2024-06-30_57b9cde4291444dad3c533a422637c4a_icedid

Sharing

Copy URL Twitter E-mail

General

Target

2024-06-30_57b9cde4291444dad3c533a422637c4a_icedid
Size

1.3MB
MD5

57b9cde4291444dad3c533a422637c4a
SHA1

a837f3eef515537aad9751aea9eeee22c0ff8559
SHA256

ef4373e51a72599a9d11fcab52f3b91736829fe5cb1439db550327bca6a40672
SHA512

67cbc8ff2313073470e7febdac46d54c41092e02e51edbf83484e6b42ad5a39b7952f82b5859804b31a6f9d6ef6212a9b9088b169c449ce3b162ad97c50d4431
SSDEEP

24576:csWFe1ZTKWQuxsGCRl51WbS4LxMxpAZ0veOWWj1/BnUo1iDee7Lt:9dKzF5iS4ipAMkUco1iDee7p

Score

1^/10

Malware Config

Signatures

Files

2024-06-30_57b9cde4291444dad3c533a422637c4a_icedid
.exe windows:5 windows x86 arch:x86

812e8492ded90346dc1864b038a13f99

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

13/04/2019, 10:00

Subject

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

11:21:fb:e8:00:4e:ad:7c:c5:99:b0:89:a5:15:56:c8:18:40
Certificate

Issuer

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

07/12/2011, 01:44

Not After

05/12/2014, 09:41

Subject

CN=Baidu Japan,OU=Business Development,O=Baidu Japan,L=Roppogi Hills Mori tower 20F\, 6-10-1\,Roppogi\,Minato-ku,ST=Tokyo,C=JP,1.2.840.113549.1.9.1=#0c11696e666f5f6a704062616964752e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

c3:af:90:f5:ad:d6:b7:45:04:b8:de:94:13:1e:27:f4:01:b3:bc:06
Signer

Actual PE Digest

c3:af:90:f5:ad:d6:b7:45:04:b8:de:94:13:1e:27:f4:01:b3:bc:06

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\cygwin\home\scmpf\compiler_src\zhouxiao02_1141393_win32\0\app\gensoft\ime-jp\all-in-one\Release\KantanStartBox_Mini.pdb

Imports

wininet

InternetQueryOptionW
InternetSetOptionW
InternetCloseHandle
InternetCreateUrlW
InternetCrackUrlW
HttpSendRequestW
HttpAddRequestHeadersW
HttpOpenRequestW
HttpQueryInfoW
InternetOpenW
InternetConnectW
InternetReadFile

psapi

GetModuleFileNameExW

kernel32

GetCurrentProcess
FindClose
FindFirstFileW
GetVolumeInformationW
GetFullPathNameW
SetErrorMode
FileTimeToLocalFileTime
GetFileAttributesW
GetFileSizeEx
GetFileTime
GetStartupInfoW
HeapFree
HeapAlloc
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
HeapReAlloc
ExitThread
HeapSize
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
FlushFileBuffers
GetACP
GetOEMCP
IsValidCodePage
GetConsoleCP
GetConsoleMode
SetConsoleCtrlHandler
InitializeCriticalSectionAndSpinCount
DuplicateHandle
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
GetProcessHeap
SetEnvironmentVariableA
GlobalFlags
GetModuleHandleA
FileTimeToSystemTime
GetThreadLocale
lstrlenA
InterlockedIncrement
InterlockedDecrement
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
LocalAlloc
WritePrivateProfileStringW
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesW
lstrcmpA
GetLocaleInfoW
CompareStringA
InterlockedExchange
UnlockFile
GetTimeZoneInformation
LockFile
GetLocalTime
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
CreateDirectoryW
DeviceIoControl
CreateTimerQueue
DeleteTimerQueueEx
CreateTimerQueueTimer
DeleteTimerQueueTimer
UnregisterWaitEx
RegisterWaitForSingleObject
FindResourceExW
GetPrivateProfileSectionNamesW
GetPrivateProfileSectionW
FindNextFileW
SetNamedPipeHandleState
TransactNamedPipe
WaitNamedPipeW
GetVersion
GlobalMemoryStatus
FlushConsoleInputBuffer
ReadConsoleInputA
SetConsoleMode
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
LoadLibraryW
CompareStringW
LoadLibraryA
FreeLibrary
lstrcmpW
GetVersionExA
FreeResource
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
lstrlenW
MulDiv
SetLastError
ReadFile
CreateMutexW
GetTempPathW
SleepEx
ExitProcess
GetExitCodeProcess
VerSetConditionMask
VerifyVersionInfoW
WideCharToMultiByte
AreFileApisANSI
MultiByteToWideChar
GetCommandLineW
GetCurrentProcessId
OpenProcess
GetTimeFormatEx
GetDateFormatEx
GetModuleFileNameW
GetVersionExW
CreateEventW
CreateThread
Sleep
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetEvent
GetCurrentThreadId
WaitForSingleObject
TerminateThread
SetFilePointer
WriteFile
SetEndOfFile
FormatMessageW
LocalFree
GetTickCount
GetModuleHandleW
GetProcAddress
DeleteFileW
CreateFileW
GetFileSize
GetLastError
CloseHandle
FindResourceW
LoadResource
LockResource
SizeofResource
GetCPInfo

user32

ReleaseCapture
SetCapture
DestroyMenu
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
LoadCursorW
GetSysColorBrush
SetWindowContextHelpId
MapDialogRect
GetWindowThreadProcessId
SetCursor
GetMessageW
TranslateMessage
GetCursorPos
ValidateRect
PostQuitMessage
ShowWindow
MoveWindow
SetWindowTextW
IsDialogMessageW
SetDlgItemTextW
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuW
EnableMenuItem
ReleaseDC
GetDC
RegisterWindowMessageW
LoadIconW
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
IsChild
GetCapture
SetWindowsHookExW
CallNextHookEx
GetClassLongW
GetClassNameW
MessageBoxA
GetProcessWindowStation
GetUserObjectInformationW
FindWindowW
GetPropW
RemovePropW
GetFocus
SetFocus
GetWindowTextW
GetForegroundWindow
GetLastActivePopup
CharUpperW
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
CharNextW
IsRectEmpty
SetRect
CopyAcceleratorTableW
InvalidateRect
InvalidateRgn
GetNextDlgGroupItem
MessageBeep
UnregisterClassW
PeekMessageW
MapWindowPoints
RegisterClipboardFormatW
GetKeyState
SetMenu
SetForegroundWindow
UpdateWindow
GetClientRect
MessageBoxW
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
GetSysColor
AdjustWindowRectEx
EqualRect
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
CopyRect
PtInRect
GetMenu
SetWindowLongW
SetWindowPos
OffsetRect
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GetWindowRect
GetSystemMetrics
GetWindow
GetDesktopWindow
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamW
DestroyWindow
IsWindow
GetWindowLongW
IsWindowEnabled
GetParent
GetNextDlgTabItem
EndDialog
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
PostMessageW
LoadStringW
wsprintfW
GetDlgItem
LoadImageW
SetPropW
EnableWindow
IsWindowVisible
IsIconic
SendMessageW
PostThreadMessageW
DispatchMessageW
CheckMenuItem

gdi32

SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
DeleteDC
GetStockObject
SetViewportExtEx
RectVisible
GetMapMode
GetBkColor
GetTextColor
GetRgnBox
ScaleViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutW
GetObjectW
SetBkColor
SetTextColor
GetClipBox
GetDeviceCaps
PtVisible
GetWindowExtEx
GetViewportExtEx
DeleteObject
SetMapMode
RestoreDC
SaveDC
CreateBitmap
CreateRectRgnIndirect
TextOutW

comdlg32

GetFileTitleW

winspool.drv

ClosePrinter
OpenPrinterW
DocumentPropertiesW

advapi32

RegEnumKeyW
RegQueryValueW
RegOpenKeyW
RegisterEventSourceA
ReportEventA
DeregisterEventSource
RegEnumValueW
RegCloseKey
RegDeleteKeyW
RegCreateKeyExW
RegSetValueExW
RegDeleteKeyExW
RegEnumKeyExW
RegOpenKeyExW
RegQueryValueExW

shell32

SHFileOperationW
SHGetSpecialFolderPathW
ShellExecuteW
Shell_NotifyIconW
ShellExecuteExW
ord165
CommandLineToArgvW

comctl32

ord17

shlwapi

SHRegGetUSValueW
PathCombineW
PathRemoveFileSpecW
PathAppendW
PathRemoveExtensionW
PathFileExistsW
PathRenameExtensionW
PathStripPathW
PathFindExtensionW
PathStripToRootW
PathIsUNCW
PathFindFileNameW
PathIsDirectoryW

oledlg

OleUIBusyW

ole32

CoGetClassObject
CLSIDFromString
CLSIDFromProgID
CoTaskMemAlloc
StgOpenStorageOnILockBytes
CoTaskMemFree
CoCreateGuid
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CoRevokeClassObject
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter

oleaut32

SysAllocString
OleCreateFontIndirect
SysStringLen
SysFreeString
SysAllocStringLen
VariantClear
VariantChangeType
VariantInit
VariantCopy
SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime

iphlpapi

GetAdaptersAddresses

winhttp

WinHttpConnect
WinHttpGetProxyForUrl
WinHttpGetIEProxyConfigForCurrentUser
WinHttpAddRequestHeaders
WinHttpReadData
WinHttpCrackUrl
WinHttpReceiveResponse
WinHttpSetOption
WinHttpSendRequest
WinHttpWriteData
WinHttpCloseHandle
WinHttpOpen
WinHttpOpenRequest

Sections

.text
Size: 875KB - Virtual size: 874KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 225KB - Virtual size: 224KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 162KB - Virtual size: 161KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

812e8492ded90346dc1864b038a13f99

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:2f:4e:e1:35:5cCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

11:21:fb:e8:00:4e:ad:7c:c5:99:b0:89:a5:15:56:c8:18:40Certificate

Extended Key Usages

Key Usages

c3:af:90:f5:ad:d6:b7:45:04:b8:de:94:13:1e:27:f4:01:b3:bc:06Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

wininet

psapi

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

iphlpapi

winhttp

Sections

.text Size: 875KB - Virtual size: 874KB

.rdata Size: 225KB - Virtual size: 224KB

.data Size: 17KB - Virtual size: 44KB

.rsrc Size: 162KB - Virtual size: 161KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

11:21:fb:e8:00:4e:ad:7c:c5:99:b0:89:a5:15:56:c8:18:40
Certificate

c3:af:90:f5:ad:d6:b7:45:04:b8:de:94:13:1e:27:f4:01:b3:bc:06
Signer

.text
Size: 875KB - Virtual size: 874KB

.rdata
Size: 225KB - Virtual size: 224KB

.data
Size: 17KB - Virtual size: 44KB

.rsrc
Size: 162KB - Virtual size: 161KB