2024-09-27_af264f75b6de5108e0c601ff2c7032f8_icedid

Sharing

Copy URL Twitter E-mail

General

Target

2024-09-27_af264f75b6de5108e0c601ff2c7032f8_icedid
Size

1000KB
MD5

af264f75b6de5108e0c601ff2c7032f8
SHA1

3e9725eb615a81db92f20a5cb717706e42f8a65d
SHA256

886fff40a59a7d2e8beb357a237351102d8d28ba280496135e380d44ffea5b67
SHA512

fdc49da668fe22a43aff38444befc3621c5d55a33b7fa8b276d953fd6ce9e11235d379449fdd6f3c6824db85099242cd535289ed46ce9e726dee7bad3c02b6fc
SSDEEP

12288:ycH2pk5N+UEd51SevhaUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7Uj:xUJd7zvhat2rR8FfBhRJUEbDk1ulUj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-09-27_af264f75b6de5108e0c601ff2c7032f8_icedid

Files

2024-09-27_af264f75b6de5108e0c601ff2c7032f8_icedid
.exe windows:4 windows x86 arch:x86

d764915cc9447e083a332895d125ad93

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

tosavctapi

?AVCT_Open@@YAHGP6GXPAUCONNECTIND_PARAM@@J@ZJPAJ@Z
?AVCT_RegistInfoForMPS@@YAHP6GXPAUMESSAGERECIND_PARAM@@J@ZJPAJ@Z
?AVCT_ConnectRsp@@YAHPAEGPAJGPAUBTCONFIG@@P6GXPAUDISCONNECTIND_PARAM@@J@ZJP6GXPAUMESSAGERECIND_PARAM@@J@ZJ@Z
?AVCT_ConnectReq@@YAHPAEPAUBTCONFIG@@P6GXPAUCONNECTCFM_PARAM@@J@ZJPAJGP6GXPAUDISCONNECTIND_PARAM@@J@ZJP6GXPAUMESSAGERECIND_PARAM@@J@ZJ@Z
?AVCT_Close@@YAHGPAJ@Z
?AVCT_DisconnectReq@@YAHPAEGPAJ@Z
?AVCT_ChangeLogonState@@YAHPAEKPAJ@Z
?AVCT_SendMessage@@YAHPAEEEG0KPAJ@Z
?AVCT_StopListen@@YAHPAJ@Z
?AVCT_StartListen@@YAHPAJ@Z

tosbtapi

BtRemoveServiceRecord
BtGetLocalInfo2
BtGetLocalInfo
BtAddServiceRecord
BtMemFree
BtMemAlloc
BtDiscoverRemoteDevice2
BtGetRemoteName
BtCloseAPI

winmm

mixerClose
mixerSetControlDetails
mixerGetControlDetailsA
mixerGetLineControlsA
mixerGetLineInfoA
mixerOpen
mixerGetDevCapsA
mixerGetNumDevs
mciSendCommandA

psapi

EnumProcessModules
EnumProcesses
GetModuleBaseNameA

kernel32

FindNextFileA
lstrcmpA
GetLocaleInfoA
EnumResourceLanguagesA
GetModuleFileNameA
ConvertDefaultLocale
GetCurrentThread
GetCurrentProcessId
LeaveCriticalSection
TlsGetValue
EnterCriticalSection
GlobalReAlloc
GlobalHandle
InitializeCriticalSection
TlsAlloc
TlsSetValue
LocalReAlloc
DeleteCriticalSection
TlsFree
InterlockedIncrement
GetThreadLocale
GlobalFlags
GetCPInfo
GetOEMCP
FlushFileBuffers
GetVolumeInformationA
GetFullPathNameA
SetErrorMode
WritePrivateProfileStringA
GetCurrentDirectoryA
HeapAlloc
HeapFree
GetACP
IsValidCodePage
HeapReAlloc
VirtualAlloc
RtlUnwind
ExitThread
CreateThread
GetCommandLineA
GetProcessHeap
GetStartupInfoA
RaiseException
ExitProcess
HeapSize
VirtualFree
HeapDestroy
HeapCreate
GetStdHandle
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA
FileTimeToLocalFileTime
FileTimeToSystemTime
FreeResource
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
lstrcmpW
InterlockedDecrement
GetModuleFileNameW
GlobalLock
GlobalUnlock
FormatMessageA
MulDiv
SetLastError
GetComputerNameA
GetTickCount
GlobalAlloc
GlobalFree
OpenMutexA
CreateMutexA
ReleaseMutex
GetPrivateProfileStringA
GetVersionExA
SetThreadLocale
OpenProcess
GetDriveTypeA
GetCurrentThreadId
ExpandEnvironmentStringsA
CreateProcessA
GetCurrentProcess
CreateNamedPipeA
LocalAlloc
LocalFree
ReadFile
ResetEvent
GetOverlappedResult
CreateEventA
ConnectNamedPipe
SetEvent
WaitForSingleObject
TerminateThread
OutputDebugStringA
GetFileSize
SetFilePointer
WriteFile
LoadLibraryA
GetProcAddress
FreeLibrary
CreateFileA
DeleteFileA
lstrcpyA
lstrcatA
GetLocalTime
GetDateFormatA
GetTimeFormatA
FindFirstFileA
CreateDirectoryA
FindClose
CloseHandle
Sleep
GetModuleHandleA
lstrlenA
CompareStringW
CompareStringA
lstrcmpiA
GetVersion
FindResourceA
LoadResource
LockResource
SizeofResource
GetLastError
WideCharToMultiByte
MultiByteToWideChar
InterlockedExchange

user32

GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
ClientToScreen
UnregisterClassA
LoadCursorA
GetDC
ReleaseDC
GetSysColorBrush
DestroyMenu
SetCursor
GetMessageA
TranslateMessage
GetCursorPos
ValidateRect
GetActiveWindow
CreateDialogIndirectParamA
GetNextDlgTabItem
EndDialog
IsWindowEnabled
MoveWindow
IsDialogMessageA
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
ModifyMenuA
CheckMenuItem
SendDlgItemMessageA
WinHelpA
GetCapture
SetWindowsHookExA
CallNextHookEx
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
GetFocus
SetFocus
GetWindowTextLengthA
GetWindowTextA
GetLastActivePopup
SetActiveWindow
DispatchMessageA
GetTopWindow
GetMessageTime
GetMessagePos
PeekMessageA
MapWindowPoints
GetKeyState
UpdateWindow
GetClientRect
GetMenu
MessageBoxA
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
GetSysColor
AdjustWindowRectEx
GetParent
CopyRect
PtInRect
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
GetWindowLongA
SetWindowLongA
IsIconic
GetSystemMetrics
GetWindow
UnhookWindowsHookEx
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
PostQuitMessage
BeginPaint
DrawIconEx
EndPaint
WaitForInputIdle
IsWindowVisible
GetWindowPlacement
ExitWindowsEx
GetForegroundWindow
GetWindowThreadProcessId
AttachThreadInput
SetForegroundWindow
SendInput
keybd_event
GetDlgItemTextA
GetSystemMenu
EnableMenuItem
EnableWindow
FindWindowA
SystemParametersInfoA
GetDesktopWindow
PostMessageA
wsprintfA
CharUpperA
LoadIconA
LoadImageA
RegisterWindowMessageA
SetTimer
KillTimer
ShowWindow
GetWindowRect
SetWindowPos
SendMessageA
GetDlgItem
SetDlgItemTextA
SetWindowTextA
DestroyWindow
IsWindow
CreateDialogParamA

gdi32

SetMapMode
RestoreDC
SaveDC
DeleteObject
ExtTextOutA
CreateBitmap
GetObjectA
SetBkColor
SetTextColor
GetClipBox
GetDeviceCaps
GetStockObject
DeleteDC
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
TextOutA
RectVisible
PtVisible

winspool.drv

ClosePrinter
OpenPrinterA
DocumentPropertiesA

advapi32

RegQueryValueA
RegEnumKeyA
RegDeleteKeyA
RegOpenKeyA
GetTokenInformation
EqualSid
RegCreateKeyExA
RegSetValueExA
RegQueryInfoKeyA
RegEnumValueA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
GetSecurityInfo
GetAclInformation
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AddAce
GetAce
AddAccessAllowedAce
SetSecurityInfo
FreeSid

shell32

SHGetPathFromIDListA
SHGetSpecialFolderLocation
SHGetMalloc
ShellExecuteA

shlwapi

PathFindFileNameA
PathStripToRootA
PathIsUNCA
PathFindExtensionA

oleaut32

VariantClear
VariantChangeType
VariantInit

Sections

.text
Size: 236KB - Virtual size: 234KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 459KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 680KB - Virtual size: 684KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

d764915cc9447e083a332895d125ad93

Headers

File Characteristics

Imports

tosavctapi

tosbtapi

winmm

psapi

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

shlwapi

oleaut32

Sections

.text Size: 236KB - Virtual size: 234KB

.rdata Size: 68KB - Virtual size: 65KB

.data Size: 12KB - Virtual size: 459KB

.rsrc Size: 680KB - Virtual size: 684KB

.text
Size: 236KB - Virtual size: 234KB

.rdata
Size: 68KB - Virtual size: 65KB

.data
Size: 12KB - Virtual size: 459KB

.rsrc
Size: 680KB - Virtual size: 684KB