2024-08-23_d051c8f2787dfbde1ea0c94af8a4a19a_icedid

Sharing

Copy URL Twitter E-mail

General

Target

2024-08-23_d051c8f2787dfbde1ea0c94af8a4a19a_icedid
Size

1.5MB
MD5

d051c8f2787dfbde1ea0c94af8a4a19a
SHA1

93e1df2bf4d2f056bf2a43abe6337b9b1e5c956b
SHA256

fb7dea1d593a882cef7103a678b420f2b8c2bbacd0ec23d49c9fd0c7108b5128
SHA512

27ef42099be7a974df7d9bbeded1309834d78bfc9425a51dc0de7432130a7c52eb64a62e3ed2c1d1aaf8e750cc0150cd43f68b82bfdeafa44cfa4b838bd7ed3e
SSDEEP

24576:ODtLVc1y1F6ILNDfSxNLLbD8mGfNn8PGp/O4Z:OD5Vc1yjjLNwNLL8JfNn8+p/Oe

Score

1^/10

Malware Config

Signatures

Files

2024-08-23_d051c8f2787dfbde1ea0c94af8a4a19a_icedid
.exe windows:4 windows x86 arch:x86

2e8e44658c846f9542dd991aa18bbf74

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

28:1a:3a:91:95:2a:90:f5:99:68:60:32:73:04:9f:f4
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

25/06/2018, 00:00

Not After

04/07/2020, 23:59

Subject

CN=SecureMetric Technology Sdn Bhd,OU=Technology Department,O=SecureMetric Technology Sdn Bhd,L=Kuala Lumpur,ST=Kuala Lumpur,C=MY

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

9d:d3:47:76:70:8e:9b:f7:41:5c:4a:76:d3:e0:ff:19:fd:98:f3:7a
Signer

Actual PE Digest

9d:d3:47:76:70:8e:9b:f7:41:5c:4a:76:d3:e0:ff:19:fd:98:f3:7a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathFileExistsW

user32

SendDlgItemMessageW
SendDlgItemMessageA
MapWindowPoints
GetSysColor
SetFocus
AdjustWindowRectEx
ScreenToClient
EqualRect
DeferWindowPos
BeginDeferWindowPos
CopyRect
EndDeferWindowPos
GetTopWindow
IsChild
GetCapture
WinHelpW
RegisterClassW
GetMenu
GetMenuItemCount
GetSubMenu
GetMenuItemID
GetWindowTextLengthW
GetWindowTextW
GetDlgCtrlID
CreateWindowExW
SetPropW
UnhookWindowsHookEx
GetPropW
CallWindowProcW
RemovePropW
DefWindowProcW
GetMessageTime
GetMessagePos
GetForegroundWindow
GetWindow
SetWindowLongW
SetWindowPos
SystemParametersInfoW
IsIconic
GetWindowPlacement
GetMenuCheckMarkDimensions
LoadBitmapW
GetMenuState
ModifyMenuW
SetMenuItemBitmaps
CheckMenuItem
GetLastActivePopup
MessageBoxW
ShowOwnedPopups
PostQuitMessage
GetNextDlgTabItem
FindWindowW
SendMessageW
SetActiveWindow
UpdateWindow
GetSystemMetrics
EnableWindow
DrawTextExW
GetClientRect
LoadCursorW
SetCursor
InvalidateRect
SetWindowTextW
PostMessageW
wsprintfW
GetClassInfoW
DestroyIcon
SetTimer
EnableMenuItem
GetSystemMenu
SetForegroundWindow
MessageBeep
UnregisterClassW
MessageBoxA
GetProcessWindowStation
GetUserObjectInformationW
LoadIconW
GetFocus
KillTimer
GetIconInfo
MapDialogRect
GetWindowRect
IsDialogMessageW
MoveWindow
ShowWindow
SetWindowContextHelpId
ClientToScreen
GetDC
ReleaseDC
GetWindowDC
BeginPaint
EndPaint
TabbedTextOutW
DrawTextW
GrayStringW
LoadStringW
DestroyMenu
ReleaseCapture
SetRectEmpty
LoadAcceleratorsW
TranslateAcceleratorW
LoadMenuW
SetMenu
ReuseDDElParam
UnpackDDElParam
BringWindowToTop
GetSysColorBrush
GetClassNameW
PtInRect
EndDialog
IsWindow
GetDesktopWindow
RegisterWindowMessageW
LoadImageW
SetWindowsHookExW
CharNextW
CopyAcceleratorTableW
SetRect
GetNextDlgGroupItem
CharUpperW
RegisterClipboardFormatW
PostThreadMessageW
OffsetRect
GetCursorPos
PeekMessageW
IsWindowVisible
ValidateRect
CreateDialogIndirectParamW
DestroyWindow
GetParent
GetWindowLongW
GetDlgItem
IsWindowEnabled
GetMessageW
TranslateMessage
DispatchMessageW
GetActiveWindow
GetKeyState
CallNextHookEx

gdi32

PtVisible
RectVisible
TextOutW
ExtTextOutW
Escape
GetMapMode
CreateFontIndirectW
DPtoLP
GetTextColor
GetBkColor
LPtoDP
GetWindowExtEx
GetViewportExtEx
GetDeviceCaps
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
SetBkMode
GetStockObject
SelectObject
RestoreDC
SaveDC
DeleteDC
SetBkColor
SetTextColor
GetClipBox
CreateBitmap
CreateFontW
GetTextExtentPoint32W
CreateDCW
GetObjectW
CreateSolidBrush
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
DeleteObject

kernel32

GetFullPathNameW
GetVolumeInformationW
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
CreateFileW
DuplicateHandle
SetErrorMode
GetThreadLocale
GlobalFlags
lstrcmpiW
GetProcessVersion
TlsGetValue
LocalReAlloc
TlsSetValue
FileTimeToSystemTime
FileTimeToLocalFileTime
GetTickCount
GetFileAttributesW
GetFileSize
GetFileTime
GetStartupInfoW
ExitProcess
RtlUnwind
HeapFree
HeapAlloc
CreateThread
ExitThread
RaiseException
HeapSize
HeapReAlloc
GetTimeZoneInformation
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetEnvironmentStrings
GetCommandLineW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
SetUnhandledExceptionFilter
SetStdHandle
LCMapStringA
LCMapStringW
IsBadReadPtr
IsBadCodePtr
CreateFileA
GetStringTypeA
GetStringTypeW
GetCPInfo
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
SetConsoleCtrlHandler
GetLocaleInfoW
CompareStringA
CompareStringW
GetACP
GetOEMCP
SetEnvironmentVariableA
InterlockedExchange
GetCurrentProcessId
GlobalMemoryStatus
QueryPerformanceCounter
FlushConsoleInputBuffer
GetDriveTypeA
FindFirstFileA
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
GetFullPathNameA
GetCurrentDirectoryA
TerminateProcess
GlobalAlloc
Sleep
CloseHandle
CopyFileW
GetTempPathW
LocalFree
LocalAlloc
GetCurrentProcess
GetLastError
GetCurrentThread
LoadResource
FindResourceW
GetModuleHandleW
GetSystemTime
GetCommandLineA
CreateMutexW
InitializeCriticalSection
DeleteCriticalSection
FreeLibrary
GetProcAddress
LoadLibraryW
MultiByteToWideChar
LeaveCriticalSection
EnterCriticalSection
CompareFileTime
SystemTimeToFileTime
WideCharToMultiByte
GetLocalTime
FindClose
FindFirstFileW
SetLastError
FormatMessageA
lstrcpynW
lstrcpyW
InterlockedIncrement
InterlockedDecrement
lstrlenW
lstrlenA
WaitForSingleObject
SetEvent
ResumeThread
SetThreadPriority
GetCurrentThreadId
SuspendThread
CreateEventW
FormatMessageW
LockResource
GlobalFree
GlobalUnlock
GlobalLock
GlobalDeleteAtom
lstrcmpW
GetModuleFileNameW
GlobalFindAtomW
GlobalAddAtomW
lstrcatW
GetVersion
LoadLibraryA
GetModuleHandleA
GetPrivateProfileIntW
WritePrivateProfileStringW
MulDiv
GlobalGetAtomNameW
TlsAlloc
GlobalHandle
TlsFree
GlobalReAlloc

advapi32

RegCloseKey
RegisterEventSourceA
ReportEventA
DeregisterEventSource
RegQueryValueExW
RegOpenKeyExW
FreeSid
AccessCheck
IsValidSecurityDescriptor
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
AddAccessAllowedAce
InitializeAcl
GetLengthSid
InitializeSecurityDescriptor
AllocateAndInitializeSid
DuplicateToken
OpenProcessToken
OpenThreadToken
RegQueryValueExA
RegOpenKeyExA
RegCreateKeyExW
RegSetValueExW

ole32

CLSIDFromProgID
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter
CoRevokeClassObject
CoFreeUnusedLibraries
OleUninitialize
OleInitialize
CoTaskMemAlloc
CoTaskMemFree
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CLSIDFromString

oleaut32

SysAllocStringLen
OleCreateFontIndirect
VariantClear
VariantTimeToSystemTime
VariantCopy
VariantChangeType
SysAllocString
SysStringLen
SysFreeString

comctl32

ord17

comdlg32

GetFileTitleW

shell32

ShellExecuteExW
SHGetFolderPathW
SHGetSpecialFolderPathA
Shell_NotifyIconW
DragFinish
DragQueryFileW

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

ctl3d32

ord25
ord3
ord21
ord6
ord24
ord16
ord13
ord12
ord22

crypt32

CertCreateCertificateContext
CertGetIntendedKeyUsage
CertSetCertificateContextProperty
CertFreeCertificateContext
CertAddCertificateContextToStore
CertCloseStore
CryptVerifyCertificateSignature
CertFindExtension
CryptDecodeObject
CertEnumCertificatesInStore
CertGetCertificateContextProperty
CertDuplicateCertificateContext
CertDeleteCertificateFromStore
CertGetNameStringW
CertOpenStore

oledlg

OleUIBusyW

ws2_32

WSASetLastError
shutdown
accept
connect
getsockopt
inet_addr
gethostbyname
recvfrom
sendto
send
WSAGetLastError
ioctlsocket
__WSAFDIsSet
select
htons
setsockopt
socket
WSAStartup
recv
ntohl
closesocket

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 308KB - Virtual size: 304KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 72KB - Virtual size: 110KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2e8e44658c846f9542dd991aa18bbf74

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cbCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

28:1a:3a:91:95:2a:90:f5:99:68:60:32:73:04:9f:f4Certificate

Extended Key Usages

Key Usages

9d:d3:47:76:70:8e:9b:f7:41:5c:4a:76:d3:e0:ff:19:fd:98:f3:7aSigner

Headers

File Characteristics

Imports

shlwapi

user32

gdi32

kernel32

advapi32

ole32

oleaut32

comctl32

comdlg32

shell32

winspool.drv

ctl3d32

crypt32

oledlg

ws2_32

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 308KB - Virtual size: 304KB

.data Size: 72KB - Virtual size: 110KB

.rsrc Size: 36KB - Virtual size: 32KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

28:1a:3a:91:95:2a:90:f5:99:68:60:32:73:04:9f:f4
Certificate

9d:d3:47:76:70:8e:9b:f7:41:5c:4a:76:d3:e0:ff:19:fd:98:f3:7a
Signer

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 308KB - Virtual size: 304KB

.data
Size: 72KB - Virtual size: 110KB

.rsrc
Size: 36KB - Virtual size: 32KB