2024-08-24_1560b6a16736740a07bc61edfd8b488b_icedid

Sharing

Copy URL Twitter E-mail

General

Target

2024-08-24_1560b6a16736740a07bc61edfd8b488b_icedid
Size

268KB
MD5

1560b6a16736740a07bc61edfd8b488b
SHA1

1c4f6e766908157e77238b22d6b89148f91c9e2c
SHA256

1e345532696a41632898e03f401b452088129c21223b9a91c6bacfb8e1c5a74f
SHA512

5fb91b0a37f40fdb86e24f523a061aaa4edf05d6b4fe4100c9b82d4128f14e206d7b920833fbcbf18dfe3763ce120f5cc9dc4f56afffdab4345eca9f97697938
SSDEEP

3072:XMxSs+HcPz8v8SLsRZHdgViDtL8ptpZkMMouBs2WOfY0Q5agIzKBmatZReu5MlxI:8xIv88sH9WeZ8pjZxMDGwY6gV5Yva

Score

1^/10

Malware Config

Signatures

Files

2024-08-24_1560b6a16736740a07bc61edfd8b488b_icedid
.exe windows:5 windows x86 arch:x86

d4db0ca87ca097e09a88c8f9f2f5a663

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5b:23:49:5e:b3:51:ee:af:64:74:11:4f:0c:ca:b2:06
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

05/12/2013, 00:00

Not After

05/12/2015, 23:59

Subject

CN=Meizhou WeCom Network Technology Co.\, Ltd.,OU=Development,O=Meizhou WeCom Network Technology Co.\, Ltd.,L=meizhou,ST=guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

5b:95:35:83:7e:77:75:0a:f4:cb:2e:4b:e3:79:4a:df:3c:fc:48:b4
Signer

Actual PE Digest

5b:95:35:83:7e:77:75:0a:f4:cb:2e:4b:e3:79:4a:df:3c:fc:48:b4

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\原盘文件\我的工程\电商导航\release\电商导航.pdb

Imports

kernel32

GlobalDeleteAtom
GetVersionExA
lstrcmpW
GlobalFindAtomA
GetCPInfo
GetOEMCP
GetSystemTimeAsFileTime
GetTimeFormatA
GetDateFormatA
Sleep
ExitProcess
HeapSize
GetCommandLineA
GetStartupInfoA
RtlUnwind
RaiseException
VirtualAlloc
SetStdHandle
GetFileType
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
HeapDestroy
GetStdHandle
GetACP
IsValidCodePage
LCMapStringA
LCMapStringW
GetTimeZoneInformation
InitializeCriticalSectionAndSpinCount
GetStringTypeA
GetStringTypeW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
QueryPerformanceCounter
GetTickCount
GetConsoleCP
GetConsoleMode
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CompareStringW
SetEnvironmentVariableA
GetLocaleInfoA
InterlockedExchange
GetCurrentThreadId
GlobalFlags
GlobalAddAtomA
GetFullPathNameA
GetVolumeInformationA
DuplicateHandle
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
GetFileTime
GetFileSizeEx
GetFileAttributesA
GlobalGetAtomNameA
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
GetCurrentProcessId
InterlockedDecrement
InterlockedIncrement
GetModuleHandleW
CompareStringA
LocalAlloc
FileTimeToLocalFileTime
FileTimeToSystemTime
SetLastError
FormatMessageA
LocalFree
HeapReAlloc
GetCommandLineW
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
WritePrivateProfileStringA
CreateDirectoryA
FindClose
FindFirstFileA
GetPrivateProfileStringA
lstrcmpA
lstrcatA
LockResource
MoveFileA
HeapFree
GetProcessHeap
HeapAlloc
GetCurrentProcess
LoadLibraryA
ReadFile
GetFileSize
CreateFileA
FreeLibrary
SizeofResource
LoadResource
FindResourceA
GetLastError
GetModuleFileNameA
WideCharToMultiByte
GetProcAddress
GetModuleHandleA
WaitForSingleObject
CreateThread
MultiByteToWideChar
lstrlenA
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualFree
CloseHandle

user32

DestroyMenu
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
RegisterWindowMessageA
LoadIconA
WinHelpA
GetCapture
GetClassLongA
SetPropA
GetPropA
RemovePropA
GetForegroundWindow
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetMenu
GetClientRect
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
CopyRect
DefWindowProcA
CallWindowProcA
GetMenu
SystemParametersInfoA
GetWindowPlacement
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
ModifyMenuA
EnableMenuItem
CheckMenuItem
PostQuitMessage
SetForegroundWindow
IsIconic
PostMessageA
SetWindowPos
SetWindowLongA
IsWindow
GetDlgItem
SetWindowsHookExA
CallNextHookEx
DispatchMessageA
GetKeyState
PeekMessageA
CreateWindowExA
ValidateRect
GetFocus
ClientToScreen
GetWindow
GetDlgCtrlID
GetWindowRect
GetClassNameA
PtInRect
SetWindowTextA
CharUpperA
GetWindowTextA
GetWindowThreadProcessId
SendMessageA
GetParent
GetWindowLongA
GetLastActivePopup
IsWindowEnabled
EnableWindow
MessageBoxA
UnhookWindowsHookEx
LoadCursorA
GetSystemMetrics
GetDC
ReleaseDC
GetSysColor
GetSysColorBrush
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu

gdi32

DeleteDC
GetStockObject
ExtTextOutA
TextOutA
RectVisible
PtVisible
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
GetDeviceCaps
SetMapMode
RestoreDC
SaveDC
SetBkColor
SetTextColor
GetClipBox
CreateBitmap
DeleteObject
Escape

comdlg32

GetFileTitleA

winspool.drv

ClosePrinter
DocumentPropertiesA
OpenPrinterA

advapi32

RegCreateKeyA
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA

shell32

CommandLineToArgvW
ShellExecuteA
SHGetFolderPathA

shlwapi

PathStripToRootA
PathIsUNCA
PathFindFileNameA
UrlUnescapeA

ole32

CoCreateInstance
CoInitialize
CoUninitialize

oleaut32

VariantInit
VariantClear
VariantChangeType

ws2_32

WSAGetLastError
WSAEventSelect
WSASetEvent
WSACreateEvent
WSARecv
WSAGetOverlappedResult
WSASend
WSAResetEvent
WSAEnumNetworkEvents
WSAConnect
WSASocketA
WSACloseEvent
closesocket
WSACleanup
WSAStartup
getaddrinfo
freeaddrinfo
WSASetLastError

netapi32

Netbios

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

urlmon

URLDownloadToFileA

wininet

InternetReadFile
InternetWriteFile
InternetSetFilePointer
InternetSetStatusCallback
InternetOpenA
InternetGetLastResponseInfoA
InternetCloseHandle
InternetQueryDataAvailable
InternetQueryOptionA
InternetCanonicalizeUrlA
InternetCrackUrlA
InternetOpenUrlA

Sections

.text
Size: 206KB - Virtual size: 205KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d4db0ca87ca097e09a88c8f9f2f5a663

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91Certificate

Key Usages

5b:23:49:5e:b3:51:ee:af:64:74:11:4f:0c:ca:b2:06Certificate

Extended Key Usages

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

5b:95:35:83:7e:77:75:0a:f4:cb:2e:4b:e3:79:4a:df:3c:fc:48:b4Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

shlwapi

ole32

oleaut32

ws2_32

netapi32

version

urlmon

wininet

Sections

.text Size: 206KB - Virtual size: 205KB

.rdata Size: 38KB - Virtual size: 38KB

.data Size: 8KB - Virtual size: 23KB

.rsrc Size: 7KB - Virtual size: 6KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

5b:23:49:5e:b3:51:ee:af:64:74:11:4f:0c:ca:b2:06
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

5b:95:35:83:7e:77:75:0a:f4:cb:2e:4b:e3:79:4a:df:3c:fc:48:b4
Signer

.text
Size: 206KB - Virtual size: 205KB

.rdata
Size: 38KB - Virtual size: 38KB

.data
Size: 8KB - Virtual size: 23KB

.rsrc
Size: 7KB - Virtual size: 6KB