2026-05-27_b803210c3d1a1adb75a7e8562e60b2fe_icedid_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-27_b803210c3d1a1adb75a7e8562e60b2fe_icedid_vidar
Size 21.6MB
Sample260527-eellbsey7k
SHA256 0f2e83485f3bb7c4837ecbadb53556a0b51feff2f19522ed09bebac09a13b0a2
MD5 b803210c3d1a1adb75a7e8562e60b2fe
SHA1 e4edcccd2459d1a524129151b1ba04de3da25540
SHA512 7a99ce262b7de51d95723a7cb226a08232f7815561a0068d34fc37e997915d25b6f00b558d08c693277402a68b00a239e72929b6724aa476267b60bbaa44fb08
SSDEEP 393216:eIZKZ9ZvoRFCgd3Ns9AQyv2BE5fF5Hnb3VEQJPUQvs48sXPH++qePUQj18n:Po9ZvQCgd3OA9eB6Vb3/sQkSXPe+lPUD
TLSH
T1F737331673F820EAF5B29779897A694AA7717C720B11D2DF12606D9D3F727C08E30722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-05-27_b803210c3d1a1adb75a7e8562e60b2fe_icedid_vidar

File Explorer

2026-05-27_b803210c3d1a1adb75a7e8562e60b2fe_icedid_vidar

.exe 21.6MB

2026-05-27_b803210c3d1a1adb75a7e8562e60b2fe_icedid_vidar

IMPHASH 5eb09526234e4eb1049531b653a987ce
SHA256 0f2e83485f3bb7c4837ecbadb53556a0b51feff2f19522ed09bebac09a13b0a2
MD5 b803210c3d1a1adb75a7e8562e60b2fe
SHA1 e4edcccd2459d1a524129151b1ba04de3da25540
SHA512 7a99ce262b7de51d95723a7cb226a08232f7815561a0068d34fc37e997915d25b6f00b558d08c693277402a68b00a239e72929b6724aa476267b60bbaa44fb08
SSDEEP 393216:eIZKZ9ZvoRFCgd3Ns9AQyv2BE5fF5Hnb3VEQJPUQvs48sXPH++qePUQj18n:Po9ZvQCgd3OA9eB6Vb3/sQkSXPe+lPUD
TLSH
T1F737331673F820EAF5B29779897A694AA7717C720B11D2DF12606D9D3F727C08E30722
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

a2:45:44:e2:19:ca:02:61:52:64:1f:08:db:1f:7b:d4:10:1d:c6:d2:e0:70:27:c9:b6:d7:0b:59:19:c4:2e:c0

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 18, 2025

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:05:19:da:dd:aa:8b:dc:44:b2:92:00:00:00:00:05:19

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 19, 2025 - Jun 17, 2026

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:07:76:56:00:00:00:00:00:08

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Oct 19, 2011 - Oct 19, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:591A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:f4:17:46:85:c0:cb:3f:39:e5:00:01:00:00:01:f4

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 25, 2024 - Oct 22, 2025

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

9976

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

HeapAlloc HeapFree GetProcessHeap Sleep GetCurrentProcess CreateProcessW GlobalMemoryStatusEx GetSystemInfo GetTickCount GetWindowsDirectoryW VirtualAlloc VirtualFree GetModuleFileNameW GetModuleHandleW GetProcAddress LoadResource LockResource SizeofResource FindResourceW GlobalMemoryStatus GetTimeZoneInformation WriteConsoleW QueryPerformanceFrequency SetFilePointerEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc HeapSize LCMapStringW VirtualProtect InitializeCriticalSectionEx QueryPerformanceCounter CloseHandle IsDebuggerPresent WriteFile FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileAttributesW GetDiskFreeSpaceExW CreateFileW CreateDirectoryW GetEnvironmentVariableW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetStartupInfoW RtlUnwindEx GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetStdHandle ExitProcess GetModuleHandleExW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetStringTypeW

user32

GetDC wsprintfW SystemParametersInfoW DestroyIcon LoadIconW FillRect GetKeyboardLayout GetCursorPos ReleaseDC GetSysColor GetSystemMetrics DestroyWindow CreateWindowExW RegisterClassExW DefWindowProcW

advapi32

RegOpenKeyExW RegQueryValueExW RegCloseKey

ole32

CoUninitialize CoInitializeEx

shell32

SHGetFileInfoW SHCreateDirectoryExW SHGetFolderPathW

gdi32

CreateCompatibleDC DeleteDC GetDeviceCaps GetStockObject GetTextMetricsW

Name

xkrintva

Size

57KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

spczpygo

Size

41KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

thyucoiw

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

gyfmctgg

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

cexuafmo

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

ioayafue

Size

742KB

Virtual Size

741KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

zwdlyrpj

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

743KB

Virtual Size

742KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-27_b803210c3d1a1adb75a7e8562e60b2fe_icedid_vidar

PE Signature issue

kernel32

user32

advapi32

ole32

shell32

gdi32

generic