Behavioral task
behavioral1
Sample
addCube.dll
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
addCube.dll
Resource
win10v2004-20220721-en
General
-
Target
addCube.dll
-
Size
5KB
-
MD5
6f7b94f8618a450e7eb515e510532440
-
SHA1
52d640160a461827635ad9ce6ca972484f213ec8
-
SHA256
394bad1d7ae1007fd9faf8277a9c367d9f50462b524ef89dbbbb8398063315de
-
SHA512
84856a3a4baf462bb55ea4649c134b33e8d9d2f75085fa0ee34907b361e542a2ceaff440f3f68b30652da440cc87272864530597a298f4a00a41f804d60bee7f
-
SSDEEP
24:ev1GSFGFajE/K3tQ3zSaJ2IkM6Pv617s3h/LjpKpuMA6aihIAJw2:qFGFajFK3zSIe7h/TMp1xJw2
Malware Config
Extracted
metasploit
windows/reverse_tcp
172.27.0.13:8080
Signatures
-
Metasploit family
Files
-
addCube.dll.dll windows x86
22647e5b96f2de81d003f25d98d7d2dc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
ExitThread
ResumeThread
CreateProcessA
GetThreadContext
SetThreadContext
VirtualAllocEx
WriteProcessMemory
Sections
.text Size: 512B - Virtual size: 338B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 268B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ