Z:\b\HTE\QDART\QDART_MFG\BSP_Storage\QSaharaServer\Release\QSaharaServer.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-21_396023ae937d9cd7eea28c981d595c98_mafia_wapomi.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-05-21_396023ae937d9cd7eea28c981d595c98_mafia_wapomi.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-05-21_396023ae937d9cd7eea28c981d595c98_mafia_wapomi
-
Size
187KB
-
MD5
396023ae937d9cd7eea28c981d595c98
-
SHA1
955f83d2ac25ef84fc38259bcb8349746693009c
-
SHA256
eaa0ba0b04296242c84fc293b1e875489516109a414088b897bfa33559084331
-
SHA512
b9c3b82b8e64062d64e32752904afbfb24f0698babeb0035eaa761111285b948aeccbfb42b8ca95094de6349c5a99eda4309a15e3c728fffd3e2b30256cbc3dc
-
SSDEEP
3072:uLKCpw8DA3Yr3mUOJfXEEZnRCI3AXny/Hj8LG4MVj/FIgW6dvn3mxIOUGCH:e83YLmUOFXEEZnRCI3AXny/Hj8LG4ujI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-05-21_396023ae937d9cd7eea28c981d595c98_mafia_wapomi
Files
-
2024-05-21_396023ae937d9cd7eea28c981d595c98_mafia_wapomi.exe windows:5 windows x86 arch:x86
ba6e7d1028cd73d291b266f23866459e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
CloseHandle
SetCommTimeouts
CreateFileA
WriteFile
ReadFile
Sleep
GetTickCount
GetSystemInfo
GetSystemTimeAsFileTime
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileInformationByHandle
PeekNamedPipe
GetLastError
GetFileType
FindClose
GetDriveTypeA
FindFirstFileExA
GetFileAttributesA
EnterCriticalSection
LeaveCriticalSection
GetProcAddress
GetModuleHandleW
ExitProcess
DecodePointer
SetFilePointer
GetCommandLineA
HeapSetInformation
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
IsProcessorFeaturePresent
WideCharToMultiByte
GetTimeZoneInformation
SetStdHandle
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetStdHandle
GetStartupInfoW
DeleteCriticalSection
GetFullPathNameA
HeapFree
GetCurrentDirectoryW
SetCurrentDirectoryW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetCurrentThread
GetConsoleCP
GetConsoleMode
SetEndOfFile
HeapAlloc
GetProcessHeap
MultiByteToWideChar
InterlockedExchange
FatalAppExitA
SetConsoleCtrlHandler
FreeLibrary
LoadLibraryW
GetLocaleInfoW
GetModuleFileNameW
HeapSize
HeapQueryInformation
HeapReAlloc
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetCurrentProcessId
RtlUnwind
GetDriveTypeW
LCMapStringW
WriteConsoleW
FlushFileBuffers
GetStringTypeW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
CreateFileW
CompareStringW
SetEnvironmentVariableA
CreateDirectoryA
Sections
.text Size: 131KB - Virtual size: 131KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 696B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
�X��u� Size: 16KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE