2026-08-03_c22917904699fdc36fb2a0db859a9628_hijackloader_icedid_mespinoza

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_c22917904699fdc36fb2a0db859a9628_hijackloader_icedid_mespinoza
Size 544KB
Sample260804-lwgr2axbpc
SHA256 025ec4cf68393d42c2b35936b0b4fa2e4c5c85eca79932ef8ea1b6a04ed4b89e
MD5 c22917904699fdc36fb2a0db859a9628
SHA1 e6a6d1618b3e18ae7d0c77713dac24595a5beee0
SHA512 624a26046c21f107b1edcf24d41504918642b4b4dd09a261c2fd43725bb01eebf49ee115d62978d53ac9267e0f19b56179fda85803513167b688d64641e80e19
SSDEEP 12288:03K2tE6DCoEre6fJwNVVZcGFHHqJDVjoOzvxpfAl:03K2Wqxqe6azVS1JDpzDAl
TLSH
T1CDC4BE6AFB82DFDAC502593A483586C4BB76A8602F64C7533249F33DBE779414D21B32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_c22917904699fdc36fb2a0db859a9628_hijackloader_icedid_mespinoza

File Explorer

2026-08-03_c22917904699fdc36fb2a0db859a9628_hijackloader_icedid_mespinoza

.exe 544KB

2026-08-03_c22917904699fdc36fb2a0db859a9628_hijackloader_icedid_mespinoza

IMPHASH 40609f327658e8f230ca3f3d6fd60a49
SHA256 025ec4cf68393d42c2b35936b0b4fa2e4c5c85eca79932ef8ea1b6a04ed4b89e
MD5 c22917904699fdc36fb2a0db859a9628
SHA1 e6a6d1618b3e18ae7d0c77713dac24595a5beee0
SHA512 624a26046c21f107b1edcf24d41504918642b4b4dd09a261c2fd43725bb01eebf49ee115d62978d53ac9267e0f19b56179fda85803513167b688d64641e80e19
SSDEEP 12288:03K2tE6DCoEre6fJwNVVZcGFHHqJDVjoOzvxpfAl:03K2Wqxqe6azVS1JDpzDAl
TLSH
T1CDC4BE6AFB82DFDAC502593A483586C4BB76A8602F64C7533249F33DBE779414D21B32
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

259552

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\netease\mpay-pc-webview-support\bin_x64\Release\webviewsupport.cef904430\render.pdb

Name

.text

Size

320KB

Virtual Size

319KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

176KB

Virtual Size

175KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

284B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

2026-08-03_c22917904699fdc36fb2a0db859a9628_hijackloader_icedid_mespinoza

il3j.kpf

generic