�P���i�W ���0�]�����jCTy�WBr?Xg9���#������n�8ꑾV �$U�ݲ��h��T�������o�M�)L���� Cn#��z��k��n ��ca�r�U�A)�O3��8�:�����6(E��6ݑ� �����/A{� ��Z�8��Rgd�+1m������܍D �"���-����.�,ygW�:��w��"(h��<@�Cq����1����[4��ߗ���[O��_�F}~�|��̆M��6�,tuu�P�~i 5���0��m;���hNce�����Xpd��|d2��s�X6k�(:�T���ѓ��`O����{+��^Tf�n�t�y�C����l\�0*r슢��$���>o���9]Cu���ɽb����f�`���Q�f�A �\�m��S7E��������p��.����M�G3��3��E=3ӽ��9�M�A���pt��Bp?�m$fU��7�I)�B�'O�2��OT�5���F2-,�A���Ls��@ݩO�;8D_ ��� �W}eA�k��lr_?J&7��7�9�1�o\NΰT[Jc�|�YK|�s8ȯ�# Q��uD��"BS_ү�Ӫ=��MV1�eF���#�Sz�b�j�i����ǂ�Nn#M�h+�Z�&Y�t���m���v�:މ�Z6���s%3��o���%�,�+�:�Gn�<�����O"��i�]Ww?zIS���7L�CHd�ʓ�y��ϳtň�G����|������Х%���0*�a�Пk�_u�Ǘ����X��+i����;�@���coӈ\����r��t�K�e�)=����8?��LNj���К��`L�I]gT����S�guI�y��]OZ�?ʾӵC�� ]��f��M���?#W^�/�NC7�w�C8�V;W���t�ŕS]�)��39�Gd�O�2��z�%�� ����Xn-��'�XYH��eN\�D9��ipY*˰������.&��!�#����\Q''n���'TV+�o�8Siq\K�/_뽰��.'�������%��}����YԭX�`g����ߡ���T�T[#1���R�wzwq�z|�loH��*n�汸����r��E.��*o8��)�\_���jg�l�h�q<�b��y+����Ͻ��n�ȿ��X���������?��"���^�wKb �Ǵ'���a��쑅�ј>��g X��PJ���TSC����HT���y���%x*� )�Y���@)�%��7[��4�/�ʷ�ZK�f�~Dž3S�=�T#u���Dža��p��tc���@6Fj} �ձI��Y��G�|E��xӬ~B����l?4��`��b���-�w�X5|�����ũZ��6�o��BhpN�y� �Vǚ�ܣ,��W��F�����(Ѝ�������iʰw\)��z'����A���ڶq&?Ԕ�����G�����D��CGP+$����}/Oz�b�aYS���Y�~���ǂ`�6� =�>���{�\��a7\��iT�-k"�y��F�f�q�u�t���%^'����ɨ���P�����Ӑ��?N@��{T�l�A�wN��N�r���i�W{����8P���(F.��Q�+� ���j`�K"ї� ��ݸF��n� *؋h��g��\����n�s�'��^Ie��@�ZB��iD�[��L_�i]S,��i�М&�7K��J��{Zz�C�t�i�V)��V<jl���(u)wq�z Z��8��F(-�SV� m�(|4R���Н��uqDCM�NM��i�k�Ҡ�~��WK���)��J P/�=�qz��8{�%�<T�:��N����o9 �95'y�����1Q��wr-S��r�����=Z�]�40�Oh,>B&����-�X+Ž�B�w<k�SI�N)p���i��*?�$g�v�SNX���7f��n�c���F�j��Zn�_X#�����&��|rt �LW��%���<��L�b,���7*o�����V�d�8�&P���`��_.���ߥ�M���d��;�V�%�k� �m�Z5�O��M&��Z�3|{��H_����?�����r�� ��(?� M��9��!��n䡫�� K�zA>�h��T������e!!r'���(W��� �FSw��ݙ�q�X���f�����ޚ�R\Ϡm7���dJGSzւQ �ޣ6ž>��B�>�����%E� �OD��8�<��{4�HY���k�)�!���U��e��1~U=���J&<p�ĖON1J���Wz.6���|������F�U'�e�ঝ`�l�a�3<����6�"�,����F���yv���{����1�d�0� Iz]��eس��b�mV#��\@�s�,��7�04|Q4��v���J��ų{pա�S���@���|�C�ii\~���pْ�ShW�w�nW��2d�}��C{A\�&E[�Z�]�/��~&���|)��N1~���eiɉ���-Ȫc?m���/�����^��T`[�P.\��,��>��K����N����~Ҽ���(����ʃ�c��S*^9��v�Q�d����u�!u&ƥ�q��M�x2��C�L�>��z#�I���yN�^�����\'[:�֚y�˂;'A�^r�p�����Ġ^��nI\���VL`jk�(\B����#iկ��G1�vb��WG[� B����P�%vt���+�vM�i���ͫlPU���� ���2$R/����v1��}�OO�id6��+Feܖ����*��]��Hg|���A˞��Y��X��$�?��fW9�>�%�95c�յQzXF?E��z��5�A������ld�/qU���?��٦�`? ׳���R�J�-lS����t@(��Ԙ�f�q~�[��@2����6;}���6*�������7g��8��T���y�P6S� dX���h���"}��!�d��:-��V�5��?~�sWDZ�����xi��P�����\�������8�I�����5�ʤ���p½P��y�ի ���x<�1�� �zը3R�u�A��D�m?�}�^��f9��FF
Static task
static1
Behavioral task
behavioral1
Sample
Device/HarddiskVolume2/Program Files/TallyPrime/capsules/00031-22747.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Device/HarddiskVolume2/Program Files/TallyPrime/capsules/00031-22747.exe
Resource
win10v2004-20230220-en
General
-
Target
00031-22747.cap
-
Size
2.7MB
-
MD5
46cb10fd012f9fa4ef43d2d7de2e1ecd
-
SHA1
98d3be7499123d42dd108b28f6414f667ae92888
-
SHA256
71b4625b8e82d06f5f35cd3c9e06b69f4e21dfa34d2ce26a7253b68f0e0f215a
-
SHA512
48a7b4e96769b1476939b2b1efebb84450aba91ef44a7aeeec6c873cec698d29f096e6243828d684dc2b4e94d8d1141a0682080163e70869a8eb57f36059bf35
-
SSDEEP
49152:4EWDedK5wyVhk5t54DOdCXuU2KPqMidEwxZ3+dIj+APhbwkMPld/hFskiq:SedK5Wt5IMPU2Kd6hfCAPhbjMPlZskiq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Device/HarddiskVolume2/Program Files/TallyPrime/capsules/00031-22747.cap
Files
-
00031-22747.cap.zip
Password: S@ndb0x!2023@@
-
Device/HarddiskVolume2/Program Files/TallyPrime/capsules/00031-22747.cap.exe windows x86
Password: S@ndb0x!2023@@
bca096f390de24ff8d0815b503bc28d7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExW
QueryPerformanceCounter
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MoveWindow
gdi32
CreateFontW
ws2_32
htonl
comctl32
ord17
advapi32
CryptCreateHash
shell32
ord155
shlwapi
PathCombineW
ole32
CoInitialize
iphlpapi
GetTcpTable
netapi32
NetShareEnum
wininet
FtpOpenFileW
mpr
WNetGetUniversalNameW
oleaut32
VariantChangeType
crypt32
CertOpenStore
Exports
Exports
Sections
.text Size: - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 610KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 735KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: - Virtual size: 324B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 292B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
manifest.json