2024-10-01_6cdf9a024eac416e6a317e5a1eca2d58_hijackloader_icedid

Sharing

Copy URL

Twitter E-mail

General

Target

2024-10-01_6cdf9a024eac416e6a317e5a1eca2d58_hijackloader_icedid
Size

6.2MB
MD5

6cdf9a024eac416e6a317e5a1eca2d58
SHA1

ae9f93d2e9c22f9a9df323e650e31b46d6bc5ac4
SHA256

e1169ab5e897aef148db7a0cb03e6ce2efd5af989ad21242f9c054b8838b1edd
SHA512

4d758c46bbfad0a1fae3b5545a99b02b24a8b8696a70cbfc8e9dfc398fc86e9564ac2db250dffd6ebc2ea306cb0ffbf0c3b2ff03486891f1bb9a06fe9d6d4e5b
SSDEEP

98304:LGShj9x31PngLABA75uty5eY3nGWBrdi1Id0kPaot+0sHdRPv:LGSj9BZngMi7P3/i1Id0LRP

Score

1^/10

Malware Config

Signatures

Files

2024-10-01_6cdf9a024eac416e6a317e5a1eca2d58_hijackloader_icedid
.exe windows:5 windows x86 arch:x86

35f7404acdca02b59c92fe6d4562901d

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:ef:7b:58:21:86:ad:99:73:71:3b:74:4c:88:0f:62
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

26/10/2022, 00:00

Not After

05/11/2025, 23:59

Subject

SERIALNUMBER=138-81-25547,CN=SINSIWAY Co.\, Ltd.,O=SINSIWAY Co.\, Ltd.,L=Songpa-gu,ST=Seoul,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#130d4d756e6a656f6e672d646f6e67,1.3.6.1.4.1.311.60.2.1.2=#130553656f756c,1.3.6.1.4.1.311.60.2.1.3=#13024b52

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

41:a7:32:95:5f:e7:48:46:0e:87:0e:35:39:ff:9f:62:d0:67:ad:0c:a1:c7:ad:1b:08:93:36:65:c1:da:1a:1f
Signer

Actual PE Digest

41:a7:32:95:5f:e7:48:46:0e:87:0e:35:39:ff:9f:62:d0:67:ad:0c:a1:c7:ad:1b:08:93:36:65:c1:da:1a:1f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\Users\Sinsiway\petra_client\PetraClientV4\PetraClientV4\Release\PetraClientV4.pdb

Imports

ws2_32

select
ioctlsocket
getpeername
accept
listen
closesocket
socket
getsockname
WSACleanup
ntohs
htons
connect
shutdown
WSASetLastError
setsockopt
recv
__WSAFDIsSet
send
WSAAsyncSelect
WSAGetLastError
bind
inet_ntoa
gethostbyname
WSAStartup

libcurl

curl_easy_perform
curl_easy_cleanup
curl_easy_init
curl_easy_setopt

iphlpapi

GetAdaptersInfo

shlwapi

PathFindExtensionA
PathFindFileNameA
PathStripToRootA
PathIsUNCA
SHDeleteKeyA

uxtheme

SetWindowTheme

version

VerQueryValueA

kernel32

FlushFileBuffers
DeleteFileW
DeleteFileA
CreateMutexW
CreateFileMappingW
CreateFileMappingA
CreateFileW
AreFileApisANSI
InitializeCriticalSection
TryEnterCriticalSection
GetCurrentThreadId
TlsGetValue
TlsSetValue
TlsAlloc
GetFileType
GetStdHandle
FlushConsoleInputBuffer
GlobalMemoryStatus
FindFirstFileA
FindClose
GetModuleFileNameW
InterlockedDecrement
lstrcmpW
CompareStringA
GlobalDeleteAtom
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
FileTimeToSystemTime
lstrcmpA
InterlockedExchange
GetLocaleInfoA
EnumResourceLanguagesA
ConvertDefaultLocale
GetDiskFreeSpaceA
GlobalFlags
LocalAlloc
GlobalReAlloc
GlobalHandle
LocalReAlloc
TlsFree
InterlockedIncrement
GetCPInfo
GetOEMCP
GetThreadLocale
GetModuleHandleW
GetCurrentDirectoryA
DuplicateHandle
GetVolumeInformationA
SetErrorMode
FileTimeToLocalFileTime
SetFileAttributesA
GetFileSizeEx
GetFileTime
RtlUnwind
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
VirtualProtect
VirtualAlloc
VirtualQuery
ExitThread
GetCommandLineA
GetStartupInfoA
ExitProcess
SetConsoleCtrlHandler
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
GetDriveTypeA
SetHandleCount
GetTimeZoneInformation
GetACP
IsValidCodePage
CompareStringW
VirtualFree
GetConsoleCP
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
LCMapStringA
LCMapStringW
FormatMessageA
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA
GetDiskFreeSpaceW
GetFileAttributesW
GetFileAttributesExW
GetFullPathNameA
GetFullPathNameW
GetSystemTime
GetSystemTimeAsFileTime
GetTempPathA
GetTempPathW
GetTickCount
GetVersionExW
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
HeapValidate
HeapCompact
LoadLibraryW
LocalFree
LockFile
LockFileEx
MapViewOfFile
QueryPerformanceCounter
SystemTimeToFileTime
UnlockFile
UnlockFileEx
UnmapViewOfFile
WaitForSingleObjectEx
OutputDebugStringW
GetProcessHeap
InterlockedCompareExchange
FlushViewOfFile
GetVersion
GetVersionExA
GetSystemInfo
MulDiv
GetModuleFileNameA
IsDBCSLeadByteEx
OutputDebugStringA
FreeLibrary
GetCurrentProcess
CreateProcessA
TerminateProcess
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetUserDefaultLangID
FreeResource
GetComputerNameA
GetFileAttributesA
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetCurrentProcessId
LoadResource
LockResource
SizeofResource
FindResourceA
SetFilePointer
SetEndOfFile
WriteFile
GetFileSize
ReadFile
CreateFileA
CreateEventA
GetModuleHandleA
LoadLibraryA
GetProcAddress
SetLastError
lstrlenA
MultiByteToWideChar
WideCharToMultiByte
CreateSemaphoreA
Sleep
WaitForSingleObject
ReleaseSemaphore
CreateThread
GetExitCodeThread
CloseHandle
TerminateThread
WinExec
WritePrivateProfileStringA
GetLastError
SetStdHandle
FormatMessageW
GetCurrentThread

user32

ShowWindow
ClientToScreen
GetWindowDC
BeginPaint
EndPaint
GetWindowThreadProcessId
TranslateAcceleratorA
BringWindowToTop
InsertMenuItemA
LoadAcceleratorsA
SetCursor
DestroyMenu
ReuseDDElParam
UnpackDDElParam
GetMenuItemInfoA
ValidateRect
TranslateMessage
GetMessageA
PostQuitMessage
ShowOwnedPopups
MapDialogRect
SetWindowContextHelpId
UnregisterClassA
GetSysColorBrush
IsRectEmpty
CharUpperA
CharNextA
CopyAcceleratorTableA
SetRect
InvalidateRgn
GetNextDlgGroupItem
MessageBeep
RegisterClipboardFormatA
PostThreadMessageA
SetWindowTextA
IsDialogMessageA
SetDlgItemTextA
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
GetMenuState
CheckMenuItem
GetActiveWindow
CreateDialogIndirectParamA
IsWindowEnabled
GetNextDlgTabItem
EndDialog
SendDlgItemMessageA
WinHelpA
IsChild
GetCapture
SetWindowsHookExA
CallNextHookEx
GetClassLongA
SetPropA
GetPropA
RemovePropA
GetFocus
GetWindowTextA
GetForegroundWindow
GetLastActivePopup
DispatchMessageA
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
PeekMessageA
MapWindowPoints
GetKeyState
SetMenu
UpdateWindow
GetMenuItemID
GetMenuItemCount
CreateWindowExA
GetClassInfoExA
RegisterClassA
AdjustWindowRectEx
DeferWindowPos
GetDlgCtrlID
CallWindowProcA
GetMenu
SetWindowPos
IntersectRect
GetWindowPlacement
GetWindow
UnhookWindowsHookEx
GetDesktopWindow
GetProcessWindowStation
GetUserObjectInformationW
RegisterWindowMessageA
DrawAnimatedRects
SetParent
GetClassNameA
ModifyMenuA
TrackPopupMenu
LoadMenuA
GetSubMenu
SetMenuDefaultItem
SetRectEmpty
UnionRect
InflateRect
GetDC
ReleaseDC
LoadImageA
DestroyIcon
InsertMenuA
CreatePopupMenu
LoadBitmapA
GetAsyncKeyState
SetCapture
TrackMouseEvent
ReleaseCapture
PostMessageA
EnableMenuItem
SetWindowLongA
RedrawWindow
IsZoomed
DrawIconEx
GetWindowLongA
DrawStateA
FillRect
GrayStringA
DrawTextExA
TabbedTextOutA
CopyRect
DrawTextA
GetSysColor
EqualRect
GetIconInfo
IsWindow
DrawIcon
GetParent
MoveWindow
EnumChildWindows
OffsetRect
GetClassInfoA
DefWindowProcA
LoadCursorA
SetFocus
GetDlgItem
GetWindowTextLengthA
IsIconic
IsWindowVisible
GetCursorPos
ScreenToClient
PtInRect
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
FindWindowA
GetDlgItemTextA
GetWindowRect
SetForegroundWindow
SetActiveWindow
SystemParametersInfoA
KillTimer
SetTimer
MessageBoxA
GetClientRect
GetSystemMetrics
InvalidateRect
SendMessageA
EnableWindow
LoadIconA
SetWindowRgn

gdi32

RestoreDC
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
SaveDC
CreateRectRgnIndirect
GetMapMode
DPtoLP
GetBkColor
GetTextColor
GetRgnBox
GetClipBox
GetPixel
GetWindowExtEx
GetTextExtentPoint32A
GetTextMetricsA
CreateRectRgn
CreateEllipticRgn
CombineRgn
CreateBitmap
SelectObject
SetBkColor
SetTextColor
DeleteDC
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetDeviceCaps
CreateFontIndirectA
GetCharWidthA
CreatePatternBrush
Rectangle
CreateCompatibleBitmap
BitBlt
DeleteObject
CreateCompatibleDC
StretchBlt
GetObjectA
CreateSolidBrush
SetTextAlign
GetStockObject
ExcludeClipRect
SetMapMode
SetStretchBltMode
SetBkMode
GetViewportExtEx

comdlg32

GetFileTitleA

winspool.drv

ClosePrinter
DocumentPropertiesA
OpenPrinterA

advapi32

CloseServiceHandle
RegQueryValueA
RegOpenKeyA
RegEnumKeyA
RegDeleteKeyA
RegisterEventSourceA
ReportEventA
DeregisterEventSource
QueryServiceStatus
ControlService
OpenServiceA
StartServiceA
OpenSCManagerA
RegEnumKeyExA
GetUserNameA
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegEnumValueA
RegCloseKey
RegCreateKeyExA

shell32

Shell_NotifyIconA
DragQueryFileA
DragFinish
SHAppBarMessage

comctl32

InitCommonControlsEx

oledlg

ord8

ole32

CoRegisterMessageFilter
OleFlushClipboard
OleIsCurrentClipboard
CoRevokeClassObject
OleInitialize
CoUninitialize
OleUninitialize
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CLSIDFromString
CLSIDFromProgID
OleRun
CoTaskMemAlloc
CoCreateInstance
CoInitialize
CoTaskMemFree
CoFreeUnusedLibraries

oleaut32

SysAllocString
OleCreateFontIndirect
SysAllocStringByteLen
SysStringLen
VariantInit
VariantChangeType
VariantClear
SystemTimeToVariantTime
VariantTimeToSystemTime
SysAllocStringLen
VariantCopy
SafeArrayDestroy
SysFreeString

Sections

.text
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 760KB - Virtual size: 760KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1013KB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

35f7404acdca02b59c92fe6d4562901d

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0e:ef:7b:58:21:86:ad:99:73:71:3b:74:4c:88:0f:62Certificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

41:a7:32:95:5f:e7:48:46:0e:87:0e:35:39:ff:9f:62:d0:67:ad:0c:a1:c7:ad:1b:08:93:36:65:c1:da:1a:1fSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

libcurl

iphlpapi

shlwapi

uxtheme

version

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

oledlg

ole32

oleaut32

Sections

.text Size: 2.6MB - Virtual size: 2.6MB

.rdata Size: 760KB - Virtual size: 760KB

.data Size: 1013KB - Virtual size: 1.0MB

.rsrc Size: 1.8MB - Virtual size: 1.8MB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0e:ef:7b:58:21:86:ad:99:73:71:3b:74:4c:88:0f:62
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

41:a7:32:95:5f:e7:48:46:0e:87:0e:35:39:ff:9f:62:d0:67:ad:0c:a1:c7:ad:1b:08:93:36:65:c1:da:1a:1f
Signer

.text
Size: 2.6MB - Virtual size: 2.6MB

.rdata
Size: 760KB - Virtual size: 760KB

.data
Size: 1013KB - Virtual size: 1.0MB

.rsrc
Size: 1.8MB - Virtual size: 1.8MB