2024-08-28_b22440b021027b68f0c16a18a10e2f4d_icedid

Sharing

Copy URL Twitter E-mail

General

Target

2024-08-28_b22440b021027b68f0c16a18a10e2f4d_icedid
Size

4.2MB
MD5

b22440b021027b68f0c16a18a10e2f4d
SHA1

afb66e971251995344f7638cdcf13783510972f4
SHA256

eb4ed741e9c55e17ec0998226e8d55163805496db0b0d518ec3d9154c8a75200
SHA512

9aa79a32b8872c9578c67b9dd4c24d955aec633e4e39bc8e3314066c529dd429ea313f0a81469104b55d975db964c0eee47bb1a4855854b48065dea26c6409c0
SSDEEP

49152:SfuS97HajdvKJ/kqs4EUTIuqPqnOMFyHPuNlB53666lHp064Nyn:/S1HzCqs4CmOMMHGln366i44n

Score

1^/10

Malware Config

Signatures

Files

2024-08-28_b22440b021027b68f0c16a18a10e2f4d_icedid
.exe windows:4 windows x86 arch:x86

a152a5c5c841dfb51a08ac9f7abfdb65

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6e:78:4d:42:6d:c9:b2:24:b7:66:a9:5d:34:b0:3a:8e
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

21/06/2013, 00:00

Not After

20/06/2016, 23:59

Subject

CN=NetEase(Hangzhou) Network Co. Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=NetEase(Hangzhou),O=NetEase(Hangzhou) Network Co. Ltd.,L=Hangzhou,ST=Zhejiang,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6c:1a:d5:6a:8b:4c:19:96:13:5c:15:cc:6d:63:16:e1:32:91:52:5c
Signer

Actual PE Digest

6c:1a:d5:6a:8b:4c:19:96:13:5c:15:cc:6d:63:16:e1:32:91:52:5c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\[datang2]\dtwsproject_bak\trunk\game\gac\src\patchdownload\yypatch_old\gpatch\Release\gpatch.pdb

Imports

iphlpapi

GetNetworkParams

kernel32

RaiseException
GlobalReAlloc
GlobalHandle
TlsGetValue
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
SystemTimeToFileTime
GlobalFlags
GetCPInfo
GetOEMCP
SetErrorMode
LocalFileTimeToFileTime
SetFileTime
GetFileAttributesA
GetFileTime
WritePrivateProfileStringA
RtlUnwind
CreateDirectoryA
HeapFree
GetDriveTypeA
GetSystemTimeAsFileTime
ExitThread
CreateThread
HeapAlloc
VirtualProtect
VirtualAlloc
VirtualQuery
GetStartupInfoA
GetCommandLineA
HeapReAlloc
TerminateProcess
SetStdHandle
GetFileType
HeapCompact
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
PeekConsoleInputA
LocalAlloc
WriteConsoleA
GetTimeFormatA
GetDateFormatA
GetFileAttributesW
SetEnvironmentVariableW
GetCurrentDirectoryW
SetCurrentDirectoryW
SetFileAttributesW
CreateDirectoryW
MoveFileW
RemoveDirectoryW
GetDriveTypeW
DeleteFileW
CreateFileW
GetFileInformationByHandle
PeekNamedPipe
HeapSize
GetCurrentProcessId
SetUnhandledExceptionFilter
HeapDestroy
HeapCreate
VirtualFree
IsBadWritePtr
SetCurrentDirectoryA
LCMapStringA
LCMapStringW
UnhandledExceptionFilter
SetHandleCount
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetTimeZoneInformation
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
GetStringTypeA
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
SetEnvironmentVariableA
GetLocaleInfoW
FileTimeToLocalFileTime
FileTimeToSystemTime
ResumeThread
GetCurrentThread
lstrcmpA
ConvertDefaultLocale
EnumResourceLanguagesA
CreateFileA
GetVolumeInformationA
lstrcpyA
UnlockFile
LockFile
FlushFileBuffers
WriteFile
ReadFile
MoveFileA
FreeResource
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
lstrcatA
lstrcmpW
GlobalFree
MulDiv
GlobalAlloc
GlobalLock
GlobalUnlock
SetLastError
lstrcpynA
GetProcessTimes
GetFullPathNameW
FindFirstFileW
FindNextFileW
FindNextFileA
ResetEvent
SetConsoleCtrlHandler
CreatePipe
GetStdHandle
QueryPerformanceFrequency
QueryPerformanceCounter
GetCurrentProcess
DuplicateHandle
FlushViewOfFile
SetFilePointer
MapViewOfFile
GetFileSize
UnmapViewOfFile
GetSystemInfo
GetModuleFileNameA
SetEndOfFile
LoadLibraryExA
GetFullPathNameA
GetConsoleCP
GetConsoleOutputCP
CreateSemaphoreA
ReleaseSemaphore
InterlockedDecrement
SetEvent
InterlockedIncrement
GetCurrentThreadId
GetModuleHandleA
CreateEventA
FormatMessageA
LocalFree
GetSystemDirectoryA
LoadLibraryA
GetProcAddress
FreeLibrary
OutputDebugStringA
FindFirstFileA
FindClose
GetEnvironmentVariableA
CompareStringW
CompareStringA
lstrlenA
lstrcmpiA
GetVersion
GetLastError
MultiByteToWideChar
GetTempPathA
GetTempFileNameA
GetTickCount
GetCurrentDirectoryA
DeleteFileA
GetDiskFreeSpaceExA
OpenFileMappingA
CreateFileMappingA
CopyFileA
GetPrivateProfileStringA
CreateProcessA
WaitForSingleObject
GetExitCodeProcess
CloseHandle
SetFileAttributesA
Sleep
ExitProcess
WideCharToMultiByte
FindResourceA
LoadResource
LockResource
SizeofResource
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetNumberOfConsoleInputEvents
RemoveDirectoryA

user32

DestroyMenu
LoadCursorA
GetSysColorBrush
ShowWindow
SetWindowTextA
IsDialogMessageA
GetDesktopWindow
CreateDialogIndirectParamA
GetNextDlgTabItem
EndDialog
EndPaint
BeginPaint
ReleaseDC
GetDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
SetMenuItemBitmaps
ModifyMenuA
EnableMenuItem
CheckMenuItem
GetMenuCheckMarkDimensions
GetMessageA
GetActiveWindow
GetCursorPos
ValidateRect
SetCursor
PostQuitMessage
IsWindowEnabled
RegisterWindowMessageA
WinHelpA
GetCapture
CreateWindowExA
SetWindowsHookExA
CallNextHookEx
GetClassInfoExA
GetClassNameA
SetPropA
GetPropA
RemovePropA
SendDlgItemMessageA
GetFocus
IsWindow
SetFocus
GetWindowTextLengthA
GetWindowTextA
GetForegroundWindow
GetLastActivePopup
SetActiveWindow
GetDlgItem
GetTopWindow
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
MapWindowPoints
GetKeyState
SetForegroundWindow
IsWindowVisible
UpdateWindow
GetMenu
GetSysColor
AdjustWindowRectEx
GetParent
ScreenToClient
GetClassInfoA
RegisterClassA
UnregisterClassA
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
GetWindowLongA
SetWindowLongA
SetWindowPos
SystemParametersInfoA
GetWindowPlacement
CopyRect
PtInRect
GetWindow
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
GetClassLongA
wsprintfA
CharUpperA
GetSystemMetrics
LoadIconA
EnableWindow
KillTimer
SetTimer
InvalidateRect
GetClientRect
GetWindowRect
IsIconic
SendMessageA
DrawIcon
LoadBitmapA
PeekMessageA
DispatchMessageA
TranslateMessage
MessageBoxA
PostMessageA

gdi32

BitBlt
DeleteObject
DeleteDC
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutA
TextOutA
RectVisible
GetObjectA
GetStockObject
SetMapMode
SetBkMode
RestoreDC
SaveDC
CreateBitmap
SetBkColor
SetTextColor
GetClipBox
GetDeviceCaps
StretchBlt
CreateCompatibleDC
PtVisible

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

RegSetValueExA
RegQueryValueExA
RegEnumKeyExA
RegQueryInfoKeyA
RegOpenKeyExA
RegConnectRegistryA
RegCreateKeyA
RegDeleteKeyA
RegDeleteValueA
RegEnumKeyA
RegEnumValueA
RegCreateKeyExA
RegOpenKeyA
RegCloseKey
RegSetValueA
RegSaveKeyA
RegQueryValueA
RegLoadKeyA
RegFlushKey

shell32

ShellExecuteA

comctl32

ord17

shlwapi

PathIsUNCA
PathFindExtensionA
PathFindFileNameA
PathStripToRootA
UrlUnescapeA

oleaut32

VariantChangeType
VariantInit
VariantClear

ws2_32

ioctlsocket
socket
htonl
getservbyname
gethostbyaddr
getservbyport
ntohs
accept
setsockopt
getsockopt
select
WSASetLastError
getsockname
getpeername
htons
recvfrom
sendto
shutdown
getprotobyname
ntohl
WSACleanup
WSAStartup
__WSAFDIsSet
closesocket
gethostname
gethostbyname
inet_ntoa
inet_addr
connect
WSAGetLastError
listen
send
recv
bind

wininet

InternetOpenA
InternetOpenUrlA
InternetReadFile
InternetWriteFile
InternetSetFilePointer
InternetSetStatusCallback
InternetQueryDataAvailable
InternetGetLastResponseInfoA
InternetCloseHandle
InternetQueryOptionA
InternetCanonicalizeUrlA
InternetCrackUrlA

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 828KB - Virtual size: 825KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 684KB - Virtual size: 681KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a152a5c5c841dfb51a08ac9f7abfdb65

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

6e:78:4d:42:6d:c9:b2:24:b7:66:a9:5d:34:b0:3a:8eCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

6c:1a:d5:6a:8b:4c:19:96:13:5c:15:cc:6d:63:16:e1:32:91:52:5cSigner

Headers

File Characteristics

PDB Paths

Imports

iphlpapi

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oleaut32

ws2_32

wininet

Sections

.text Size: 1.0MB - Virtual size: 1.0MB

.rdata Size: 828KB - Virtual size: 825KB

.data Size: 1.7MB - Virtual size: 1.7MB

.rsrc Size: 684KB - Virtual size: 681KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

6e:78:4d:42:6d:c9:b2:24:b7:66:a9:5d:34:b0:3a:8e
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

6c:1a:d5:6a:8b:4c:19:96:13:5c:15:cc:6d:63:16:e1:32:91:52:5c
Signer

.text
Size: 1.0MB - Virtual size: 1.0MB

.rdata
Size: 828KB - Virtual size: 825KB

.data
Size: 1.7MB - Virtual size: 1.7MB

.rsrc
Size: 684KB - Virtual size: 681KB