Skip to content

Instantly share code, notes, and snippets.

@kirk-sayre-work
Created September 27, 2022 23:07
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save kirk-sayre-work/3aa33a776041a6710d0844b6e00856a3 to your computer and use it in GitHub Desktop.
Save kirk-sayre-work/3aa33a776041a6710d0844b6e00856a3 to your computer and use it in GitHub Desktop.
IcedID Word Docs 9/27/2022
Word PE Dropper Samples:
0b1b3f889461485e71868160f46aeb008d8dd68c44b7b2e2f6f2c3e8831aae8b
1630d71da594875c9aa1fd50a955a8adfe02a3bb54d1aa610873cec89ca32911
26f492c47084b37acb68702cafda4256054eb8b07dbed4d215ea7844827efd4d
297216dc24f4d311ab548ded700e850ed72aebcbff60e9a21574f9b651b33273
29764707bbe878fb00cd85bac9323de74328e33f48d34fbf2073c8ef4aded411
31a379b1373f69bea5ca9acdd5a908d787e3f6635ecf48a15f717e3ed7f30adc
38d1be9067da72a234a872f6a3734df25a7e5b147d862d96a83618e58b2a45f7
3e8d73987b1f9063b922aa66eed77d195d350e64fb99f1e3c7c24688ce94a09c
461e1057fcb66e15536d92acf0da35546ecc6d9c0db677b0dfb0bc23fc2bbe88
4de986bc1d553823577929819c03ee508e911384119ebdb1f0d8cb190a7e381e
563eba169c321af25eeefb52a0adaac9fc7006d1e8712ca2e4de6937ecef2e07
5bed7aa2d24f217abcbcef9ba69ea7eac2b58d2bf3921e845934c65efb7fd251
6cf4b6897928f8630040e5cb5db66fc6b979be1d3b8849986db9f0ac5bef1b84
6d8a66cddd81c9d8ab0f017bd38f72e3dd65235989ed207670fdbc9427f45db1
7a584e0486038cb215525eea0dfd5375d196136bcb64f34f9fdfb8ac18eec55b
80388e408f4208e1ddd8cf42d39ec382fe085819c4431013aeb5e609c32bb014
807fb8634a8e1fea7d7927dd6b00a351e51b8533009d76184a930f41ebcbcf49
86905033625f22c13a09dbdf5332c31a1a853ca26a83dc4c5188708a5a035fff
8fe36ce43919ed3d512c9d988fab6051be4e5ca61a1243807522374830f2792c
994afac3be849124810bf5eac058baf805cee4fb17d9f1d74f48d645f456911e
99626203a5826631059ea9a59dbe297771e30edf523f4f636b1374ffdfaf3eb5
9b00c59ed990ef0ec4b2703e1a59c2c246027054dbba766733fe9c27373f2f98
a36f793145c7a775fca887e5ada691ec71137678da479a476bfe70fc1e30e57f
ab820915d00cf32c67fbaa79b4ee3ce7bf9d9d3357bea3a53b54f429e03a3c63
b3ed2de0e147060a7d2cd7def624976d606e7937e7b2e22e805a9961430d4fb6
b63410aee1ea13f6175d41c6e980606cca09a12069f68e49b330d01f3e75a777
b7c2b49bc0c9fc9ce0668e24229d18f21b18b8bf7c78bc45ffb1293e833cc0ce
c219777c4bdd8df4f3190678b777156b2f81f734f55376a627bedcb4b3daf3dc
cb36ff420bbc18158dbfdf3e9068ab775043db2bc61a637ad592a4762ee71b15
cb7b6d4c2ff89c0d673c3026033b840e8f766c11b7af0983cb0267392a01bc2d
cf87fceb65b025e6f9f824496762f234ea3e043b8b4150df251d28cc80aaa1a2
d81386d5d8563af670454122752a89722a901d1aa76fd4a65b8acfe4f4a76874
e0f330fce3d6e226cc531b6b943a3ca33e81ee683f3068d0ae5a8e7553e20df2
e269a681bba217da4d23d53a8cb44c19d502af3a25b37c416e0d5f273caf589e
e2ba042f4194826bed8a8ba388dd26755cb76d5e82811f86e418f377b6fc3791
e3887579686027793f881b42efdc407dc6c928a950e67fdd77ea56e2345b0bb9
ea153aab8f9073d6bc3552d78cb0d0fc57a80cbdb437d9d9ffd6e3629d63b19f
ebc3abd89547ce79d0f33ec18ed216750317fa53cd1aab40fad24f7b19736ebd
ef8d859f7a834d90814b0a4a2b323571b46244ffd5286c4bcafaaf88f787032f
f0fe9a6eb424f7e7c63ff495b7576cfcf29676ae9dc5b8539808f5ffd763be5e
f29e633a2bc1afed5f4dbfb62d82e47754d8f0d31dd247f62febd8810e1fe881
f59f47970092e69c7fe1d8473dd57c3fd946eccd80b67ab1131a0c82c1aa025d
f9938f14df5d7889b1dfd3af2d529ceadf1017aa2f83337dad71ee67379d9a3d
Dropped DLLs:
0338c68a4014bebd5f13ee6658d3045eee4cc08fb72f9878df24ba2a7629684e
0cd14035982a4565d306738f467d6049a244672b42792bdb6d98ce1b0bac8dd5
11d3e096338d429cc4fe77215afa44ad4b5ff60100ef53fa5204ebe12ba7b80f
17a795bf143192d0ed3aeb4c1fa33922bc2085588a67b6fdf58d664550943023
1a99f0a60c95852e830e7b22e0b85f122e9d02168567709b65877807588efa35
277ccb0645d58bd80a640576e7d083b1063f5b01035b374ec8e538ba5353c399
37dcbe10877b0e4fd1b860eca58617620fd09a77cc3a747929444a86f31d6b93
3c808f5d5d5956a7cbae3bb1ee7b6c072f6dd006bb4bdbd8b4db4289dbe37670
410837fc7390ba781a914fa81ccd99ac11b7335b55e96270d43751c9154baedd
496aa0c735bbb1d22463bba633c196d111fea07254f4cbaf20e0d2c4ca4a595e
49e9d0bd273737ef385fc4646b39eea72a95b19f40ff1e2b037ffaa6ccf86aec
49fe14b176055d6f2890182ae7b1a3c5453d9286e72187192d738da947dc1646
4ef50ecd86e1d0de1b4c67247190539c0190906406d0bebee2aa6533208184db
4f427b863ad4070652fbeecb31a1ef13bc4ae2e680a55dd1589915472d912d06
511918c0f99b2190c1b68d88d6da5eeda5de19a56e1d5193de0fcb36aa289038
58a4d3c9fdf25fd876cb9e8202215a79e1a7ad63f85dfcff3001ea41b28a3346
5fe8899f852e865fde929d7c4139e952ea3a04d8d01ce514e72220bf98ffd703
664b86a4cb993275366e2eaf5cb9e96cda5f9d6ff2df94bbb867cad99484ba99
73040a68c98ee2e510cb2a2fb316258d6412a57f35226d90e23cbfbdcfbfe30e
7ce8cbf1a56c54d0b04292dad9d9303b924d13303957e932d6d0d1482d9b261e
83bbc64c1c1911f3f47b5e323e9900cbe304078f240c32b73eef952e3804e1f1
8a0e4c24611f140a1c5497759621b31be32fa382aeef5d10075e0d3741644090
9df7b80c8373fe7479ccf37df1e0fb165fea6826fdcfaac1dd3e20f6c889ffc0
9ea73832d0fddac88a327efdb639423ebccf3f83074c323e0f30c67b9b1a3986
a319b443f7630e48f86bba1429d48b83f1a020a719d5b72f3965c2e99882d3eb
a7d58e715429b2526f9b38efb4bc3a5e70a8a8cb74e7d8f1400a6dd1d61b7707
ae2918b9f9fd9a2d06839aae367d821fab8c6dfd6867e5a28673efe12620c088
b63c2f14b1d1f1cb46cf25f9e0b448556ff72aacdead47def7308d449234bdfc
b6be619091093808fc448ac0a4eebcde46ea800a8b6a4ec34ec1313b3b3502d4
c5517820fdeaf541bfdc93774699a34a06e096a2b4c0f6181652ceebcd65deab
d55dd601c9ef11e4890d7bd946fbead4d6a0e52ea9254e726d6b1f468a61aeac
e27526dec22a8d0206f0876aa61f2863e647b0c2be25830c56ad4eda6a65a8f9
e2f6c01fe32fef3192f6cf85f358aeed843e5f6b2a48bcd8d3ddcf6976488c6e
e784617783714ac268c31d697ba44ae4ec4646d09a1a18bb07afafad0e032274
ea7b4a0b129b0753b93c72448ef6966790901be6b8bc2ef17e7b1716047a5ca1
eb6634eb8949fafe20d9fe2ef144264425871bdb8972183804fafe652725b00a
ec7025920f2cb5d6dd981006f2217520e567a781ea0f95c04c3541d8d4fffa80
f466926ec7581c7ae1a940330be737fadf3001be46838a56507f5d53fd2d1655
f8df233f6eb0bb875a65fef5d3b3c5b3c26fadf76f30e4b30e2405d1ba02c351
f93c2c67f9daa2c1c09cf5a48a04cbfb37777f9aff9f8b7f24871b3f052d7925
f9c11dd211d7903280315c48ca1d6cf15a2fdfe0b91554adc440cba8971458b7
ff22f8e204e940c2ce2652c5be030577782bd90274b1113a8f659d0d18abe5da
ffa3b34b354411b2040aec2815df5ddc9568e3a87aa5519eb18c1726442f9ed0
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment