Report - dege.fw.hu/dgVoodoo2/bin/dgVoodoo2_41.zip

Report Overview

Submitted URL
dege.fw.hu/dgVoodoo2/bin/dgVoodoo2_41.zip
IP
157.90.171.43
ASN
#24940 Hetzner Online GmbH
Submitted
2024-05-05 08:52:08
Access
public
Website Title
about:privatebrowsing
Final URL
about:privatebrowsing
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
15

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
dege.fw.hu	unknown	2000-08-29	2013-01-28	2019-06-07	495 B	487 kB	157.90.171.43

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
dege.fw.hu/dgVoodoo2/bin/dgVoodoo2_41.zip
IP
157.90.171.43
ASN
#24940 Hetzner Online GmbH

File type
Zip archive data, at least v2.0 to extract, compression method=store
Size
487 kB (486785 bytes)
Hash
fd8c6876b36d5cb2235f0dfbd35db2d7
2363eafc1218a6a9b178e92e683f5ba92013778e
717553a4e4e1220c957df8bdeb2bf9a6c0cc407bfad6da5ae3324ff45cdd075e

Archive (10)

Filename

Md5

File type

Glide.dll

580a92ddb0233f915671c53b270d251d

PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 3 sections

Glide2x.dll

89f48aa8480a3c395055638a6baee3ef

PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 3 sections

Glide3x.dll

e482b2b939a47c861fb53f6ce92ec09a

PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 3 sections

D3DImm.dll

c55e2b434fbd47f164581fd72e9d2e51

PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 3 sections

DDraw.dll

5ef50b35bc80ee70703c2e0a436bb76a

PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 3 sections

Glide3x.dll

285b8769f9e70d5f629261a8ad8014aa

PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 3 sections

dgVoodooSetup.exe

3ef866614c44ddd4b804abeac042a918

PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 3 sections

Readme.txt

0804cec899022944d56a8beb7d45fa17

ASCII text, with CRLF line terminators

ReadmeDirectX.txt

816b3463e411a18830150ddfc5f333a9

ASCII text, with CRLF line terminators

ReadmeGlide.txt

6cf7b14e145fe16ef4f9ce1105cb61ba

ASCII text, with CRLF line terminators

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	meth_get_eip
YARAhub by abuse.ch	malware	meth_get_eip
YARAhub by abuse.ch	malware	meth_get_eip
YARAhub by abuse.ch	malware	meth_get_eip
YARAhub by abuse.ch	malware	meth_get_eip
YARAhub by abuse.ch	malware	meth_get_eip
YARAhub by abuse.ch	malware	meth_get_eip
VirusTotal	malicious	VirusTotal - Scan result 15/61

JavaScript (0)

HTTP Transactions (1)

URL IP Response Size

dege.fw.hu/dgVoodoo2/bin/dgVoodoo2_41.zip

157.90.171.43

200 OK

487 kB

URL User Request GET HTTP/1.1
dege.fw.hu/dgVoodoo2/bin/dgVoodoo2_41.zip
IP
157.90.171.43:443
ASN
#24940 Hetzner Online GmbH

Certificate
IssuerLet's Encrypt
Subjectdege.freeweb.hu
Fingerprint84:FD:EA:30:25:AA:78:BE:5F:28:58:10:71:85:BE:7B:0B:A9:69:9F
ValidityThu, 21 Mar 2024 08:32:04 GMT - Wed, 19 Jun 2024 08:32:03 GMT

File type
Zip archive data, at least v2.0 to extract, compression method=store
Size
487 kB (486785 bytes)
Hash
fd8c6876b36d5cb2235f0dfbd35db2d7
2363eafc1218a6a9b178e92e683f5ba92013778e
717553a4e4e1220c957df8bdeb2bf9a6c0cc407bfad6da5ae3324ff45cdd075e

Detections

Analyzer	Verdict	Alert
VirusTotal	malicious	VirusTotal - Scan result 15/61

HTTP Headers

GET /dgVoodoo2/bin/dgVoodoo2_41.zip HTTP/1.1
Host: dege.fw.hu
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sun, 05 May 2024 08:42:00 GMT
Server: Apache
Last-Modified: Sat, 26 Dec 2020 18:46:44 GMT
ETag: "76d81-5b76276657885"
Accept-Ranges: bytes
Content-Length: 486785
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/zip