Static task
static1
Behavioral task
behavioral1
Sample
2024-09-25_b5279e4d336e2d4eeca51f14d1dd484d_icedid.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-09-25_b5279e4d336e2d4eeca51f14d1dd484d_icedid.exe
Resource
win10v2004-20240910-en
General
-
Target
2024-09-25_b5279e4d336e2d4eeca51f14d1dd484d_icedid
-
Size
3.4MB
-
MD5
b5279e4d336e2d4eeca51f14d1dd484d
-
SHA1
32ea89af54c0f654902316d47c2a02e43a81a9cb
-
SHA256
35b6a853ded11ad0bd6c2c6d28c5bf5233ffa42076d86f490b37a6eae028c9a6
-
SHA512
427b3ecd196a38f16c324c3e7175710b5aa44c48533494d53b8257928628285ed2c0ec894b2f43b6dca143e4f6d20f3cc237be45750f04b022164490fed36136
-
SSDEEP
24576:gI71Exev7q89R3RnJVBEX0wX5CvFjbvcOZ2+LBSbDpLFtaxiNDRd5EOEDD/:gNoveG7BUYL09rx75SDD/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-09-25_b5279e4d336e2d4eeca51f14d1dd484d_icedid
Files
-
2024-09-25_b5279e4d336e2d4eeca51f14d1dd484d_icedid.exe windows:4 windows x86 arch:x86
ca693519786fae7cdeb8d7cc3391106b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateProcessA
SetFileAttributesA
CopyFileA
Sleep
CloseHandle
GetFileSize
CreateFileA
GetWindowsDirectoryA
GetCommandLineA
WriteFile
DeleteFileA
GetExitCodeProcess
WaitForSingleObject
SetFilePointer
CreateMutexA
FindClose
FindNextFileA
FindFirstFileA
PeekNamedPipe
GetStartupInfoA
CreatePipe
GetModuleHandleA
GetLastError
GetLogicalDriveStringsA
ReadFile
GetDriveTypeA
user32
DispatchMessageA
TranslateMessage
TranslateAcceleratorA
GetMessageA
LoadAcceleratorsA
PostQuitMessage
MessageBoxA
BeginPaint
EndPaint
DefWindowProcA
wsprintfA
DestroyWindow
CreateWindowExA
LoadIconA
LoadCursorA
RegisterClassExA
LoadStringA
advapi32
RegCloseKey
RegOpenKeyExA
RegSetValueExA
shell32
ShellExecuteA
msvcrt
_CxxThrowException
_endthread
fclose
fwrite
fseek
fopen
fread
__dllonexit
_onexit
??1type_info@@UAE@XZ
_exit
_XcptFilter
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
??2@YAPAXI@Z
__p__fmode
__set_app_type
_except_handler3
_controlfp
__CxxFrameHandler
memmove
exit
_beginthread
??3@YAXPAX@Z
rename
__p__commode
msvcp60
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?_Xran@std@@YAXXZ
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
?_Xlen@std@@YAXXZ
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
ws2_32
htons
inet_addr
socket
inet_ntoa
gethostbyname
WSAStartup
closesocket
recv
send
connect
Sections
.text Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 393KB - Virtual size: 393KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE