icedid | 4d1f75b3c608b9254382556062ad86b5be654a094fd297e003cb4c2fbacfae29 | Triage

Sharing

Reason

config extraction: CfgExtr crashed: 'IcedidFirstLoader' runtime error: slice bounds out of range [256:0]

General

Target

4d1f75b3c608b9254382556062ad86b5be654a094fd297e003cb4c2fbacfae29
Size

10KB
MD5

0f296b65b5fc0e47d293c548d91a165d
SHA1

4eab0bcacd3217579804a7ec3495062c189879fd
SHA256

4d1f75b3c608b9254382556062ad86b5be654a094fd297e003cb4c2fbacfae29
SHA512

e85ed08ae274b46e52bc9166062fc5228eb74b39966000584a23c5a825edb7aa4c0864d64ee6fd208e2333ed677f8a1d4b0604e7d87065a76d9b468b730dd7d1
SSDEEP

192:5piF7hWH0iI8jKWE2uNB+PEwtDtf7LgzOnDpfSbxNPDt:KNh8q8joRmPEi1LgSnDsbxNP

Score

10^/10

loader icedid

Malware Config

Signatures

IcedID First Stage Loader 1 IoCs
loader

Processes:

resource yara_rule

sample IcedidFirstLoader
Icedid family
icedid

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
4d1f75b3c608b9254382556062ad86b5be654a094fd297e003cb4c2fbacfae29

Files

4d1f75b3c608b9254382556062ad86b5be654a094fd297e003cb4c2fbacfae29
.exe windows:5 windows x86 arch:x86

5a8049d632f4eb2fc4735faed7b61978

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

GetUserNameA
LookupAccountNameW

shlwapi

StrToIntA
StrStrIA
StrChrA

kernel32

GetComputerNameExA
SwitchToThread
GetLastError
GetTickCount64
GetComputerNameExW
HeapReAlloc
GetModuleFileNameA
HeapFree
WaitForSingleObject
GetCommandLineA
Sleep
GetTempPathA
LoadLibraryA
GetProcAddress
ExitProcess
GetProcessHeap
GetTickCount
ReadFile
WriteFile
CreateFileA
CloseHandle
HeapAlloc
GetFileSize
lstrlenA

user32

wsprintfW
wsprintfA

winhttp

WinHttpConnect
WinHttpSendRequest
WinHttpCloseHandle
WinHttpSetOption
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpQueryHeaders
WinHttpOpen
WinHttpReceiveResponse
WinHttpQueryOption
WinHttpAddRequestHeaders
WinHttpOpenRequest
WinHttpSetStatusCallback

msvcrt

memset

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

bss
Size: - Virtual size: 8B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 408B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ