Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
2025-03-25_fa93e5224640f9c2f0376eff52d95651_icedid_ramnit.exe
Resource
win7-20240903-en
General
-
Target
2025-03-25_fa93e5224640f9c2f0376eff52d95651_icedid_ramnit
-
Size
3.7MB
-
MD5
fa93e5224640f9c2f0376eff52d95651
-
SHA1
c984a55f00d96464053d26535f71ac67b8e0a3f6
-
SHA256
ffc0d865cfbd409a73a4292c31e396d1b6ba10d3742b00eefc8ec056dbc2a26b
-
SHA512
878b5615cae26ad0a91102b84068db1fb2531d667055f4132106fc74851471f6504c8c635d9d72c6a6c159d4e731cc75d3bcbc0ac13b3b3958a9e44bae4b0064
-
SSDEEP
98304:rF2SDPX7mB6Nu9PGfspNYkbdxJcDaUWzKIgb6ODMeH:TDmBb9JbPWHWzKaOA2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2025-03-25_fa93e5224640f9c2f0376eff52d95651_icedid_ramnit
Files
-
2025-03-25_fa93e5224640f9c2f0376eff52d95651_icedid_ramnit.exe windows:5 windows x86 arch:x86
87bed5a7cba00c7e1f4015f1bdae2183
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
GetProcAddress
Sections
.text Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 358KB - Virtual size: 357KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 27KB - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 377KB - Virtual size: 377KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.scc0 Size: 967KB - Virtual size: 998KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 360KB - Virtual size: 364KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE