2024-09-12_491d630f35bb458c1250fc44971e1bd0_icedid

Sharing

Copy URL Twitter E-mail

General

Target

2024-09-12_491d630f35bb458c1250fc44971e1bd0_icedid
Size

1.9MB
MD5

491d630f35bb458c1250fc44971e1bd0
SHA1

7b168f99ee41bcef188c4dc5785b89007a2f0ffd
SHA256

94d731fb9336bce63b91374216b61bc6cbe8f9c44ddf5b4699a18360fc6e33be
SHA512

5f256b4efe8580ddeef404aaabcd208089e888a6073822d418ba9476925616232f622df972d0204be044f3acde1279eddbbccb277ae9f73a230673c8c7dc4f94
SSDEEP

49152:7l6tiVyIOYziFOcRsa5JVtHqvqcTOi9uVvIlpx:7lQiVyw+FRsa5JSX93H

Score

1^/10

Malware Config

Signatures

Files

2024-09-12_491d630f35bb458c1250fc44971e1bd0_icedid
.exe windows:5 windows x86 arch:x86

96fdd25324af4956af4b239d3fbb79f5

Code Sign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

73:93:ad:65:df:71:bf:83:c8:88:24:20:f2:fe:0a:56
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

19/05/2009, 00:00

Not After

02/07/2011, 23:59

Subject

CN=W3i\, LLC,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=W3i\, LLC,L=Sartell,ST=Minnesota,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

11:6c:80:a8:43:a8:14:0c:b9:82:c0:91:5c:fe:4d:9b:ce:0d:6c:15
Signer

Actual PE Digest

11:6c:80:a8:43:a8:14:0c:b9:82:c0:91:5c:fe:4d:9b:ce:0d:6c:15

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\AFEICK\Projects\Installer\MAIN\Installer.FreezeWrap.Application\Release\FreezeWrapWin.pdb

Imports

psapi

GetModuleFileNameExA
EnumProcesses

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

wininet

InternetCanonicalizeUrlA
InternetCombineUrlA
InternetGetCookieA
InternetSetCookieA
InternetCloseHandle
InternetCrackUrlA
InternetOpenA
InternetErrorDlg
HttpQueryInfoA
HttpSendRequestA
HttpAddRequestHeadersA
HttpOpenRequestA
InternetConnectA
InternetSetStatusCallback
InternetReadFileExA

kernel32

InterlockedIncrement
TlsGetValue
GlobalReAlloc
GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
GlobalFlags
GetCPInfo
GetOEMCP
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
DuplicateHandle
GetVolumeInformationA
GetFileSizeEx
SetErrorMode
ExitProcess
GetCommandLineA
GetStartupInfoA
GetTimeFormatA
GetDateFormatA
GetSystemTimeAsFileTime
RtlUnwind
VirtualProtect
VirtualAlloc
VirtualQuery
GetModuleHandleW
ExitThread
CreateThread
HeapSize
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetACP
IsValidCodePage
LCMapStringA
LCMapStringW
GetStdHandle
InitializeCriticalSectionAndSpinCount
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapCreate
VirtualFree
QueryPerformanceCounter
GetStringTypeA
GetStringTypeW
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CompareStringW
SetEnvironmentVariableA
GetFileAttributesW
LoadLibraryW
GetFullPathNameW
GetThreadLocale
RaiseException
InterlockedDecrement
GetModuleFileNameW
CreateEventA
SuspendThread
SetEvent
SetThreadPriority
GetCurrentThread
ConvertDefaultLocale
GetLocaleInfoA
InterlockedExchange
lstrcmpA
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
CompareStringA
lstrcmpW
FreeResource
SetLastError
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
lstrlenW
MulDiv
ResumeThread
GlobalMemoryStatus
GetSystemInfo
GetCurrentProcess
GetSystemDirectoryA
GetWindowsDirectoryA
GetVersionExA
GetFileSize
SetFilePointer
WriteFile
ReadFile
FileTimeToLocalFileTime
GetFileTime
CreateFileA
GetTimeZoneInformation
FileTimeToSystemTime
GetCurrentProcessId
GetProcAddress
Module32Next
Module32First
GetExitCodeProcess
TerminateProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
OpenProcess
WaitForSingleObject
CreateProcessA
CloseHandle
GetLongPathNameA
GetFullPathNameA
GetCurrentDirectoryA
GetModuleFileNameA
GetFileAttributesA
SetFileAttributesA
RemoveDirectoryA
DeleteFileA
GetTempFileNameA
GetSystemTime
CreateDirectoryA
FindClose
FindNextFileA
FindFirstFileA
GetTempPathA
GetPrivateProfileSectionA
GetPrivateProfileSectionNamesA
MultiByteToWideChar
GetCurrentThreadId
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetModuleHandleA
LocalFree
FormatMessageA
lstrlenA
LocalAlloc
GetUserDefaultUILanguage
FindResourceExA
LoadLibraryExA
FreeLibrary
EnumResourceLanguagesA
EnumResourceNamesA
LoadLibraryA
EndUpdateResourceA
UpdateResourceA
HeapAlloc
BeginUpdateResourceA
GetProcessHeap
HeapFree
WritePrivateProfileStringA
CreateMutexA
ReleaseMutex
GetPrivateProfileStringA
GetPrivateProfileIntA
CopyFileA
SystemTimeToFileTime
GetLocalTime
GetTickCount
Sleep
GetLastError
FindResourceA
LoadResource
LockResource
SizeofResource
WideCharToMultiByte
CreateFileW
GetTempPathW
LockFileEx
DeleteFileW
AreFileApisANSI
ResetEvent
HeapReAlloc

user32

DestroyMenu
GetMenuItemInfoA
WindowFromPoint
SetWindowRgn
IsRectEmpty
InflateRect
EndPaint
BeginPaint
GetWindowDC
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
FillRect
ShowOwnedPopups
GetMessageA
TranslateMessage
ValidateRect
PostQuitMessage
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
ModifyMenuA
EnableMenuItem
CheckMenuItem
ReleaseDC
GetDC
RegisterWindowMessageA
WinHelpA
IsChild
CallNextHookEx
GetClassLongA
SetPropA
GetPropA
RemovePropA
GetForegroundWindow
GetLastActivePopup
DispatchMessageA
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageA
MapWindowPoints
ScrollWindow
TrackPopupMenu
GetKeyState
SetMenu
SetScrollRange
GetScrollRange
GetScrollPos
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
SetWindowPlacement
DefWindowProcA
CallWindowProcA
GetMenu
IntersectRect
GetWindowPlacement
GetDesktopWindow
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
GetNextDlgTabItem
GetWindowTextLengthA
CharUpperA
UnregisterClassA
CopyAcceleratorTableA
IsWindow
GetWindowTextA
GetFocus
SetWindowPos
SetFocus
ShowWindow
MoveWindow
IsDialogMessageA
SetDlgItemTextA
SendDlgItemMessageA
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
GetKeyboardState
DrawIcon
IsIconic
AppendMenuA
CreatePopupMenu
AdjustWindowRectEx
ShowScrollBar
DrawEdge
ChildWindowFromPoint
GetCursorPos
CopyRect
SetRect
InvalidateRgn
TranslateAcceleratorA
BringWindowToTop
SetRectEmpty
InsertMenuItemA
LoadAcceleratorsA
LoadMenuA
ReuseDDElParam
PtInRect
GetWindow
UnpackDDElParam
PostThreadMessageA
MessageBeep
GetNextDlgGroupItem
RegisterClipboardFormatA
SetWindowContextHelpId
SetScrollPos
CharNextA
SendMessageA
EnableWindow
SetTimer
UpdateWindow
KillTimer
RedrawWindow
MessageBoxA
MessageBoxExA
IsWindowVisible
GetClientRect
LoadIconA
PostMessageA
SetForegroundWindow
LoadStringA
wsprintfA
EnumWindows
IsWindowEnabled
GetWindowThreadProcessId
GetClassNameA
EnumChildWindows
GetWindowRect
ScreenToClient
InvalidateRect
SystemParametersInfoA
GetSystemMetrics
EnumDisplaySettingsA
GetShellWindow
GetParent
OffsetRect
SetClassLongA
GetCapture
ReleaseCapture
SetCapture
WaitForInputIdle
DialogBoxParamA
GetWindowLongA
GetDlgCtrlID
GetSysColor
GetSysColorBrush
EndDialog
SetCursor
LoadImageA
MapDialogRect
ClientToScreen
LoadCursorA
GetDlgItem
SetWindowTextA
SetWindowLongA
SetWindowsHookExA

gdi32

GetTextExtentPoint32A
GetRgnBox
GetBkColor
Ellipse
CreateEllipticRgn
LPtoDP
GetMapMode
CreatePatternBrush
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
Escape
CreateFontIndirectA
ExtTextOutA
GetObjectA
DeleteObject
GetStockObject
GetTextColor
SetBkColor
RectVisible
PtVisible
GetPixel
GetWindowExtEx
GetViewportExtEx
SetMapMode
SetBkMode
RestoreDC
SaveDC
CreateBitmap
CreateRectRgnIndirect
SetTextColor
GetClipBox
GetDeviceCaps
CreateCompatibleBitmap
DeleteDC
BitBlt
SelectObject
CreateCompatibleDC
CreateSolidBrush
TextOutA

comdlg32

GetFileTitleA

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter

advapi32

RegQueryValueA
RegOpenKeyA
RegEnumKeyA
RegDeleteKeyA
AdjustTokenPrivileges
GetLengthSid
ImpersonateLoggedOnUser
DuplicateTokenEx
LookupPrivilegeValueA
SetTokenInformation
RevertToSelf
RegEnumValueA
RegEnumKeyExA
RegQueryInfoKeyA
RegDeleteValueA
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegOpenCurrentUser
GetSidSubAuthority
GetSidSubAuthorityCount
GetSidIdentifierAuthority
IsValidSid
GetTokenInformation
OpenProcessToken

shell32

Shell_NotifyIconA
ShellExecuteExA
SHGetSpecialFolderPathA
SHBrowseForFolderA
SHGetPathFromIDListA
DragFinish
DragQueryFileA

comctl32

InitCommonControlsEx

shlwapi

PathRemoveFileSpecA
PathStripPathA
PathRenameExtensionA
PathFindExtensionA
PathCombineA
UrlEscapeA
SHDeleteEmptyKeyA
PathFindFileNameA
PathRemoveFileSpecW
PathStripToRootA
PathIsUNCA

oledlg

ord8

ole32

CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
OleUninitialize
CoInitializeSecurity
OleInitialize
CoUninitialize
CoInitializeEx
StringFromGUID2
CLSIDFromString
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CoCreateGuid
CreateILockBytesOnHGlobal
CLSIDFromProgID
CoFreeUnusedLibraries
CoRevokeClassObject
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter
CoInitialize

oleaut32

SysFreeString
VariantClear
SysAllocStringLen
VariantInit
SysStringLen
VariantChangeType
SysAllocStringByteLen
SysAllocString
VariantCopy
DispCallFunc
LoadRegTypeLi
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetElemsize
SafeArrayGetDim
SafeArrayCreate
SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
SafeArrayCreateVector
OleCreateFontIndirect

urlmon

IsValidURL
URLDownloadToFileA

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 416KB - Virtual size: 415KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 246KB - Virtual size: 246KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

96fdd25324af4956af4b239d3fbb79f5

Code Sign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

73:93:ad:65:df:71:bf:83:c8:88:24:20:f2:fe:0a:56Certificate

Extended Key Usages

Key Usages

11:6c:80:a8:43:a8:14:0c:b9:82:c0:91:5c:fe:4d:9b:ce:0d:6c:15Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

psapi

version

wininet

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

urlmon

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.rdata Size: 416KB - Virtual size: 415KB

.data Size: 24KB - Virtual size: 46KB

.rsrc Size: 246KB - Virtual size: 246KB

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

73:93:ad:65:df:71:bf:83:c8:88:24:20:f2:fe:0a:56
Certificate

11:6c:80:a8:43:a8:14:0c:b9:82:c0:91:5c:fe:4d:9b:ce:0d:6c:15
Signer

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 416KB - Virtual size: 415KB

.data
Size: 24KB - Virtual size: 46KB

.rsrc
Size: 246KB - Virtual size: 246KB