Z:\b\HTE\QDART\QDART_MFG\BSP_Storage\QSaharaServer\Release\QSaharaServer.pdb
Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
2025-01-16_ec2fa71ba3898e6be236306034f3a937_mafia_wapomi.exe
Resource
win7-20240903-en
General
-
Target
2025-01-16_ec2fa71ba3898e6be236306034f3a937_mafia_wapomi
-
Size
188KB
-
MD5
ec2fa71ba3898e6be236306034f3a937
-
SHA1
468b181d329fe70901419fcedbb256f67d2b301c
-
SHA256
697035661c0e0cb59a5c8c6c1c6654c17deb8cf85a01615987df73fe133ee811
-
SHA512
8a66d194d094c2b2d8dd2c8583849e57ac95158f4f529b3d6ddd37c3109484afddfad164fa87f2a87c0c432e75a590626abdba4229baa0590141d4747e55ca3d
-
SSDEEP
3072:Djaz/kdH1QuA3rGuYt/ie+0T1ddxWTXOvXjfaz4WUSXpltz7GUd+w3wieCzpjGCH:LdHeuAbGuYVie+0T1ddxWTXOvXjfaz4R
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2025-01-16_ec2fa71ba3898e6be236306034f3a937_mafia_wapomi
Files
-
2025-01-16_ec2fa71ba3898e6be236306034f3a937_mafia_wapomi.exe windows:5 windows x86 arch:x86
ba6e7d1028cd73d291b266f23866459e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
CloseHandle
SetCommTimeouts
CreateFileA
WriteFile
ReadFile
Sleep
GetTickCount
GetSystemInfo
GetSystemTimeAsFileTime
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileInformationByHandle
PeekNamedPipe
GetLastError
GetFileType
FindClose
GetDriveTypeA
FindFirstFileExA
GetFileAttributesA
EnterCriticalSection
LeaveCriticalSection
GetProcAddress
GetModuleHandleW
ExitProcess
DecodePointer
SetFilePointer
GetCommandLineA
HeapSetInformation
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
IsProcessorFeaturePresent
WideCharToMultiByte
GetTimeZoneInformation
SetStdHandle
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetStdHandle
GetStartupInfoW
DeleteCriticalSection
GetFullPathNameA
HeapFree
GetCurrentDirectoryW
SetCurrentDirectoryW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetCurrentThread
GetConsoleCP
GetConsoleMode
SetEndOfFile
HeapAlloc
GetProcessHeap
MultiByteToWideChar
InterlockedExchange
FatalAppExitA
SetConsoleCtrlHandler
FreeLibrary
LoadLibraryW
GetLocaleInfoW
GetModuleFileNameW
HeapSize
HeapQueryInformation
HeapReAlloc
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetCurrentProcessId
RtlUnwind
GetDriveTypeW
LCMapStringW
WriteConsoleW
FlushFileBuffers
GetStringTypeW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
CreateFileW
CompareStringW
SetEnvironmentVariableA
CreateDirectoryA
Sections
.text Size: 132KB - Virtual size: 131KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 26KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 696B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
��q��uI Size: 16KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE