2026-10-26_5d0eec6008777e3e58fc9b583f2ea6cf_icedid

General

Target
2026-10-26_5d0eec6008777e3e58fc9b583f2ea6cf_icedid
Size 1.1MB
Sample261027-tyflrasz8p
SHA256 7d95144dfe9038978adb3d1085a91df2020be0e4392f0e243431e5c303cf6d98
MD5 5d0eec6008777e3e58fc9b583f2ea6cf
SHA1 e8f10f0104718abf5f487fd36dfb641e07196171
SHA512 e66c2d63e31b6da9a1530fd803482f47b7d0a9e41adfd3063744db7385e42dc426caa9de36dece22b7a85490c4eba8e4eaae3de6b9ba8be49cf11cd7289c5696
SSDEEP 12288:HLmCf5DGf4oLJlC2TsvZpzYSjsYfmjQ4PbM2TSbopNi0Vi6oml4c:rm6GZslgPz3XNiR66
TLSH
T149454A56B55A69ACD05AC47483168963AA3170CB1B75BEFF02D482383FAABF05F3C714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-26_5d0eec6008777e3e58fc9b583f2ea6cf_icedid

File Explorer

2026-10-26_5d0eec6008777e3e58fc9b583f2ea6cf_icedid

.exe 1.1MB

2026-10-26_5d0eec6008777e3e58fc9b583f2ea6cf_icedid

IMPHASH 6baed73eff02347a5072f1b081dd7186
SHA256 7d95144dfe9038978adb3d1085a91df2020be0e4392f0e243431e5c303cf6d98
MD5 5d0eec6008777e3e58fc9b583f2ea6cf
SHA1 e8f10f0104718abf5f487fd36dfb641e07196171
SHA512 e66c2d63e31b6da9a1530fd803482f47b7d0a9e41adfd3063744db7385e42dc426caa9de36dece22b7a85490c4eba8e4eaae3de6b9ba8be49cf11cd7289c5696
SSDEEP 12288:HLmCf5DGf4oLJlC2TsvZpzYSjsYfmjQ4PbM2TSbopNi0Vi6oml4c:rm6GZslgPz3XNiR66
TLSH
T149454A56B55A69ACD05AC47483168963AA3170CB1B75BEFF02D482383FAABF05F3C714
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

782028

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

cacheeval.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

bcryptprimitives

ProcessPrng

kernel32

HeapSize LCMapStringW CompareStringW CloseHandle GetSystemInfo UnmapViewOfFile VirtualProtect CreateFileMappingW MapViewOfFile GetCurrentProcess DuplicateHandle FlushFileBuffers GetLastError FreeEnvironmentStringsW WaitForSingleObject SetLastError GetFullPathNameW GetCurrentThreadId SetFileInformationByHandle CreateFileW GetStdHandle GetProcessHeap HeapFree HeapReAlloc QueryPerformanceCounter CreateThread GetCurrentProcessId RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetFileTime GetFileInformationByHandle GetFileInformationByHandleEx TerminateProcess GetEnvironmentStringsW SetFilePointerEx AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetCommandLineW lstrlenW FindFirstFileExW FindClose ExitProcess GetProcAddress WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA CreateMutexA ReleaseMutex GetEnvironmentVariableW SetEnvironmentVariableW HeapAlloc GetModuleFileNameW MultiByteToWideChar WriteConsoleW GetConsoleMode GetConsoleOutputCP FlsFree FlsAlloc GetModuleHandleExW GetModuleHandleW FlsSetValue IsThreadAFiber GetFileType FormatMessageW GetModuleHandleA FindNextFileW InitializeCriticalSectionEx FlsGetValue GetStringTypeW SetStdHandle GetCPInfo GetOEMCP GetACP IsValidCodePage GetCommandLineA WriteFile LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer RaiseException RtlPcToFileHeader RtlUnwindEx IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent GetSystemTimeAsFileTime InitializeSListHead

ntdll

NtWriteFile NtReadFile RtlNtStatusToDosError

Name

.text

Size

867KB

Virtual Size

867KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

264KB

Virtual Size

264KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_5d0eec6008777e3e58fc9b583f2ea6cf_icedid

api-ms-win-core-synch-l1-2-0

bcryptprimitives

kernel32

ntdll

generic