2024-09-08_3f691d04732d701dcdf456b7c393a8a9_icedid

Sharing

Copy URL Twitter E-mail

General

Target

2024-09-08_3f691d04732d701dcdf456b7c393a8a9_icedid
Size

3.2MB
MD5

3f691d04732d701dcdf456b7c393a8a9
SHA1

5ff629e0d4f0281afe05e971712071efd5603b0b
SHA256

2b73165e3b465e67ebd83143ce34c2288ba876a8ccbd71056db8eb7547764b52
SHA512

6be9baffce5a2f9e08484fff1f1f30adeba50b50efdd9ef1f913b6b92270d173c8edc103e91a61996ea7193df6d7a3e9e3cb16a3702e0db143458586ec26f2c4
SSDEEP

49152:BTLwILEr4vdMXi/C0xJs5RvJCIXT5puePJEFHR2FZnTRyTYAzAHGO:BX9WbXiy5RvJCIFpxPJE9RBYAzAHGO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-09-08_3f691d04732d701dcdf456b7c393a8a9_icedid

Files

2024-09-08_3f691d04732d701dcdf456b7c393a8a9_icedid
.exe windows:4 windows x86 arch:x86

9a9a33e0182e606172cbaacb01eb91e1

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\Gunz_brz\Gunz\Runtime\theduel.pdb

Imports

fmod

_FSOUND_Sample_Free@4
_FSOUND_Sample_SetMinMaxDistance@12
_FSOUND_GetError@0
_FSOUND_Sample_Load@20
_FSOUND_SetPaused@8
_FSOUND_SetVolume@8
_FSOUND_SetPriority@8
_FSOUND_3D_SetAttributes@12
_FSOUND_PlaySoundEx@16
_FSOUND_Sample_GetMode@4
_FSOUND_3D_SetRolloffFactor@4
_FSOUND_3D_SetDistanceFactor@4
_FSOUND_3D_SetDopplerFactor@4
_FSOUND_SetMute@8
_FSOUND_3D_SetMinMaxDistance@12
_FSOUND_Update@0
_FSOUND_3D_Listener_SetAttributes@32
_FSOUND_StopSound@4
_FSOUND_GetNumDrivers@0
_FSOUND_GetDriverName@4
_FSOUND_GetMaxChannels@0
_FSOUND_Stream_SetBufferSize@4
_FSOUND_Init@12
_FSOUND_SetMaxHardwareChannels@4
_FSOUND_SetMinHardwareChannels@4
_FSOUND_GetDriverCaps@8
_FSOUND_SetDriver@4
_FSOUND_SetOutput@4
_FSOUND_SetHWND@4
_FSOUND_GetVersion@0
_FSOUND_GetVolume@4
_FSOUND_Close@0
_FSOUND_Stream_SetEndCallback@12
_FSOUND_Stream_Open@16
_FSOUND_Stream_GetMode@4
_FSOUND_Stream_SetMode@8
_FSOUND_Stream_PlayEx@16
_FSOUND_Stream_Close@4
_FSOUND_Stream_Stop@4

kernel32

GetLocaleInfoA
GetACP
InterlockedExchange
GetThreadLocale
GetCurrentProcess
SetPriorityClass
lstrlenA
WideCharToMultiByte
GetVersion
CompareStringA
CompareStringW
GetProcessHeap
SetEnvironmentVariableA
SetStdHandle
IsBadCodePtr
IsBadReadPtr
GetStringTypeW
GetStringTypeA
GetDriveTypeA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
IsBadWritePtr
VirtualFree
HeapCreate
HeapDestroy
GetTimeZoneInformation
GetFileType
GetStdHandle
SetHandleCount
GlobalMemoryStatus
InitializeCriticalSection
DeleteCriticalSection
Sleep
lstrcmpiA
QueryPerformanceCounter
QueryPerformanceFrequency
GetCurrentThreadId
SetCurrentDirectoryA
CreateMutexA
WaitForSingleObject
CloseHandle
GetModuleFileNameA
GetWindowsDirectoryA
FindFirstFileA
CreateDirectoryA
FindClose
GetCurrentDirectoryA
GetVolumeInformationA
GetTickCount
GetLastError
WinExec
IsDebuggerPresent
OutputDebugStringA
GetModuleHandleA
EnterCriticalSection
LeaveCriticalSection
GetVersionExA
LoadLibraryA
GetProcAddress
FreeLibrary
MultiByteToWideChar
GetLocalTime
LCMapStringW
LCMapStringA
HeapSize
HeapReAlloc
GetCommandLineA
GetStartupInfoA
VirtualAlloc
HeapAlloc
HeapFree
GetSystemTimeAsFileTime
RtlUnwind
FileTimeToLocalFileTime
SetEndOfFile
FlushFileBuffers
MulDiv
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GetFileSize
CreateFileA
CreateEventA
IsDBCSLeadByte
SetEvent
ResetEvent
ExitThread
WaitForMultipleObjects
SizeofResource
LockResource
LoadResource
FindResourceA
SetUnhandledExceptionFilter
TerminateProcess
CreateThread
GetSystemInfo
GlobalUnlock
GlobalLock
ReadFile
SetFileTime
GetFileAttributesA
lstrcatA
GlobalMemoryStatusEx
InterlockedDecrement
FindNextFileA
GetCurrentProcessId
WriteFile
SystemTimeToFileTime
OpenProcess
GetCurrentThread
GlobalAlloc
GlobalSize
GlobalAddAtomA
GlobalDeleteAtom
FindNextChangeNotification
OpenEventA
FindCloseChangeNotification
FindFirstChangeNotificationA
SetThreadPriority
lstrcpyA
GetExitCodeThread
ExitProcess
VirtualProtect
GetSystemDefaultLangID
VirtualQuery
SetFileAttributesA
DeleteFileA
LocalFree
lstrcpynA
FormatMessageA
GlobalFree
SetLastError
GlobalReAlloc
lstrcmpA
lstrcmpW
RaiseException
InterlockedIncrement
LocalAlloc
GlobalHandle
TlsGetValue
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
FileTimeToSystemTime
GlobalFindAtomA
GlobalGetAtomNameA
GlobalFlags
GetCPInfo
GetOEMCP
GetFullPathNameA
SetFilePointer
IsProcessorFeaturePresent

user32

GetSysColorBrush
GetSysColor
GetSystemMetrics
LoadCursorA
TabbedTextOutA
DrawTextA
DrawTextExA
GrayStringA
LoadBitmapA
GetMenuCheckMarkDimensions
CheckMenuItem
EnableMenuItem
ModifyMenuA
GetFocus
SetMenuItemBitmaps
PtInRect
CopyRect
GetWindowPlacement
IsIconic
SystemParametersInfoA
CallWindowProcA
GetDlgCtrlID
GetClassInfoA
AdjustWindowRectEx
GetMenu
SetForegroundWindow
MapWindowPoints
GetSubMenu
GetMessageTime
DestroyWindow
GetDlgItem
GetForegroundWindow
RemovePropA
SetPropA
GetClassInfoExA
GetClassLongA
GetCapture
WinHelpA
RegisterWindowMessageA
SetWindowTextA
UnregisterClassA
DestroyMenu
GetParent
GetLastActivePopup
SetWindowsHookExA
CallNextHookEx
ValidateRect
UnhookWindowsHookEx
GetMenuState
GetMenuItemID
IsWindowEnabled
EnableWindow
MapVirtualKeyA
GetKeyNameTextA
ScreenToClient
SendMessageA
GetTopWindow
GetClassNameA
FindWindowExA
ShowWindow
GetWindow
DefWindowProcA
SetFocus
ShowCursor
MessageBoxA
OpenClipboard
IsClipboardFormatAvailable
GetClipboardData
CloseClipboard
GetAsyncKeyState
wsprintfA
PostQuitMessage
GetWindowRect
PostMessageA
EnumWindows
GetWindowTextA
GetKeyState
ClientToScreen
SetCursorPos
GetKeyboardLayout
UnregisterHotKey
EmptyClipboard
SetClipboardData
GetCursorPos
GetDC
ReleaseDC
DispatchMessageA
PeekMessageA
TranslateMessage
LoadIconA
RegisterClassA
CreateWindowExA
SetWindowPos
GetActiveWindow
UpdateWindow
GetWindowLongA
SetWindowLongA
GetClientRect
GetMenuItemCount
MoveWindow
GetPropA
GetMessagePos

gdi32

OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
CreateBitmap
GetStockObject
DeleteDC
DeleteObject
SelectObject
GetTextExtentPoint32A
GetObjectA
SetMapMode
CreateDIBSection
CreateCompatibleDC
CreateFontA
GetDeviceCaps
GetTextMetricsA
SaveDC
SetViewportOrgEx
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetClipBox
SetTextColor
RemoveFontResourceA
AddFontResourceA
SetBkColor
RestoreDC

shell32

ShellExecuteA
SHChangeNotify
SHGetSpecialFolderPathA

ole32

CoInitialize
OleRun
CoUninitialize
CoCreateInstance

comctl32

ord17

shlwapi

PathSearchAndQualifyA
StrStrIA
PathRemoveFileSpecA
PathStripPathA
PathFileExistsA
PathIsDirectoryA

urlmon

URLDownloadToFileA

imm32

ImmGetCompositionStringA
ImmGetDefaultIMEWnd
ImmSetConversionStatus
ImmAssociateContext
ImmNotifyIME
ImmGetCandidateListA
ImmGetContext
ImmGetOpenStatus
ImmReleaseContext
ImmGetConversionStatus

winmm

timeBeginPeriod
timeGetDevCaps
timeEndPeriod
timeGetTime

ws2_32

getsockname
recvfrom
sendto
shutdown
WSACreateEvent
WSAEventSelect
WSAWaitForMultipleEvents
inet_ntoa
ntohs
inet_addr
gethostbyname
gethostname
closesocket
WSAStartup
WSACleanup
setsockopt
ioctlsocket
socket
bind
htons
htonl
recv
WSAGetLastError
connect
WSACloseEvent
send
WSAEnumNetworkEvents

gdiplus

GdipDrawPath
GdipGraphicsClear
GdipFillPath
GdipDrawString
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipGetFamily
GdipCloneBrush
GdipSetSmoothingMode
GdipCreateFromHDC
GdipAddPathString
GdipCreateSolidFill
GdipDeleteFont
GdipDeleteGraphics
GdipDeletePath
GdipCreatePath
GdipStringFormatGetGenericTypographic
GdipDeletePen
GdipCreatePen1
GdipDeleteBrush
GdiplusShutdown
GdiplusStartup
GdipAlloc
GdipFree
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipSaveImageToFile
GdipDeleteFontFamily
GdipDisposeImage

dbghelp

MiniDumpWriteDump

wininet

InternetCloseHandle
InternetSetStatusCallback
InternetReadFileExA
HttpQueryInfoA
HttpSendRequestA
HttpOpenRequestA
InternetConnectA
InternetOpenA
DeleteUrlCacheEntry
InternetCrackUrlA

psapi

EnumProcesses
EnumProcessModules
GetModuleFileNameExA
GetModuleBaseNameA

oleacc

LresultFromObject
CreateStdAccessibleObject

winspool.drv

ClosePrinter
DocumentPropertiesA
OpenPrinterA

advapi32

RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyA
RegOpenKeyA
RegCloseKey

oleaut32

GetErrorInfo
VariantChangeType
SysFreeString
SysAllocString
SysAllocStringByteLen
SysStringByteLen
VariantInit
VariantClear

Exports

Exports

fcEXP

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 404KB - Virtual size: 403KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 156KB - Virtual size: 26.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 404KB - Virtual size: 401KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9a9a33e0182e606172cbaacb01eb91e1

Headers

File Characteristics

PDB Paths

Imports

fmod

kernel32

user32

gdi32

shell32

ole32

comctl32

shlwapi

urlmon

imm32

winmm

ws2_32

gdiplus

dbghelp

wininet

psapi

oleacc

winspool.drv

advapi32

oleaut32

Exports

Exports

Sections

.text Size: 2.2MB - Virtual size: 2.2MB

.rdata Size: 404KB - Virtual size: 403KB

.data Size: 156KB - Virtual size: 26.1MB

.rsrc Size: 404KB - Virtual size: 401KB

.text
Size: 2.2MB - Virtual size: 2.2MB

.rdata
Size: 404KB - Virtual size: 403KB

.data
Size: 156KB - Virtual size: 26.1MB

.rsrc
Size: 404KB - Virtual size: 401KB