�X������B��,��v�|����j����ܼ�P����Q�-Ĉ�Ɋ8E7q��+���2�d��:��m���:U�x�LT||�%�<���c�wN~��~�QN=�.* ʡ�H��,'�]\��rĢ��/�����bC�#E�s���}�t����H��O���w���,݀0o.+f��� ��9 �~�r#����ÿ��f����9����� PՃ��n~�N5���+-Ú�·f(OpQ,�f�7̈́k�o[��(ڋ� M���\68�R�sƒJ��L��J�u@ԟT��6y����{���Wsh�Q�wں���4��+�S(��P V@:��� Z��R�U��aAۋJ���T�� ?f5��83iU�������k���ӱ�K��2����B2���a���������Yz�)>0=d���f�/6�П�$�é�cH[LE}@�t'KY�:��9y�j�2ƌh;��H�qY��Uq��I���m,�7Т̲}��L����D�^�+��V�+A�@��+?˴�Eqp(g�̨.7yؽ�1�2YR�ܝu?w��f�|���=��qu�S}�z[���u5$4�B#��L�����%�5�ςm��j� �;|���!F2C�����Ú �c*un�<'���zP,�Hg��ž}]�C���9���F�Б|�v�\�TJ`�{mc��������3��,ix��{|�&� �,�9�jT��O&�_9!�'�" �h,]�X�'7�,�^��W�szj��� ,-dС�d`��� ��WiW�}�'zw�RB���>��J�I��a����'%�BJLC�����(H���&8��������b窮�x �J �^3'6�N���n��RJ5�/��`X~ַ@� ��c��5+��D}���� �b��ɣ�u�G��Ql%yJ_5~V#~;Ǎ`�nlCͺ�Q(�qV�j�n��7V<&��Nơ�ަ��!�}�O�7a|�:a�T�H]a�� �^pY�B�]4d�����l���E�� ���P`�уZ���a�"l�Bٸ�H�6Ԛ��|&�SP�p�J��������-��n��Ϙ� �q�K'ͭ����=�Y��t�]�m��y5j�� � U[��� � �����;�Gq#@'������q���?]�G Q*��mr�-����|cCS�>����8 6c�a�#R���E?�uV��^z�4y;�-���f�.κ�F�2��#|y���@~����p�d�Z��>7o O ӊ�G��W���L�G�zI�bU��C��7����-�g��)ͯ��4=�\��0C�p.d��7�������&X_�8`nj��hl�9}�35V�ލiq�Xtb��v�T)��zQK�6��^����!��� ��\j��&&��^&ɁH�k��1U�ؐ@���!�p`�� �>3�g>����0��yy!�*�8J͏I�U~U�V���+����/^��Ɋ�59�I����Я�v���]�!]Ed<C�����u��l�:[���������(�^i��NE ��=Oqe��F�A�����3 �ϥ4�o�G��E٬B%ݖ>b��qq�f��'[uW�jܢAl��m�H��Z����6�^"���cE}�Usp��1��� �%j�]��H���� m��>O�s���p���nY����{�恵S)����(�0�k���� !d�F�����#�4�^ܴ���O��A`l�kz�"�Y���E}�_^ⶆ(���{�.Ύ�.4a�ܪ��d?��;OJ�Q�`z�"�F<�r��73�7�i���Sy�LVn!�I�=z) \UhIK��"����x?uo���q�⡁��Tb!yn��t�[����-F� �#%�������Ȃ��t6��$�u�vu�Xj�Qł`"�=z܈��ۓ�6�h'���0�0~���h��g��=3���rr�$,���~eP�C����|�Ȅ�[���FG��-�Y���7<���Uni~V���$�����f�F�$?t+X��̾� ������$x����{�L(8,�0��3��K��̜x'O-]�gB�Y�k9�������FbFv-���R/���� �-�kRi�-�Т��@q��ˆ�'�dPl">���|#�%E���Ś2�[��s�P���l��ᠪɑ��������#�{�u6\g���Sѓh0Y�m��:��|>o�1���K�B�N�~'p�"��A� g��0��H l�<l6�u��A�� bŸVd�����H�b$�ۓQ�*y�x��tY�;lS������4�������b���i� ��34N>p��Ѩ�X�� ��`� �pۈW�ԥ� D����d`;m��`��@�gR�FAϓ���d��۩E��ZM�/���p�q�5, ?� �p����qI�h�,����Q��By����D���B˟0�Y��@g�4_+e�Y����xy�O-cq� k>��k�����5� y�H��Л��'^+�&)Yi&pm��:����dKV���i^����z�zv���*jDY��Y꾚c�>�n���o�S�E>�e��Y�,�HAWM�g�=�|Zq�LO{}w�*=-r�8`�=+H�O���g#]�G��h�[٭�S�D&��G�����5�xu�������̄LS����ڪ7J�t�?�#.�Z��M��}i��e��~iMF��`�e´���;O�Tek˃�?� 'E�V-1� �<�#���\�NJI�/���;h]峽�d�3���%��oϐ��l�5��H@zP��7n�g�et�G�U����h�-%��� ����k�Q��i0'�Z�*���z�أu�"����_"=��o�-r؇x��֪֟�,5�X�w�'YM��C�_6j��z��־�M��� �$ɫ����mJ%��%&��Yep���0���ڛ����&�r��A�f�&��� �2��*C�3�����}T�s��U¢Ԫ����$�[���h�؞S2��֨i�\���Eᾌ����������*�naJ&T�G��(�N��·@lSi�C������^a�]!��i�2���{�[2��a�'݇�]��Ƒ����ӧH�;��
Static task
static1
Behavioral task
behavioral1
Sample
Device/HarddiskVolume2/Program Files/TallyPrime/Setup.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
Device/HarddiskVolume2/Program Files/TallyPrime/Setup.exe
Resource
win10v2004-20230703-en
General
-
Target
Setup.exe
-
Size
2.7MB
-
MD5
71959e252714e4d50017d854e434f275
-
SHA1
caeb6301cb69eefcb7c39b9540fad311338a2213
-
SHA256
61264adc7d8cee467d848d85e297ab24a24be816bb07f9dd71d830b1b0014ed1
-
SHA512
58c7f05974db12e59a1318422bcf64e462c09c37cd7dce0efcdd03159d210c525bdddccc56020ce2c857b8593b21137f3668f8583bfa7eea705f0a1268d7b69d
-
SSDEEP
49152:JZ+ldrqlk1yeBmvUJZqIlqKZeqJGoYwbjrHCDedfpmfHxRpDSsVM2:JZ+ya1bMvUJZAOHbjTCNf9/M2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Device/HarddiskVolume2/Program Files/TallyPrime/Setup.exe
Files
-
Setup.exe.zip
Password: S@ndb0x!2023@@
-
Device/HarddiskVolume2/Program Files/TallyPrime/Setup.exe.exe windows x86
Password: S@ndb0x!2023@@
e15331975e4fb5e7e8b572d067112b62
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExW
DeleteCriticalSection
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetDesktopWindow
gdi32
LineTo
ws2_32
WSACleanup
comctl32
ord17
advapi32
RegEnumKeyExW
shell32
SHGetMalloc
shlwapi
PathAddBackslashW
ole32
CoTaskMemFree
iphlpapi
GetTcpTable
netapi32
NetShareEnum
wininet
InternetReadFile
mpr
WNetGetUniversalNameW
oleaut32
VariantChangeType
crypt32
CertGetCertificateContextProperty
Exports
Exports
Sections
.text Size: - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 606KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 734KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: - Virtual size: 324B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 340B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
manifest.json