2024-06-28_97fad77c8c40509e269f7d6d84a1f29b_icedid

Sharing

Copy URL Twitter E-mail

General

Target

2024-06-28_97fad77c8c40509e269f7d6d84a1f29b_icedid
Size

13.0MB
MD5

97fad77c8c40509e269f7d6d84a1f29b
SHA1

73eca97a6803b3c15fcbcee9ff9e4798257636e8
SHA256

3f0769eaa2ec6afc6e7f04a5bc89267f6954f93f646f9527a00d484f4d78c9a9
SHA512

8aa72f6643f5331fc6e573d3b19a43b2c7a099f7a974b669b3809d7170864973d2e4bd8013e41feb2ab024346382c63988044bb27d8eef8314056fadd5a4851d
SSDEEP

196608:um+ZHvcUSzLJZZnIcfBymkTzCcxJ5EFbof4aWLgrWl6MRDBhS1hrMH8e8vEbWxYn:EPqNfnTTyzCcGFpt4yDzKrMce8vAWqJB

Score

1^/10

Malware Config

Signatures

Files

2024-06-28_97fad77c8c40509e269f7d6d84a1f29b_icedid
.exe windows:4 windows x86 arch:x86

cfd01e4b0beb8b83d5ef0ea1c4fb1d43

Code Sign

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

25/04/2007, 00:00

Not After

09/07/2019, 18:40

Subject

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
ExtKeyUsageClientAuth

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/07/1999, 18:31

Not After

09/07/2019, 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

30/04/2007, 00:00

Not After

29/04/2012, 23:59

Subject

CN=WoSign Time Stamping Signer,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

cc:31:84:83:81:c9:a0:c5:2f:13:6f:2b:2f:60:17:fc
Certificate

Issuer

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Not Before

29/10/2007, 00:00

Not After

28/10/2008, 23:59

Subject

CN=深圳市世强电脑科技有限公司,OU=Class 3 - for Microsoft Authenticode Signing,O=深圳市世强电脑科技有限公司,L=深圳市,ST=广东省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

bb:28:54:6c:50:94:0f:79:f1:33:e4:5f:4e:92:26:e6:30:38:a8:23
Signer

Actual PE Digest

bb:28:54:6c:50:94:0f:79:f1:33:e4:5f:4e:92:26:e6:30:38:a8:23

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

f:\公司产品\万能安装和卸载\万能安装\WnInstall\WnInstall\Release\WnInstall.pdb

Imports

kernel32

GetCurrentProcessId
SetUnhandledExceptionFilter
LCMapStringA
LCMapStringW
GetTimeFormatA
GetDateFormatA
GetTimeZoneInformation
IsBadWritePtr
SetStdHandle
GetOEMCP
GetCPInfo
IsBadReadPtr
IsBadCodePtr
QueryPerformanceCounter
GetStringTypeA
GetStringTypeW
GetDriveTypeA
CompareStringA
CompareStringW
SetEnvironmentVariableA
VirtualFree
HeapCreate
HeapDestroy
GetStartupInfoA
SetHandleCount
GetCommandLineW
InterlockedExchange
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetModuleFileNameA
GetStdHandle
HeapSize
VirtualQuery
GetSystemInfo
VirtualAlloc
VirtualProtect
TerminateProcess
HeapReAlloc
CreateFileA
GetFileType
GetSystemTimeAsFileTime
CreateThread
ExitThread
RtlUnwind
ExitProcess
GetStartupInfoW
GetCurrentDirectoryW
GetFileTime
GetFileAttributesW
SetErrorMode
InterlockedIncrement
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
TlsGetValue
EnterCriticalSection
GlobalHandle
GlobalReAlloc
LeaveCriticalSection
GlobalFlags
DeleteCriticalSection
InitializeCriticalSection
RaiseException
ConvertDefaultLocale
GetVersion
EnumResourceLanguagesW
GetLocaleInfoW
FileTimeToLocalFileTime
FileTimeToSystemTime
FindNextFileW
GetModuleFileNameW
GetFullPathNameW
FindFirstFileW
FindClose
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
lstrcmpiW
InterlockedDecrement
MulDiv
lstrcpynW
GetCurrentThreadId
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
GetModuleHandleA
LoadLibraryA
lstrcmpW
GetVersionExA
GlobalLock
GlobalUnlock
FreeResource
lstrcmpiA
lstrlenA
lstrcmpA
lstrcpyW
WideCharToMultiByte
DosDateTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
GetTickCount
GlobalFree
GlobalAlloc
SetLastError
GetSystemDefaultLangID
MoveFileW
FormatMessageW
GetVolumeInformationW
lstrlenW
lstrcatW
GetCurrentThread
LocalAlloc
LocalFree
GetLastError
GetProcessHeap
HeapAlloc
GetModuleHandleW
HeapFree
GetCurrentProcess
LoadLibraryW
GetProcAddress
FreeLibrary
GetTempPathW
CopyFileW
MoveFileExW
DeviceIoControl
Sleep
RemoveDirectoryW
CreateFileW
GetWindowsDirectoryW
SetFileAttributesW
GetExitCodeProcess
WritePrivateProfileStringW
MultiByteToWideChar
DeleteFileW
GetPrivateProfileIntW
GetPrivateProfileStringW
CreateDirectoryW
GetSystemDirectoryW
FindResourceW
LoadResource
LockResource
SizeofResource
CreateProcessW
WaitForSingleObject
CloseHandle
GetVersionExW
GetThreadLocale
GetLocaleInfoA
GetACP

user32

MessageBeep
GetNextDlgGroupItem
InvalidateRgn
InvalidateRect
CopyAcceleratorTableW
SetRect
IsRectEmpty
CharNextW
ReleaseCapture
SetCapture
GetSysColorBrush
DestroyMenu
SetWindowContextHelpId
MapDialogRect
GetMessageW
TranslateMessage
GetCursorPos
ValidateRect
PostQuitMessage
wsprintfW
CharUpperW
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
SetMenuItemBitmaps
ModifyMenuW
GetMenuState
EnableMenuItem
CheckMenuItem
GetMenuCheckMarkDimensions
LoadBitmapW
ShowWindow
SetWindowTextW
IsDialogMessageW
SetDlgItemTextW
RegisterWindowMessageW
WinHelpW
GetCapture
CreateWindowExW
SetWindowsHookExW
CallNextHookEx
GetClassInfoExW
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
SendDlgItemMessageW
SendDlgItemMessageA
SetFocus
IsChild
GetWindowTextLengthW
GetWindowTextW
GetForegroundWindow
GetLastActivePopup
DispatchMessageW
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageW
MapWindowPoints
GetKeyState
SetForegroundWindow
IsWindowVisible
UpdateWindow
GetMenu
PostMessageW
GetSubMenu
GetMenuItemID
GetMenuItemCount
GetSysColor
AdjustWindowRectEx
EqualRect
GetClassInfoW
RegisterClassW
RegisterClipboardFormatW
PostThreadMessageW
UnregisterClassW
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
SetWindowLongW
SetWindowPos
OffsetRect
IntersectRect
SystemParametersInfoA
GetWindowPlacement
CopyRect
PtInRect
GetWindow
GetDesktopWindow
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamW
DestroyWindow
IsWindow
GetWindowLongW
IsWindowEnabled
GetNextDlgTabItem
EndDialog
CharUpperA
CharNextA
ExitWindowsEx
GetParent
GetFocus
GetDlgItem
GetSystemMetrics
LoadIconW
GetClientRect
IsIconic
GetSystemMenu
DrawIcon
MessageBoxW
LoadCursorW
SetCursor
ClientToScreen
GetWindowRect
SendMessageW
EnableWindow
MoveWindow

gdi32

PtVisible
GetWindowExtEx
GetViewportExtEx
RectVisible
TextOutW
ExtTextOutW
Escape
GetRgnBox
GetTextColor
GetBkColor
GetMapMode
CreateRectRgnIndirect
GetDeviceCaps
GetStockObject
DeleteDC
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
DeleteObject
SetMapMode
CreateFontW
CreateSolidBrush
GetClipBox
SetTextColor
SetBkColor
GetObjectW
CreateBitmap
SaveDC
RestoreDC
SelectObject

comdlg32

GetFileTitleW

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

advapi32

OpenProcessToken
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
RegEnumValueW
RegCreateKeyW
RegCreateKeyExA
SetFileSecurityW
GetSecurityDescriptorControl
SetSecurityDescriptorDacl
AddAccessAllowedAce
RegQueryValueW
RegDeleteKeyW
RegSetValueExA
RegDeleteValueA
RegDeleteKeyA
RegOpenKeyExA
RegQueryValueExA
RegEnumKeyW
RegOpenKeyW
LookupPrivilegeValueW
AdjustTokenPrivileges
RegCreateKeyExW
RegSetValueW
ImpersonateSelf
OpenThreadToken
RegCloseKey
AllocateAndInitializeSid
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
IsValidSecurityDescriptor
AccessCheck
RevertToSelf
FreeSid
LookupAccountNameW
GetFileSecurityW
InitializeSecurityDescriptor
GetSecurityDescriptorDacl
GetAclInformation
GetLengthSid
InitializeAcl
GetAce
EqualSid
AddAce

shell32

ShellExecuteW
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetSpecialFolderPathW

comctl32

ord17
ImageList_Destroy

shlwapi

PathStripToRootW
PathIsUNCW
PathFindExtensionW
PathFileExistsW
PathFindFileNameW

oledlg

OleUIBusyW

ole32

CoGetClassObject
CLSIDFromString
CLSIDFromProgID
CoTaskMemAlloc
StgOpenStorageOnILockBytes
CoTaskMemFree
CoInitialize
CoCreateInstance
CoUninitialize
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CoRevokeClassObject
CoRegisterMessageFilter
OleFlushClipboard
OleIsCurrentClipboard

oleaut32

SysFreeString
OleCreateFontIndirect
SysAllocString
SystemTimeToVariantTime
SafeArrayDestroy
VariantCopy
VariantChangeType
VariantClear
SysAllocStringLen
SysStringLen
VariantInit

cabinet

ord23
ord21
ord20
ord22

Sections

.text
Size: 264KB - Virtual size: 260KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 12KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12.6MB - Virtual size: 12.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cfd01e4b0beb8b83d5ef0ea1c4fb1d43

Code Sign

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04Certificate

Extended Key Usages

Key Usages

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1bCertificate

Extended Key Usages

Key Usages

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0dCertificate

Extended Key Usages

Key Usages

cc:31:84:83:81:c9:a0:c5:2f:13:6f:2b:2f:60:17:fcCertificate

Extended Key Usages

Key Usages

bb:28:54:6c:50:94:0f:79:f1:33:e4:5f:4e:92:26:e6:30:38:a8:23Signer

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

cabinet

Sections

.text Size: 264KB - Virtual size: 260KB

.rdata Size: 68KB - Virtual size: 67KB

.data Size: 12KB - Virtual size: 25KB

.rsrc Size: 12.6MB - Virtual size: 12.6MB

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Certificate

cc:31:84:83:81:c9:a0:c5:2f:13:6f:2b:2f:60:17:fc
Certificate

bb:28:54:6c:50:94:0f:79:f1:33:e4:5f:4e:92:26:e6:30:38:a8:23
Signer

.text
Size: 264KB - Virtual size: 260KB

.rdata
Size: 68KB - Virtual size: 67KB

.data
Size: 12KB - Virtual size: 25KB

.rsrc
Size: 12.6MB - Virtual size: 12.6MB