2024-07-11_fc9c25098125bb29de5194a93c75ceff_icedid

Sharing

Copy URL

Twitter E-mail

General

Target

2024-07-11_fc9c25098125bb29de5194a93c75ceff_icedid
Size

1.5MB
MD5

fc9c25098125bb29de5194a93c75ceff
SHA1

0f3495b94689bec1ad0ffd389acc10d542f36b99
SHA256

2b174d0cb477507e845f39280dfd934950de19bc8902e547a866e73381c25e36
SHA512

a1998b4c537c99b5d55b93771c65e6bd3760e41887f2d5d0f1019306430d728d3f5e1dfa9e70050a9603731bef9bc0ad5fa805ea787630d799f252c22fd2c1c7
SSDEEP

24576:+mnhEqoOaT9tKpPn1rj1ieod3peIdBoreh42c6M27g1fn1Qc:+WhEZOQjKpP0d5eIk2T+1fnCc

Score

1^/10

Malware Config

Signatures

Files

2024-07-11_fc9c25098125bb29de5194a93c75ceff_icedid
.exe windows:5 windows x86 arch:x86

f7adc0c62f1d34f7313d1c5959c865f3

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-04-2021 00:00

Not After

28-04-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:8c:af:f5:9b:1d:48:c7:e5:1d:82:13:8d:fe:26:c4
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

30-04-2024 00:00

Not After

28-04-2026 23:59

Subject

CN=BlueMoonSoft Co.\,Ltd.,O=BlueMoonSoft Co.\,Ltd.,L=Dongjak-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23-12-2017 00:00

Not After

22-03-2029 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

f4:84:d9:9e:67:62:ce:fd:03:50:f6:ef:80:5f:7d:1c:87:7d:33:3c:f9:9e:b1:87:b1:c3:f1:0d:37:9a:e5:1f
Signer

Actual PE Digest

f4:84:d9:9e:67:62:ce:fd:03:50:f6:ef:80:5f:7d:1c:87:7d:33:3c:f9:9e:b1:87:b1:c3:f1:0d:37:9a:e5:1f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

g:\Project\gradius_project_src\GRADIUS\Client\BMSAgentInstaller2\Release\BMSAgentInstaller.pdb

Imports

kernel32

VirtualAlloc
VirtualQuery
GetFileInformationByHandle
PeekNamedPipe
GetFileType
GetSystemTimeAsFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
ExitProcess
RaiseException
HeapReAlloc
HeapSize
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetStartupInfoA
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetConsoleCP
GetConsoleMode
VirtualProtect
GetACP
GetOEMCP
IsValidCodePage
SetStdHandle
LCMapStringW
InitializeCriticalSectionAndSpinCount
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
LCMapStringA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
CreateFileA
GetCurrentDirectoryA
GetDriveTypeA
GetProcessHeap
SetEnvironmentVariableA
HeapAlloc
HeapFree
GetStartupInfoW
GetFileSizeEx
GetFileAttributesW
SetErrorMode
GetFullPathNameW
GetVolumeInformationW
DuplicateHandle
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
GetThreadLocale
InterlockedIncrement
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
GlobalFlags
WritePrivateProfileStringW
GlobalFindAtomW
CompareStringW
LoadLibraryA
GetVersionExA
InterlockedDecrement
GlobalAddAtomW
FreeResource
FileTimeToLocalFileTime
SetLastError
GlobalFree
GlobalUnlock
FormatMessageW
MulDiv
GlobalDeleteAtom
GetCurrentThread
GetCurrentThreadId
ConvertDefaultLocale
EnumResourceLanguagesW
lstrcmpA
GetLocaleInfoW
LoadLibraryExW
CompareStringA
InterlockedExchange
GlobalLock
lstrcmpW
GlobalAlloc
GetModuleHandleA
FindNextFileW
GetCurrentProcessId
GetTimeZoneInformation
SetFilePointer
FileTimeToSystemTime
GetFileTime
LocalAlloc
LocalFree
ProcessIdToSessionId
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
TerminateProcess
GetExitCodeProcess
OpenProcess
WriteFile
VerifyVersionInfoW
VerSetConditionMask
GetSystemWow64DirectoryW
MoveFileW
lstrlenW
FindClose
FindFirstFileW
CloseHandle
ReadFile
GetFileSize
CreateFileW
WideCharToMultiByte
FindResourceExW
MultiByteToWideChar
lstrlenA
IsBadWritePtr
IsBadReadPtr
GetSystemInfo
GetModuleHandleW
CreateDirectoryW
FreeLibrary
GetLastError
GetProcAddress
LoadLibraryW
SetFileAttributesW
WaitForSingleObject
GetSystemDirectoryW
GetCurrentProcess
IsWow64Process
GetSystemDefaultLangID
GetModuleFileNameW
GetVersionExW
DeleteFileW
Sleep
GetTickCount
FindResourceW
LoadResource
LockResource
SizeofResource
GetCPInfo

user32

IsChild
GetCapture
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
SetFocus
GetWindowTextW
GetForegroundWindow
GetTopWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetMenu
SetForegroundWindow
UpdateWindow
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
EqualRect
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
PtInRect
GetMenu
SetWindowLongW
OffsetRect
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GetWindowRect
GetSysColor
DestroyMenu
CopyRect
UnhookWindowsHookEx
GetDesktopWindow
WinHelpW
CreateDialogIndirectParamW
DestroyWindow
IsWindow
GetDlgItem
GetNextDlgTabItem
EndDialog
GetWindowLongW
GetLastActivePopup
IsWindowEnabled
SetCursor
FindWindowW
SendDlgItemMessageA
SendDlgItemMessageW
RegisterWindowMessageW
SetWindowsHookExW
CallNextHookEx
GetMessageW
GetActiveWindow
IsWindowVisible
GetKeyState
GetCursorPos
ValidateRect
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
GetFocus
ModifyMenuW
EnableMenuItem
CheckMenuItem
GetWindow
SetWindowContextHelpId
GetParent
MapDialogRect
SetWindowPos
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
PostQuitMessage
GetWindowThreadProcessId
DispatchMessageW
TranslateMessage
PeekMessageW
EnableWindow
DrawIcon
GetClientRect
GetSystemMetrics
IsIconic
SendMessageW
AppendMenuW
GetSystemMenu
LoadIconW
LoadStringW
DrawTextW
DrawTextExW
GrayStringW
ClientToScreen
GetDC
ReleaseDC
GetWindowDC
BeginPaint
EndPaint
MessageBoxW
PostMessageW
IsDialogMessageW
SetWindowTextW
PostThreadMessageW
RegisterClipboardFormatW
UnregisterClassW
CharUpperW
MessageBeep
GetNextDlgGroupItem
InvalidateRgn
InvalidateRect
SetRect
IsRectEmpty
CopyAcceleratorTableW
CharNextW
GetSysColorBrush
ReleaseCapture
LoadCursorW
SetCapture
ShowWindow
SetActiveWindow
MoveWindow
TabbedTextOutW

gdi32

SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
DeleteDC
GetStockObject
Escape
GetBkColor
GetTextColor
CreateRectRgnIndirect
GetRgnBox
GetMapMode
RectVisible
TextOutW
PtVisible
GetWindowExtEx
GetViewportExtEx
DeleteObject
SetMapMode
RestoreDC
SaveDC
SetBkColor
SetTextColor
GetClipBox
ExtTextOutW
GetObjectW
CreateBitmap
GetDeviceCaps

comdlg32

GetFileTitleW

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

advapi32

RegOpenKeyExW
RegQueryValueW
RegOpenKeyW
RegEnumKeyW
RegDeleteKeyW
RegQueryValueExW
OpenSCManagerW
CryptDecrypt
CryptReleaseContext
CryptDestroyHash
CryptDestroyKey
CryptEncrypt
CryptSetKeyParam
CryptDeriveKey
CryptHashData
CryptCreateHash
CryptAcquireContextW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegCloseKey
RegSetValueExW
RegCreateKeyExW
CreateServiceW
StartServiceW
CloseServiceHandle
ControlService
OpenServiceW

shell32

ShellExecuteExW

comctl32

InitCommonControlsEx

shlwapi

StrCmpW
PathFindFileNameW
PathFindExtensionW
PathIsUNCW
PathStripToRootW

oledlg

OleUIBusyW

ole32

StgOpenStorageOnILockBytes
CoGetClassObject
CLSIDFromString
CLSIDFromProgID
CoTaskMemAlloc
StgCreateDocfileOnILockBytes
CoTaskMemFree
CoUninitialize
CoCreateInstance
CoInitialize
CreateILockBytesOnHGlobal
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CoRevokeClassObject
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter

oleaut32

SysAllocStringLen
SysFreeString
SysStringLen
VariantClear
VariantChangeType
VariantInit
VariantCopy
SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
OleCreateFontIndirect
SysAllocString

Sections

.text
Size: 301KB - Virtual size: 300KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 96KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f7adc0c62f1d34f7313d1c5959c865f3

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

03:8c:af:f5:9b:1d:48:c7:e5:1d:82:13:8d:fe:26:c4Certificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

f4:84:d9:9e:67:62:ce:fd:03:50:f6:ef:80:5f:7d:1c:87:7d:33:3c:f9:9e:b1:87:b1:c3:f1:0d:37:9a:e5:1fSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

Sections

.text Size: 301KB - Virtual size: 300KB

.rdata Size: 96KB - Virtual size: 96KB

.data Size: 11KB - Virtual size: 26KB

.rsrc Size: 1.0MB - Virtual size: 1.0MB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

03:8c:af:f5:9b:1d:48:c7:e5:1d:82:13:8d:fe:26:c4
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

f4:84:d9:9e:67:62:ce:fd:03:50:f6:ef:80:5f:7d:1c:87:7d:33:3c:f9:9e:b1:87:b1:c3:f1:0d:37:9a:e5:1f
Signer

.text
Size: 301KB - Virtual size: 300KB

.rdata
Size: 96KB - Virtual size: 96KB

.data
Size: 11KB - Virtual size: 26KB

.rsrc
Size: 1.0MB - Virtual size: 1.0MB