D:\CYC\装机大师_ventoy_merge\系统装机大师\bin\Release\update.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-20_dc8cb7538c8f8f07f639aa33eb0b05ab_icedid.exe
Resource
win7-20240704-en
General
-
Target
2024-08-20_dc8cb7538c8f8f07f639aa33eb0b05ab_icedid
-
Size
724KB
-
MD5
dc8cb7538c8f8f07f639aa33eb0b05ab
-
SHA1
e88a7fe26237ac712e4b8280834702300c9e597e
-
SHA256
385845b689b14d84e8145f4bfc39bbd1897006b31850d24bdb244aebddb47e50
-
SHA512
bf4f8416cc079e642414176dc2da93ea7e56a4c9048d6990809ecf0410ed870474d7ae270c6517f7a20c0a9fcfdae4a64dfa3266a5d54a4f2a7b891454bcbcd4
-
SSDEEP
12288:xAbgr/D00PnD7DLsuhgCkfzyho8dGNSaUtFIz2CyP:xAbgLD04D/LWCOCo8eSaa+zvQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-08-20_dc8cb7538c8f8f07f639aa33eb0b05ab_icedid
Files
-
2024-08-20_dc8cb7538c8f8f07f639aa33eb0b05ab_icedid.exe windows:5 windows x86 arch:x86
0b0341f0ed7d6117219d00cb9d19dfc3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
DeleteFileW
CreateFileW
FlushFileBuffers
ReadFile
SetEndOfFile
WriteFile
GetCurrentProcess
SetErrorMode
GetFileAttributesW
GetFileAttributesExW
SetFileAttributesW
GetCommandLineA
RtlUnwind
HeapQueryInformation
IsDebuggerPresent
IsProcessorFeaturePresent
CreateThread
ExitProcess
GetModuleHandleExW
AreFileApisANSI
IsValidCodePage
GetOEMCP
GetCPInfo
GetStdHandle
GetFileType
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
GetTimeZoneInformation
GetDateFormatW
GetTimeFormatW
LCMapStringW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStringTypeW
GetConsoleCP
GetConsoleMode
SetFilePointerEx
OutputDebugStringW
SetStdHandle
WriteConsoleW
ReadConsoleW
SetEnvironmentVariableA
SetDllDirectoryW
FindFirstFileA
OpenFile
OpenProcess
MoveFileExW
GetSystemInfo
GetLocalTime
InterlockedCompareExchange
InterlockedExchange
GetLocaleInfoW
CompareStringW
GetVersionExW
CloseHandle
lstrcmpA
GlobalFlags
GetCurrentProcessId
LocalReAlloc
LocalAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSection
FormatMessageW
LocalFree
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
SizeofResource
GlobalFindAtomW
GlobalAddAtomW
FindResourceW
lstrcmpW
GlobalDeleteAtom
LockResource
LoadResource
LoadLibraryExW
GetSystemDirectoryW
GetCurrentThreadId
LeaveCriticalSection
EnterCriticalSection
EncodePointer
LoadLibraryW
GetModuleHandleW
GetModuleHandleA
GetModuleFileNameW
SetLastError
OutputDebugStringA
GetACP
WideCharToMultiByte
MultiByteToWideChar
CopyFileA
DeleteFileA
WaitForSingleObject
GetTempPathA
Sleep
FreeLibrary
GetProcAddress
LoadLibraryA
DeleteCriticalSection
DecodePointer
HeapSize
GetLastError
RaiseException
InitializeCriticalSectionAndSpinCount
GetProcessHeap
HeapFree
HeapAlloc
GetTickCount
HeapReAlloc
user32
LoadCursorW
GetSysColorBrush
PostQuitMessage
DestroyMenu
GetSystemMetrics
LoadBitmapW
SetMenuItemInfoW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
EnableMenuItem
CheckMenuItem
RealChildWindowFromPoint
ClientToScreen
ReleaseDC
GetDC
TabbedTextOutW
GrayStringW
DrawTextExW
DrawTextW
GetWindowThreadProcessId
SetWindowTextW
IsWindowEnabled
GetMonitorInfoW
MonitorFromWindow
WinHelpW
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
GetLastActivePopup
GetTopWindow
GetClassNameW
GetClassLongW
SetWindowLongW
PtInRect
CopyRect
GetSysColor
MapWindowPoints
MessageBoxW
AdjustWindowRectEx
GetWindowRect
GetClientRect
RemovePropW
GetPropW
SetPropW
RedrawWindow
ValidateRect
SetForegroundWindow
GetForegroundWindow
ScreenToClient
SendMessageW
GetMenuItemCount
GetMenuItemID
GetSubMenu
SetMenu
GetMenu
EnableWindow
GetCapture
GetKeyState
GetFocus
GetDlgCtrlID
GetDlgItem
SetWindowPos
DestroyWindow
IsWindow
LoadIconW
GetParent
GetWindowTextW
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
CallWindowProcW
DefWindowProcW
PostMessageW
GetMessageTime
GetMessagePos
PeekMessageW
DispatchMessageW
RegisterWindowMessageW
GetWindow
GetWindowLongW
shell32
ShellExecuteA
shlwapi
PathFileExistsA
oleacc
CreateStdAccessibleObject
LresultFromObject
imagehlp
MakeSureDirectoryPathExists
gdi32
GetDeviceCaps
CreateBitmap
DeleteDC
DeleteObject
Escape
GetClipBox
OffsetViewportOrgEx
GetStockObject
ScaleViewportExtEx
ScaleWindowExtEx
SetTextColor
SetWindowExtEx
SetViewportOrgEx
SetViewportExtEx
ExtTextOutW
TextOutW
SetBkColor
SetMapMode
SelectObject
SaveDC
RestoreDC
RectVisible
PtVisible
winspool.drv
ClosePrinter
OpenPrinterW
DocumentPropertiesW
advapi32
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
ole32
CoUninitialize
CoCreateInstance
CoInitialize
oleaut32
VariantChangeType
VariantClear
VariantInit
Sections
.text Size: 460KB - Virtual size: 460KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 97KB - Virtual size: 97KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 51KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 103KB - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE