Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-23_6ce9fdcf1af555015d189a0698f341bd_cobalt-strike_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-23_6ce9fdcf1af555015d189a0698f341bd_cobalt-strike_mafia.exe
Resource
win10v2004-20231215-en
Target
2024-01-23_6ce9fdcf1af555015d189a0698f341bd_cobalt-strike_mafia
Size
717KB
MD5
6ce9fdcf1af555015d189a0698f341bd
SHA1
c37b259b2701d9b13c12f78a720fe5eb90ad6658
SHA256
cfeda9e48f586b66b5913f2cc5691d5ca2a9a8b5f4ea2d345969efbf3905dfd0
SHA512
4f491b517ced3bf84a97e25c798b2208a8e8ea6f22c3e5b53545b69bd80440141464df66d4cb4d8433ce715fd5725fc2780b45cdf66f0c0573fbc4844be0a378
SSDEEP
12288:LxqmCPeNMjki07HhKWMFsyBLM3FHMOU9flYGz/LX/gtbs2yrd20iLCGnMIhfTbIc:LxPCWNMd0712BGsUGz7/Ys2yrdLiLXnc
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
CryptStringToBinaryA
GdipCreateBitmapFromScan0
GdiplusStartup
GdipFree
GdipAlloc
GdipLoadImageFromFile
GdipLoadImageFromFileICM
GdipDisposeImage
GdipCloneImage
GdipCreateHICONFromBitmap
GdipGetImageGraphicsContext
GdipDeleteGraphics
GdipDrawImageRectI
GdipGetImageHeight
GdipGetImageWidth
xmlTextReaderDepth
xmlTextReaderValue
xmlTextReaderAttributeCount
xmlParseMemory
xmlTextReaderGetAttribute
xmlFree
xmlNodeListGetString
xmlCleanupParser
xmlFreeDoc
xmlDocGetRootElement
xmlParseFile
xmlTextReaderRead
xmlFreeTextReader
xmlStrcmp
xmlNewTextReaderFilename
xmlTextReaderName
OpenSCManagerW
OpenServiceW
QueryServiceStatus
ControlService
CloseServiceHandle
RegOpenKeyExW
RegCloseKey
RegSetValueExW
RegSetValueExA
RegCreateKeyA
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegQueryValueExW
ord41
ord31
ord36
ord9
ord39
ord43
ord11
ord18
ord8
ord4
ord13
ord26
ord72
ord29
ord49
ord3
ord19
ord12
ord16
ord20
ord2
ord1
ord48
CoTaskMemFree
CoTaskMemAlloc
OleUninitialize
OleInitialize
OleSetContainedObject
CoGetClassObject
InterlockedIncrement
InterlockedCompareExchange
DecodePointer
MoveFileExA
LocalLock
LocalUnlock
InterlockedExchange
InitializeCriticalSectionAndSpinCount
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
GetSystemTimeAsFileTime
GetFileType
GetConsoleCP
GetConsoleMode
RtlUnwind
GetCommandLineA
HeapSetInformation
GetFileInformationByHandle
GetStringTypeW
PeekNamedPipe
GetDriveTypeA
FindFirstFileExA
RaiseException
ExitThread
ExitProcess
LCMapStringW
GetCPInfo
CompareStringW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetHandleCount
GetStdHandle
GetStartupInfoW
IsProcessorFeaturePresent
HeapCreate
GetModuleFileNameW
SetStdHandle
SetEndOfFile
GetLocaleInfoW
WriteConsoleW
GetFileAttributesA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
VirtualQuery
SetEnvironmentVariableA
EncodePointer
ResumeThread
SuspendThread
QueryPerformanceCounter
LocalAlloc
CreateDirectoryA
DeleteFileW
GetFullPathNameA
lstrcmpW
FlushFileBuffers
DisconnectNamedPipe
FormatMessageW
FormatMessageA
LocalFree
GetSystemDirectoryA
FileTimeToLocalFileTime
FileTimeToSystemTime
GetCurrentDirectoryW
SetLastError
CreateNamedPipeA
ConnectNamedPipe
SetFilePointer
GetCurrentProcessId
LoadLibraryW
CreateMutexA
ReleaseMutex
SystemTimeToFileTime
GetTickCount
WriteFile
FindFirstFileA
FindClose
CreateThread
InterlockedDecrement
GetCurrentProcess
FindResourceExW
FindResourceW
LoadResource
WideCharToMultiByte
Sleep
SizeofResource
ReadFile
CreateFileW
MultiByteToWideChar
GetFileSizeEx
GetLastError
LockResource
CloseHandle
GetModuleHandleW
GetProcAddress
GetCurrentThreadId
GetConsoleWindow
lstrlenW
GetLocalTime
InitializeCriticalSection
MoveFileW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
DeleteFileA
GetModuleHandleA
GlobalFree
GlobalAlloc
GetModuleFileNameA
GetSystemTime
GetLocaleInfoA
FreeLibrary
LoadLibraryA
GetFileSize
CreateFileA
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
GetExitCodeProcess
TerminateProcess
WaitForSingleObject
CreateProcessA
SetCurrentDirectoryA
GetCurrentDirectoryA
GetDriveTypeW
GetWindowRect
MoveWindow
UpdateWindow
SetWindowPos
IsWindowVisible
SendMessageA
ShowScrollBar
SetActiveWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsWindow
GetClientRect
SystemParametersInfoA
LoadImageA
ShowWindow
LoadCursorA
CreateWindowExA
DefWindowProcA
GetWindowLongA
SetFocus
SetWindowTextA
SetWindowLongA
GetDesktopWindow
AdjustWindowRect
RegisterClassExA
SetCursor
ReleaseDC
GetDCEx
InflateRect
SetWindowRgn
PostQuitMessage
PostMessageW
MessageBoxA
SetTimer
KillTimer
GetSystemMetrics
DestroyWindow
CreateRoundRectRgn
CreatePen
SetBkMode
Rectangle
RoundRect
SelectObject
CreateRectRgn
CombineRgn
DeleteObject
VariantClear
SysAllocString
VariantInit
SysFreeString
SafeArrayCreate
SafeArrayAccessData
SafeArrayDestroy
?CloseWindow@WebDialog@@QAEXXZ
?CreateSelf@WebDialog@@QAE_NPBD_N@Z
?EMSWebDialogLoop@WebDialog@@SAJXZ
?ExecuteJavascript@WebDialog@@QAEKV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_N@Z
?ExecuteJavascriptW@WebDialog@@QAEKV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@_N@Z
?GetHandle@WebDialog@@QAEPAUHWND__@@XZ
?GetParent@WebDialog@@QAEPAUHWND__@@XZ
?GetWindowSize@WebDialog@@QAE?AUtagRECT@@XZ
?Hide@WebDialog@@QAEXXZ
?Maximize@WebDialog@@QAEXXZ
?Minimize@WebDialog@@QAEXXZ
?QueryDOMSizeAsync@WebDialog@@QAEXKK@Z
?ResetHandle@WebDialog@@QAEXXZ
?ResizeReorderAndRepositionSelf@WebDialog@@QAEX_N0@Z
?ResizeWindow@WebDialog@@QAEHUtagRECT@@_N@Z
?Restore@WebDialog@@QAEXXZ
?SetClassStyle@WebDialog@@QAEKV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@00_N@Z
?SetElementInnerHTML@WebDialog@@QAEKV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0_N@Z
?SetElementInnerHTMLW@WebDialog@@QAEKV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0_N@Z
?SetElementProp@WebDialog@@QAEKV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@00_N@Z
?SetElementPropW@WebDialog@@QAEKV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@00_N@Z
?SetElementStyle@WebDialog@@QAEKV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@00_N@Z
?SetElementText@WebDialog@@QAEKV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0_N@Z
?SetElementTextW@WebDialog@@QAEKV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0_N@Z
?SetListItems@WebDialog@@QAEKV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@3@_N@Z
?SetListItemsW@WebDialog@@QAEKV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$vector@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$allocator@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@3@_N@Z
?SetShellIcon@WebDialog@@QAEHV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?SetStateSwitch@WebDialog@@QAEXK@Z
?SetTempFileName@WebDialog@@SAXV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?Show@WebDialog@@QAEXXZ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ