2024-09-01_6a603a4c92f80f06f9dfb901f530d8cb_icedid

Sharing

Copy URL Twitter E-mail

General

Target

2024-09-01_6a603a4c92f80f06f9dfb901f530d8cb_icedid
Size

6.4MB
MD5

6a603a4c92f80f06f9dfb901f530d8cb
SHA1

d3ea63903b5a6273f3bd392959d273af24dce017
SHA256

8718729586da92790b24822e07ba949be6cd933094c63c84fda86642f68cec0c
SHA512

f0921e9f5e8c2cb1fa4c1175ff5e83ccf50842f7ab9592ae87fdbec80d3f337ef3c2eec5cb42aabf6078e883b1511a50b4408cac94df115918480228fe2e956f
SSDEEP

196608:cHV+yOXVJRH5ko4BN7QQPgU2W1EyjHmTIIn:cHVIJRHb+s8gBWOSGpn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-09-01_6a603a4c92f80f06f9dfb901f530d8cb_icedid

Files

2024-09-01_6a603a4c92f80f06f9dfb901f530d8cb_icedid
.exe windows:5 windows x86 arch:x86

fe9b4400b88565402280bc1219578c43

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\外发制作\OutPut\ODMGuard\ODMGuard.pdb

Imports

kernel32

GlobalDeleteAtom
GlobalFindAtomW
GlobalAddAtomW
FreeResource
MulDiv
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
GlobalFree
GetModuleHandleA
SetThreadPriority
InterlockedExchange
CompareStringA
LoadLibraryExW
GetLocaleInfoW
lstrcmpA
EnumResourceLanguagesW
ConvertDefaultLocale
GetCurrentThread
CreateSemaphoreW
ReleaseSemaphore
ReleaseMutex
WaitForMultipleObjects
SetErrorMode
LeaveCriticalSection
TlsGetValue
EnterCriticalSection
GlobalReAlloc
GlobalHandle
InitializeCriticalSection
TlsAlloc
TlsSetValue
LocalReAlloc
DeleteCriticalSection
TlsFree
GlobalFlags
InterlockedIncrement
GlobalGetAtomNameW
GetAtomNameW
GetStartupInfoW
RtlUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
ExitProcess
DeleteFileA
GetFileAttributesA
GetFileType
lstrcmpW
HeapReAlloc
ExitThread
HeapSize
VirtualAlloc
VirtualQuery
GetStdHandle
CompareStringW
GetEnvironmentStringsW
SetHandleCount
GetStartupInfoA
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
FatalAppExitA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetTimeFormatA
GetDateFormatA
LCMapStringA
LCMapStringW
SetConsoleCtrlHandler
InitializeCriticalSectionAndSpinCount
SetStdHandle
GetConsoleCP
GetConsoleMode
GetCurrentDirectoryA
SetCurrentDirectoryA
GetDriveTypeA
GetFullPathNameA
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA
GetFileTime
GetFileSizeEx
SetFileTime
SystemTimeToFileTime
LocalFileTimeToFileTime
GetFileAttributesExW
GetShortPathNameW
GetFullPathNameW
DuplicateHandle
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
GetThreadLocale
PeekNamedPipe
GetFileInformationByHandle
FindFirstFileA
DefineDosDeviceW
MoveFileExW
DebugBreak
InterlockedCompareExchange
FreeEnvironmentStringsW
LoadLibraryA
GetStringTypeExW
MoveFileW
SetVolumeLabelW
GetDriveTypeW
GetProcessHeap
HeapAlloc
HeapFree
GetPrivateProfileIntW
ExpandEnvironmentStringsW
SearchPathW
GetModuleFileNameA
CreateFileA
WaitForDebugEvent
GetThreadContext
SetThreadContext
FlushInstructionCache
ContinueDebugEvent
GetProcessVersion
ReadProcessMemory
VirtualProtectEx
SuspendThread
GetLogicalDriveStringsW
QueryDosDeviceW
GetLocalTime
lstrcpynA
BeginUpdateResourceW
UpdateResourceW
EndUpdateResourceW
lstrcmpiA
GetTempPathW
LocalAlloc
LocalFree
InterlockedDecrement
RemoveDirectoryW
GetSystemInfo
GetCommandLineW
GetWindowsDirectoryW
GetDiskFreeSpaceExW
GetSystemDefaultLangID
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
SetSystemTime
SetLastError
GetSystemTime
GetLogicalDrives
Process32FirstW
OpenFileMappingW
CreateFileMappingW
MapViewOfFile
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
GetLongPathNameW
GetEnvironmentVariableW
GetWindowsDirectoryA
lstrcatA
UnmapViewOfFile
GetProcessTimes
GetSystemTimeAsFileTime
Module32FirstW
Module32NextW
FormatMessageW
GetVolumeInformationW
CreateMutexW
GetCurrentProcessId
GetCurrentDirectoryW
CreateDirectoryW
CopyFileW
GetFileAttributesW
SetFileAttributesW
WritePrivateProfileStringW
GetPrivateProfileStringW
OpenThread
CreateToolhelp32Snapshot
Process32NextW
OpenProcess
OpenMutexW
CreateProcessW
CreateNamedPipeW
ConnectNamedPipe
DisconnectNamedPipe
GetVersionExA
CreateEventW
ResetEvent
WaitForSingleObject
CreateThread
GetCurrentThreadId
GetTickCount
Sleep
OpenEventW
SetEvent
LoadLibraryW
FreeLibrary
OutputDebugStringW
IsBadStringPtrW
IsBadStringPtrA
lstrcpynW
lstrcmpiW
TerminateProcess
ResumeThread
IsBadCodePtr
GetModuleHandleW
GetProcAddress
GetVersion
IsBadReadPtr
IsBadWritePtr
VirtualProtect
GetVersionExW
GetCurrentProcess
SetPriorityClass
LoadResource
LockResource
SizeofResource
FindResourceW
FileTimeToLocalFileTime
FileTimeToSystemTime
SetCurrentDirectoryW
FindFirstFileW
FindNextFileW
FindClose
lstrcpyW
GetModuleFileNameW
GetSystemDirectoryW
lstrcatW
DeleteFileW
GetDiskFreeSpaceW
lstrlenW
WideCharToMultiByte
GetLastError
SetFilePointer
lstrlenA
MultiByteToWideChar
GetFileSize
DeviceIoControl
CreateFileW
ReadFile
CloseHandle
SetEnvironmentVariableW
WriteFile

user32

LoadMenuW
IsZoomed
InvalidateRect
SetRectEmpty
GetActiveWindow
CreateDialogIndirectParamW
GetNextDlgTabItem
EndDialog
EndPaint
BeginPaint
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
FillRect
GetMenuStringW
InsertMenuW
RemoveMenu
ScrollWindowEx
IsWindowEnabled
MoveWindow
SetWindowTextW
IsDialogMessageW
IsDlgButtonChecked
SetDlgItemTextW
SetDlgItemInt
GetDlgItemTextW
GetDlgItemInt
SendMessageW
EnableWindow
IsWindow
SystemParametersInfoW
CheckRadioButton
CheckDlgButton
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuW
ValidateRect
EnableMenuItem
CheckMenuItem
RegisterWindowMessageW
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
IsChild
GetCapture
GetClassLongW
SetCapture
GetPropW
RemovePropW
GetFocus
SetFocus
GetWindowTextLengthW
GetForegroundWindow
GetLastActivePopup
SetActiveWindow
DispatchMessageW
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
MapWindowPoints
ScrollWindow
TrackPopupMenuEx
TrackPopupMenu
GetKeyState
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
ShowScrollBar
UpdateWindow
GetSubMenu
GetMenuItemID
GetMenuItemCount
GetCursorPos
TranslateMessage
GetMessageW
PostQuitMessage
SetCursor
ShowOwnedPopups
SetWindowContextHelpId
InflateRect
GetMenuItemInfoW
DestroyMenu
MsgWaitForMultipleObjects
GetSysColorBrush
LoadCursorW
UnregisterClassW
GetDialogBaseUnits
TranslateAcceleratorW
BringWindowToTop
CreatePopupMenu
InsertMenuItemW
LoadAcceleratorsW
ReleaseCapture
GetMenuBarInfo
ReuseDDElParam
UnpackDDElParam
SetRect
WindowFromPoint
GetMenuState
DeleteMenu
GetClientRect
GetWindowDC
MapDialogRect
wsprintfW
MessageBoxW
PostMessageW
SetWindowsHookExW
CallNextHookEx
PeekMessageW
UnhookWindowsHookEx
EnumChildWindows
BroadcastSystemMessageW
SetWindowLongW
GetWindowTextW
GetParent
GetDlgCtrlID
GetClassNameW
WaitForInputIdle
wsprintfA
WaitMessage
DestroyIcon
CharNextW
CopyAcceleratorTableW
IsRectEmpty
InvalidateRgn
GetNextDlgGroupItem
MessageBeep
SetParent
RegisterClipboardFormatW
UnionRect
GetDCEx
LockWindowUpdate
PostThreadMessageW
SetPropW
IsWindowVisible
GetWindowThreadProcessId
GetWindow
GetDesktopWindow
EnumWindows
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
GetSysColor
AdjustWindowRectEx
ScreenToClient
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
SetWindowPlacement
DefWindowProcW
CallWindowProcW
PtInRect
GetMenu
SetWindowPos
OffsetRect
IntersectRect
SystemParametersInfoA
GetWindowPlacement
MapVirtualKeyW
GetKeyNameTextW
ReleaseDC
GetDC
CopyRect
GetWindowRect
DrawIcon
SetForegroundWindow
GetDlgItem
GetWindowLongW
LoadIconW
CharUpperW
KillTimer
GetSystemMenu
AppendMenuW
SetTimer
GetSystemMetrics
IsIconic
ShowWindow

gdi32

GetRgnBox
GetTextColor
GetBkColor
DPtoLP
GetMapMode
CombineRgn
SetRectRgn
GetTextMetricsW
CreateCompatibleBitmap
StretchDIBits
CreateFontW
GetCharWidthW
CreateHatchBrush
CreateSolidBrush
ExtCreatePen
TextOutW
CreatePen
PlayMetaFile
EnumMetaFile
GetObjectType
PlayMetaFileRecord
SelectPalette
GetStockObject
CreateCompatibleDC
CreatePatternBrush
CreateDIBPatternBrushPt
DeleteDC
ExtSelectClipRgn
PolyBezierTo
PolylineTo
PolyDraw
ArcTo
RectVisible
PtVisible
StartDocW
GetPixel
BitBlt
GetWindowExtEx
GetViewportExtEx
SelectClipPath
CreateRectRgn
GetClipRgn
SelectClipRgn
DeleteObject
SetColorAdjustment
SetArcDirection
SetMapperFlags
SetTextCharacterExtra
SetTextJustification
SetTextAlign
MoveToEx
LineTo
OffsetClipRgn
IntersectClipRect
ExcludeClipRect
SetMapMode
ModifyWorldTransform
GetTextExtentPoint32W
CreateFontIndirectW
CreateRectRgnIndirect
PatBlt
GetDCOrgEx
GetClipBox
SetTextColor
SetBkColor
GetObjectW
CreateBitmap
GetDeviceCaps
CopyMetaFileW
CreateDCW
SaveDC
RestoreDC
SetBkMode
SetPolyFillMode
SetROP2
GetCurrentPositionEx
ScaleWindowExtEx
SetWindowExtEx
OffsetWindowOrgEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
SetWorldTransform
SetStretchBltMode
SetGraphicsMode
ExtTextOutW

comdlg32

GetFileTitleW
GetOpenFileNameW

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

advapi32

AddAce
DeregisterEventSource
RegisterEventSourceW
QueryServiceConfigW
ControlService
QueryServiceStatusEx
ChangeServiceConfigW
OpenServiceW
OpenSCManagerW
DeleteService
CloseServiceHandle
CreateServiceW
RegQueryValueW
GetSecurityInfo
SetSecurityInfo
ConvertSecurityDescriptorToStringSecurityDescriptorW
GetTokenInformation
IsValidSid
ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
SetNamedSecurityInfoW
LookupAccountNameW
GetFileSecurityW
GetSecurityDescriptorDacl
GetAclInformation
GetLengthSid
InitializeAcl
GetAce
EqualSid
ReportEventW
AddAccessAllowedAce
GetSecurityDescriptorControl
SetFileSecurityW
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExW
RegEnumKeyW
RegDeleteValueW
RegCreateKeyW
RegSetValueW
RegOpenKeyW
RegDeleteKeyW
RegEnumValueW
RegCloseKey
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegQueryInfoKeyW
RegEnumKeyExW

shell32

ExtractIconW
SHGetFileInfoW
SHGetSpecialFolderLocation
SHGetMalloc
SHGetPathFromIDListW
SHBrowseForFolderW
ShellExecuteExW
FindExecutableW
SHChangeNotify
ShellExecuteW
ord680
DragFinish
SHGetSpecialFolderPathW
DragQueryFileW

shlwapi

StrStrIA
StrStrIW
SHSetValueW
PathFileExistsW
PathFindFileNameW
SHGetValueW
SHDeleteValueW
PathStripToRootW
PathIsUNCW
PathFindExtensionW
PathRemoveExtensionW
PathRemoveFileSpecW

oledlg

OleUIBusyW

ole32

CLSIDFromString
CLSIDFromProgID
CoRegisterClassObject
CoDisconnectObject
CoRevokeClassObject
OleSetClipboard
StringFromGUID2
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
CoInitializeEx
OleUninitialize
OleInitialize
CoFreeUnusedLibraries
OleIsCurrentClipboard
CoTreatAsClass
StringFromCLSID
CoTaskMemAlloc
ReleaseStgMedium
CreateBindCtx
ReadClassStg
ReadFmtUserTypeStg
OleRegGetUserType
WriteClassStg
WriteFmtUserTypeStg
SetConvertStg
CoTaskMemFree
OleRun
CoUninitialize
CoInitialize
CoCreateGuid
CoCreateInstance
OleFlushClipboard
CoRegisterMessageFilter
CreateStreamOnHGlobal
OleDuplicateData

oleaut32

SysAllocString
SysFreeString
SysAllocStringByteLen
SysStringByteLen
SafeArrayGetElement
VariantClear
VariantInit
VariantCopy
SafeArrayPutElement
SafeArrayCreate
SysAllocStringLen
VariantChangeType
SysStringLen
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetElemsize
SafeArrayGetDim
SafeArrayRedim
SafeArrayAllocData
SafeArrayAllocDescriptor
SafeArrayCopy
SafeArrayPtrOfIndex
SafeArrayLock
SafeArrayUnlock
SafeArrayDestroy
SafeArrayDestroyData
SafeArrayDestroyDescriptor
VariantTimeToSystemTime
SystemTimeToVariantTime
VarDateFromStr
SysReAllocStringLen
VarCyFromStr
VarBstrFromCy
VarBstrFromDec
VarDecFromStr
VarBstrFromDate
RegisterTypeLi
LoadTypeLi
LoadRegTypeLi
OleCreateFontIndirect
GetErrorInfo
SetErrorInfo
CreateErrorInfo

iphlpapi

GetAdaptersInfo

ntdll

NtClose
RtlNtStatusToDosError
NtCreateFile
ZwQueryObject
RtlUnicodeStringToAnsiString
RtlFreeAnsiString

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

imagehlp

ImageLoad
ImageUnload

psapi

GetMappedFileNameW
GetModuleFileNameExW
EnumProcessModules
GetModuleInformation

winmm

timeGetTime

setupapi

SetupDiGetDeviceInstallParamsW
SetupDiCallClassInstaller
SetupDiSetClassInstallParamsW
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
CM_Get_DevNode_Status
SetupDiGetDeviceInterfaceDetailA
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsW
SetupDiChangeState

ws2_32

htons
inet_addr
select
connect
send
gethostbyname
socket
htonl
ntohl
WSAStartup
WSACleanup
recv
closesocket

Exports

Exports

FormatNTFS

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 321KB - Virtual size: 321KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 34KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4.8MB - Virtual size: 4.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fe9b4400b88565402280bc1219578c43

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

shlwapi

oledlg

ole32

oleaut32

iphlpapi

ntdll

version

imagehlp

psapi

winmm

setupapi

ws2_32

Exports

Exports

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.rdata Size: 321KB - Virtual size: 321KB

.data Size: 34KB - Virtual size: 75KB

.rsrc Size: 4.8MB - Virtual size: 4.8MB

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 321KB - Virtual size: 321KB

.data
Size: 34KB - Virtual size: 75KB

.rsrc
Size: 4.8MB - Virtual size: 4.8MB