2024-10-13_a732b29352fd7215a52708d0a00f0526_icedid

Sharing

Copy URL Twitter E-mail

General

Target

2024-10-13_a732b29352fd7215a52708d0a00f0526_icedid
Size

16.5MB
MD5

a732b29352fd7215a52708d0a00f0526
SHA1

cdf73df8258e64fba88d71d09e33316a29c3d606
SHA256

69325d0974be722a3c3f64acd92d4a71b71c3e1cd92e4a9c65085c1e72f6c941
SHA512

81c5bf1d6df526b699df45b5a4af2dc4bece5aeadae69e8c613e8af37e7cdf15781f8be22afa1bb4875bd32496458b0f043fde16e754a1b88ac25a0e05b608fa
SSDEEP

393216:1iE/5hqVtPWBsJs7B8fZ7u7OdmBg5EVvid7xxe3HE9ce:aBWBsJs7BxSdmBgaVqxxaHEJ

Score

1^/10

Malware Config

Signatures

Files

2024-10-13_a732b29352fd7215a52708d0a00f0526_icedid
.exe windows:5 windows x86 arch:x86

723ace535a7cfa4650043cd33bd28f49

Code Sign

4e:40:e4:37:54:ed:e6:8c:00:00:00:00:51:d3:94:7f
Certificate

Issuer

CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

07/05/2021, 15:43

Not After

07/11/2030, 16:13

Subject

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

35:af:b7:7b:9d:34:1f:6a:fc:8f:84:46:ab:31:35:2b
Certificate

Issuer

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Not Before

07/05/2021, 19:19

Not After

29/12/2040, 23:59

Subject

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:d6:c4:fa:c6:e9:ae:f2:48:e4:9a:b3:0b:6f:bc:81
Certificate

Issuer

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Not Before

21/12/2021, 23:23

Not After

21/12/2024, 23:23

Subject

SERIALNUMBER=4227913,CN=WireGuard LLC,O=WireGuard LLC,L=Boulder,ST=Colorado,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13044f68696f,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

4a:53:8c:28
Certificate

Issuer

CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

07/07/2009, 17:25

Not After

07/12/2030, 17:55

Subject

CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4e:40:e4:37:54:ed:e6:8c:00:00:00:00:51:d3:94:7f
Certificate

Issuer

CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

07/05/2021, 15:43

Not After

07/11/2030, 16:13

Subject

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

25:bc:2b:f3:29:ca:10:7f:1e:a9:ba:88:85:d4:9d:3b
Certificate

Issuer

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Not Before

07/05/2021, 19:22

Not After

29/12/2040, 23:59

Subject

CN=Entrust Time Stamping CA - TS2,O=Entrust\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

74:d9:f2:db:51:3c:22:67:fd:47:9c:36:07:3f:7b:1d
Certificate

Issuer

CN=Entrust Time Stamping CA - TS2,O=Entrust\, Inc.,C=US

Not Before

14/05/2021, 00:00

Not After

14/08/2032, 00:00

Subject

CN=Entrust Timestamp Authority - TSA2,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

08:17:bf:8f:21:cf:f2:61:78:29:e7:1f:25:45:3e:e3:44:07:89:f7:42:0b:97:ff:9b:70:76:0d:d7:b1:9d:77
Signer

Actual PE Digest

08:17:bf:8f:21:cf:f2:61:78:29:e7:1f:25:45:3e:e3:44:07:89:f7:42:0b:97:ff:9b:70:76:0d:d7:b1:9d:77

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

winmm

mmioRead
PlaySoundA
mmioAscend
mmioClose
mmioOpenA
mciSendStringA
mmioDescend

psapi

EnumProcesses
GetModuleFileNameExA

kernel32

FindResourceExA
LoadLibraryW
GetSystemDirectoryW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
GetStartupInfoA
HeapReAlloc
RtlUnwind
RaiseException
VirtualAlloc
VirtualQuery
ExitThread
CreateThread
SetStdHandle
GetFileType
HeapSize
GlobalHandle
IsValidCodePage
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
GetStdHandle
GetConsoleCP
GetConsoleMode
SetHandleCount
InitializeCriticalSectionAndSpinCount
HeapCreate
VirtualFree
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetDriveTypeA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CompareStringW
SetEnvironmentVariableA
GlobalReAlloc
TlsGetValue
GetModuleHandleW
GetFileSizeEx
SetFileAttributesA
SetFileTime
LocalFileTimeToFileTime
GetFileAttributesExA
VirtualProtect
ConvertDefaultLocale
EnumResourceLanguagesA
LoadLibraryExA
InterlockedExchange
lstrcmpA
GetUserDefaultLCID
GetModuleFileNameW
SuspendThread
GetFullPathNameA
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
GetThreadLocale
GetStringTypeExA
FileTimeToLocalFileTime
FindNextFileA
FreeResource
WritePrivateProfileStringA
SetErrorMode
GetOEMCP
GetCPInfo
GlobalFlags
TlsFree
LocalReAlloc
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
CompareStringA
lstrcmpW
lstrlenA
SetThreadPriority
GetThreadPriority
GetDiskFreeSpaceExA
GetVolumeInformationA
DeviceIoControl
GetVolumePathNameA
TerminateProcess
GetProcessId
OpenProcess
FileTimeToSystemTime
GetTimeZoneInformation
LocalAlloc
ResetEvent
GetFileTime
CreateFileA
GetCurrentProcess
GetNumberFormatA
GetCurrentDirectoryA
CreateProcessA
GetExitCodeProcess
GetFileAttributesA
GetCurrentThread
GlobalUnlock
GlobalLock
QueryPerformanceFrequency
QueryPerformanceCounter
SystemTimeToFileTime
GetTimeFormatA
GetDateFormatA
GetVersion
GetSystemInfo
CreateEventA
SetEvent
GetTempPathA
GetTempFileNameA
ReleaseMutex
WaitForSingleObject
CreateMutexA
GetExitCodeThread
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
Beep
ExitProcess
GetSystemTimeAsFileTime
GetWindowsDirectoryA
CloseHandle
HeapFree
GetProcessHeap
HeapAlloc
MoveFileA
OutputDebugStringA
GlobalAlloc
FindClose
FindFirstFileA
CreateDirectoryA
GetLocaleInfoA
GetCurrentThreadId
ResumeThread
MulDiv
GetCurrentProcessId
GetVersionExA
FreeLibrary
WaitForMultipleObjects
TerminateThread
ExpandEnvironmentStringsA
MultiByteToWideChar
GetProcAddress
LoadLibraryA
SetLastError
lstrcpynA
GetModuleHandleA
RemoveDirectoryA
InterlockedDecrement
InterlockedIncrement
IsBadWritePtr
GetLastError
GetTickCount
CopyFileA
GetModuleFileNameA
DeleteFileA
GlobalFree
Sleep
LocalFree
FormatMessageA
FindResourceA
LoadResource
LockResource
SizeofResource
WideCharToMultiByte
TlsSetValue
TlsAlloc
InterlockedCompareExchange
GetACP

user32

DrawTextExA
TabbedTextOutA
MapDialogRect
MoveWindow
GetMenuCheckMarkDimensions
GetMessageA
TranslateMessage
ValidateRect
CharUpperA
CreateDialogIndirectParamA
EndDialog
SendDlgItemMessageA
WinHelpA
GetCapture
SetWindowsHookExA
CallNextHookEx
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
GetWindowTextLengthA
GetWindowTextA
GetLastActivePopup
DispatchMessageA
GetTopWindow
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
MapWindowPoints
SetMenu
SetScrollPos
GetClassInfoExA
RegisterClassA
AdjustWindowRectEx
DeferWindowPos
SetWindowPlacement
DefWindowProcA
CallWindowProcA
GetWindowLongA
SetWindowLongA
IntersectRect
GetWindowPlacement
GetMenuStringA
DrawStateA
ShowWindow
GetSysColorBrush
CopyImage
DrawFocusRect
GetMenuBarInfo
SendInput
GetWindowDC
SetWindowTextA
CloseClipboard
SetClipboardData
OpenClipboard
SetMenuItemBitmaps
TrackPopupMenu
PostThreadMessageA
UnregisterHotKey
RegisterHotKey
IsZoomed
GetDoubleClickTime
DrawIcon
PostQuitMessage
GetActiveWindow
FindWindowA
GetClassInfoA
EnumDisplaySettingsA
CopyIcon
GetMessagePos
EnumChildWindows
GetMenuItemInfoA
GetKeyNameTextA
MapVirtualKeyA
GetIconInfo
CreateIconIndirect
DrawTextA
RegisterWindowMessageA
CreateMenu
UnionRect
WindowFromPoint
CreateWindowExA
LoadIconA
DrawMenuBar
EqualRect
AllowSetForegroundWindow
SetActiveWindow
GetWindowThreadProcessId
IsWindowEnabled
BringWindowToTop
GetMenu
SetFocus
FindWindowExA
IsChild
IsDialogMessageA
DrawEdge
InflateRect
PeekMessageA
SetForegroundWindow
MonitorFromPoint
GetDesktopWindow
OffsetRect
GetWindow
SetWindowPos
GetDlgCtrlID
HideCaret
SetCursor
LoadCursorA
IsIconic
IsWindowVisible
GetDlgItem
SetMenuDefaultItem
EnableMenuItem
LoadMenuA
GetSubMenu
ModifyMenuA
BeginPaint
EndPaint
DestroyMenu
SetRect
CharNextA
SetWindowContextHelpId
RegisterClipboardFormatA
GetNextDlgGroupItem
InvalidateRgn
CopyAcceleratorTableA
RemoveMenu
InsertMenuA
ScreenToClient
LoadBitmapA
MessageBeep
keybd_event
UnregisterClassA
FillRect
LoadImageA
GetKeyState
GetForegroundWindow
GetNextDlgTabItem
GetFocus
ReleaseDC
GetDC
UpdateWindow
ChildWindowFromPointEx
ChildWindowFromPoint
ReleaseCapture
SetCapture
GetCursorPos
CheckMenuItem
DeleteMenu
AppendMenuA
GetMenuItemID
ClientToScreen
PtInRect
IsRectEmpty
DrawFrameControl
CreatePopupMenu
SetRectEmpty
GetMenuItemCount
CopyRect
GetMonitorInfoA
MonitorFromRect
GetSystemMetrics
SystemParametersInfoA
GetClientRect
GetWindowRect
RedrawWindow
TranslateAcceleratorA
GetParent
DestroyAcceleratorTable
CreateAcceleratorTableA
EnableWindow
InvalidateRect
DestroyIcon
GetAsyncKeyState
IsWindow
PostMessageA
KillTimer
SetTimer
MessageBoxA
GetSysColor
SendMessageA
GetMenuState
LoadStringA
EmptyClipboard
GrayStringA

gdi32

ExtSelectClipRgn
GetMapMode
DPtoLP
GetCharWidthA
StretchDIBits
GetBkColor
GetRgnBox
RestoreDC
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetWindowExtEx
GetViewportExtEx
MoveToEx
LineTo
IntersectClipRect
SetBkMode
SelectObject
CreateFontIndirectA
ExcludeClipRect
GetObjectA
DeleteObject
SaveDC
CreateRectRgnIndirect
SetBkColor
GetClipBox
GetPixel
GetTextColor
SetBitmapBits
GetBitmapBits
GetDIBits
SetTextColor
RoundRect
CreateBitmap
GetTextCharset
GetTextMetricsA
EnumFontFamiliesExA
CreateFontA
EndDoc
EndPage
StartPage
StartDocA
SetMapMode
DeleteDC
GetDeviceCaps
GetTextExtentPoint32A
CreateCompatibleBitmap
StretchBlt
CreateCompatibleDC
Polygon
Rectangle
CreatePen
CreateSolidBrush
GetStockObject
SetPixel
SetStretchBltMode

msimg32

TransparentBlt

comdlg32

GetFileTitleA
FindTextA

winspool.drv

ClosePrinter
OpenPrinterA
DocumentPropertiesA

advapi32

CryptAcquireContextA
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegCloseKey
RegQueryValueA
RegOpenKeyA
CryptReleaseContext
CryptDestroyKey
CryptDecrypt
CryptEncrypt
CryptGetKeyParam
CryptSetKeyParam
CryptImportKey
CryptDestroyHash
RegEnumValueA
AccessCheck
MapGenericMask
OpenThreadToken
ImpersonateSelf
GetFileSecurityA
RegOpenKeyExA

shell32

SHBrowseForFolderA
SHFileOperationA
ExtractIconExA
DragQueryFileA
SHChangeNotify
DragQueryPoint
Shell_NotifyIconA
SHGetFolderPathA
ShellExecuteA
ShellExecuteExA
SHGetMalloc
SHGetPathFromIDListA
SHGetSpecialFolderLocation

comctl32

_TrackMouseEvent
ord17
ord8

shlwapi

PathIsUNCA
PathFindFileNameA
PathFindExtensionA
PathRemoveFileSpecW
PathStripToRootA
UrlUnescapeA

oledlg

ord8

ole32

CoUninitialize
StgCreateDocfile
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
CoInitializeEx
CLSIDFromProgID
CLSIDFromString
CoDisconnectObject
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CoRevokeClassObject
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter
CoInitialize

oleaut32

SystemTimeToVariantTime
LoadTypeLi
SafeArrayDestroy
OleCreateFontIndirect
SysFreeString
SysAllocStringLen
VariantInit
SysStringLen
SysAllocStringByteLen
VariantClear
VariantChangeType
VariantCopy
SysAllocString
VariantTimeToSystemTime

wsock32

WSACleanup
WSAStartup
WSASetLastError
gethostbyname
WSAGetLastError
htons
socket
connect
closesocket
send
recv
setsockopt
shutdown
select

gdiplus

GdiplusShutdown
GdiplusStartup
GdipGetImageHeight
GdipGetImageWidth
GdipCloneImage
GdipLoadImageFromFile
GdipDrawImageRectI
GdipSetInterpolationMode
GdipSetCompositingQuality
GdipSetCompositingMode
GdipAlloc
GdipDeleteGraphics
GdipCreateFromHDC
GdipDisposeImage
GdipFree

httpapi

HttpSendHttpResponse
HttpCreateHttpHandle
HttpAddUrl
HttpReceiveHttpRequest
HttpTerminate
HttpRemoveUrl
HttpInitialize

crypt32

CryptMsgClose
CertCloseStore
CertGetNameStringA
CryptQueryObject
CryptMsgGetParam
CertFindCertificateInStore
CertFreeCertificateContext
CertOpenSystemStoreA
CertEnumCertificatesInStore

version

GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA

wintrust

WinVerifyTrust

iphlpapi

GetAdaptersInfo

wininet

InternetCanonicalizeUrlA
InternetCrackUrlA
InternetReadFile
HttpSendRequestA
InternetGetLastResponseInfoA
HttpQueryInfoA
HttpOpenRequestA
InternetConnectA
InternetOpenA
InternetQueryOptionA
InternetDial
InternetCloseHandle
InternetSetOptionA
InternetGetConnectedState
InternetAutodialHangup
InternetAutodial

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 527KB - Virtual size: 526KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13.7MB - Virtual size: 13.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

723ace535a7cfa4650043cd33bd28f49

Code Sign

4e:40:e4:37:54:ed:e6:8c:00:00:00:00:51:d3:94:7fCertificate

Extended Key Usages

Key Usages

35:af:b7:7b:9d:34:1f:6a:fc:8f:84:46:ab:31:35:2bCertificate

Extended Key Usages

Key Usages

7b:d6:c4:fa:c6:e9:ae:f2:48:e4:9a:b3:0b:6f:bc:81Certificate

Extended Key Usages

Key Usages

4a:53:8c:28Certificate

Key Usages

4e:40:e4:37:54:ed:e6:8c:00:00:00:00:51:d3:94:7fCertificate

Extended Key Usages

Key Usages

25:bc:2b:f3:29:ca:10:7f:1e:a9:ba:88:85:d4:9d:3bCertificate

Extended Key Usages

Key Usages

74:d9:f2:db:51:3c:22:67:fd:47:9c:36:07:3f:7b:1dCertificate

Extended Key Usages

Key Usages

08:17:bf:8f:21:cf:f2:61:78:29:e7:1f:25:45:3e:e3:44:07:89:f7:42:0b:97:ff:9b:70:76:0d:d7:b1:9d:77Signer

Headers

DLL Characteristics

File Characteristics

Imports

winmm

psapi

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

wsock32

gdiplus

httpapi

crypt32

version

wintrust

iphlpapi

wininet

Sections

.text Size: 2.2MB - Virtual size: 2.2MB

.rdata Size: 527KB - Virtual size: 526KB

.data Size: 26KB - Virtual size: 57KB

.rsrc Size: 13.7MB - Virtual size: 13.7MB

4e:40:e4:37:54:ed:e6:8c:00:00:00:00:51:d3:94:7f
Certificate

35:af:b7:7b:9d:34:1f:6a:fc:8f:84:46:ab:31:35:2b
Certificate

7b:d6:c4:fa:c6:e9:ae:f2:48:e4:9a:b3:0b:6f:bc:81
Certificate

4a:53:8c:28
Certificate

4e:40:e4:37:54:ed:e6:8c:00:00:00:00:51:d3:94:7f
Certificate

25:bc:2b:f3:29:ca:10:7f:1e:a9:ba:88:85:d4:9d:3b
Certificate

74:d9:f2:db:51:3c:22:67:fd:47:9c:36:07:3f:7b:1d
Certificate

08:17:bf:8f:21:cf:f2:61:78:29:e7:1f:25:45:3e:e3:44:07:89:f7:42:0b:97:ff:9b:70:76:0d:d7:b1:9d:77
Signer

.text
Size: 2.2MB - Virtual size: 2.2MB

.rdata
Size: 527KB - Virtual size: 526KB

.data
Size: 26KB - Virtual size: 57KB

.rsrc
Size: 13.7MB - Virtual size: 13.7MB