igucc.exe

First submission 2023-09-11 16:51:04

File details

File type: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Mime type: application/x-dosexec
File size: 593.44 KB (607684 bytes)
Compile time: 2021-07-25 00:19:26
MD5: 35951704bf97c135fec65cca9bc2e1c1
SHA1: f5232f30da3a3c5df4a6d15aea178059fb14cd89
SHA256: 932a29dcd8b778f2e7c509b3ef9d732632edc266596bea3ed351803dc08cd5af
Import Hash : c05041e01f84e1ccca9c4451f3b6a383
Sections 5 .text .rdata .data .ndata .rsrc
Directories 2 import resource
Virus Total: 21/71 VT report date: 2023-09-11 14:44:30

File features detected

Is DLL

Packers

Anti Debug

Anti VM

Signed

XOR

URLs, FQDN and IP indicators 1

URL Host (FQDN/IP) Date Added
hXXp://192.3.172.208/250/igucc.exe VirusTotal Report 192.3.172.208 VirusTotal Report 2023-09-11 16:51:04

PE Sections 1 suspicious

Name VAddress VSize Size SHA1 MD5 Suspicious
.text 0x1000 0x6572 26112 3442c1bb49ba3c7bfc46618255cc471a7e3e3bb7 869e1d11bbf88d92521c022fa6f3d4f0
.rdata 0x8000 0x1398 5120 fe2bedee8c2ca0b3a39a9a62d201d08eee8b3f17 79e286249499b713a2ddbee33baa50da
.data 0xa000 0x20378 1536 ac77cc46ab8d1809c15541e5c084c069a6bf8107 b6d02c867f7bfbcf68de2cfeea94fd73
.ndata 0x2b000 0x29000 0 da39a3ee5e6b4b0d3255bfef95601890afd80709 d41d8cd98f00b204e9800998ecf8427e
.rsrc 0x54000 0x42ae0 273408 1989ef69e9286d9313934e6f3ce770da782ffa62 4552585fa16081711de84c7a39360cc7

PE Resources 5

Name Language Sublanguage Offset Size Data
RT_ICON LANG_ENGLISH SUBLANG_ENGLISH_US 0x54208 270376
RT_DIALOG LANG_ENGLISH SUBLANG_ENGLISH_US 0x96518 96
RT_GROUP_ICON LANG_ENGLISH SUBLANG_ENGLISH_US 0x96578 20
RT_VERSION LANG_ENGLISH SUBLANG_ENGLISH_US 0x96590 528
RT_MANIFEST LANG_ENGLISH SUBLANG_ENGLISH_US 0x967a0 830

Meta infos 6

LegalCopyright: saamaskinen
FileVersion: 3.0.0.0
FileDescription: shadow unvaporous
Translation: 0x0409 0x04b0
ProductName: armekorpss victual
ProductVersion: 3.0.0.0

Anti debug functions 2

FindWindowExW
GetLastError

Strings analysis - File found

Library
%s%s.dll
ADVAPI32.dll
SHELL32.dll
USER32.dll
ole32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll

Strings analysis - Possible URLs found 1

http://nsis.sf.net/NSIS_Error

Import functions

Name Latest seen MD5
igucc.exe 2023-09-11 11:12:04 633674661a6ccfe8a4507da0611a5496