Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
Behavioral task
behavioral1
Sample
Device/HarddiskVolume5/Program Files/Tally.ERP9/capsules/00031-00068.exe
Resource
win7-20230220-en
Target
00031-00068.cap
Size
3.2MB
MD5
5b90d9bfcf283f41398d639014b2a276
SHA1
83be72ca78162b7e9438c956827354147089f2a6
SHA256
29e73739d0fadc537e56f8657c4b30ee9d1b3966b5ddaac12afb4b18a7acbd87
SHA512
c1a2b0f9a400ddccee5e3529ad77b2f643d29a1eeae076c95ef78488a3bbd2158a74221b4a001f57b04ca2abf2394ff182f71a0836afc12825cd8212c9d61c2f
SSDEEP
98304:jPN4gfTSEzxvTv284GyoBViMY9J13y1qV50:bT9xrO8Tji/1iYA
resource | yara_rule |
---|---|
static1/unpack001/Device/HarddiskVolume5/Program Files/Tally.ERP9/capsules/00031-00068.cap | vmprotect |
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
GetVersionExW
GetACP
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
GetClassNameW
CreateFontW
InternetQueryDataAvailable
ord190
PathIsRootW
NetApiBufferFree
connect
InitCommonControlsEx
CryptGenRandom
WNetGetUniversalNameW
CoInitializeEx
URLDownloadToFileW
CertGetCertificateContextProperty
���Լy�D5�}��x+�ۦX��dfox�Y9$5��ULż���G��8Ϊx��Ja-@@�� uȟ*^��O�� G��<л����a &�&RFJ�n:��q�+�$��wP�z*��i<ۙ�{��� �����$_-�^_�"1H��*��T*���o�ܛ�0M����0��t���c�`��2�X@�Ҿ��T2�����*#�-�3�5�,�V�͢}v�c������� î"z>�iY���k���nzW�6�i:\xe�K,o$T5�'_T�h3�R��I�@�h�*��K}H���yc��P�Φ� wB�3�q<���-W%-�)$�P�]�軰��|2�����$Bhr�Qӳ�t�ާ��B��,�C���!���d~H��es�{9�(���¦$ n��M܄"3&�h�k�/��6 &1��������������h�xF6��uv͗'���nk_�U��W�sg^J�<kG�p,��b�QA�_pm ��C?5�.M�J��?�d[z�gg��$�`!���}%)*�q�c%eD����8ń3�)>����$cA�:8[C:��c�L�{�g����LV$H�������q����o��(�2|��?����V<���6���'����bI��ĵ̗�u�B?͋���aIp?� yS#冂h��� �T�������a�Tx�'K��0} N1���:٭֊���M7�%~�֦���]���:�~Ѡ[��I�VM֎����ǝV���ӣ.�-���m�鬛P_�6��� ��T�Q}G��C:�r|��:y�Mе�!�T4�P������*��B�:�> `�E�"r��K"s�N���.1O��o��:���M՜Ö ,=m=�Tp�6ɟ���],燿6�+Te=(�kF�/=�{��s�<�:ƻL �m��d_=��{T\��BH���.Ϥ�)���a�����qO��_��{V�R���LH��Ӭ J|#�ۏl��� yhi�`���;�z����������l�p��@N%g,��|ia�pU"���ȡ�lZDv;e + =��9�e�Ѱ� 6RS����b�����&�)��A蔷������Y��4����ϷpFQm��S��o��3 kU����X�Q��)�-͖`��m��#T��_+:%[�������w��7�S��Б���M�b�.��8ml�]�Z��L����<��l�`��ueO��� ~�C2��C�1��+��Ղ:�&2K>2�yDQu4���-1��=���M箷)����14m;r~�8P@y�| $M�ͱ� ����w��`xQF�P���چط=Q\�����f�V�C�z�,����ۼȲ"(\?[JRp0��<��%�r���\X��@���4��&�Y�!'A;��R���J��Q*� ��bPKJ�YZR�ODU�t'g�=��EB0�;��w$�NצJI�����R;ME|l�܍b�ft9¡I��c2q��,'�m�^����o�n�1���k��uc|� �wЊӎ����͐�Y�!~�=i4w�a^\�w$��M(�R��n� �kTI�c.���-�U� |��DY��=t�&�D}Z��������cp������ ���+�#�E�M�-�o��(m/�����ft�OK��A�F�`���;�ಂ<I�4!Zd�Q�cR�k�=:�$×58U�q��_�۳��.vR�6|`����^S��~)���ژ^_�� $���z�xbR�_��f�;k�Bs�Y��*Q�#��g}J�h�@?�WDY�v��PJ嘁��^��z���/G������u�@}h����^����2�X��9��2f�6�|�� ,�V]��+�@�+j��S�h��T#/�0OT�v_F�?����g�ݿg9�:�ފ0�%嚗ϗ������L�A��}c8d����ʂh�.�6�� ��=�\��m�>�\�D���:]����3�J���zi^C$�,A�K��!���Zl3��мBU�9�=�גo2#UӁ�������X<9��]��%[4x(��3��?�8� v~�%ߩk��B& �ڌk&�N/�6rX�-DP�zi�G�����zS���Z~z7i'���~x`j8�]A���.W~����Q/���YI��I��`�-��x(��vo��F���������2T�_Z�hP�݇�K���c�����>��g@�r Q��˯�����cO�1��h�]�����*�Vw3��U[�pĮ*k{���'�_Z���$8jk�!_��_������t�>%��!XM�a\A@�Do��}���a�R��F]�ۀb�� �����h,� �*S�F��A�� 8^�y��y 2��F$ϑ�T϶�{P/ ���px�Sɳ28t�6�2Hu�̵�{�U"��/W��^~C��H�0��^�3r7j{G��ω��ˉ����剾���C|�ӾK=3o] 8'=!S���������������]ݥ���VfR$��"F��3F�0K#�������&�xs*Pk��6�~l���ߑ�t�9��]W���z�(VW�p͟bP��ؾ���� �-;@4J� �Y���e�-�}�In++<�x.IVE�[�f �3?M^ vaD����^)W�����b�r_R���ɪ!瘟i����5�X@�62���˰\�����w{�b=g,�-��.���F�a��?��G>�m��&M�T� z7>;l��,�{�uQ�2��|u1� ��N~�J�O��l���)��8"�m�?�h �p ��#">GNĩ8l��־�4��.[P Tg��ܙJ9F6nH�2��e-z�Xawҿ ���ܖ�� �r�vkJ������;���H��]��^�����)?^"^��T�M|�܋���� e�ش����,4��A��75�c���ɭ55�����)z� �w}+[�$P�����?L%]����)�p��M����q5���X���B3lv+���-%���g�b±�TT#�� R����7U݉�r@�PI쵻��H��mzP��5�|��x�־�hX��=�F3�@ �ì���|���l|$�~�K~�;DX�Cwpxp�V���M�rP�%���
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ