2026-09-09_d99d4688c0ffdbada257180b2214e3f8_icedid_mespinoza_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-09_d99d4688c0ffdbada257180b2214e3f8_icedid_mespinoza_ryuk
Size 1.6MB
Sample260909-m42ylsej21
SHA256 785a62580a18c4ee2abb75e27adb350cab8be037b67b53e4a50cfb731255a4b6
MD5 d99d4688c0ffdbada257180b2214e3f8
SHA1 0e7ebcadd2c3c772b6b2d4b963c63527dda983d6
SHA512 2157f662947664d4f3ff421d73494737f2ffabba3d347ddbc58ff15ebf3a27b91a023fdc08afe5c0d4e595a838cff4124c89f3d343ebdc5b99e94a2a6074ae4d
SSDEEP 12288:pXfNWmUyKL3wQnQ1Pgv2KkbtBH8vr4b25hwgD9j2AHhSv1sn9qJH+Mu:LWBL3bQhak5BH8vz5+gZSen0JHu
TLSH
T1EF75124FB6C8B4F5D2339A39C9611254D772B87206619B9F17A4A3161F33AC19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-09_d99d4688c0ffdbada257180b2214e3f8_icedid_mespinoza_ryuk

File Explorer

2026-09-09_d99d4688c0ffdbada257180b2214e3f8_icedid_mespinoza_ryuk

.exe 1.6MB

2026-09-09_d99d4688c0ffdbada257180b2214e3f8_icedid_mespinoza_ryuk

IMPHASH 9488532fe0247f77391c32c458a5ed9e
SHA256 785a62580a18c4ee2abb75e27adb350cab8be037b67b53e4a50cfb731255a4b6
MD5 d99d4688c0ffdbada257180b2214e3f8
SHA1 0e7ebcadd2c3c772b6b2d4b963c63527dda983d6
SHA512 2157f662947664d4f3ff421d73494737f2ffabba3d347ddbc58ff15ebf3a27b91a023fdc08afe5c0d4e595a838cff4124c89f3d343ebdc5b99e94a2a6074ae4d
SSDEEP 12288:pXfNWmUyKL3wQnQ1Pgv2KkbtBH8vr4b25hwgD9j2AHhSv1sn9qJH+Mu:LWBL3bQhak5BH8vz5+gZSen0JHu
TLSH
T1EF75124FB6C8B4F5D2339A39C9611254D772B87206619B9F17A4A3161F33AC19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12708

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Prog\HP3DDGDrivers\x64\Win8Release\HP3DDGService.pdb

kernel32

HeapSize MultiByteToWideChar GetLastError HeapReAlloc CloseHandle GetNativeSystemInfo RaiseException FindClose DeleteCriticalSection GetProcessHeap CopyFileW WriteConsoleW SetFilePointerEx InitializeCriticalSectionEx SetProcessShutdownParameters FindNextFileW HeapFree GetProcessShutdownParameters HeapAlloc FindFirstFileW IsDebuggerPresent OutputDebugStringW EnterCriticalSection LeaveCriticalSection CreateEventW GetModuleHandleW GetProcAddress RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW RtlUnwindEx SetLastError CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetModuleFileNameW WideCharToMultiByte GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetACP CompareStringW LCMapStringW FindFirstFileExW IsValidCodePage GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetFileType SetStdHandle GetStringTypeW FlushFileBuffers GetConsoleCP GetConsoleMode CreateFileW

advapi32

SetServiceStatus RegisterServiceCtrlHandlerW StartServiceCtrlDispatcherW RegisterEventSourceW ReportEventW DeregisterEventSource

Name

.text

Size

59KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

39KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

240B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-09_d99d4688c0ffdbada257180b2214e3f8_icedid_mespinoza_ryuk

kernel32

advapi32

generic