dedosa[.]exe | Triage

Sharing

General

Target

dedosa.exe
Size

4.0MB
MD5

7ccddebf57e3478bcc00d8c6e6685885
SHA1

20c81b6d3559c3f87e7c65f46c14e790a6c195d9
SHA256

c008dae28d28d9b7601321ca95b5785c346681b7b202ef8d1b43e43197baf1b7
SHA512

85e6599aaab3096cc59ae5a6a34af49aa7b65e63b1a54a31fb9d91e2b705778eada6bd425c2004177969f93475e0e8829b42608d884ebf2d0d9c5f6791920359
SSDEEP

49152:Zcj90+YujiaW+XPoRR//yXWX3BEVAwplM0lzn5rmptVqUMgOrxPi6VdCu5+ZNTT3:ZcjbYuGJso/Bw/Pn5r6LqRhBC9Bx

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
upx

Processes:

resource yara_rule

sample upx

Files

dedosa.exe
.exe windows x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Sections

UPX0
Size: - Virtual size: 9.8MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 4.0MB - Virtual size: 4.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE