2026-11-01_b3c39599d8dc8e8f7869538549a6a80d_icedid_mespinoza_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_b3c39599d8dc8e8f7869538549a6a80d_icedid_mespinoza_njrat
Size 21.2MB
Sample261102-nccebasya1
SHA256 2a5153c118d312ebf4c024dd7bc9b65fd840aae260712e579842eaba01083ca5
MD5 b3c39599d8dc8e8f7869538549a6a80d
SHA1 a88a477317fbafe8157ba043698f81174cb7e670
SHA512 e2dc1358fdfdc79082e36d7b2025598c893c5e65346519ba10f899f345031ffe274608501c4c29119821edbd31cebfa51af7c9682e9229db8d693578f524e884
SSDEEP 196608:zfpFAK2nkR4fYUCLFhbmWqPWpyR1pOIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIt:zfpFAK2ny4fqFhlqPWpyR1px
TLSH
T1342739B2D95185CCDE2CA6B5CE1E89FDCEA26C1AAF9089AF41143C11ED732C09D3D25D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-11-01_b3c39599d8dc8e8f7869538549a6a80d_icedid_mespinoza_njrat

File Explorer

2026-11-01_b3c39599d8dc8e8f7869538549a6a80d_icedid_mespinoza_njrat

.exe 21.2MB

2026-11-01_b3c39599d8dc8e8f7869538549a6a80d_icedid_mespinoza_njrat

IMPHASH 42c8a5ee0e87705462f8d6c99b125737
SHA256 2a5153c118d312ebf4c024dd7bc9b65fd840aae260712e579842eaba01083ca5
MD5 b3c39599d8dc8e8f7869538549a6a80d
SHA1 a88a477317fbafe8157ba043698f81174cb7e670
SHA512 e2dc1358fdfdc79082e36d7b2025598c893c5e65346519ba10f899f345031ffe274608501c4c29119821edbd31cebfa51af7c9682e9229db8d693578f524e884
SSDEEP 196608:zfpFAK2nkR4fYUCLFhbmWqPWpyR1pOIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIt:zfpFAK2ny4fqFhlqPWpyR1px
TLSH
T1342739B2D95185CCDE2CA6B5CE1E89FDCEA26C1AAF9089AF41143C11ED732C09D3D25D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

24:d6:b6:8c:bb:b7:37:5d:45:7d:fd:ce:e5:c9:c5:38:5f:41:7a:5b:93:a4:9d:6e:77:ae:af:a6:77:55:76:e8

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=200204019,CN=VS REVO GROUP OOD,O=VS REVO GROUP OOD,L=Ruse,C=BG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024247

Chains

Jan 1, 0001

PE Signature issue

Digest

32:90:4c:f3:d7:98:be:fa:73:f3:f8:f0:11:19:27:70:91:2b:ed:6c

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=200204019,CN=VS REVO GROUP OOD,O=VS REVO GROUP OOD,L=Ruse,C=BG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024247

Chains

Jan 1, 0001

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

SERIALNUMBER=200204019,CN=VS REVO GROUP OOD,O=VS REVO GROUP OOD,L=Ruse,C=BG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024247

Serial Number

0f:ae:00:14:1b:9f:16:25:f7:80:19:f2:59:ff:fc:df

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 7, 2024 - Aug 13, 2027

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Minor OS version

Major OS version

Entry point

22193960

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

shlwapi

StrCmpIW ord29 SHQueryValueExW PathIsUNCW PathIsRootW StrStrW PathRemoveExtensionW PathMatchSpecW PathAddBackslashW PathQuoteSpacesW StrToIntW PathStripToRootW SHDeleteKeyW SHDeleteValueW PathRemoveArgsW PathGetArgsW PathUnquoteSpacesW StrFormatKBSizeW StrCmpW PathIsDirectoryEmptyW StrStrIW PathIsDirectoryW StrFormatByteSizeW ord487 PathFindFileNameW PathAppendW PathFindExtensionW PathFileExistsW StrCatW PathRemoveBackslashW PathRemoveFileSpecW StrCpyW PathUnExpandEnvStringsW

msi

ord217 ord173

advapi32

RegQueryValueW RevertToSelf ImpersonateLoggedOnUser DuplicateTokenEx RegDeleteKeyExW FreeSid SetNamedSecurityInfoW AllocateAndInitializeSid RegUnLoadKeyW RegSetValueExW RegSetKeySecurity RegSaveKeyW RegRestoreKeyW RegReplaceKeyW RegLoadKeyW RegGetKeySecurity RegFlushKey RegEnumKeyExW RegCreateKeyExW RegConnectRegistryW RegDeleteKeyW RegEnumKeyW GetUserNameW RegNotifyChangeKeyValue GetTokenInformation AdjustTokenPrivileges LookupPrivilegeValueW SetSecurityInfo SetEntriesInAclW OpenProcessToken ConvertSidToStringSidW RegOpenKeyExW RegQueryValueExW RegCloseKey OpenSCManagerW OpenServiceW CloseServiceHandle DeleteService RegOpenKeyW RegDeleteValueW RegQueryInfoKeyW RegEnumValueW LookupAccountNameW

wininet

FindCloseUrlCache DeleteUrlCacheEntryW FindFirstUrlCacheEntryW FindNextUrlCacheEntryW

wtsapi32

WTSEnumerateProcessesW WTSEnumerateSessionsW WTSFreeMemory WTSQuerySessionInformationW

kernel32

VirtualFreeEx ReadProcessMemory K32GetModuleFileNameExW WriteProcessMemory SuspendThread VirtualAlloc VirtualFree GetVersion GetModuleHandleW ExitProcess GetUserDefaultLCID GetLocaleInfoW GetLongPathNameW GetLogicalDriveStringsW QueryDosDeviceW GetFinalPathNameByHandleW GetLocalTime GetUserDefaultLangID GetCommandLineW GetShortPathNameW GlobalSize GlobalFree CopyFileW SetLastError SetThreadPriority EncodePointer FreeResource GetModuleHandleExW LoadLibraryExW GlobalDeleteAtom GlobalAddAtomW GlobalFindAtomW CreateActCtxW ActivateActCtx DeactivateActCtx FindActCtxSectionStringW QueryActCtxW lstrcmpA GlobalGetAtomNameW ReleaseSemaphore GetVolumeInformationW GetThreadLocale FileTimeToLocalFileTime GetCurrentThread GetPrivateProfileIntW GetFileSizeEx GetFileTime TlsGetValue TlsSetValue TlsFree GlobalReAlloc GlobalHandle LocalAlloc LocalReAlloc GlobalFlags CompareStringW GetSystemDefaultUILanguage VirtualProtect SetErrorMode GetCurrentDirectoryW FindResourceExW GetProfileIntW SearchPathW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTimeAsFileTime GetProcessHeap GetCurrentProcessId GetFileSize LockFileEx UnregisterWaitEx VirtualAllocEx InterlockedPopEntrySList GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation SwitchToThread SignalObjectAndWait CreateTimerQueue FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage ReadConsoleW GetConsoleMode GetConsoleCP WriteConsoleW GetTimeZoneInformation EnumSystemLocalesW IsValidLocale SetEnvironmentVariableA GetACP GetStdHandle HeapQueryInformation GetCommandLineA SetStdHandle PeekNamedPipe GetFileType FreeLibraryAndExitThread ExitThread VirtualQuery InterlockedFlushSList InterlockedPushEntrySList RtlUnwindEx RtlPcToFileHeader GetCPInfo LCMapStringW QueryPerformanceFrequency SetFilePointerEx FindFirstFileExW GetExitCodeThread GetStringTypeW IsBadWritePtr IsBadReadPtr WinExec CreateThread GetVersionExA GetCurrencyFormatW GetNumberFormatW GetTimeFormatW GetDateFormatW GetModuleHandleA GetPriorityClass SetPriorityClass GetThreadPriority CreateFileMappingA UnlockFile HeapDestroy HeapCompact MulDiv SizeofResource LockResource LoadResource FindResourceW WaitForSingleObject HeapAlloc MoveFileExW GetSystemInfo RaiseException HeapReAlloc DeleteFileA WaitForSingleObjectEx LoadLibraryA CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA Sleep CreateDirectoryW GetLastError DecodePointer FlushFileBuffers QueryDepthSList GetTickCount FindFirstFileW FindNextFileW FindClose DeleteFileW GetFullPathNameW lstrcpyW lstrcmpW ExpandEnvironmentStringsW GetWindowsDirectoryW lstrcatW MoveFileW CreateProcessW CloseHandle GlobalAlloc GlobalLock GlobalUnlock CreateFileW WriteFile K32EnumProcesses OpenProcess K32GetProcessImageFileNameW RemoveDirectoryW SetFileAttributesW ResetEvent ResumeThread SetEvent TlsAlloc MultiByteToWideChar InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection DeleteCriticalSection GetLogicalDrives GetDriveTypeW VerSetConditionMask VerifyVersionInfoW GetBinaryTypeW GetUserDefaultUILanguage InitializeCriticalSectionEx lstrlenW lstrcmpiW DeviceIoControl GetFileAttributesW GetDiskFreeSpaceExW LocalFree WTSGetActiveConsoleSessionId GetSystemTime SystemTimeToFileTime GetTempPathW CompareFileTime GetDiskFreeSpaceA FormatMessageW GetTempPathA HeapSize HeapValidate UnmapViewOfFile GetCurrentThreadId GetVersionExW GetModuleFileNameW TerminateProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW WritePrivateProfileStringW GetPrivateProfileSectionW GetPrivateProfileSectionNamesW GetPrivateProfileStringW GetEnvironmentVariableW GetCurrentProcess DuplicateHandle GetSystemDirectoryW GetExitCodeProcess WideCharToMultiByte GetTempFileNameW CreateEventW WaitForMultipleObjects GetComputerNameW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime LoadLibraryW CreateMutexW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer InitializeCriticalSection LockFile OutputDebugStringA GetDiskFreeSpaceW HeapFree HeapCreate TryEnterCriticalSection ReadFile AreFileApisANSI FreeLibrary GetProcAddress

user32

DestroyCursor GetWindowRgn WindowFromDC SubtractRect TranslateMDISysAccel DefMDIChildProcW DefFrameProcW DrawMenuBar GetUpdateRect IsClipboardFormatAvailable CharUpperBuffW ModifyMenuW SetMenuDefaultItem DestroyAcceleratorTable CreateAcceleratorTableW GetKeyboardState ToUnicodeEx MapVirtualKeyExW IsCharLowerW GetKeyboardLayout WaitMessage GetComboBoxInfo MonitorFromPoint UpdateLayeredWindow FrameRect CopyIcon SetCursorPos DrawStateW SetClassLongPtrW EnumDisplayMonitors NotifyWinEvent InvertRect HideCaret EnableScrollBar GetIconInfo DrawIconEx GetMenuDefaultItem MessageBeep GetNextDlgGroupItem PostThreadMessageW GetDCEx CopyAcceleratorTableW UnionRect InvalidateRgn CreateMenu GetTabbedTextExtentW TrackMouseEvent GetAsyncKeyState CopyImage RealChildWindowFromPoint ShowOwnedPopups MapDialogRect SetWindowContextHelpId RegisterClipboardFormatW PostQuitMessage DeleteMenu CharNextW CharUpperW GetWindowRect GetClientRect IsWindow EndDeferWindowPos DeferWindowPos MapVirtualKeyW GetKeyNameTextW MsgWaitForMultipleObjectsEx ReuseDDElParam UnpackDDElParam InsertMenuItemW BringWindowToTop SetParent DrawEdge SendDlgItemMessageA SetMenuItemInfoW GetMenuCheckMarkDimensions SetMenuItemBitmaps EnableMenuItem CheckMenuItem GetNextDlgTabItem EndDialog CreateDialogIndirectParamW GetMenuItemInfoW WinHelpW GetScrollInfo SetScrollInfo UnhookWindowsHookEx GetLastActivePopup GetTopWindow GetClassLongPtrW SetWindowLongPtrW ScreenToClient BeginDeferWindowPos IsChild GetWindowLongPtrW IsCharAlphaNumericW GetClipboardData GetCursor SystemParametersInfoA CreateIconIndirect LoadMenuIndirectW LoadCursorW DefWindowProcW GetClassInfoW SetTimer GetFocus GetSystemMetrics GetSystemMenu InvalidateRect EnableWindow GetDlgItem GetSysColor LoadImageW DestroyIcon UpdateWindow GetParent SendMessageW ClientToScreen LoadAcceleratorsW CopyRect SetCursor PostMessageW CreateWindowExW OpenClipboard EmptyClipboard SetClipboardData CloseClipboard TranslateAcceleratorW wsprintfW KillTimer GrayStringW DrawTextExW DrawTextW TabbedTextOutW SetRectEmpty SetFocus RedrawWindow SetWindowPos ShowWindow SetScrollPos GetDC ReleaseDC GetCursorPos OffsetRect InflateRect LoadStringW LoadIconW UnregisterHotKey DestroyMenu LoadMenuW MonitorFromWindow GetMonitorInfoW LockWindowUpdate EqualRect GetClassNameW GetDesktopWindow SetScrollRange GetScrollRange GetScrollPos GetWindowLongW SetWindowLongW IsZoomed IsRectEmpty FillRect DrawFrameControl GetMessagePos UnregisterClassW SetRect GetSysColorBrush LoadBitmapW SetWindowRgn SystemParametersInfoW GetForegroundWindow SetForegroundWindow GetWindowDC FindWindowW EnumChildWindows SetLayeredWindowAttributes PtInRect IsIconic DrawIcon SetCapture ReleaseCapture WindowFromPoint GetWindowThreadProcessId GetAncestor MapWindowPoints AdjustWindowRectEx RemovePropW GetPropW SetPropW ShowScrollBar ScrollWindow SetActiveWindow SetMenu GetMenu GetCapture SetWindowPlacement GetWindowPlacement DestroyWindow IsMenu GetClassInfoExW RegisterClassW CallWindowProcW GetMessageTime RegisterWindowMessageW IsDialogMessageW GetWindowTextLengthW GetWindowTextW SetWindowTextW IsWindowEnabled GetDlgCtrlID SendDlgItemMessageW CheckDlgButton SetDlgItemTextW MoveWindow EndPaint BeginPaint IntersectRect CallNextHookEx SetWindowsHookExW ValidateRect GetKeyState RemoveMenu AppendMenuW GetMenuState PeekMessageW GetWindow IsWindowVisible CreatePopupMenu InsertMenuW TrackPopupMenu GetMenuItemCount GetMenuItemID GetSubMenu MsgWaitForMultipleObjects IsWindowUnicode GetMessageW GetMessageA TranslateMessage DispatchMessageW DispatchMessageA MessageBoxW IsCharAlphaW GetDoubleClickTime GetActiveWindow GetMenuStringW DrawFocusRect

gdi32

SetROP2 SetTextColor SetTextAlign GetClipBox ExcludeClipRect CreateSolidBrush CreateHatchBrush SetRectRgn SetPolyFillMode GetLayout SetLayout CreateEllipticRgnIndirect SetBkColor PatBlt CreateRectRgnIndirect CreatePatternBrush CreateDCW CopyMetaFileW StretchBlt GetDIBits CombineRgn CreateRectRgn SetStretchBltMode StartDocW CreatePen Rectangle Ellipse GetStockObject CreateFontW SetDIBColorTable SelectObject DeleteDC PtVisible RectVisible TextOutW ExtTextOutW Escape CreateCompatibleDC LPtoDP CreateBitmap CreateDIBSection CreateCompatibleBitmap GetMapMode DPtoLP BitBlt GetBkColor GetObjectW DeleteObject CreateFontIndirectW GetTextExtentPoint32W SetMapMode GetTextMetricsW ExtCreatePen MoveToEx SetViewportExtEx SetViewportOrgEx SetWindowExtEx SetWindowOrgEx OffsetViewportOrgEx OffsetWindowOrgEx ScaleViewportExtEx ScaleWindowExtEx CloseMetaFile CreateMetaFileW DeleteMetaFile GetTextColor GetTextAlign GetViewportOrgEx OffsetRgn GetCharWidthW StretchDIBits GetRgnBox EnumFontFamiliesExW CreatePalette GetNearestPaletteIndex GetPaletteEntries GetSystemPaletteEntries RealizePalette CreateDIBitmap EnumFontFamiliesW GetTextCharsetInfo SetPixel CreateEllipticRgn CreatePolygonRgn Polygon Polyline CreateRoundRectRgn RoundRect FillRgn FrameRgn GetBoundsRect PtInRegion ExtFloodFill SetPaletteEntries SetPixelV GetWindowOrgEx EndDoc StartPage EndPage AbortDoc SetAbortProc GetROP2 GetBkMode GetNearestColor GetPolyFillMode GetTextFaceW SetBkMode SelectPalette ExtSelectClipRgn SaveDC SelectClipRgn RestoreDC PlayMetaFile LineTo IntersectClipRect GetWindowExtEx GetViewportExtEx GetPixel GetObjectType GetCurrentPositionEx GetDeviceCaps GetStretchBltMode GetDCOrgEx GetMetaFileW CloseEnhMetaFile CreateEnhMetaFileW DeleteEnhMetaFile GetEnhMetaFileW PlayEnhMetaFile GetTextCharset

msimg32

TransparentBlt AlphaBlend

winspool.drv

ClosePrinter DocumentPropertiesW OpenPrinterW

shell32

SHGetKnownFolderPath SHGetPropertyStoreForWindow Shell_NotifyIconW CommandLineToArgvW DragFinish DragQueryFileW SHGetMalloc SHGetPathFromIDListW SHGetSpecialFolderLocation SHGetDesktopFolder SHAppBarMessage SHAddToRecentDocs ord92 SHBrowseForFolderW ShellExecuteExW ShellExecuteW SHGetFileInfoW ExtractIconW SHGetFolderPathW SHFileOperationW

comctl32

_TrackMouseEvent ImageList_ReplaceIcon ImageList_Remove ImageList_GetImageCount ImageList_GetIcon ord17 ImageList_AddMasked ImageList_Duplicate ImageList_GetImageInfo

uxtheme

GetThemeSysColor GetWindowTheme GetCurrentThemeName GetThemeColor DrawThemeText DrawThemeParentBackground IsAppThemed IsThemeBackgroundPartiallyTransparent GetThemePartSize DrawThemeBackground CloseThemeData OpenThemeData

ole32

OleLockRunning RevokeDragDrop RegisterDragDrop CoLockObjectExternal OleGetClipboard DoDragDrop CoRegisterMessageFilter OleFlushClipboard CoRevokeClassObject StgOpenStorageOnILockBytes CoGetClassObject OleDestroyMenuDescriptor OleCreateMenuDescriptor CreateILockBytesOnHGlobal OleLoadFromStream StgCreateDocfileOnILockBytes CreateStreamOnHGlobal CoDisconnectObject CLSIDFromProgID OleUninitialize OleInitialize CoFreeUnusedLibraries CoCreateGuid OleTranslateAccelerator ReleaseStgMedium OleDuplicateData CoTaskMemAlloc CoTaskMemFree CLSIDFromString PropVariantClear CoInitializeEx CoUninitialize CoInitialize CoCreateInstance WriteClassStm IsAccelerator OleSaveToStream OleIsCurrentClipboard

oleaut32

VarR8FromStr VarDiv VarMul VarI4FromStr VarBstrFromR8 OleCreatePictureIndirect VariantTimeToSystemTime SystemTimeToVariantTime VarBstrFromDate SysFreeString SysAllocString VariantInit VariantClear VarDateFromStr SysStringByteLen SysAllocStringByteLen SysAllocStringLen VariantChangeType OleCreateFontIndirect SysStringLen SafeArrayDestroy VariantCopy VarCyFromStr LoadTypeLi

oledlg

OleUIBusyW

urlmon

URLDownloadToFileW

gdiplus

GdipGetImagePalette GdipGetImagePaletteSize GdipBitmapLockBits GdipGetImagePixelFormat GdipGetImageHeight GdipFree GdipDisposeImage GdipGetImageGraphicsContext GdipDeleteGraphics GdipDrawImageI GdipCloneImage GdipGetImageWidth GdipCreateBitmapFromFile GdipCreateBitmapFromScan0 GdipDrawImageRectI GdipSetInterpolationMode GdipCreateFromHDC GdipCreateBitmapFromHBITMAP GdipCreateBitmapFromStream GdiplusShutdown GdiplusStartup GdipAlloc GdipBitmapUnlockBits

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

oleacc

AccessibleObjectFromWindow CreateStdAccessibleObject LresultFromObject

imm32

ImmGetContext ImmGetOpenStatus ImmReleaseContext

winmm

PlaySoundW

rpcrt4

UuidToStringW UuidCreate RpcStringFreeW

Name

.text

Size

6.7MB

Virtual Size

6.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

144KB

Virtual Size

214KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

310KB

Virtual Size

310KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

112KB

Virtual Size

112KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.giats

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

11.6MB

Virtual Size

11.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_b3c39599d8dc8e8f7869538549a6a80d_icedid_mespinoza_njrat

PE Signature issue

PE Signature issue

shlwapi

msi

advapi32

wininet

wtsapi32

kernel32

user32

gdi32

msimg32

winspool.drv

shell32

comctl32

uxtheme

ole32

oleaut32

oledlg

urlmon

gdiplus

version

oleacc

imm32

winmm

rpcrt4

generic