2026-08-07_987e2d14f1b4f4aaf683eb5131c41c16_icedid

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-07_987e2d14f1b4f4aaf683eb5131c41c16_icedid
Size 8.4MB
Sample260808-a91araer2x
SHA256 f0ef47aca4dc111693a14ff6e3108b1a44603d0a9ea542215f58c951dcbcc70a
MD5 987e2d14f1b4f4aaf683eb5131c41c16
SHA1 f6a3550c31a050180c1a9597ca2aa24d47882f97
SHA512 c60a00f935c14b7a2382c7b10b210a0603179f8400a351f035ea600e636b1947726f3f0c29ae9c52cf54d8c86209d6d5f5c27f9bea8bfe5fc6ac1cf875ffff63
SSDEEP 49152:hA7Ql/TjJU0XOI0RKzl9MsSy9GtqYpz/5g261kx/7PObQgBa5o77axK8+nsBsvY:hA7QlLjtmRKXxAqvV4/7Wpa5wmksBs
TLSH
T1C7969E70EA64353BD7DB07BF94502F824674D5321F2574A9F69D0259080BF8F8B2AE2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing possible sandbox analysis VM usernames 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-07_987e2d14f1b4f4aaf683eb5131c41c16_icedid

File Explorer

2026-08-07_987e2d14f1b4f4aaf683eb5131c41c16_icedid

.exe 8.4MB

2026-08-07_987e2d14f1b4f4aaf683eb5131c41c16_icedid

IMPHASH ef70d240bc709c0dee4dafab9a15bcc9
SHA256 f0ef47aca4dc111693a14ff6e3108b1a44603d0a9ea542215f58c951dcbcc70a
MD5 987e2d14f1b4f4aaf683eb5131c41c16
SHA1 f6a3550c31a050180c1a9597ca2aa24d47882f97
SHA512 c60a00f935c14b7a2382c7b10b210a0603179f8400a351f035ea600e636b1947726f3f0c29ae9c52cf54d8c86209d6d5f5c27f9bea8bfe5fc6ac1cf875ffff63
SSDEEP 49152:hA7Ql/TjJU0XOI0RKzl9MsSy9GtqYpz/5g261kx/7PObQgBa5o77axK8+nsBsvY:hA7QlLjtmRKXxAqvV4/7Wpa5wmksBs
TLSH
T1C7969E70EA64353BD7DB07BF94502F824674D5321F2574A9F69D0259080BF8F8B2AE2B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing possible sandbox analysis VM usernames
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

36624

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

top.pdb

user32

ReleaseDC GetDC GetDesktopWindow

gdi32

GetStockObject

kernel32

GetEnvironmentVariableW SetLastError FormatMessageW LCMapStringW HeapSize LocalFree GetCommandLineW VirtualProtect InitializeCriticalSectionEx CompareStringW CreateFileW GetLastError GetCurrentThread GetProcessHeap HeapReAlloc FindFirstFileExW HeapFree GetModuleHandleW GetModuleHandleA GetProcAddress HeapAlloc GetStdHandle GetConsoleMode GetConsoleOutputCP WaitForSingleObject MultiByteToWideChar WriteConsoleW QueryPerformanceCounter GetSystemTimeAsFileTime RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter RtlUnwindEx FreeLibrary EncodePointer RaiseException RtlPcToFileHeader GetCommandLineA FindClose FindNextFileW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetFileType FlushFileBuffers SetFilePointerEx CloseHandle GetCurrentProcessId GetCurrentThreadId InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW WriteFile GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess GetModuleHandleExW IsValidCodePage GetACP GetOEMCP GetCPInfo WideCharToMultiByte SetStdHandle GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree

shell32

CommandLineToArgvW

advapi32

SystemFunction036 RegOpenKeyExW RegCloseKey RegQueryValueExW

version

GetFileVersionInfoW VerQueryValueW

ntdll

RtlNtStatusToDosError NtWriteFile

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

Name

.text

Size

88KB

Virtual Size

87KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

8.3MB

Virtual Size

8.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-07_987e2d14f1b4f4aaf683eb5131c41c16_icedid

user32

gdi32

kernel32

shell32

advapi32

version

ntdll

api-ms-win-core-synch-l1-2-0

generic