2024-09-27_7118787b2d592a087d8bdd4eed0607bf_icedid

Sharing

Copy URL Twitter E-mail

General

Target

2024-09-27_7118787b2d592a087d8bdd4eed0607bf_icedid
Size

1.3MB
MD5

7118787b2d592a087d8bdd4eed0607bf
SHA1

6331bdabe6fa3dc9d606c7964853356854abab5c
SHA256

f3e731e111692b3b7d4f5ce20e91143f7093bced29ce516a64eddeaf3588faca
SHA512

7ae428965a45a180530be22e87e84dfa8f8274d2fbacf72555ee955ad8243e7850d08cf7a7ab904f6f74c248964d1e9f873ce096516e308246316ffe6d0fd970
SSDEEP

24576:SjABunaVjlGrKuMaTM54x5t2rR8FfBhRJUEbDk1ulUH:V4cjlGrKHgM5ut2r4PRSEk1ul

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-09-27_7118787b2d592a087d8bdd4eed0607bf_icedid

Files

2024-09-27_7118787b2d592a087d8bdd4eed0607bf_icedid
.exe windows:5 windows x86 arch:x86

6f6e0618db158129c059bd5853f7e404

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\Documents and Settings\20080038\デスクトップ\HFP関連\HFP71\TosBtHSP\Release\TosBtHSP.pdb

Imports

tosbteccapi

EccGetConnectInfoDetail
EccFreePECCCONNECTINFODETAIL
EccOpenAPI
EccEnumConnectInfo
EccGetConnectInfo
EccFreePECCCONNECTINFO
EccCloseAPI

tosbdapi

?BdGetLinkInfoList@@YAHPAXPAU_BT_LINK_INFO_LIST@@K@Z
?BdScoReject@@YAHPAXPAEG@Z
?BdScoAccept@@YAHPAXPAEPAG2@Z
?BdScoListenEx@@YAHPAXPAEPAHPAUHWND__@@II@Z
?BdOpen@@YAPAXXZ
?BdScoNotifyEx@@YAHPAXGPAU_BT_SCO_NOTIFY_INFO@@PAHPAUHWND__@@II@Z
?BdClose@@YAHPAX@Z

lcwizard

_LCCreateCOM3@36

tosbtapi

BtGetLocalInfo2
BtAddServiceRecord
BtGetConnectedDeviceList2
BtGetCOMMInfoList2
BtNotifyCOMM
BtDestroyCOMM
BtDisconnectCOMM
BtGetRemoteName
BtAnalyzeServiceAttributeLists2
BtServiceSearchAttribute2
BtGetConnectionHandle
BtRoleDiscovery
BtSwitchRole
BtGetSecurityLevel
BtGetServiceLevelSecurityInfo
BtConnectCOMM2
BtMemFree
BtMemAlloc
BtDiscoverRemoteDevice2
BtConnectSDP
BtAnalyzeProtocolParameter2
BtOpenAPI
BtCloseAPI
BtNotifyEvent
BtGetCOMMCreatorName2
BtRemoveServiceRecord
BtGetServiceRecordHandleList2
BtDisconnectSDP

tossndapi

RfSndClose
RfSndOpen2
RfSndOpen3
RfSndStartCodec
RfSndStopCodec
RfSndStartStream
RfSndStopStream
RfSndOpen

winmm

PlaySoundA

tossndplug

SNDPLG_GetSndModuleUsingInfo
SNDPLG_PlugIn2
SNDPLG_PlugIn
SNDPLG_StartSndModuleUsing
SNDPLG_IsPlugIn
SNDPLG_IsPlugIn3
SNDPLG_GetPlugInList
SNDPLG_UnPlug3
SNDPLG_PlugIn3
SNDPLG_IsPlugIn2
SNDPLG_JackOut
SNDPLG_StopSndModuleUsing
SNDPLG_UnPlug2
SNDPLG_ResetState
SNDPLG_Close
SNDPLG_Open
SNDPLG_JackIn
SNDPLG_ResetState2
SNDPLG_UnPlug

kernel32

FindClose
CreateDirectoryA
FindFirstFileA
GetTimeFormatA
GetDateFormatA
GetLocalTime
DeleteFileA
FreeLibrary
GetProcAddress
LoadLibraryA
WriteFile
SetFilePointer
GetFileSize
OutputDebugStringA
ReadFile
ClearCommError
WaitCommEvent
SetCommMask
GetPrivateProfileIntA
ReleaseMutex
CreateMutexA
OpenMutexA
ExitProcess
CreateProcessA
Process32Next
lstrcmpiA
Process32First
CreateToolhelp32Snapshot
CreateThread
GetTickCount
ReleaseSemaphore
GetCurrentProcess
CreateSemaphoreA
WaitForMultipleObjects
WaitNamedPipeA
GetModuleHandleA
HeapAlloc
GetProcessHeap
HeapReAlloc
HeapSize
HeapFree
SetThreadPriority
GetCurrentThreadId
SuspendThread
lstrcatA
LockResource
LoadResource
FindResourceA
lstrcmpW
MultiByteToWideChar
SetLastError
CompareStringA
GlobalDeleteAtom
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
FreeResource
GlobalFree
GlobalUnlock
GlobalLock
MulDiv
lstrlenW
FormatMessageA
GlobalAlloc
GlobalSize
CopyFileA
GetModuleFileNameW
InterlockedDecrement
lstrcmpA
InterlockedExchange
GetLocaleInfoA
GetModuleFileNameA
EnumResourceLanguagesA
ConvertDefaultLocale
GetCurrentThread
GetCurrentProcessId
LeaveCriticalSection
TlsGetValue
EnterCriticalSection
GlobalReAlloc
GlobalHandle
InitializeCriticalSection
TlsAlloc
TlsSetValue
LocalReAlloc
DeleteCriticalSection
TlsFree
GlobalFlags
InterlockedIncrement
GetCPInfo
GetOEMCP
GetAtomNameA
GetModuleHandleW
GetThreadLocale
FileTimeToSystemTime
SystemTimeToFileTime
WritePrivateProfileStringA
GetPrivateProfileStringA
GetCurrentDirectoryA
MoveFileA
GetStringTypeExA
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
DuplicateHandle
GetVolumeInformationA
GetFullPathNameA
GetShortPathNameA
SetErrorMode
FileTimeToLocalFileTime
GetFileAttributesExA
LocalFileTimeToFileTime
SetFileTime
SetFileAttributesA
GetFileAttributesA
GetFileSizeEx
GetFileTime
RtlUnwind
GetCommandLineA
GetStartupInfoA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
ExitThread
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapCreate
HeapDestroy
VirtualFree
FatalAppExitA
GetStdHandle
GetACP
IsValidCodePage
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetSystemTimeAsFileTime
SetConsoleCtrlHandler
InitializeCriticalSectionAndSpinCount
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CompareStringW
SetEnvironmentVariableA
lstrcpyA
WideCharToMultiByte
GetVersionExA
CancelIo
GetExitCodeThread
GetCommState
SetCommState
GetCommTimeouts
SetCommTimeouts
SetupComm
EscapeCommFunction
PurgeComm
ResumeThread
Sleep
DeviceIoControl
GetOverlappedResult
CreateFileA
GetLastError
LocalAlloc
LocalFree
ResetEvent
lstrlenA
lstrcpynA
WaitForSingleObject
SetEvent
CloseHandle
CreateEventA
SizeofResource

user32

UnpackDDElParam
SetRect
GetKeyNameTextA
MapVirtualKeyA
IsRectEmpty
SetParent
UnionRect
GetDCEx
LockWindowUpdate
TabbedTextOutA
FillRect
ClientToScreen
DestroyMenu
GetMenuItemInfoA
InflateRect
GetWindowThreadProcessId
ShowOwnedPopups
SetCursor
GetMenuStringA
AppendMenuA
InsertMenuA
RemoveMenu
GetDesktopWindow
CreateDialogIndirectParamA
GetNextDlgTabItem
EndDialog
ScrollWindowEx
IsWindowEnabled
MoveWindow
SetWindowTextA
IsDialogMessageA
IsDlgButtonChecked
SetDlgItemTextA
SetDlgItemInt
GetDlgItemInt
CheckRadioButton
CheckDlgButton
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
ModifyMenuA
GetMenuState
CheckMenuItem
SendDlgItemMessageA
WinHelpA
IsChild
GetCapture
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
GetFocus
SetFocus
GetWindowTextLengthA
GetWindowTextA
GetForegroundWindow
GetLastActivePopup
SetActiveWindow
BeginDeferWindowPos
EndDeferWindowPos
GetDlgItem
GetTopWindow
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
MapWindowPoints
ScrollWindow
ReuseDDElParam
TrackPopupMenu
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
SetForegroundWindow
ShowScrollBar
UpdateWindow
GetClientRect
GetSubMenu
GetMenuItemID
GetMenuItemCount
MessageBoxA
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
GetSysColor
AdjustWindowRectEx
GetParent
ScreenToClient
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
CopyRect
PtInRect
GetDlgCtrlID
DefWindowProcA
LoadMenuA
GetMenuBarInfo
LoadAcceleratorsA
InsertMenuItemA
CallWindowProcA
GetMenu
GetWindowLongA
SetWindowLongA
SetWindowPos
OffsetRect
IntersectRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
GetSystemMetrics
GetWindow
SetWindowsHookExA
CallNextHookEx
GetMessageA
TranslateMessage
GetActiveWindow
IsWindowVisible
GetKeyState
GetCursorPos
ValidateRect
UnregisterDeviceNotification
PeekMessageA
DispatchMessageA
RegisterDeviceNotificationA
PostQuitMessage
CreatePopupMenu
BringWindowToTop
TranslateAcceleratorA
InvalidateRect
SetRectEmpty
CharUpperA
DestroyIcon
WaitMessage
ReleaseCapture
WindowFromPoint
SetCapture
DeleteMenu
UnregisterClassA
GetDialogBaseUnits
LoadCursorA
GetSysColorBrush
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
LoadIconA
RegisterWindowMessageA
ShowWindow
wsprintfW
IsWindow
GetSystemMenu
EnableMenuItem
GetDlgItemTextA
EnableWindow
PostMessageA
SetTimer
SendMessageA
wsprintfA
KillTimer
GetDC
GrayStringA
DrawTextExA
TrackPopupMenuEx
DrawTextA
SetWindowPlacement

gdi32

SetBkMode
SetPolyFillMode
SetROP2
SetStretchBltMode
SetGraphicsMode
SetWorldTransform
ModifyWorldTransform
SetMapMode
ExcludeClipRect
IntersectClipRect
OffsetClipRgn
LineTo
MoveToEx
SetTextAlign
SetTextJustification
SetTextCharacterExtra
SetMapperFlags
SetArcDirection
SetColorAdjustment
SelectClipRgn
GetClipRgn
CreateRectRgn
SelectClipPath
GetViewportExtEx
GetWindowExtEx
GetPixel
StartDocA
PtVisible
RectVisible
TextOutA
RestoreDC
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
GetCurrentPositionEx
ArcTo
PolyDraw
PolylineTo
PolyBezierTo
ExtSelectClipRgn
DeleteDC
CreateDIBPatternBrushPt
CreatePatternBrush
GetStockObject
SelectPalette
PlayMetaFileRecord
GetObjectType
EnumMetaFile
PlayMetaFile
CreatePen
ExtCreatePen
CreateSolidBrush
CreateHatchBrush
GetTextMetricsA
GetCharWidthA
SaveDC
DeleteObject
GetTextExtentPoint32A
ExtTextOutA
BitBlt
CreateCompatibleDC
CreateFontIndirectA
CreateDCA
CopyMetaFileA
GetDeviceCaps
CreateBitmap
GetObjectA
SetBkColor
SetTextColor
GetClipBox
Escape
GetBkColor
DPtoLP
PatBlt
GetMapMode
CombineRgn
SetRectRgn
CreateRectRgnIndirect
CreateCompatibleBitmap
StretchDIBits
CreateFontA
GetDCOrgEx

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

RegDeleteValueA
RegCreateKeyA
RegEnumKeyA
RegCloseKey
RegEnumValueA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
RegCreateKeyExA
RegNotifyChangeKeyValue
RegSetValueA
RegDeleteKeyA
RegOpenKeyA
RegQueryValueA

shell32

ExtractIconA
SHGetFileInfoA
DragQueryFileA
DragFinish

shlwapi

PathFindFileNameA
PathRemoveExtensionA
PathFindExtensionA
PathIsUNCA
PathRemoveFileSpecW
PathStripToRootA

ole32

OleDuplicateData
CoTaskMemAlloc
ReleaseStgMedium
CreateBindCtx
CoTreatAsClass
StringFromCLSID
CoDisconnectObject
ReadFmtUserTypeStg
StringFromGUID2
CoCreateInstance
OleRegGetUserType
WriteClassStg
WriteFmtUserTypeStg
SetConvertStg
CoTaskMemFree
CLSIDFromString
CoUninitialize
CoInitializeEx
ReadClassStg

oleaut32

VarBstrFromDate
SysReAllocStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroyDescriptor
SafeArrayDestroyData
VarCyFromStr
VarDecFromStr
VarBstrFromDec
VariantClear
VariantChangeType
VariantInit
SysAllocStringLen
VarBstrFromCy
SysStringLen
SysFreeString
SysAllocStringByteLen
SysStringByteLen
RegisterTypeLi
LoadTypeLi
LoadRegTypeLi
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetElemsize
SafeArrayGetDim
SafeArrayCreate
SafeArrayRedim
VariantCopy
SafeArrayAllocData
SafeArrayAllocDescriptor
SafeArrayCopy
SafeArrayGetElement
SafeArrayPtrOfIndex
SafeArrayPutElement
SafeArrayLock
SafeArrayUnlock
SafeArrayDestroy
VarDateFromStr

setupapi

SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsA
SetupDiGetDeviceInterfaceDetailA

Sections

.text
Size: 541KB - Virtual size: 541KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 147KB - Virtual size: 146KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 463KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 584KB - Virtual size: 588KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

6f6e0618db158129c059bd5853f7e404

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

tosbteccapi

tosbdapi

lcwizard

tosbtapi

tossndapi

winmm

tossndplug

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

shlwapi

ole32

oleaut32

setupapi

Sections

.text Size: 541KB - Virtual size: 541KB

.rdata Size: 147KB - Virtual size: 146KB

.data Size: 14KB - Virtual size: 463KB

.rsrc Size: 584KB - Virtual size: 588KB

.text
Size: 541KB - Virtual size: 541KB

.rdata
Size: 147KB - Virtual size: 146KB

.data
Size: 14KB - Virtual size: 463KB

.rsrc
Size: 584KB - Virtual size: 588KB