2024-09-10_7161832bb856c1f9d0e02ffa1618f12f_floxif_hijackloader_icedid

Sharing

Copy URL Twitter E-mail

General

Target
2024-09-10_7161832bb856c1f9d0e02ffa1618f12f_floxif_hijackloader_icedid
Size 2.1MB
Sample240910-c8wmaavcrc
SHA256 13e742a80e011cfacd555eddbaab5639c17a1bf66e6ea022ce41585df223527d
MD5 7161832bb856c1f9d0e02ffa1618f12f
SHA1 e31224daad163e30b338bfadf9d806dbd6c8d6d5
SHA512 54573982d9ecc2d5723e82f92288cd7ad28f5fbdb68cfdba7ff88063bcb54119a68c23d35b74b0e06a4599ffd115ba8123315eb530782d56b96028245b11f2eb
SSDEEP 49152:V8PsZNCH5OAxh5f1fWtfxaPZXbuo3j5XpI:uPsZu5OA4fxaPhbuo3j5XpI
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

2024-09-10_7161832bb856c1f9d0e02ffa1618f12f_floxif_hijackloader_icedid

.exe 2.1MB

2024-09-10_7161832bb856c1f9d0e02ffa1618f12f_floxif_hijackloader_icedid

IMPHASH 964d99ec0c0e5a03658f1714f812c1cf
SHA256 13e742a80e011cfacd555eddbaab5639c17a1bf66e6ea022ce41585df223527d
MD5 7161832bb856c1f9d0e02ffa1618f12f
SHA1 e31224daad163e30b338bfadf9d806dbd6c8d6d5
SHA512 54573982d9ecc2d5723e82f92288cd7ad28f5fbdb68cfdba7ff88063bcb54119a68c23d35b74b0e06a4599ffd115ba8123315eb530782d56b96028245b11f2eb
SSDEEP 49152:V8PsZNCH5OAxh5f1fWtfxaPZXbuo3j5XpI:uPsZu5OA4fxaPhbuo3j5XpI
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

92:f2:38:7a:d0:7b:fc:33:81:5d:3c:34:2c:6e:b9:1c:dd:1f:51:6d:dc:3d:99:e8:1e:09:17:4b:fb:6e:58:c8

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=110111-1138985,CN=AhnLab\, Inc.,O=AhnLab\, Inc.,L=Seongnam-si,ST=Gyeonggi-do,C=KR,1.3.6.1.4.1.311.60.2.1.1=#130b53656f6e676e616d2d7369,1.3.6.1.4.1.311.60.2.1.2=#130b4779656f6e6767692d646f,1.3.6.1.4.1.311.60.2.1.3=#13024b52,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Oct 5, 2022

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0d:dd:a3:fa:e1:5d:dc:b3:77:ef:dc:e3:aa:6b:c2:a5

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 10, 2022 - Jan 7, 2023

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

1382193

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

u:\AhnLab\Common\AhnRestore\Trunk\Src\V3Restore\Release\V3Restore.pdb

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

ws2_32

WSAGetLastError getsockopt gethostbyname WSAStartup getaddrinfo ioctlsocket getsockname socket connect setsockopt bind listen getnameinfo ntohs freeaddrinfo WSACleanup send WSASetLastError recv accept closesocket

kernel32

InterlockedDecrement SetThreadPriority ResumeThread SetEvent SuspendThread CreateEventW GlobalAddAtomW GetFileAttributesExW LocalFileTimeToFileTime SystemTimeToFileTime SetFileTime SetFileAttributesW GetFileAttributesW GetFileSizeEx GetFileTime InterlockedIncrement CompareStringW GlobalReAlloc GlobalHandle InitializeCriticalSection LocalReAlloc GlobalGetAtomNameW GetAtomNameW GetThreadLocale GetPrivateProfileIntW WritePrivateProfileStringW GetPrivateProfileStringW GlobalFlags GetVersionExA LoadLibraryA GlobalFindAtomW FreeResource MoveFileW DeleteFileW GetStringTypeExW FlushFileBuffers LockFile UnlockFile DuplicateHandle GlobalDeleteAtom GetVolumeInformationW GetFullPathNameW GetShortPathNameW SetErrorMode GetStartupInfoW RtlUnwind HeapFree HeapAlloc GetDriveTypeW GetLocalTime HeapReAlloc GetFileInformationByHandle PeekNamedPipe Sleep ExitProcess SetConsoleCtrlHandler GetDriveTypeA FindFirstFileA RaiseException ExitThread CreateThread HeapSize SetUnhandledExceptionFilter GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetStartupInfoA HeapCreate HeapDestroy VirtualFree GetTickCount TerminateProcess UnhandledExceptionFilter IsDebuggerPresent GetCPInfo GetACP GetOEMCP IsValidCodePage GetTimeZoneInformation FatalAppExitA VirtualAlloc GetConsoleCP GetCurrentDirectoryA SetCurrentDirectoryA SetStdHandle LCMapStringA LCMapStringW GetFullPathNameA CreateFileA GetStringTypeA GetStringTypeW GetTimeFormatA GetDateFormatA GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale WriteConsoleA GetConsoleOutputCP WriteConsoleW GetProcessHeap SetEnvironmentVariableA GetCurrentThread ConvertDefaultLocale EnumResourceLanguagesW GetLocaleInfoW CompareStringA InterlockedExchange GlobalFree CopyFileW GlobalSize GlobalAlloc GlobalLock GlobalUnlock MulDiv GetEnvironmentVariableW ReadConsoleW ReadConsoleA SetConsoleMode GetConsoleMode FindClose FindFirstFileW FindNextFileW QueryPerformanceCounter GetSystemTimeAsFileTime FormatMessageW GetStdHandle GetFileType InterlockedExchangeAdd GetCurrentThreadId TlsFree TlsSetValue TlsGetValue TlsAlloc DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSectionAndSpinCount InterlockedCompareExchange SetLastError GetCurrentDirectoryW CreateProcessW WaitForSingleObject OutputDebugStringA GetCurrentProcessId SetCurrentDirectoryW GetModuleFileNameW GetTempPathW SetFilePointer WriteFile SetEndOfFile WideCharToMultiByte GetFileSize ReadFile MultiByteToWideChar CreateFileW LoadLibraryW GetWindowsDirectoryW GetSystemDirectoryW LoadLibraryExW GetUserDefaultLangID FileTimeToLocalFileTime FileTimeToSystemTime FindResourceW LoadResource LockResource SizeofResource lstrcpyW lstrcatW CreateMutexW lstrcmpA CloseHandle lstrlenA lstrcpynW GetVersion GetModuleHandleA FreeLibrary LocalAlloc lstrcmpW lstrlenW LocalFree GetSystemInfo lstrcmpiW GetVersionExW GetLastError GetModuleHandleW GetProcAddress GetCurrentProcess

user32

MoveWindow ShowWindow ScrollWindowEx DestroyIcon CharUpperW InflateRect GetMenuItemInfoW DestroyMenu SystemParametersInfoW TranslateAcceleratorW BringWindowToTop SetRectEmpty CreatePopupMenu InsertMenuItemW InvalidateRect LoadAcceleratorsW GetMenuBarInfo LoadMenuW ReuseDDElParam UnpackDDElParam EndDialog GetNextDlgTabItem CreateDialogIndirectParamW GetKeyNameTextW MapVirtualKeyW IsRectEmpty GetSystemMenu SetParent UnionRect GetDialogBaseUnits SetRect SetTimer KillTimer GetDCEx LockWindowUpdate WinHelpW IsChild GetClassLongW SetPropW GetPropW RemovePropW IsWindow SetFocus GetForegroundWindow SetActiveWindow BeginDeferWindowPos EndDeferWindowPos GetDlgItem GetTopWindow DestroyWindow GetMessageTime GetMessagePos MapWindowPoints ScrollWindow TrackPopupMenuEx TrackPopupMenu SetMenu SetScrollRange GetScrollRange SetScrollPos GetScrollPos SetForegroundWindow ShowScrollBar UpdateWindow GetClientRect CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW AdjustWindowRectEx EqualRect DeferWindowPos GetScrollInfo SetScrollInfo IsDialogMessageW DefWindowProcW CallWindowProcW CopyRect GetMenu SetWindowLongW SetWindowPos OffsetRect IntersectRect SystemParametersInfoA IsIconic GetWindowPlacement UnregisterClassW WaitMessage ReleaseCapture GetCapture WindowFromPoint SetCapture GetDesktopWindow GetWindow GetDlgCtrlID GetWindowRect GetClassNameW PtInRect SetWindowTextW EndPaint BeginPaint GetWindowDC ClientToScreen ScreenToClient GrayStringW DrawTextExW DrawTextW TabbedTextOutW FillRect DeleteMenu GetWindowTextLengthW GetWindowTextW LoadCursorW GetDC ReleaseDC GetSysColor GetSysColorBrush GetWindowThreadProcessId GetWindowLongW GetLastActivePopup IsWindowEnabled EnableWindow ShowOwnedPopups SetCursor SetWindowsHookExW CallNextHookEx GetMessageW TranslateMessage DispatchMessageW GetActiveWindow IsWindowVisible GetKeyState PeekMessageW GetCursorPos ValidateRect SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW GetFocus GetParent SendMessageW ModifyMenuW EnableMenuItem CheckMenuItem UnhookWindowsHookEx PostMessageW PostQuitMessage GetMenuState GetMenuStringW AppendMenuW GetMenuItemID IsDlgButtonChecked SetDlgItemTextW SetDlgItemInt GetDlgItemTextW GetDlgItemInt CheckRadioButton CheckDlgButton RegisterWindowMessageW LoadIconW SendDlgItemMessageW SetWindowPlacement SendDlgItemMessageA InsertMenuW GetMenuItemCount GetSubMenu RemoveMenu MessageBoxW GetProcessWindowStation GetUserObjectInformationW wsprintfW CharNextA CharPrevA GetSystemMetrics

gdi32

SetTextJustification SetTextCharacterExtra SetMapperFlags ExtTextOutW Escape SelectObject SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowOrgEx OffsetWindowOrgEx SetWindowExtEx ScaleWindowExtEx GetCurrentPositionEx ArcTo PolyDraw PolylineTo PolyBezierTo ExtSelectClipRgn DeleteDC CreateDIBPatternBrushPt CreatePatternBrush CreateCompatibleDC GetStockObject SetTextAlign PlayMetaFileRecord LineTo EnumMetaFile PlayMetaFile CreatePen ExtCreatePen CreateSolidBrush CreateHatchBrush GetDCOrgEx CreateFontIndirectW GetTextExtentPoint32W CreateRectRgnIndirect SetRectRgn RectVisible CombineRgn GetMapMode PatBlt DPtoLP CreateCompatibleBitmap GetCharWidthW CreateFontW StretchDIBits GetTextMetricsW GetBkColor SelectPalette MoveToEx PtVisible StartDocW GetPixel BitBlt OffsetClipRgn IntersectClipRect ExcludeClipRect GetClipBox SetMapMode ModifyWorldTransform SetWorldTransform SetGraphicsMode SetTextColor SetStretchBltMode SetROP2 SetPolyFillMode SetBkMode SetBkColor RestoreDC SaveDC CreateBitmap CreateDCW CopyMetaFileW GetObjectType GetDeviceCaps GetWindowExtEx GetViewportExtEx GetObjectW SelectClipPath CreateRectRgn GetClipRgn SelectClipRgn DeleteObject SetColorAdjustment SetArcDirection TextOutW

comdlg32

GetFileTitleW

winspool.drv

DocumentPropertiesW OpenPrinterW ClosePrinter

advapi32

RegSetValueExW RegCreateKeyW RegCreateKeyExW RegQueryValueW RegOpenKeyW RegEnumKeyW RegDeleteKeyW RegSetValueW CryptAcquireContextW CryptGenRandom CryptReleaseContext RegisterEventSourceW ReportEventW DeregisterEventSource RegOpenKeyA RegQueryValueExA RegOpenKeyExW RegQueryValueExW RegCloseKey RegDeleteValueW

shell32

ExtractIconW DragFinish DragQueryFileW SHGetFileInfoW

shlwapi

PathFindFileNameW PathStripToRootW PathIsUNCW PathFindExtensionW PathRemoveExtensionW PathRemoveFileSpecW

ole32

CoTaskMemFree SetConvertStg WriteFmtUserTypeStg WriteClassStg OleRegGetUserType ReadFmtUserTypeStg ReadClassStg CreateBindCtx ReleaseStgMedium CoTaskMemAlloc StringFromCLSID CoInitializeEx CoUninitialize CLSIDFromString CoCreateInstance StringFromGUID2 CoDisconnectObject OleDuplicateData CoTreatAsClass

oleaut32

SysStringLen VariantClear SafeArrayCreate SafeArrayGetDim SafeArrayGetElemsize SafeArrayGetLBound SafeArrayGetUBound SafeArrayAccessData SafeArrayUnaccessData LoadRegTypeLi LoadTypeLi RegisterTypeLi SysStringByteLen SysAllocStringByteLen SysFreeString SafeArrayRedim VariantChangeType VariantCopy SafeArrayAllocData SafeArrayAllocDescriptor SafeArrayCopy SafeArrayGetElement SafeArrayPtrOfIndex SafeArrayPutElement SafeArrayLock SafeArrayUnlock SafeArrayDestroy SafeArrayDestroyData SafeArrayDestroyDescriptor VariantTimeToSystemTime SystemTimeToVariantTime SysAllocStringLen VarDateFromStr SysReAllocStringLen VarCyFromStr VarBstrFromCy VarBstrFromDec VarDecFromStr VarBstrFromDate VariantInit

Sharing

General

Malware Config

Signatures

File Explorer

2024-09-10_7161832bb856c1f9d0e02ffa1618f12f_floxif_hijackloader_icedid

PE Signature issue

version

ws2_32

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

shlwapi

ole32

oleaut32

generic