2024-09-02_2c750da79c7828fb0d0a1cebc72bd2a3_floxif_icedid

Sharing

Copy URL Twitter E-mail

General

Target
2024-09-02_2c750da79c7828fb0d0a1cebc72bd2a3_floxif_icedid
Size 2.2MB
Sample240902-3rv8assake
SHA256 bd41c445d668d3b0707c7554151a0e0728e39425c29e14aa594b5b981f7f40a5
MD5 2c750da79c7828fb0d0a1cebc72bd2a3
SHA1 715efe29da54d9dace72f477ef6ea715c28994b6
SHA512 2131fd3033e1048728bc53d91895248ddb06dbed20892028f9fc95b132d06b56cf0b95ff1f167c56c52c72f281a9a0a95e47395da726d09934660d0316d1e07b
SSDEEP 24576:BRQWsYPzy5zLcyuP+KYc/fQR6+6Q4l+BF9k8v65OdsZ1n07rvxfQ0e0yGtrEH7Ya:U5/cbKU8v6RZ1q54rf2a
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

2024-09-02_2c750da79c7828fb0d0a1cebc72bd2a3_floxif_icedid

.exe 2.2MB

2024-09-02_2c750da79c7828fb0d0a1cebc72bd2a3_floxif_icedid

IMPHASH 2c1504bd326ccda023e1eca816945492
SHA256 bd41c445d668d3b0707c7554151a0e0728e39425c29e14aa594b5b981f7f40a5
MD5 2c750da79c7828fb0d0a1cebc72bd2a3
SHA1 715efe29da54d9dace72f477ef6ea715c28994b6
SHA512 2131fd3033e1048728bc53d91895248ddb06dbed20892028f9fc95b132d06b56cf0b95ff1f167c56c52c72f281a9a0a95e47395da726d09934660d0316d1e07b
SSDEEP 24576:BRQWsYPzy5zLcyuP+KYc/fQR6+6Q4l+BF9k8v65OdsZ1n07rvxfQ0e0yGtrEH7Ya:U5/cbKU8v6RZ1q54rf2a
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

b5:9c:b5:9a:15:3c:9a:d2:ee:f6:b2:60:7b:92:b1:9a:d6:f7:a9:30:ac:0e:1d:ed:92:ce:1a:eb:40:45:e0:f2

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 22, 2024

PE Signature issue

Digest

7f:d5:96:a0:91:95:c0:26:0e:48:34:a4:df:60:d1:01:ff:e5:4e:09

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=22671299,CN=Realtek Semiconductor Corp.,O=Realtek Semiconductor Corp.,POSTALCODE=300,STREET=No. 2\, Innovation Road II\, Hsinchu Science Park,L=Hsinchu,ST=Taiwan,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Apr 20, 2017

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

Serial Number

03:20:be:3e:b8:66:52:69:27:f9:99:b9:7b:04:34:6e

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 13, 2016 - Jan 24, 2019

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Timespan

Nov 10, 2006 - Nov 10, 2021

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:43:9b:d4:99:23:01:cb:6d:34:00:00:00:00:00:43

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 1, 2017 - Jun 1, 2018

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0b:aa:c1:00:00:00:00:00:09

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 18, 2012 - Apr 18, 2027

Minor OS version

Major OS version

Entry point

1199091

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\proj_20170418_bss_restoretodefault\20170418_ep_modify\_ma4_release\win32\EP.pdb

setupapi

SetupDiGetDeviceRegistryPropertyW SetupDiDestroyDeviceInfoList SetupDiGetDeviceInterfaceDetailW SetupDiEnumDeviceInterfaces SetupDiGetDeviceInstanceIdW SetupDiEnumDeviceInfo SetupDiGetClassDevsW

winmm

mmioRead mmioCreateChunk mmioGetInfo mmioSeek mmioSetInfo mmioWrite mmioAscend mmioDescend mmioClose mmioOpenW mmioAdvance

dsound

ord6 ord3 ord1

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

propsys

PropVariantCompareEx PropVariantToUInt32 PropVariantToString

uxtheme

CloseThemeData DrawThemeBackground OpenThemeData

gdiplus

GdipGetImageHeight GdiplusShutdown GdipGetImagePixelFormat GdipGetImageWidth GdipCloneImage GdipSetInterpolationMode GdipCreateBitmapFromHBITMAP GdipCreateBitmapFromScan0 GdipGetImageGraphicsContext GdipDrawImageI GdipCreateFromHDC GdipAddPathPie GdipAddPathEllipse GdipCreatePathGradientFromPath GdipSetPathGradientCenterColor GdipSetPathGradientSurroundColorsWithCount GdipGetPathGradientPointCount GdipFillPath GdipCreateBitmapFromStream GdipDeleteGraphics GdipDeleteBrush GdipFree GdipAlloc GdipCloneBrush GdipCreatePath GdipDeletePath GdipBitmapUnlockBits GdipDrawImageRectI GdipBitmapLockBits GdiplusStartup GdipGetImagePalette GdipDisposeImage GdipGetImagePaletteSize

imm32

ImmDisableIME

bcrypt

BCryptCloseAlgorithmProvider BCryptDestroyKey BCryptEncrypt BCryptImportKeyPair BCryptOpenAlgorithmProvider

wtsapi32

WTSRegisterSessionNotification WTSUnRegisterSessionNotification

kernel32

GetTempPathW SystemTimeToFileTime CompareFileTime OutputDebugStringW FreeLibrary VirtualAlloc VirtualFree GlobalUnlock GlobalFree GlobalAlloc GlobalLock FindResourceExW GetUserDefaultUILanguage IsBadReadPtr GetSystemDirectoryA WideCharToMultiByte ResetEvent DeleteFileW AllocConsole WriteConsoleW GetStdHandle HeapAlloc CreateMutexW LocalAlloc LocalFree ReleaseMutex lstrcpyW TerminateThread OpenMutexW GetSystemPowerStatus GetPrivateProfileStringW GetModuleFileNameW GetFileSize GetPrivateProfileIntW GetLocalTime GetDateFormatW GetTimeFormatW SetFilePointer SetThreadPriority LoadLibraryA RaiseException GetVersionExA lstrcmpW CompareStringW GlobalDeleteAtom GlobalFindAtomW GlobalAddAtomW InterlockedDecrement GetModuleHandleA GetCurrentProcessId FormatMessageW SuspendThread VirtualProtect WritePrivateProfileStringW GetProcessHeap CompareStringA LoadLibraryExW GetLocaleInfoW EnumResourceLanguagesW ConvertDefaultLocale GetCurrentThread GetThreadLocale ReadFile FlushFileBuffers LockFile UnlockFile GetSystemInfo FindClose FindFirstFileW GetVolumeInformationW GetFullPathNameW GetTickCount InterlockedIncrement TlsGetValue GlobalReAlloc GlobalHandle TlsAlloc TlsSetValue LocalReAlloc TlsFree GlobalFlags FileTimeToSystemTime SetErrorMode FileTimeToLocalFileTime GetFileTime GetStartupInfoW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent VirtualQuery GetSystemTimeAsFileTime ExitThread RtlUnwind HeapReAlloc ExitProcess HeapSize GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapDestroy HeapCreate QueryPerformanceCounter GetACP GetOEMCP IsValidCodePage LCMapStringA LCMapStringW GetLocaleInfoA GetConsoleCP GetConsoleMode GetStringTypeA GetStringTypeW SetStdHandle WriteConsoleA GetConsoleOutputCP CreateFileA SetEnvironmentVariableA HeapFree CreateProcessW SetEndOfFile WriteFile DeviceIoControl CreateFileW GetWindowsDirectoryW GetSystemTime GetTimeZoneInformation GetFileAttributesW GetCurrentThreadId MulDiv CreateThread lstrcmpiW GetCPInfo MultiByteToWideChar lstrlenA InterlockedExchange FreeResource GetVersionExW GetVersion SearchPathW DeleteCriticalSection CloseHandle WaitForSingleObject GetExitCodeThread SetEvent EnterCriticalSection ResumeThread GetCurrentProcess DuplicateHandle WaitForMultipleObjects CreateEventW InitializeCriticalSection LeaveCriticalSection lstrlenW GetSystemDirectoryW IsWow64Process Sleep GetProcAddress GetModuleHandleW LoadLibraryW GetLastError SetLastError FindResourceW LoadResource LockResource SizeofResource lstrcmpA

user32

GetMessageTime DestroyWindow GetTopWindow GetDlgItem SetActiveWindow GetLastActivePopup GetWindowTextW GetWindowTextLengthW SetFocus IsWindow RemovePropW GetPropW SetPropW GetClassNameW GetClassLongW IsChild WinHelpW SendDlgItemMessageA SendDlgItemMessageW EndDialog GetNextDlgTabItem IsWindowEnabled CreateDialogIndirectParamW GetActiveWindow IsDialogMessageW SetWindowTextW MoveWindow GetMenuCheckMarkDimensions ClientToScreen GetWindowDC BeginPaint EndPaint GetMenuStringW ValidateRect GetMessageW GetAsyncKeyState DestroyMenu SetRectEmpty WindowFromPoint CharUpperW RegisterClipboardFormatW SetWindowContextHelpId UnregisterClassW ReleaseCapture PostThreadMessageW CharNextW CopyAcceleratorTableW IsRectEmpty InvalidateRgn SetCapture GetNextDlgGroupItem MessageBeep SetParent GetDCEx LockWindowUpdate DeferWindowPos GetScrollInfo SetScrollInfo DefWindowProcW CallWindowProcW IntersectRect SystemParametersInfoA GetWindowPlacement GetDlgCtrlID FindWindowW SetProcessDPIAware GetMessagePos SetCursor PtInRect TrackMouseEvent EnableMenuItem CheckMenuItem AdjustWindowRect ShowScrollBar GetFocus LoadCursorW WindowFromDC FrameRect OffsetRect ScreenToClient SetMenuItemBitmaps DrawFocusRect InflateRect EqualRect UnionRect MapDialogRect GetWindow FindWindowExW DispatchMessageW TranslateMessage PostQuitMessage UnhookWindowsHookEx PeekMessageW SetWindowsHookExW CallNextHookEx EnumThreadWindows SetWindowPos AttachThreadInput SendInput GetWindowThreadProcessId ShowWindow ExitWindowsEx GetWindowRect UpdateWindow DrawTextW TabbedTextOutW GetSysColorBrush FillRect ModifyMenuW InsertMenuW GetMenuItemCount DrawEdge AppendMenuW SystemParametersInfoW GetSubMenu ReleaseDC GetMenuItemInfoW GetDC GetDesktopWindow CreateMenu DestroyIcon DrawIconEx GetMenuItemID LoadBitmapW GrayStringW DrawTextExW GetMenuState RegisterDeviceNotificationW SetMenuDefaultItem SetForegroundWindow GetForegroundWindow UnregisterDeviceNotification CreatePopupMenu GetCursorPos RegisterWindowMessageW CopyRect KillTimer SetTimer GetParent PostMessageW RedrawWindow GetCapture IsWindowVisible SetWindowLongW GetWindowLongW DrawIcon SendMessageW IsIconic LoadIconW GetSystemMetrics GetClientRect SetRect EnableWindow GetSysColor MapWindowPoints ScrollWindow TrackPopupMenuEx GetKeyState GetScrollRange SetScrollPos GetScrollPos GetMenu CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW MessageBoxW AdjustWindowRectEx InvalidateRect UnregisterClassA

gdi32

SetDIBColorTable GetMapMode SetGraphicsMode GetWorldTransform SetWorldTransform StretchBlt GetClipBox SetTextColor SetBkColor CreateRectRgn CreateRectRgnIndirect SetRectRgn ExtFloodFill CreatePatternBrush CreateBitmap SaveDC RestoreDC SetBkMode CreateSolidBrush ExtTextOutW TextOutW CreateFontW GetStockObject CombineRgn CreatePen CreateDIBSection RectVisible CreateFontIndirectW PtVisible Ellipse SetMapMode GetBkMode GetTextExtentPoint32W PatBlt Escape GetDeviceCaps SetPixel BitBlt GetPixel SelectObject DeleteDC GetViewportExtEx GetWindowExtEx CreateCompatibleBitmap ExcludeClipRect IntersectClipRect LineTo MoveToEx SelectClipRgn SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowOrgEx SetWindowExtEx ScaleWindowExtEx ExtSelectClipRgn GetCharWidthW StretchDIBits GetTextMetricsW EnumFontFamiliesExW GetBkColor GetTextColor GetRgnBox CreateCompatibleDC GetObjectW DeleteObject

msimg32

AlphaBlend

comdlg32

GetFileTitleW

winspool.drv

OpenPrinterW DocumentPropertiesW ClosePrinter

advapi32

OpenSCManagerW RegOpenKeyW RegDeleteKeyW RegEnumKeyW RegQueryValueW RegEnumKeyExW StartServiceW CloseServiceHandle OpenServiceW RegCloseKey RegOpenKeyExW RegSetValueExW RegCreateKeyExW RegDeleteValueW RegNotifyChangeKeyValue LookupPrivilegeValueW OpenProcessToken RegQueryValueExW AdjustTokenPrivileges

shell32

SHGetFolderPathW SHGetKnownFolderPath Shell_NotifyIconW ShellExecuteExW

comctl32

_TrackMouseEvent ImageList_GetIconSize InitCommonControlsEx

shlwapi

PathFindFileNameW PathFindExtensionW PathStripToRootW PathIsUNCW

oledlg

OleUIBusyW

ole32

CreateILockBytesOnHGlobal StgCreateDocfileOnILockBytes CoRegisterMessageFilter OleFlushClipboard OleIsCurrentClipboard CoRevokeClassObject CoGetClassObject CLSIDFromProgID OleInitialize OleUninitialize FreePropVariantArray PropVariantCopy CoFreeUnusedLibrariesEx CreateStreamOnHGlobal StringFromGUID2 CoTaskMemAlloc CoInitializeEx PropVariantClear CLSIDFromString CoUninitialize CoInitialize CoCreateInstance CoTaskMemFree StgOpenStorageOnILockBytes CoFreeUnusedLibraries

oleaut32

SafeArrayCreate VariantInit VariantClear SysStringLen VariantChangeType SysAllocStringLen SysFreeString VariantCopy SysAllocString OleCreateFontIndirect SafeArrayDestroy VariantTimeToSystemTime SystemTimeToVariantTime

Sharing

General

Malware Config

Signatures

File Explorer

2024-09-02_2c750da79c7828fb0d0a1cebc72bd2a3_floxif_icedid

PE Signature issue

PE Signature issue

setupapi

winmm

dsound

version

propsys

uxtheme

gdiplus

imm32

bcrypt

wtsapi32

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

generic