2026-11-07_9968a3e24aa7c137012f2ff52db896d2_glassworm_icedid

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-07_9968a3e24aa7c137012f2ff52db896d2_glassworm_icedid
Size 3.3MB
Sample261107-n2fs2aeg46
SHA256 1bdd462f00c88a545d51d30e2f71a8b178f9d993953faf2c0d24a107a6065b72
MD5 9968a3e24aa7c137012f2ff52db896d2
SHA1 515175d9cddac32148d26227d7c0fd8478a4adc0
SHA512 31790b10b7343f28edb99d41f5147a297f0a9c3384859fea4fd6ad0823e2c39605ddd3911a4a59f3e34a7b4315eb4545e72b95d73a616dc60ddd20988c22a9df
SSDEEP 49152:1CsJKoJg2+1pNnrxiq6Vu4izsviq6uu4VzsrlULCurH:dJuiq6Vu4izsviq6uu4VzsSC6H
TLSH
T1FBF570C1A7AD45D4EE67867C8F7286479733B874492F8F7FD220022E4E2A69E4C50727
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-11-07_9968a3e24aa7c137012f2ff52db896d2_glassworm_icedid

.exe 3.3MB

2026-11-07_9968a3e24aa7c137012f2ff52db896d2_glassworm_icedid

IMPHASH 5e5b8f3b1b122c8ce53306ecdf49b8cb
SHA256 1bdd462f00c88a545d51d30e2f71a8b178f9d993953faf2c0d24a107a6065b72
MD5 9968a3e24aa7c137012f2ff52db896d2
SHA1 515175d9cddac32148d26227d7c0fd8478a4adc0
SHA512 31790b10b7343f28edb99d41f5147a297f0a9c3384859fea4fd6ad0823e2c39605ddd3911a4a59f3e34a7b4315eb4545e72b95d73a616dc60ddd20988c22a9df
SSDEEP 49152:1CsJKoJg2+1pNnrxiq6Vu4izsviq6uu4VzsrlULCurH:dJuiq6Vu4izsviq6uu4VzsSC6H
TLSH
T1FBF570C1A7AD45D4EE67867C8F7286479733B874492F8F7FD220022E4E2A69E4C50727
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

d8:c9:ce:2f:b5:d7:0c:15:56:6f:54:a3:02:ee:e4:32:2b:1e:6c:d3:92:1f:42:f4:25:7b:51:8a:47:58:a4:96

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=HP Inc.,O=HP Inc.,L=Palo Alto,ST=California,C=US

Chains

Nov 30, 2021

CN=HP Inc.,O=HP Inc.,L=Palo Alto,ST=California,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=HP Inc.,O=HP Inc.,L=Palo Alto,ST=California,C=US

Serial Number

02:80:ae:12:d4:c5:28:dc:0a:a1:06:fb:9f:17:aa:37

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 16, 2021 - Apr 21, 2022

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

Major OS version

Entry point

586444

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

f:\jnks\workspace\K13_Prod_Active\build81\SxS\src\x64\Release\ScanToPCActivationApp.pdb

kernel32

VerSetConditionMask GetPrivateProfileStringW GetPrivateProfileStringA WritePrivateProfileStringW WritePrivateProfileStringA GetStringTypeW EncodePointer DecodePointer GetStartupInfoW HeapFree GetSystemTimeAsFileTime GetDateFormatW GetTimeFormatW RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx ExitThread CreateThread HeapAlloc LCMapStringW GetCPInfo TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext HeapSize ExitProcess GetACP GetOEMCP IsValidCodePage FlsGetValue FlsSetValue FlsFree FlsAlloc GetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType HeapSetInformation GetVersion HeapCreate GetTimeZoneInformation GetLocaleInfoW GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale HeapReAlloc GetConsoleCP GetConsoleMode FlushFileBuffers ReadFile WriteConsoleW SetStdHandle CompareStringW SetEnvironmentVariableA WideCharToMultiByte GetEnvironmentVariableW FindClose FindNextFileW FindFirstFileW CreateDirectoryW QueryPerformanceFrequency FreeLibrary GetProcAddress LoadLibraryW SetLastError UnmapViewOfFile ReleaseMutex MapViewOfFile CreateFileMappingW WaitForSingleObject CreateMutexW LocalFree FormatMessageW SearchPathW GetLongPathNameW GetTempFileNameW GetFileAttributesExW OpenProcess QueryPerformanceCounter GetCurrentThreadId OutputDebugStringW CloseHandle WriteFile SetFilePointer Sleep CreateFileW GetTickCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection MultiByteToWideChar GetCurrentProcessId InitializeCriticalSection ExpandEnvironmentStringsW GetModuleFileNameW GetFileSize CancelIo GetOverlappedResult lstrcmpiW RemoveDirectoryW GetFullPathNameW FileTimeToSystemTime GetCommandLineW GetModuleHandleW lstrlenW SetEndOfFile ReleaseSemaphore CreateSemaphoreW GetVersionExW CreateProcessW GetTempPathW GetDiskFreeSpaceExW GetExitCodeThread GetExitCodeProcess TerminateThread CreateEventW OpenEventW ResetEvent SetEvent GetLocalTime GetSystemTime GetFileAttributesW OpenMutexW GetShortPathNameW GetFileSizeEx PeekNamedPipe TryEnterCriticalSection WaitForMultipleObjects CreatePipe GlobalMemoryStatusEx OpenFileMappingW FlushViewOfFile GetSystemDefaultLCID GetSystemDefaultUILanguage GetUserDefaultUILanguage DeleteFileW GetComputerNameExW GetCurrentDirectoryW SetCurrentDirectoryW GetUserDefaultLangID LocalAlloc GlobalAlloc ProcessIdToSessionId GlobalLock GlobalUnlock GlobalFree FindResourceW FindResourceExW LoadResource LockResource SizeofResource GetFileTime DeviceIoControl GetSystemDirectoryW MoveFileExW CopyFileW SetFileAttributesW VerifyVersionInfoW GetComputerNameW GetProcessHeap GetLastError

user32

wsprintfW OpenDesktopW DispatchMessageW TranslateMessage GetKeyState SendMessageCallbackW GetMessageW SetTimer RegisterWindowMessageW CloseDesktop ExitWindowsEx AllowSetForegroundWindow MsgWaitForMultipleObjectsEx DestroyIcon WaitForInputIdle GetAsyncKeyState OpenWindowStationW LoadIconW SystemParametersInfoW GetSystemMetrics MsgWaitForMultipleObjects PeekMessageW CloseWindowStation GetProcessWindowStation SetProcessWindowStation GetThreadDesktop SetThreadDesktop

advapi32

OpenProcessToken CheckTokenMembership GetUserNameW RegOpenKeyExW RegCloseKey RegQueryInfoKeyW RegCreateKeyExW RegQueryValueExW RegDeleteKeyW RegSetValueExW RegDeleteValueW RegEnumValueW CryptDestroyHash CryptGetHashParam CryptHashData CryptCreateHash CryptReleaseContext OpenSCManagerW OpenServiceW CloseServiceHandle QueryServiceStatus StartServiceW ControlService QueryServiceConfigW ChangeServiceConfigW CreateProcessAsUserW AllocateAndInitializeSid FreeSid OpenEventLogW CloseEventLog BackupEventLogW SetSecurityDescriptorDacl InitializeSecurityDescriptor SetEntriesInAclW LookupPrivilegeValueW AdjustTokenPrivileges ConvertStringSecurityDescriptorToSecurityDescriptorW ImpersonateLoggedOnUser DuplicateToken RevertToSelf CryptAcquireContextW RegEnumKeyExW

ole32

CLSIDFromString CoCreateInstance CoInitialize GetHGlobalFromStream PropVariantClear CoSetProxyBlanket CreateStreamOnHGlobal OleUninitialize OleInitialize CoCreateGuid CoInitializeEx CoUninitialize OleRun CLSIDFromProgID CoInitializeSecurity

shlwapi

PathIsDirectoryW PathFindFileNameW PathIsFileSpecW PathFindExtensionW PathRemoveFileSpecW

psapi

GetModuleFileNameExW EnumProcessModules EnumProcesses GetModuleBaseNameW

shell32

CommandLineToArgvW SHGetSpecialFolderPathW ExtractIconW ShellExecuteExW SHGetFolderPathW ShellExecuteW

oleaut32

VariantInit VariantChangeType GetErrorInfo SafeArrayLock SafeArrayCreate SafeArrayRedim SafeArrayUnlock SafeArrayDestroy SafeArrayGetElement SafeArrayGetUBound SysAllocString SysFreeString SafeArrayGetLBound VariantClear SafeArrayUnaccessData SafeArrayAccessData SafeArrayCreateVector DispCallFunc VariantCopy SafeArrayCopy SafeArrayGetVartype SysStringLen SysStringByteLen SysAllocStringByteLen

setupapi

SetupDiEnumDeviceInfo SetupDiEnumDeviceInterfaces SetupDiGetDeviceInterfaceDetailW SetupDiGetDeviceInstallParamsW SetupDiSetDeviceInstallParamsW SetupDiGetDeviceRegistryPropertyW SetupDiOpenDeviceInfoW SetupDiDestroyDeviceInfoList CM_Set_DevNode_Registry_PropertyW CM_Get_DevNode_Registry_PropertyW CM_Get_Device_IDW SetupDiCallClassInstaller CM_Get_DevNode_Status CM_Locate_DevNodeW SetupDiOpenClassRegKey SetupDiCreateDevRegKeyW SetupDiOpenDevRegKey SetupDiCreateDeviceInfoList CM_Disable_DevNode SetupDiBuildDriverInfoList SetupDiDestroyDriverInfoList SetupDiCreateDeviceInfoW SetupDiRemoveDevice SetupDiGetSelectedDriverW SetupDiGetDriverInfoDetailW SetupOpenInfFileW SetupDiGetClassDevsW SetupDiSetClassInstallParamsW CMP_WaitNoPendingInstallEvents SetupCloseInfFile SetupGetLineTextW SetupFindFirstLineW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

secur32

GetUserNameExW

ws2_32

WSADuplicateSocketW freeaddrinfo getaddrinfo WSAGetLastError WSAStartup WSAStringToAddressW WSACleanup WSASocketW setsockopt WSACreateEvent WSAEventSelect WSAConnect WSAEnumNetworkEvents WSAResetEvent shutdown closesocket WSACloseEvent send bind listen accept recv WSAAddressToStringW

crypt32

CertAddEncodedCertificateToStore CertDeleteCertificateFromStore CertCloseStore CryptUnprotectData CertOpenStore

winspool.drv

DocumentPropertiesW OpenPrinterW ClosePrinter AddPrinterW DeletePrinter EnumPrintersW GetPrinterDataExW SetPrinterDataExW AddPrinterDriverW GetPrinterDriverW XcvDataW GetPrinterW DeletePrinterDriverExW GetPrinterDriverDirectoryW EnumPrinterDriversW SetPrinterW SetJobW GetJobW EnumJobsW ord204 ord203 AddMonitorW DeleteMonitorW EnumMonitorsW EnumPortsW StartDocPrinterW StartPagePrinter WritePrinter EndPagePrinter EndDocPrinter FindFirstPrinterChangeNotification FindNextPrinterChangeNotification FindClosePrinterChangeNotification

iphlpapi

GetAdaptersAddresses GetIfEntry GetAdaptersInfo IpReleaseAddress IpRenewAddress AddIPAddress DeleteIPAddress IcmpCreateFile IcmpSendEcho IcmpCloseHandle NotifyAddrChange GetInterfaceInfo

Name

.text

Size

921KB

Virtual Size

920KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

25KB

Virtual Size

65KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

44KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

text

Size

1024B

Virtual Size

798B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE

Name

data

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

45KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

188KB

Virtual Size

187KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-07_9968a3e24aa7c137012f2ff52db896d2_glassworm_icedid

kernel32

user32

advapi32

ole32

shlwapi

psapi

shell32

oleaut32

setupapi

version

secur32

ws2_32

crypt32

winspool.drv

iphlpapi

generic