Z:\b\HTE\QDART\QDART_MFG\BSP_Storage\QSaharaServer\Release\QSaharaServer.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2025-01-07_05b3e65f8db67b719efe991d01069b21_mafia_wapomi.exe
Resource
win7-20240903-en
General
-
Target
2025-01-07_05b3e65f8db67b719efe991d01069b21_mafia_wapomi
-
Size
188KB
-
MD5
05b3e65f8db67b719efe991d01069b21
-
SHA1
e9aacf30ab7bd3ae84b1a7a031bf3c2e81c9356c
-
SHA256
a410b4330a20950c6f502fc8281f8b4f2e2249faf47a0aefb7cce10e5c631784
-
SHA512
1e965b1c31d8ac28d56da18019f69f99448a9e31df716cd40efef77b43e43b4ffa403d2e6685e1f15d056ede44b8c42b1517912b85b0b6908a37ed0e185cc355
-
SSDEEP
3072:Djaz/kdH1QuA3rGuYt/ie+0T1ddxWTXOvXjfaz4WUSXpltz7GUd+w3wieCzpFGCH:LdHeuAbGuYVie+0T1ddxWTXOvXjfaz43
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2025-01-07_05b3e65f8db67b719efe991d01069b21_mafia_wapomi
Files
-
2025-01-07_05b3e65f8db67b719efe991d01069b21_mafia_wapomi.exe windows:5 windows x86 arch:x86
ba6e7d1028cd73d291b266f23866459e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
CloseHandle
SetCommTimeouts
CreateFileA
WriteFile
ReadFile
Sleep
GetTickCount
GetSystemInfo
GetSystemTimeAsFileTime
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileInformationByHandle
PeekNamedPipe
GetLastError
GetFileType
FindClose
GetDriveTypeA
FindFirstFileExA
GetFileAttributesA
EnterCriticalSection
LeaveCriticalSection
GetProcAddress
GetModuleHandleW
ExitProcess
DecodePointer
SetFilePointer
GetCommandLineA
HeapSetInformation
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
IsProcessorFeaturePresent
WideCharToMultiByte
GetTimeZoneInformation
SetStdHandle
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetStdHandle
GetStartupInfoW
DeleteCriticalSection
GetFullPathNameA
HeapFree
GetCurrentDirectoryW
SetCurrentDirectoryW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetCurrentThread
GetConsoleCP
GetConsoleMode
SetEndOfFile
HeapAlloc
GetProcessHeap
MultiByteToWideChar
InterlockedExchange
FatalAppExitA
SetConsoleCtrlHandler
FreeLibrary
LoadLibraryW
GetLocaleInfoW
GetModuleFileNameW
HeapSize
HeapQueryInformation
HeapReAlloc
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetCurrentProcessId
RtlUnwind
GetDriveTypeW
LCMapStringW
WriteConsoleW
FlushFileBuffers
GetStringTypeW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
CreateFileW
CompareStringW
SetEnvironmentVariableA
CreateDirectoryA
Sections
.text Size: 132KB - Virtual size: 131KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 26KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 696B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
��q��uI Size: 16KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE