Behavioral task
behavioral1
Sample
2024-07-02_cd1801f7d14e01364fd57038e7cca70e_icedid.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
2024-07-02_cd1801f7d14e01364fd57038e7cca70e_icedid.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-07-02_cd1801f7d14e01364fd57038e7cca70e_icedid
-
Size
14KB
-
MD5
cd1801f7d14e01364fd57038e7cca70e
-
SHA1
73afca4045a2b9767a8ac5dd6d69935c7f4e1b79
-
SHA256
35d30d73e4ab515b7120e65fdda108c94ccd7de5f7e0ad35e1f1c41b3ec6f53c
-
SHA512
f9f02e1f7a72a8ddd99da63f674827a5922a51aee6714444e50d05231aba9762aca77474410e1ebb4b353b935b561438b4e6d40a6ed3597d02d6829c76efa999
-
SSDEEP
192:eC+YPv6UOyDqZ1KcMzqTHG+3F+j7rT9z7VYe/7Vd/5A27E0mgGnfL:eev6UbqZ1K7zX+3q7PEe/7Vd227E0lMj
Malware Config
Extracted
icedid
Signatures
-
Icedid family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-07-02_cd1801f7d14e01364fd57038e7cca70e_icedid
Files
-
2024-07-02_cd1801f7d14e01364fd57038e7cca70e_icedid.exe windows:6 windows x64 arch:x64
3a0cfb574e9f4ca8db6893e099e2d5bb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
advapi32
GetUserNameW
LookupAccountNameW
winhttp
WinHttpSetOption
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpOpenRequest
WinHttpCloseHandle
WinHttpOpen
WinHttpSetStatusCallback
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpConnect
kernel32
WideCharToMultiByte
lstrlenW
VirtualProtect
VirtualAlloc
lstrcatA
lstrcpyA
Sleep
GetTempPathA
CreateDirectoryA
LoadLibraryA
GetProcAddress
GetComputerNameExW
ExitProcess
HeapAlloc
HeapFree
GetProcessHeap
CreateFileA
WriteFile
CloseHandle
HeapReAlloc
GetLastError
SwitchToThread
GetTickCount64
shell32
SHGetFolderPathA
msvcrt
memset
user32
wsprintfW
Sections
.c Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: 512B - Virtual size: 6B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: 512B - Virtual size: 396B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.r Size: 512B - Virtual size: 416B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.d Size: 512B - Virtual size: 128B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE