2026-10-13_1be1b1d6e355db2b28d2fb79a111a43d_icedid

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-13_1be1b1d6e355db2b28d2fb79a111a43d_icedid
Size 1.6MB
Sample261015-xbd17azyex
SHA256 f3ad4a65ee3d253513feec5a2d53a1d6c62162d3d2249dbbd31efaace5ee1d9c
MD5 1be1b1d6e355db2b28d2fb79a111a43d
SHA1 9cc44d4cc8f03b4e71a9ff0db6515a51bffcbb4b
SHA512 ba91c36b6ae9a2180e8673e2ae33676e6303d56fe3d327074302ffa4374e3ef2423048c735e91852d9268f6f29dc7edff757107a490e480ebe278262df022b19
SSDEEP 24576:FL3QqJqAC/PT+S1g0xHnxC4bZtxoEgmK0:F3j7CS4g0djtLhVR
TLSH
T15875F115B24118FDE86BC07C86558572F57278D50B22EEFF1694122A3F7BAE18E3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-13_1be1b1d6e355db2b28d2fb79a111a43d_icedid

File Explorer

2026-10-13_1be1b1d6e355db2b28d2fb79a111a43d_icedid

.exe 1.6MB

2026-10-13_1be1b1d6e355db2b28d2fb79a111a43d_icedid

IMPHASH b270ee1350f09ca65b0ef2a1a7d3d04c
SHA256 f3ad4a65ee3d253513feec5a2d53a1d6c62162d3d2249dbbd31efaace5ee1d9c
MD5 1be1b1d6e355db2b28d2fb79a111a43d
SHA1 9cc44d4cc8f03b4e71a9ff0db6515a51bffcbb4b
SHA512 ba91c36b6ae9a2180e8673e2ae33676e6303d56fe3d327074302ffa4374e3ef2423048c735e91852d9268f6f29dc7edff757107a490e480ebe278262df022b19
SSDEEP 24576:FL3QqJqAC/PT+S1g0xHnxC4bZtxoEgmK0:F3j7CS4g0djtLhVR
TLSH
T15875F115B24118FDE86BC07C86558572F57278D50B22EEFF1694122A3F7BAE18E3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

122944

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

audio_effects_helper.pdb

ole32

CoCreateInstance CoInitializeEx CoUninitialize CoTaskMemFree

kernel32

RaiseException EncodePointer IsProcessorFeaturePresent QueryPerformanceCounter TlsAlloc WaitForSingleObject TlsGetValue GetLastError TlsFree GetConsoleMode SetErrorMode LoadLibraryExW TlsSetValue LoadLibraryExA GetProcAddress FreeLibrary GetProcessHeap HeapAlloc HeapFree FlsGetValue FormatMessageW RtlPcToFileHeader GetStdHandle GetSystemTimeAsFileTime IsDebuggerPresent GetStartupInfoW FindClose FindNextFileW HeapSize SetStdHandle LCMapStringW CompareStringW GetModuleHandleA GetFileType IsThreadAFiber FlsSetValue GetModuleHandleW GetModuleHandleExW VirtualProtect FlsAlloc FlsFree InitializeCriticalSectionEx GetStringTypeW GetCPInfo GetOEMCP GetACP IsValidCodePage GetCommandLineA WriteFile InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection GetConsoleOutputCP RtlUnwindEx WriteConsoleW MultiByteToWideChar SetUnhandledExceptionFilter GetModuleFileNameW UnhandledExceptionFilter InitializeSListHead SetEnvironmentVariableW GetEnvironmentVariableW ReleaseMutex CreateMutexA LoadLibraryA WaitForSingleObjectEx WideCharToMultiByte CloseHandle FreeEnvironmentStringsW SetLastError GetCurrentThreadId CreateFileW GetCurrentProcess HeapReAlloc GetCurrentProcessId FlushFileBuffers RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind TerminateProcess GetEnvironmentStringsW SetFilePointerEx AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetCommandLineW lstrlenW FindFirstFileExW ExitProcess

oleaut32

SysFreeString SysStringLen GetErrorInfo

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

ntdll

NtWriteFile RtlNtStatusToDosError

Name

.text

Size

179KB

Virtual Size

178KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

79KB

Virtual Size

79KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-13_1be1b1d6e355db2b28d2fb79a111a43d_icedid

ole32

kernel32

oleaut32

api-ms-win-core-synch-l1-2-0

ntdll

generic