2026-09-16_1ca64f63cef7705fb93d30e0ad142a86_icedid

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-16_1ca64f63cef7705fb93d30e0ad142a86_icedid
Size 484KB
Sample260916-ravpnack9w
SHA256 bf266b9192565baa5168db5b7ad2a5783873a6ce1a236943726ca54d6dff1389
MD5 1ca64f63cef7705fb93d30e0ad142a86
SHA1 5caf0f107183bd31c552fba1d76b7ca8f003c718
SHA512 38eaee7ba9f030949625b1c1ff2f921891f3e57844072720f21e43db060afe03b3d7d66737e1c3b078d388161db19995c23f0e71c5c9e653b451410f4dcef264
SSDEEP 6144:BNV43Wb+dTTUFgEs3XojAdP+dTTUFgEs3X5wLuLahmZ2uhuYc:rCGbgUFgEsnojA9gUFgEsndAmZXuYc
TLSH
T191B4D706FA9540B5E473097049A6E27E5730B925C6138EABA1949FCFFFF2BD08D24631
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-09-16_1ca64f63cef7705fb93d30e0ad142a86_icedid

File Explorer

2026-09-16_1ca64f63cef7705fb93d30e0ad142a86_icedid

.exe 484KB

2026-09-16_1ca64f63cef7705fb93d30e0ad142a86_icedid

IMPHASH a220beeafc75603adf8a3e0eebda23d9
SHA256 bf266b9192565baa5168db5b7ad2a5783873a6ce1a236943726ca54d6dff1389
MD5 1ca64f63cef7705fb93d30e0ad142a86
SHA1 5caf0f107183bd31c552fba1d76b7ca8f003c718
SHA512 38eaee7ba9f030949625b1c1ff2f921891f3e57844072720f21e43db060afe03b3d7d66737e1c3b078d388161db19995c23f0e71c5c9e653b451410f4dcef264
SSDEEP 6144:BNV43Wb+dTTUFgEs3XojAdP+dTTUFgEs3X5wLuLahmZ2uhuYc:rCGbgUFgEsnojA9gUFgEsndAmZXuYc
TLSH
T191B4D706FA9540B5E473097049A6E27E5730B925C6138EABA1949FCFFFF2BD08D24631
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

59:52:60:6f:08:aa:91:b5:d8:95:54:7f:46:0d:7b:bf:48:9e:c0:03:7a:c1:1e:27:99:10:14:32:80:e3:b9:b8

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 30, 2015

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

PE Signature issue

Digest

1d:36:1b:9c:33:e2:c5:ba:16:bc:74:76:e3:0e:0b:6e:4d:cc:6b:4b

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 30, 2015

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:98FD-C61E-E641,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:89:62:0d:9e:95:d3:61:6b:a8:00:00:00:00:00:89

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 7, 2015 - Jan 7, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:7b:a2:81:0b:87:11:ab:e7:fc:00:00:00:00:00:7b

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 1, 2014 - Jan 1, 2016

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 1, 2010 - Jul 1, 2025

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:5847-F761-4F70,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:6f:c6:fe:ea:06:36:34:01:16:00:00:00:00:00:6f

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 7, 2015 - Jan 7, 2017

Minor OS version

Major OS version

Entry point

19328

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

diagtrackrunner.pdb

advapi32

EventWriteTransfer RegCreateKeyExW RegDeleteValueW RegGetValueW RegCloseKey OpenThreadToken

kernel32

LoadLibraryExW SetEnvironmentVariableW GetModuleHandleExW OutputDebugStringW GetModuleHandleW GetCurrentThread FormatMessageW RaiseException GetLastError SetLastError GetProcAddress GetModuleFileNameA GetCurrentThreadId CloseHandle ExpandEnvironmentStringsW GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter Sleep QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetTickCount TerminateProcess

msvcrt

_CxxThrowException ??0exception@@QEAA@AEBV0@@Z ??1exception@@UEAA@XZ ?what@exception@@UEBAPEBDXZ _callnewh _XcptFilter _amsg_exit __wgetmainargs __set_app_type exit _exit _cexit __setusermatherr ??0exception@@QEAA@AEBQEBD@Z __C_specific_handler _fmode _commode ?terminate@@YAXXZ _lock _unlock __dllonexit _onexit ??1type_info@@UEAA@XZ _purecall _vsnwprintf malloc memcpy _initterm __CxxFrameHandler3 free memmove _wcsicmp ??3@YAXPEAX@Z ??0exception@@QEAA@AEBQEBDH@Z memset

ntdll

RtlLookupFunctionEntry RtlCaptureContext RtlVirtualUnwind

userenv

ExpandEnvironmentStringsForUserW

diagtrack

RunDll32Main

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-16_1ca64f63cef7705fb93d30e0ad142a86_icedid

PE Signature issue

PE Signature issue

advapi32

kernel32

msvcrt

ntdll

userenv

diagtrack

generic