V:\hyp_bin\windows\VisIbis\ICX_Release\WinIbis.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-05_a552d5962e4b5aa8172e5677e4e677a9_icedid.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-08-05_a552d5962e4b5aa8172e5677e4e677a9_icedid.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-05_a552d5962e4b5aa8172e5677e4e677a9_icedid
-
Size
3.0MB
-
MD5
a552d5962e4b5aa8172e5677e4e677a9
-
SHA1
3e7539ac5393e38f41787e7eb0be3acb505242be
-
SHA256
dffbb5e95f85791dff64b13b893ebf57b62a41737c33279da8325298d5ffffb3
-
SHA512
9b2ddd37e364316f965e2543a683233085cf9805d163d781afe8b4f751e4defd03f6d1d84f173def26fd0655d52ceda8d35dc895075042b2a5f547e28dddeffc
-
SSDEEP
98304:1tIwsk0sAtMjvumXwNPJp8eF603TEBBT3TKV4:XIwN0smS/ANPJp8eF64EBAC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-08-05_a552d5962e4b5aa8172e5677e4e677a9_icedid
Files
-
2024-08-05_a552d5962e4b5aa8172e5677e4e677a9_icedid.exe windows:5 windows x86 arch:x86
18c7a8d81d41d32a5083124b7a8fc4bb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
version
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
mgc_olh
OlhHelpCall
kernel32
SetEnvironmentVariableA
ExitProcess
GetCommandLineA
GetStartupInfoA
VirtualAlloc
ExitThread
CreateThread
HeapSize
HeapCreate
HeapDestroy
VirtualFree
FatalAppExitA
GetACP
IsValidCodePage
GetStdHandle
GetTimeZoneInformation
LCMapStringA
LCMapStringW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetHandleCount
GetFileType
SetStdHandle
CreateFileW
SetConsoleCtrlHandler
InitializeCriticalSectionAndSpinCount
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoW
GetProcessHeap
CompareStringW
SizeofResource
LockResource
GetConsoleMode
LoadResource
FindResourceA
WideCharToMultiByte
Sleep
GetTickCount
MulDiv
GlobalUnlock
GlobalAlloc
GlobalLock
FormatMessageA
GetLastError
LocalFree
LocalUnlock
LocalHandle
LocalAlloc
GetProcAddress
GetFileAttributesA
CreateDirectoryA
GetFullPathNameA
SetLastError
WriteFile
FindClose
FindFirstFileA
GlobalFree
GetModuleFileNameA
FreeLibrary
GetDiskFreeSpaceA
SetCurrentDirectoryA
GetCurrentDirectoryA
LoadLibraryA
UnmapViewOfFile
MapViewOfFile
OpenFileMappingA
GetModuleHandleA
GetSystemInfo
GlobalMemoryStatus
VirtualQuery
CloseHandle
GetExitCodeProcess
GetVersion
SetProcessWorkingSetSize
GetNumberFormatA
GetSystemTime
LocalLock
RemoveDirectoryA
GetConsoleCP
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
HeapReAlloc
GetDriveTypeA
GetDateFormatA
GetTimeFormatA
GetSystemTimeAsFileTime
RaiseException
HeapAlloc
HeapFree
RtlUnwind
FindResourceExA
GetModuleHandleW
GetAtomNameA
GetOEMCP
GetCPInfo
InterlockedIncrement
GlobalFlags
GetFileSizeEx
SystemTimeToFileTime
LocalFileTimeToFileTime
GetFileAttributesExA
FileTimeToLocalFileTime
FileTimeToSystemTime
GetShortPathNameA
GetVolumeInformationA
GetCurrentProcess
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
GetThreadLocale
GetStringTypeExA
DeleteFileA
MoveFileA
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
InterlockedExchange
GetProfileIntA
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
GetFileTime
SetFileTime
WritePrivateProfileStringA
GetPrivateProfileIntA
CreateEventA
SuspendThread
SetEvent
ResumeThread
SetThreadPriority
VirtualProtect
lstrcmpA
GetCurrentProcessId
InterlockedDecrement
GetModuleFileNameW
WaitForSingleObject
CopyFileA
GlobalSize
lstrlenW
lstrlenA
GetCurrentThreadId
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
CompareStringA
MultiByteToWideChar
lstrcmpW
FreeResource
GetVersionExA
GetEnvironmentStrings
FreeEnvironmentStringsA
SetErrorMode
ReadFile
GetPrivateProfileStringA
lstrcmpiA
CreateFileA
GetEnvironmentVariableA
GetTempPathA
GetTempFileNameA
SetFileAttributesA
FindNextFileA
lstrcpynA
lstrcpyA
GetPrivateProfileSectionA
CreateProcessA
user32
WindowFromPoint
UnionRect
UnregisterClassA
GetSysColorBrush
GetDialogBaseUnits
TranslateMDISysAccel
DrawMenuBar
DefMDIChildProcA
DefFrameProcA
SetWindowContextHelpId
ShowOwnedPopups
CharUpperA
PostQuitMessage
DestroyIcon
SetParent
GetSystemMenu
DestroyCursor
SetCursorPos
RedrawWindow
IsZoomed
UnpackDDElParam
ReuseDDElParam
GetMenuBarInfo
InsertMenuItemA
MapVirtualKeyA
GetKeyNameTextA
DestroyMenu
GetMenuItemInfoA
GetMessageA
TranslateMessage
ValidateRect
MapDialogRect
InflateRect
GetWindowThreadProcessId
GetMenuStringA
InsertMenuA
RemoveMenu
EndPaint
BeginPaint
GetWindowDC
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
ScrollWindowEx
MoveWindow
SetWindowTextA
IsDialogMessageA
IsDlgButtonChecked
SetDlgItemTextA
SetDlgItemInt
GetDlgItemTextA
GetDlgItemInt
CheckRadioButton
CheckDlgButton
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
ModifyMenuA
LoadIconA
SendDlgItemMessageA
WinHelpA
GetCapture
SetWindowsHookExA
CallNextHookEx
GetClassLongA
GetClassNameA
SetPropA
GetPropA
DrawIcon
SetFocus
GetWindowTextLengthA
DispatchMessageA
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageA
ScrollWindow
TrackPopupMenuEx
TrackPopupMenu
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
GetMenuItemID
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
SetWindowPlacement
GetDlgCtrlID
CallWindowProcA
GetMenu
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GetDesktopWindow
GetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
GetDlgItem
IsWindowEnabled
GetNextDlgTabItem
EndDialog
IsCharAlphaNumericA
GetCursorPos
SetTimer
GetKeyState
LoadStringA
GetLastActivePopup
RegisterClipboardFormatA
ScreenToClient
GetSystemMetrics
GetAsyncKeyState
LoadAcceleratorsA
wsprintfA
MapWindowPoints
DestroyCaret
CreateCaret
IsClipboardFormatAvailable
TranslateAcceleratorA
HideCaret
SetCaretPos
KillTimer
BringWindowToTop
AppendMenuA
CreatePopupMenu
SetRectEmpty
RegisterWindowMessageA
IsMenu
GetMenuItemCount
SetWindowRgn
GetDCEx
SendNotifyMessageA
WaitMessage
GetTabbedTextExtentA
PostThreadMessageA
CreateMenu
WindowFromDC
InSendMessage
GetNextDlgGroupItem
InvalidateRgn
CopyAcceleratorTableA
CharNextA
RemovePropA
LockWindowUpdate
GetMenuState
DeleteMenu
SetWindowPos
IsIconic
CharLowerA
FrameRect
SubtractRect
EnableScrollBar
DrawFocusRect
FindWindowA
GetOpenClipboardWindow
DrawEdge
InvertRect
ShowWindow
SetActiveWindow
SetForegroundWindow
ClientToScreen
PostMessageA
ShowScrollBar
IsChild
GetFocus
MessageBeep
MessageBoxA
GetClipboardData
ShowCaret
GetSysColor
IsWindowVisible
LoadMenuA
GetSubMenu
EnableMenuItem
CheckMenuItem
GetWindowLongA
SetWindowLongA
DefWindowProcA
EmptyClipboard
SetClipboardData
CloseClipboard
PtInRect
IsWindow
ReleaseCapture
LoadCursorA
OpenClipboard
SetCapture
UpdateWindow
ReleaseDC
GetDC
FillRect
SetRect
CopyRect
SetCursor
LoadImageA
IsRectEmpty
GetWindowTextA
InvalidateRect
OffsetRect
EnableWindow
GetParent
GetClientRect
GetWindowRect
SendMessageA
GetWindow
GetForegroundWindow
gdi32
CreatePen
GetTextMetricsA
GetTextFaceA
DeleteDC
GetDIBColorTable
CreateFontIndirectA
GetStockObject
CreatePatternBrush
GetTextColor
RoundRect
PatBlt
ExtTextOutA
GetROP2
Ellipse
GetDCOrgEx
GetClipBox
SetTextColor
SetBkColor
CreateBitmap
SaveDC
RestoreDC
SetBkMode
SetPolyFillMode
SetROP2
SetStretchBltMode
SetGraphicsMode
SetWorldTransform
ModifyWorldTransform
SetMapMode
ExcludeClipRect
IntersectClipRect
OffsetClipRgn
LineTo
MoveToEx
SetTextAlign
SetTextJustification
SetTextCharacterExtra
SetMapperFlags
SetArcDirection
SetColorAdjustment
SelectClipRgn
GetClipRgn
SelectClipPath
GetViewportExtEx
GetWindowExtEx
GetPixel
PtVisible
RectVisible
TextOutA
EnumFontFamiliesExA
GetTextExtentPoint32A
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
Rectangle
ScaleWindowExtEx
GetCurrentPositionEx
ArcTo
PolyDraw
PolylineTo
PolyBezierTo
ExtSelectClipRgn
CreateDIBPatternBrushPt
SelectPalette
PlayMetaFileRecord
GetObjectType
EnumMetaFile
PlayMetaFile
ExtCreatePen
CreateHatchBrush
CopyMetaFileA
CreateDCA
CreateRectRgnIndirect
SetRectRgn
CombineRgn
GetMapMode
DPtoLP
SetAbortProc
AbortDoc
GetCharWidthA
StretchDIBits
GetViewportOrgEx
GetBkColor
CreateEllipticRgn
LPtoDP
GetRgnBox
GetNearestColor
GetBkMode
GetPolyFillMode
GetStretchBltMode
GetTextAlign
GetTextExtentPointA
GetWindowOrgEx
CreateMetaFileA
CloseMetaFile
DeleteMetaFile
EndDoc
EndPage
StartPage
Escape
StartDocA
FrameRgn
FillRgn
SetBrushOrgEx
CreatePolygonRgn
CreateICA
CreateRectRgn
CreateCompatibleBitmap
CreateFontA
CreateSolidBrush
GetObjectA
SelectObject
BitBlt
RealizePalette
Polygon
SetPixel
SetWindowExtEx
DeleteObject
GetDeviceCaps
SetViewportOrgEx
CreatePalette
EnumFontFamiliesA
CreateBrushIndirect
CreatePenIndirect
StretchBlt
CreateCompatibleDC
comdlg32
ChooseColorA
ChooseFontA
CommDlgExtendedError
GetFileTitleA
winspool.drv
GetJobA
OpenPrinterA
ClosePrinter
DocumentPropertiesA
advapi32
RegQueryValueA
RegOpenKeyA
RegEnumKeyA
GetFileSecurityA
SetFileSecurityA
RegDeleteKeyA
RegDeleteValueA
RegSetValueA
RegCloseKey
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCreateKeyA
shell32
SHGetFileInfoA
SHGetPathFromIDListA
SHBrowseForFolderA
ShellExecuteExA
DragQueryFileA
DragFinish
ShellExecuteA
ExtractIconA
shlwapi
PathFindExtensionA
PathRemoveExtensionA
PathStripToRootA
PathIsUNCA
PathRemoveFileSpecW
PathFindFileNameA
oledlg
ord8
ord3
ole32
OleQueryLinkFromData
OleIsRunning
CreateGenericComposite
CreateItemMoniker
OleGetIconOfClass
OleCreateLinkToFile
OleCreateFromFile
OleSetContainedObject
GetHGlobalFromILockBytes
OleLoad
OleCreate
OleCreateStaticFromData
OleCreateLinkFromData
OleCreateFromData
OleLockRunning
OleSaveToStream
WriteClassStm
OleSave
CoFreeUnusedLibraries
OleRun
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
IsAccelerator
OleTranslateAccelerator
OleRegGetMiscStatus
OleRegEnumVerbs
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
OleQueryCreateFromData
StringFromGUID2
CoDisconnectObject
RevokeDragDrop
CoLockObjectExternal
RegisterDragDrop
CLSIDFromString
CLSIDFromProgID
DoDragDrop
OleFlushClipboard
OleIsCurrentClipboard
OleSetClipboard
OleGetClipboard
CoInitializeEx
OleSetMenuDescriptor
CoRegisterMessageFilter
CoCreateInstance
CoUninitialize
OleDuplicateData
CoTaskMemAlloc
ReleaseStgMedium
CreateBindCtx
CoTreatAsClass
StringFromCLSID
ReadClassStg
ReadFmtUserTypeStg
OleRegGetUserType
WriteClassStg
WriteFmtUserTypeStg
SetConvertStg
CoTaskMemFree
OleUninitialize
OleInitialize
CoGetMalloc
OleConvertIStorageToOLESTREAM
CoRevokeClassObject
CoRegisterClassObject
CreateDataAdviseHolder
CreateOleAdviseHolder
StgIsStorageFile
StgCreateDocfile
StgOpenStorage
CreateFileMoniker
CreateStreamOnHGlobal
OleConvertOLESTREAMToIStorage
ProgIDFromCLSID
GetRunningObjectTable
oleaut32
VariantClear
SysAllocString
OleCreateFontIndirect
VarBstrFromDate
VarCyFromStr
VarDecFromStr
VarBstrFromDec
VarBstrFromCy
VarDateFromStr
SysReAllocStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroyDescriptor
SafeArrayDestroyData
SafeArrayDestroy
SafeArrayUnlock
SafeArrayLock
SafeArrayPutElement
SafeArrayPtrOfIndex
SafeArrayGetElement
SafeArrayCopy
SafeArrayAllocDescriptor
SafeArrayAllocData
VariantCopy
SafeArrayRedim
SafeArrayCreate
SafeArrayGetDim
SafeArrayGetElemsize
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
LoadRegTypeLi
LoadTypeLi
RegisterTypeLi
SysStringByteLen
SysAllocStringByteLen
SysFreeString
SysStringLen
VariantInit
VariantChangeType
VarR8FromStr
SysAllocStringLen
VarUdateFromDate
imagehlp
MapFileAndCheckSumA
comctl32
ord17
Sections
.text Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 507KB - Virtual size: 506KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 77KB - Virtual size: 231KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 426KB - Virtual size: 428KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE