2024-07-04_b12aa59e24be55008c4a237627c41f07_icedid

Sharing

Copy URL Twitter E-mail

General

Target

2024-07-04_b12aa59e24be55008c4a237627c41f07_icedid
Size

356KB
MD5

b12aa59e24be55008c4a237627c41f07
SHA1

58cd64e145a247b89de1be6a8f6fa2d6413acedb
SHA256

2cbb9e3b5649fa0502134e186fe3b1c31395f14388604bbe92e4709ce9e15e16
SHA512

cc28c310850fe1b4df56c87ead728f4efcca8737cd18757b7211fb6009580b42e7b71109a1f232fff2bbb57a75ef85d5c5a53c3106aaeaf9a1ab577a064c590b
SSDEEP

6144:hvYvc8C9lfOzM6MtNqA7Ud6EfEkuygEBZgg7G8BQ5JXEPv:J38oNGMtEdd6EMkzgoS8mXEPv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-07-04_b12aa59e24be55008c4a237627c41f07_icedid

Files

2024-07-04_b12aa59e24be55008c4a237627c41f07_icedid
.exe windows:4 windows x86 arch:x86

7ded97d9d023911c0ab8a3ab54e0c8a8

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Windows\SourceManage\down\downmodule.pdb

Imports

rpcrt4

UuidCreate
UuidToStringA
RpcStringFreeA

kernel32

FileTimeToLocalFileTime
InterlockedIncrement
GlobalReAlloc
GlobalHandle
TlsGetValue
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
GlobalFlags
GetCPInfo
GetOEMCP
SetErrorMode
RtlUnwind
HeapAlloc
HeapFree
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetSystemTimeAsFileTime
HeapReAlloc
GetTimeFormatA
GetDateFormatA
GetCommandLineA
HeapSize
SetStdHandle
GetFileType
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetCurrentProcessId
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
HeapDestroy
HeapCreate
VirtualFree
IsBadWritePtr
UnhandledExceptionFilter
GetTimeZoneInformation
SetHandleCount
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
IsBadReadPtr
IsBadCodePtr
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
GetLocaleInfoW
SetEnvironmentVariableA
GetVolumeInformationA
FindClose
GetCurrentProcess
DuplicateHandle
UnlockFile
LockFile
FlushFileBuffers
GetFullPathNameA
GetFileTime
RaiseException
InterlockedDecrement
GlobalGetAtomNameA
GlobalFindAtomA
lstrcatA
lstrcmpW
GlobalAddAtomA
FreeResource
GetCurrentThread
GetCurrentThreadId
GlobalDeleteAtom
lstrcmpA
ConvertDefaultLocale
EnumResourceLanguagesA
lstrcpyA
LoadLibraryA
SetLastError
GlobalFree
MulDiv
GlobalAlloc
GlobalLock
GlobalUnlock
lstrcpynA
ResumeThread
SetEvent
CreateEventA
GetTickCount
FreeLibrary
OutputDebugStringA
SetEndOfFile
FindFirstFileA
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetFileSize
SetFilePointer
ExpandEnvironmentStringsA
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
OpenProcess
TerminateProcess
CreateFileA
WriteFile
ReadFile
TerminateThread
WaitForSingleObject
CompareStringW
CompareStringA
lstrcmpiA
GetVersion
GetExitCodeThread
DeleteFileA
GetLocalTime
GetFileAttributesA
InitializeCriticalSection
GetPrivateProfileIntA
CreateThread
ExitProcess
GetStdHandle
WritePrivateProfileStringA
EnterCriticalSection
LeaveCriticalSection
GetPrivateProfileStringA
CloseHandle
DeleteCriticalSection
GetLastError
FormatMessageA
lstrlenA
LocalAlloc
LocalFree
OpenMutexA
CreateMutexA
Sleep
FindResourceA
LoadResource
LockResource
SizeofResource
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
MultiByteToWideChar
WideCharToMultiByte
GetStartupInfoA

user32

InvalidateRgn
CopyAcceleratorTableA
SetRect
IsRectEmpty
CharNextA
SetCapture
LoadCursorA
GetSysColorBrush
ReleaseCapture
InvalidateRect
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
DestroyMenu
ShowWindow
MoveWindow
SetWindowTextA
IsDialogMessageA
RegisterWindowMessageA
WinHelpA
GetCapture
CreateWindowExA
GetClassLongA
GetClassInfoExA
GetClassNameA
SetPropA
GetPropA
RemovePropA
SendDlgItemMessageA
SetFocus
IsChild
GetWindowTextA
GetForegroundWindow
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
MapWindowPoints
SetForegroundWindow
UpdateWindow
GetMenu
GetSysColor
AdjustWindowRectEx
EqualRect
GetClassInfoA
RegisterClassA
UnregisterClassA
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
SetWindowLongA
OffsetRect
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GetWindowRect
CopyRect
PtInRect
GetWindow
SetWindowContextHelpId
MapDialogRect
SetWindowPos
wsprintfA
SetMenuItemBitmaps
GetFocus
ModifyMenuA
EnableMenuItem
CheckMenuItem
GetMenuCheckMarkDimensions
LoadBitmapA
SetWindowsHookExA
CallNextHookEx
GetMessageA
TranslateMessage
DispatchMessageA
PostThreadMessageA
GetKeyState
PeekMessageA
GetCursorPos
ValidateRect
GetLastActivePopup
SetCursor
GetDesktopWindow
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
RegisterClipboardFormatA
MessageBeep
GetNextDlgGroupItem
IsWindow
GetWindowLongA
GetDlgItem
IsWindowEnabled
GetNextDlgTabItem
EndDialog
PostQuitMessage
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
EnumWindows
GetWindowThreadProcessId
IsWindowVisible
GetParent
CharUpperA
MessageBoxA
GetSystemMetrics
LoadIconA
EnableWindow
GetClientRect
IsIconic
GetSystemMenu
PostMessageA
SendMessageA
AppendMenuA
DrawIcon

gdi32

CreateRectRgnIndirect
GetRgnBox
GetMapMode
GetTextColor
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
TextOutA
RectVisible
PtVisible
GetWindowExtEx
GetViewportExtEx
GetBkColor
GetStockObject
DeleteDC
ExtSelectClipRgn
ScaleWindowExtEx
CreateBitmap
GetDeviceCaps
DeleteObject
SetMapMode
RestoreDC
SaveDC
ExtTextOutA
GetObjectA
SetBkColor
SetTextColor
GetClipBox
SetWindowExtEx

comdlg32

GetFileTitleA

winspool.drv

ClosePrinter
DocumentPropertiesA
OpenPrinterA

advapi32

RegQueryValueExA
RegOpenKeyExA
RegOpenKeyA
RegDeleteKeyA
RegEnumKeyA
RegQueryValueA
RegCreateKeyExA
RegSetValueExA
RegCloseKey

comctl32

ord17

shlwapi

PathAppendA
PathFindFileNameA
PathStripToRootA
PathIsUNCA
PathFileExistsA
PathFindExtensionA

ws2_32

htonl
bind
listen
closesocket
WSAStartup
WSACleanup
recv
htons
socket
send
connect
gethostbyname
ioctlsocket
select
WSAGetLastError
inet_ntoa
gethostname
getsockname
shutdown
accept
setsockopt
WSAIoctl
inet_addr

oledlg

ord8

ole32

CoTaskMemFree
CoRegisterMessageFilter
OleFlushClipboard
OleIsCurrentClipboard
CoRevokeClassObject
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CLSIDFromString
CLSIDFromProgID
CoTaskMemAlloc

oleaut32

SysStringLen
SysAllocStringByteLen
SysAllocStringLen
VariantClear
OleCreateFontIndirect
SysAllocString
SystemTimeToVariantTime
SafeArrayDestroy
SysFreeString
VariantCopy
VariantInit
VariantChangeType

winmm

timeSetEvent
timeKillEvent

psapi

EnumProcessModules
EnumProcesses
GetModuleFileNameExA

netapi32

Netbios

Sections

.text
Size: 240KB - Virtual size: 239KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 60KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 40KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7ded97d9d023911c0ab8a3ab54e0c8a8

Headers

File Characteristics

PDB Paths

Imports

rpcrt4

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

comctl32

shlwapi

ws2_32

oledlg

ole32

oleaut32

winmm

psapi

netapi32

Sections

.text Size: 240KB - Virtual size: 239KB

.rdata Size: 60KB - Virtual size: 58KB

.data Size: 12KB - Virtual size: 30KB

.rsrc Size: 40KB - Virtual size: 36KB

.text
Size: 240KB - Virtual size: 239KB

.rdata
Size: 60KB - Virtual size: 58KB

.data
Size: 12KB - Virtual size: 30KB

.rsrc
Size: 40KB - Virtual size: 36KB