TallyAdmin[.]exe

General

Target

TallyAdmin.exe
Size

610KB
MD5

6efc79707755bbe05afc8fcfae08cd1f
SHA1

5b8e051bf28a584d953b19add35ef31f00be1275
SHA256

28e54d220c99f08ab2fb0568746c8b200914c225eae07ceb25c7b5d581b7baef
SHA512

55cd1f7e4fbed5e71450b85591669ad0d868d89fbd92f0b30631e2226e0b733440a316711940c2b5951342064477e4dfd5e23269e9a2f53d051f44bc9690a6d8
SSDEEP

12288:vynF9iq9Twgbi+00B/MhZjSvKMIHtJxRg6tDC+kj8G2d8bncy+8iT6juPmp68/ja:v5q9LBB02yMI7xRttO+k/2Qncy+8iT6c

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Device/HarddiskVolume3/Application Server Data Backup_10.200_05.03.2024/D drive/Tally.ERP9/TallyAdmin.exe

Files

TallyAdmin.exe
.zip

Password: India@2023@@
Device/HarddiskVolume3/Application Server Data Backup_10.200_05.03.2024/D drive/Tally.ERP9/TallyAdmin.exe
.exe windows:4 windows x86 arch:x86

Password: India@2023@@

f433e7fcc51e68080022754836705744

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
LoadLibraryA
GetProcAddress
ExitProcess
VirtualAlloc
VirtualFree

user32

MessageBoxA

Sections

.text
Size: - Virtual size: 908KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: - Virtual size: 228KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: - Virtual size: 344KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 60KB - Virtual size: 264KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

nl4qcq2r
Size: - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

wiiewhmc
Size: - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

ddqwpqtx
Size: 606KB - Virtual size: 608KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

1k.pos89
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
manifest.json

Sharing

General

Malware Config

Signatures

Files

Password: India@2023@@

Password: India@2023@@

f433e7fcc51e68080022754836705744

Headers

File Characteristics

Imports

kernel32

user32

Sections

.text Size: - Virtual size: 908KB

.rdata Size: - Virtual size: 228KB

.data Size: - Virtual size: 344KB

.rsrc Size: 60KB - Virtual size: 264KB

nl4qcq2r Size: - Virtual size: 76KB

wiiewhmc Size: - Virtual size: 8KB

ddqwpqtx Size: 606KB - Virtual size: 608KB

1k.pos89 Size: 4KB - Virtual size: 4KB

.text
Size: - Virtual size: 908KB

.rdata
Size: - Virtual size: 228KB

.data
Size: - Virtual size: 344KB

.rsrc
Size: 60KB - Virtual size: 264KB

nl4qcq2r
Size: - Virtual size: 76KB

wiiewhmc
Size: - Virtual size: 8KB

ddqwpqtx
Size: 606KB - Virtual size: 608KB

1k.pos89
Size: 4KB - Virtual size: 4KB