TallyAdmin[.]exe

General

Target

TallyAdmin.exe
Size

611KB
MD5

58a88005e94b67c988112e841cf64c53
SHA1

a5de1d08e0feca7642c50921226373235e30554f
SHA256

343c2f17650264dabc1b35b2ce584f5584e8b6750f1e2f86656fa84a975791e1
SHA512

cca2ec12c7711daa24adf3fe0e78da675e550695a703ff8ad6866c9cc2c50adb96a75e4029920a43be4652a94acebd54adad12fbae4c846d05deefc35812c309
SSDEEP

12288:G4Zu/FiB8X09ttGUG5RAFRxvVWyiG4UylIlvVsFfmbe6wD5ACw67hldcjbb28dI8:fZK6I+nrhxoyiGHrq+e6wD5c8Xwbb28f

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Device/HarddiskVolume3/Application Server Data Backup_10.200_05.03.2024/E drive/Accounts/Accounts/Old Files/print/Radeep/Tally.ERP9/TallyAdmin.exe

Files

TallyAdmin.exe
.zip

Password: India@2023@@
Device/HarddiskVolume3/Application Server Data Backup_10.200_05.03.2024/E drive/Accounts/Accounts/Old Files/print/Radeep/Tally.ERP9/TallyAdmin.exe
.exe windows:4 windows x86 arch:x86

Password: India@2023@@

f433e7fcc51e68080022754836705744

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
LoadLibraryA
GetProcAddress
ExitProcess
VirtualAlloc
VirtualFree

user32

MessageBoxA

Sections

.text
Size: - Virtual size: 908KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: - Virtual size: 228KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: - Virtual size: 344KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 60KB - Virtual size: 264KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

nl4qcq2r
Size: - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

wiiewhmc
Size: - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

ddqwpqtx
Size: 606KB - Virtual size: 608KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

1k.pos89
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
manifest.json

Sharing

General

Malware Config

Signatures

Files

Password: India@2023@@

Password: India@2023@@

f433e7fcc51e68080022754836705744

Headers

File Characteristics

Imports

kernel32

user32

Sections

.text Size: - Virtual size: 908KB

.rdata Size: - Virtual size: 228KB

.data Size: - Virtual size: 344KB

.rsrc Size: 60KB - Virtual size: 264KB

nl4qcq2r Size: - Virtual size: 76KB

wiiewhmc Size: - Virtual size: 8KB

ddqwpqtx Size: 606KB - Virtual size: 608KB

1k.pos89 Size: 4KB - Virtual size: 4KB

.text
Size: - Virtual size: 908KB

.rdata
Size: - Virtual size: 228KB

.data
Size: - Virtual size: 344KB

.rsrc
Size: 60KB - Virtual size: 264KB

nl4qcq2r
Size: - Virtual size: 76KB

wiiewhmc
Size: - Virtual size: 8KB

ddqwpqtx
Size: 606KB - Virtual size: 608KB

1k.pos89
Size: 4KB - Virtual size: 4KB