dgVoodooCpl.exe
This report is generated from a file or URL submitted to this webservice on February 9th 2020 16:50:59 (UTC)
Guest System: Windows 7 32 bit, Professional, 6.1 (build 7601), Service Pack 1
Report generated by
Falcon Sandbox v8.30 © Hybrid Analysis
Incident Response
Risk Assessment
- Fingerprint
- Reads the active computer name
- Evasive
- Possibly tries to implement anti-virtualization techniques
MITRE ATT&CK™ Techniques Detection
Indicators
Not all malicious and suspicious indicators are displayed. Get your own cloud service or the full version to view all details.
-
Malicious Indicators 3
-
External Systems
-
Sample was identified as malicious by a large number of Antivirus engines
- details
- 15/70 Antivirus vendors marked sample as malicious (21% detection rate)
- source
- External System
- relevance
- 10/10
-
Sample was identified as malicious by at least one Antivirus engine
- details
-
15/70 Antivirus vendors marked sample as malicious (21% detection rate)
5/22 Antivirus vendors marked sample as malicious (22% detection rate) - source
- External System
- relevance
- 8/10
-
Sample was identified as malicious by a large number of Antivirus engines
-
Hiding 1 Malicious Indicators
- All indicators are available only in the private webservice or standalone version
-
Suspicious Indicators 8
-
Anti-Reverse Engineering
-
PE file has unusual entropy sections
- details
- .rsrc with unusual entropies 7.11796850266
- source
- Static Parser
- relevance
- 10/10
-
PE file has unusual entropy sections
-
Environment Awareness
-
Possibly tries to implement anti-virtualization techniques
- details
-
"DosBox' or 'QEmu'.
; EnableGDIHooking: If enabled then dgVoodoo hooks GDI to be able to render graphical contents
; (like movie playback through the ancient Windows Multimedia AVI player library)
; rendered through GDI - experimental feature, for the time being it's implemented
; only for DX emulation
DesktopResolution = %s
DesktopBitDepth = %s
DeframerSize = %s
ImageScaleFactor = %s
DisplayROI = %s
Resampling = %s
FreeMouse = %s
WindowedAttributes = %s
Environment = %s
EnableGDIHooking = %s
;--------------------------------------------------------------------------
[Glide]
; VideoCard: "voodoo_graphics", "voodoo_rush", "voodoo_2", "voodoo_banshee", "other_greater"
; OnboardRAM:" (Indicator: "qemu")
"qemu" (Indicator: "qemu")
"QEmu" (Indicator: "qemu")
"; or can be set to 'DosBox' or 'QEmu'." (Indicator: "qemu") - source
- File/Memory
- relevance
- 4/10
-
Reads the active computer name
- details
- "dgVoodooCpl.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME")
- source
- Registry Access
- relevance
- 5/10
- ATT&CK ID
- T1012 (Show technique in the MITRE ATT&CK™ matrix)
-
Possibly tries to implement anti-virtualization techniques
-
General
-
Contains ability to find and load resources of a specific module
- details
-
FindResourceW@KERNEL32.dll (Show Stream)
LockResource@KERNEL32.dll (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Contains ability to find and load resources of a specific module
-
Network Related
-
Found potential IP address in binary/memory
- details
- "2.63.0.0"
- source
- File/Memory
- relevance
- 3/10
-
Found potential IP address in binary/memory
-
Unusual Characteristics
-
Imports suspicious APIs
- details
-
LoadLibraryW
LoadLibraryA
LockResource
CreateDirectoryW
GetProcAddress
GetFileSizeEx
GetModuleFileNameW
WriteFile
GetModuleHandleW
FindResourceW
CreateFileW
CreateFileA
FindWindowExW - source
- Static Parser
- relevance
- 1/10
-
Reads information about supported languages
- details
- "dgVoodooCpl.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409")
- source
- Registry Access
- relevance
- 3/10
- ATT&CK ID
- T1012 (Show technique in the MITRE ATT&CK™ matrix)
-
Imports suspicious APIs
-
Hiding 1 Suspicious Indicators
- All indicators are available only in the private webservice or standalone version
-
Informative 7
-
General
-
Contains PDB pathways
- details
- "D:\Dev\dgVoodoo_2.6x\Bin\Win32\Release\dgVoodooCpl.pdb"
- source
- File/Memory
- relevance
- 1/10
-
Scanning for window names
- details
- "dgVoodooCpl.exe" searching for class "DGVOODOOCOMM"
- source
- API Call
- relevance
- 10/10
- ATT&CK ID
- T1010 (Show technique in the MITRE ATT&CK™ matrix)
-
Contains PDB pathways
-
Installation/Persistance
-
Connects to LPC ports
- details
- "dgVoodooCpl.exe" connecting to "\ThemeApiPort"
- source
- API Call
- relevance
- 1/10
-
Dropped files
- details
- "dgVoodoo.conf" has type "ASCII text with CRLF line terminators"
- source
- Binary File
- relevance
- 3/10
-
Touches files in the Windows directory
- details
-
"dgVoodooCpl.exe" touched file "%WINDIR%\System32\en-US\user32.dll.mui"
"dgVoodooCpl.exe" touched file "%WINDIR%\Globalization\Sorting\SortDefault.nls"
"dgVoodooCpl.exe" touched file "%WINDIR%\Fonts\StaticCache.dat"
"dgVoodooCpl.exe" touched file "%WINDIR%\System32\en-US\msctf.dll.mui" - source
- API Call
- relevance
- 7/10
-
Connects to LPC ports
-
Network Related
-
Found potential URL in binary/memory
- details
-
Pattern match: "http://schemas.microsoft.com/SMI/2005/WindowsSettings"
Pattern match: "http://www.benshoof.org/blog/minicrt"
Pattern match: "https://github.com/GPUOpen-Tools/common-src-ShaderUtils/tree/master/DX10"
Pattern match: "benshoof.org/blog/minicrt" - source
- File/Memory
- relevance
- 10/10
-
Found potential URL in binary/memory
-
System Security
-
Opens the Kernel Security Device Driver (KsecDD) of Windows
- details
- "dgVoodooCpl.exe" opened "\Device\KsecDD"
- source
- API Call
- relevance
- 10/10
- ATT&CK ID
- T1215 (Show technique in the MITRE ATT&CK™ matrix)
-
Opens the Kernel Security Device Driver (KsecDD) of Windows
File Details
dgVoodooCpl.exe
- Filename
- dgVoodooCpl.exe
- Size
- 344KiB (352256 bytes)
- Type
- peexe executable
- Description
- PE32 executable (GUI) Intel 80386, for MS Windows
- Architecture
- WINDOWS
- SHA256
- b8d28c0d5a37789ce9610fd96a1062a19ce28002d612dec9b425728ccbac2c50
- MD5
- ef35a50542687221e7f08756015abb1e
- SHA1
- fdd72088e4bb8a8311a440033daf3bca457e0f21
- ssdeep
-
6144:hd4lWZLeCt5Fz3wwKQ/PdLTT6/xsoTtX:hdJeCVwwKk
- imphash
-
125efe8469a81fecbe11643e609e549d
- authentihash
-
ca397bd433d73c3e056c9b969cc73ef46889e4b946510fb76ce0e0b0700c45b5
- PDB Timestamp
- 12/24/2019 17:29:22 (UTC)
- PDB Pathway
- D:\Dev\dgVoodoo_2.6x\Bin\Win32\Release\dgVoodooCpl.pdb
- PDB GUID
- 186092D0AF584F79A00FCDF92BFB263F
Version Info
- LegalCopyright
- Copyright (C) 2013-2020
- InternalName
- dgVoodooCpl.rc
- FileVersion
- 2.63.0.0
- CompanyName
- Dege's stuff
- ProductName
- dgVoodoo
- ProductVersion
- 2.63.0.0
- FileDescription
- dgVoodoo 2.63 Control Panel
- OriginalFilename
- dgVoodooCpl.exe
- Translation
- 0x0409 0x04b0
Classification (TrID)
- 72.3% (.EXE) Win64 Executable (generic)
- 11.8% (.EXE) Win32 Executable (generic)
- 5.3% (.EXE) OS/2 Executable (generic)
- 5.2% (.EXE) Generic Win/DOS Executable
- 5.2% (.EXE) DOS Executable Generic
File Metadata
- 1 .OBJ Files (COFF) linked with LINK.EXE 5.10 (Visual Studio 5) (build: 27034)
- 1 Unknown Resource Files (build: 0)
- 30 .BAS Files compiled with C2.EXE 5.0 (Visual Basic 6) (build: 27034)
- 2 .OBJ Files (OMF) linked with LINK.EXE 5.10 (Visual Studio 5) (build: 27034)
- 8 .OBJ Files (OMF) linked with LINK.EXE 6.00 (Visual Studio 6) (build: 27034)
- 1 .OBJ Files (COFF) linked with LINK.EXE 6.00 (Visual Studio 6) (build: 27034)
- 1 .ASM Files assembled with MASM 7.10 (Visual Studio .NET 2002) (build: 3077)
- 1 .OBJ Files (COFF) linked with LINK.EXE 6.00 (Visual Studio 6) (build: 25711)
- File contains Visual Basic code
- File appears to contain raw COFF/OMF content
- File is the product of a medium codebase (30 files)
File Sections
| Details | ||||||
|---|---|---|---|---|---|---|
File Resources
| Details | ||||
|---|---|---|---|---|
File Imports
Screenshots
Loading content, please wait...
Hybrid Analysis
Tip: Click an analysed process below to view more details.
Analysed 1 process in total.
-
dgVoodooCpl.exe
(PID: 3748)
19/82
Network Analysis
DNS Requests
No relevant DNS requests were made.
Contacted Hosts
No relevant hosts were contacted.
HTTP Traffic
No relevant HTTP requests were made.
Extracted Strings
Extracted Files
-
Informative 1
-
-
dgVoodoo.conf
- Size
- 15KiB (15546 bytes)
- Type
- text
- Description
- ASCII text, with CRLF line terminators
- Runtime Process
- dgVoodooCpl.exe (PID: 3748)
- MD5
-
98a9dcd3a350d68b9130bdc4a51bc43c
- SHA1
-
6736b98f5fd54c3a93ca86c76815beb8c78f4169
- SHA256
-
615503b9ff097e35b3c5035adf5c519d57111d5ed250057ae04d9a1a11c7a367
-