
GetWindowExtEx
GetViewportExtEx
GetTextExtentPoint32W
SetWindowExtEx
GetTextMetricsW
SetViewportOrgEx

comdlg32

GetFileTitleW

winspool.drv

GetPrinterDriverDirectoryW
GetPrintProcessorDirectoryW
OpenPrinterW
SetPrinterDataW
ClosePrinter
GetPrinterDataW
DeletePrinterDataW
ord204
ord203
GetPrinterW
SetPrinterW
EnumPrintProcessorsW
GetPrinterDriverW
EnumPrintersW
EnumMonitorsW
EnumPrinterDriversW
EnumPortsW
DocumentPropertiesW

advapi32

EqualSid
OpenProcessToken
AllocateAndInitializeSid
FreeSid
GetTokenInformation
RegQueryValueExW
RegOpenKeyExW
RegQueryValueW
RegEnumKeyW
RegDeleteKeyW
RegOpenKeyW
RegDeleteValueW
RegSetValueExW
RegCreateKeyExW
RegEnumValueW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetDesktopFolder
DragQueryFileW
ExtractIconExW
SHGetMalloc
DragFinish

shlwapi

SHDeleteKeyW
PathFindExtensionW
PathFindFileNameW
PathStripToRootW
SHDeleteEmptyKeyW
PathIsUNCW

oledlg

OleUIBusyW

ole32

CoInitializeEx
CLSIDFromProgID
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CLSIDFromString
CoTaskMemAlloc
CoInitialize
CoUninitialize
CoCreateInstance
CoRegisterMessageFilter
OleFlushClipboard
OleIsCurrentClipboard
CoRevokeClassObject
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CoTaskMemFree

oleaut32

SafeArrayGetElemsize
SafeArrayAccessData
SafeArrayUnaccessData
VariantInit
VariantChangeType
SysStringLen
SafeArrayGetDim
SafeArrayDestroy
SafeArrayCreate
SafeArrayGetUBound
SafeArrayGetLBound
SysAllocStringLen
VariantCopy
SysFreeString
VariantTimeToSystemTime
SystemTimeToVariantTime
VariantClear
OleCreateFontIndirect
SysAllocString

Sections

.text
Size: 564KB - Virtual size: 560KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 128KB - Virtual size: 126KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 84KB - Virtual size: 83KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

417878308651126ae1b207910bdc6fd6

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bfCertificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

56:26:c0:f3:da:fb:59:2f:94:a9:f1:e2:5a:d5:5d:68Certificate

Extended Key Usages

Key Usages

8f:e3:bf:48:09:09:b2:d1:21:b1:0c:33:f6:f9:49:28:dc:1c:b2:01Signer

Headers

File Characteristics

Imports

version

setupapi

wintrust

mscms

avifil32

lz32

mpr

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

shlwapi

oledlg

ole32

oleaut32

Sections

.text Size: 564KB - Virtual size: 560KB

.rdata Size: 128KB - Virtual size: 126KB

.data Size: 16KB - Virtual size: 32KB

.rsrc Size: 84KB - Virtual size: 83KB

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

56:26:c0:f3:da:fb:59:2f:94:a9:f1:e2:5a:d5:5d:68
Certificate

8f:e3:bf:48:09:09:b2:d1:21:b1:0c:33:f6:f9:49:28:dc:1c:b2:01
Signer

.text
Size: 564KB - Virtual size: 560KB

.rdata
Size: 128KB - Virtual size: 126KB

.data
Size: 16KB - Virtual size: 32KB

.rsrc
Size: 84KB - Virtual size: 83KB