2024-07-01_718c548405d41c962a2b042cd164774b_chir_icedid_nymaim

Sharing

Copy URL Twitter E-mail

General

Target

2024-07-01_718c548405d41c962a2b042cd164774b_chir_icedid_nymaim
Size

3.9MB
MD5

718c548405d41c962a2b042cd164774b
SHA1

1ce6c6f4212af4025a7ca0280e706a3bd5a93fff
SHA256

ddd6ccfc0a6725951f51bf5e01e72917f1ef651e28c0ab9e2d7e618e924368d3
SHA512

c46be479387d4892b4886dd5f7a9a0c891bf1806c2bc761bed12e56ba4ea43d541af6b258cb29f59c721adfdca4dc8dcbea9077c5681017168686256604092ed
SSDEEP

49152:jUrzg71FRQ7HkR93/ddPHTRaPE4hMw5HiJLu:jZHRBR93VdPzRGh55HiJL

Score

1^/10

Malware Config

Signatures

Files

2024-07-01_718c548405d41c962a2b042cd164774b_chir_icedid_nymaim
.exe windows:4 windows x86 arch:x86

d71010d64cc36222e4fb45b9dfeae829

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:24:f4:75:eb:a5:95:13:91:c5:12:6c:f4:ee:b3:ce
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

05/01/2018, 00:00

Not After

05/01/2019, 23:59

Subject

CN=Power Software Limited,O=Power Software Limited,L=NORTH POINT,ST=HONG KONG,C=HK

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

58:ed:01:9d:da:86:72:57:49:3e:61:e5:f1:8d:fa:f4
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

17/05/2017, 00:00

Not After

15/08/2020, 23:59

Subject

CN=Power Software Limited,O=Power Software Limited,L=North Point,ST=Hong Kong,C=HK

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

ce:4a:b9:d7:82:2a:19:58:e5:01:a3:ef:fb:1e:05:cd:50:26:67:14:51:b1:7f:a4:47:8c:5a:0c:0c:f1:79:6d
Signer

Actual PE Digest

ce:4a:b9:d7:82:2a:19:58:e5:01:a3:ef:fb:1e:05:cd:50:26:67:14:51:b1:7f:a4:47:8c:5a:0c:0c:f1:79:6d

Digest Algorithm

sha256

PE Digest Matches

false

3f:38:a8:e9:03:4b:8b:22:bf:b5:20:0c:d6:2c:11:7c:11:fa:ef:78
Signer

Actual PE Digest

3f:38:a8:e9:03:4b:8b:22:bf:b5:20:0c:d6:2c:11:7c:11:fa:ef:78

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

winmm

mixerGetLineControlsW
mixerGetLineInfoW
mixerClose
mixerSetControlDetails
mixerGetNumDevs
mixerOpen
mixerGetDevCapsW
waveOutGetDevCapsW
waveOutOpen
waveOutReset
waveOutClose
waveOutUnprepareHeader
mixerGetControlDetailsW
waveOutWrite
waveOutPrepareHeader

kernel32

SetHandleCount
GetStdHandle
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
GetModuleFileNameA
VirtualAlloc
IsBadWritePtr
LCMapStringA
SetUnhandledExceptionFilter
SetStdHandle
GetDriveTypeA
GetStringTypeA
IsBadReadPtr
IsBadCodePtr
CompareStringA
GetACP
GetOEMCP
SetEnvironmentVariableA
GetWindowsDirectoryA
GetCommandLineA
InterlockedExchange
QueryPerformanceCounter
FindResourceA
FindClose
GetLocalTime
FileTimeToSystemTime
FileTimeToLocalFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
Sleep
WaitForSingleObject
ReadFile
SetLastError
ExitProcess
ResumeThread
SuspendThread
CreateThread
GetTickCount
LocalFree
LocalAlloc
GlobalUnlock
GlobalLock
GlobalFree
DeviceIoControl
CloseHandle
GetLastError
GetCommandLineW
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
HeapSize
GetFileType
RaiseException
TerminateProcess
RtlUnwind
GetSystemTimeAsFileTime
HeapFree
GetCurrentDirectoryA
GetSystemTime
GetTimeZoneInformation
HeapAlloc
HeapReAlloc
SetErrorMode
GetProcessVersion
LocalReAlloc
GlobalReAlloc
TlsFree
GlobalFlags
lstrcmpiA
UnlockFile
LockFile
FlushFileBuffers
lstrcmpA
GetModuleHandleA
GlobalDeleteAtom
lstrlenA
InterlockedDecrement
InterlockedIncrement
LoadLibraryA
GetProfileStringA
GlobalAddAtomA
GetFileInformationByHandle
MoveFileExW
TlsAlloc
DosDateTimeToFileTime
TlsSetValue
TlsGetValue
GetSystemDefaultLangID
SetThreadExecutionState
CreateEventA
GetOverlappedResult
GetCurrentThread
GetFileSize
WriteFile
MapViewOfFile
UnmapViewOfFile
GetThreadPriority
WinExec
GetExitCodeProcess
CreatePipe
DuplicateHandle
DeleteCriticalSection
SetFilePointer
SetEndOfFile
GlobalSize
GetCurrentProcessId
MulDiv
SetEvent
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
SetThreadPriority
GetFileTime
GlobalHandle
LoadResource
SizeofResource
LockResource
GlobalAlloc
GetCurrentThreadId
GetCurrentProcess
GetVersion
DefineDosDeviceW
GetLogicalDrives
SetFileTime
FreeLibrary
ResetEvent
GetSystemDirectoryA

user32

SetRect
SetParent
BringWindowToTop
UnpackDDElParam
ReuseDDElParam
SetRectEmpty
TranslateMessage
DestroyCursor
SetCursorPos
DestroyMenu
MapDialogRect
GetAsyncKeyState
EndPaint
BeginPaint
GetMenuCheckMarkDimensions
GetMenuState
SetMenuItemBitmaps
IsDlgButtonChecked
CheckRadioButton
SendDlgItemMessageA
MapWindowPoints
AdjustWindowRectEx
DeferWindowPos
ScrollWindow
GetScrollInfo
SetScrollInfo
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
GetTopWindow
IsChild
GetMenu
TrackPopupMenu
GetMessageTime
GetLastActivePopup
GetForegroundWindow
GetWindow
PostQuitMessage
EndDialog
GetActiveWindow
SetActiveWindow
DestroyWindow
IsWindowEnabled
MessageBoxA
DrawEdge
CreateIconIndirect
ShowWindow
IsWindow
EnumChildWindows
GetWindowPlacement
MoveWindow
SetWindowPos
DrawFrameControl
FrameRect
DrawFocusRect
MessageBeep
IsIconic
DrawIcon
SetMenuDefaultItem
IsWindowVisible
GetKeyboardLayout
IntersectRect
SetCaretPos
GetSystemMetrics
SetCapture
HideCaret
CreateCaret
ShowCaret
ReleaseCapture
DestroyCaret
IsRectEmpty
FillRect
InvalidateRgn
SetMenu
CheckMenuRadioItem
GetSysColorBrush
GetCapture
GetMessagePos
IsZoomed
GetIconInfo
DestroyIcon
SetClipboardData
EmptyClipboard
PtInRect
GetWindowDC
ShowOwnedPopups
ValidateRect
GetDCEx
GetNextDlgTabItem
GetMenuItemCount
WindowFromPoint
UpdateWindow
GetDesktopWindow
TrackPopupMenuEx
UnhookWindowsHookEx
CallNextHookEx
GetDlgItem
SetFocus
GetKeyState
GetFocus
EqualRect
BeginDeferWindowPos
EndDeferWindowPos
GetDC
ReleaseDC
RedrawWindow
InflateRect
GetSysColor
CopyRect
OffsetRect
OpenClipboard
CloseClipboard
GetSystemMenu
BroadcastSystemMessage
GetMenuItemID
RemoveMenu
CreatePopupMenu
EnableMenuItem
CheckMenuItem
GetSubMenu
GetClientRect
ClientToScreen
GetWindowRect
SetForegroundWindow
GetParent
LockWindowUpdate
ShowScrollBar
SetTimer
KillTimer
GetCursorPos
ScreenToClient
SetCursor
InvalidateRect
GetClassNameA
SendMessageA
SetWindowsHookExA
CharNextA
DefWindowProcA
DefDlgProcA
GetClassInfoA
DrawTextA
GetWindowTextA
ExcludeUpdateRgn
GetWindowTextLengthA
GetDlgCtrlID

gdi32

GetClipBox
SaveDC
RestoreDC
SetBkMode
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
SelectClipRgn
ExcludeClipRect
IntersectClipRect
MoveToEx
LineTo
GetViewportExtEx
GetWindowExtEx
CreatePatternBrush
CombineRgn
StretchDIBits
LPtoDP
SetDIBits
Escape
RectVisible
PtVisible
CreateRectRgn
Ellipse
GetDeviceCaps
DeleteDC
GetBkColor
GetTextColor
SetBkColor
SetTextColor
CreateRectRgnIndirect
SetRectRgn
TranslateCharsetInfo
SetBoundsRect
RoundRect
GetDIBits
CreateCompatibleBitmap
CreatePen
DeleteObject
CreateSolidBrush
Rectangle
GetStockObject
PatBlt
CreateDIBSection
CreateCompatibleDC
SelectObject
CreateBitmap
StretchBlt
BitBlt
SetStretchBltMode
SetPixel
ExtTextOutA
GetTextExtentPointA
CreateDIBitmap
GetPixel

winspool.drv

ClosePrinter

advapi32

RegOpenKeyExA
GetTokenInformation
OpenProcessToken
LookupAccountNameW
AdjustTokenPrivileges
LookupPrivilegeValueW
SetNamedSecurityInfoW
SetEntriesInAclW
BuildExplicitAccessWithNameW
GetNamedSecurityInfoW
DeleteAce
EqualSid
GetAce
GetAclInformation
RegQueryValueExA
RegCloseKey

shell32

SHGetSpecialFolderPathW
SHGetMalloc
SHGetDesktopFolder
DragFinish
DragAcceptFiles

comctl32

ImageList_AddMasked
ImageList_Add
_TrackMouseEvent
ImageList_SetBkColor
ImageList_ReplaceIcon
ImageList_Destroy
ImageList_Create
ord17
PropertySheetW
DestroyPropertySheetPage
CreatePropertySheetPageW

ole32

OleSetClipboard
DoDragDrop
OleGetClipboard
CoTaskMemFree
RegisterDragDrop
PropVariantClear
CoCreateInstance
CoUninitialize
ReleaseStgMedium
OleFlushClipboard
CoLockObjectExternal
RevokeDragDrop
OleInitialize
OleUninitialize
CoFreeUnusedLibraries
OleDuplicateData
CoTaskMemAlloc
CoInitialize
OleIsCurrentClipboard
CoRegisterMessageFilter
CoRevokeClassObject
CreateStreamOnHGlobal

olepro32

ord251

oleaut32

SysFreeString
VariantClear
SysAllocString
SysStringByteLen

wininet

InternetAttemptConnect
InternetOpenW
InternetCloseHandle
HttpSendRequestW
HttpAddRequestHeadersW
HttpOpenRequestW
InternetReadFile
HttpQueryInfoW
InternetConnectW

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 940KB - Virtual size: 937KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 836KB - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 462KB - Virtual size: 462KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

d71010d64cc36222e4fb45b9dfeae829

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

13:24:f4:75:eb:a5:95:13:91:c5:12:6c:f4:ee:b3:ceCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

58:ed:01:9d:da:86:72:57:49:3e:61:e5:f1:8d:fa:f4Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

ce:4a:b9:d7:82:2a:19:58:e5:01:a3:ef:fb:1e:05:cd:50:26:67:14:51:b1:7f:a4:47:8c:5a:0c:0c:f1:79:6dSigner

3f:38:a8:e9:03:4b:8b:22:bf:b5:20:0c:d6:2c:11:7c:11:fa:ef:78Signer

Headers

File Characteristics

Imports

winmm

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

comctl32

ole32

olepro32

oleaut32

wininet

Sections

.text Size: 1.7MB - Virtual size: 1.7MB

.rdata Size: 940KB - Virtual size: 937KB

.data Size: 836KB - Virtual size: 2.0MB

.rsrc Size: 462KB - Virtual size: 462KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

13:24:f4:75:eb:a5:95:13:91:c5:12:6c:f4:ee:b3:ce
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

58:ed:01:9d:da:86:72:57:49:3e:61:e5:f1:8d:fa:f4
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

ce:4a:b9:d7:82:2a:19:58:e5:01:a3:ef:fb:1e:05:cd:50:26:67:14:51:b1:7f:a4:47:8c:5a:0c:0c:f1:79:6d
Signer

3f:38:a8:e9:03:4b:8b:22:bf:b5:20:0c:d6:2c:11:7c:11:fa:ef:78
Signer

.text
Size: 1.7MB - Virtual size: 1.7MB

.rdata
Size: 940KB - Virtual size: 937KB

.data
Size: 836KB - Virtual size: 2.0MB

.rsrc
Size: 462KB - Virtual size: 462KB