Z:\b\HTE\QDART\QDART_MFG\BSP_Storage\QSaharaServer\Release\QSaharaServer.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-29_d91bb240c1e42615c756c9ba8d618e1d_mafia_wapomi.exe
Resource
win7-20241023-en
General
-
Target
2024-10-29_d91bb240c1e42615c756c9ba8d618e1d_mafia_wapomi
-
Size
188KB
-
MD5
d91bb240c1e42615c756c9ba8d618e1d
-
SHA1
1922aaaf5bb6442cfc45141ef12c569fd605575b
-
SHA256
e1d605e8fc5cac42c464d8f5f49a6b49870d7259c9f95ed0cefcb322edd4cd00
-
SHA512
433083baae966471f55dffc43221351fce6db24889186f7b4f1ffd3b64b99f304634a5f8ae853917c11ea0519649037dd0740e2841dfd23646db69d62dfe3ad1
-
SSDEEP
3072:Djaz/kdH1QuA3rGuYt/ie+0T1ddxWTXOvXjfaz4WUSXpltz7GUd+w3wieCzp1GCH:LdHeuAbGuYVie+0T1ddxWTXOvXjfaz4P
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 2024-10-29_d91bb240c1e42615c756c9ba8d618e1d_mafia_wapomi
Files
-
2024-10-29_d91bb240c1e42615c756c9ba8d618e1d_mafia_wapomi.exe windows:5 windows x86 arch:x86
ba6e7d1028cd73d291b266f23866459e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
CloseHandle
SetCommTimeouts
CreateFileA
WriteFile
ReadFile
Sleep
GetTickCount
GetSystemInfo
GetSystemTimeAsFileTime
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileInformationByHandle
PeekNamedPipe
GetLastError
GetFileType
FindClose
GetDriveTypeA
FindFirstFileExA
GetFileAttributesA
EnterCriticalSection
LeaveCriticalSection
GetProcAddress
GetModuleHandleW
ExitProcess
DecodePointer
SetFilePointer
GetCommandLineA
HeapSetInformation
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
IsProcessorFeaturePresent
WideCharToMultiByte
GetTimeZoneInformation
SetStdHandle
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetStdHandle
GetStartupInfoW
DeleteCriticalSection
GetFullPathNameA
HeapFree
GetCurrentDirectoryW
SetCurrentDirectoryW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetCurrentThread
GetConsoleCP
GetConsoleMode
SetEndOfFile
HeapAlloc
GetProcessHeap
MultiByteToWideChar
InterlockedExchange
FatalAppExitA
SetConsoleCtrlHandler
FreeLibrary
LoadLibraryW
GetLocaleInfoW
GetModuleFileNameW
HeapSize
HeapQueryInformation
HeapReAlloc
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetCurrentProcessId
RtlUnwind
GetDriveTypeW
LCMapStringW
WriteConsoleW
FlushFileBuffers
GetStringTypeW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
CreateFileW
CompareStringW
SetEnvironmentVariableA
CreateDirectoryA
Sections
.text Size: 132KB - Virtual size: 131KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 26KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 696B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
��q��uI Size: 16KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE