Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-27_b1649a746e7fef318c6d33c89ccf2766_mafia.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-01-27_b1649a746e7fef318c6d33c89ccf2766_mafia.exe
Resource
win10v2004-20231215-en
Target
2024-01-27_b1649a746e7fef318c6d33c89ccf2766_mafia
Size
7.2MB
MD5
b1649a746e7fef318c6d33c89ccf2766
SHA1
deb7c9db95da1e487868e5b05630ef986226126a
SHA256
e81d0c333e73fb2e1098b3f095b761cec271fc5593bd960c99c918f97c3056d0
SHA512
8c6311069767ac9a5764910ee46048bce3aa67c5b63ef8881eeaf876ac76ae2fdaadd8b9f3a8c8ded3bcf7e411c0067d0ca40a9eaffa31d2e681a440784945b8
SSDEEP
49152:goz4exphqMAQ2ls7ehdUJCj7hvR2SvtfbJMs425z4la9:goU8YQes7ehdUJC5vRrOs4Az4la
resource | yara_rule |
---|---|
sample | INDICATOR_SUSPICIOUS_Binary_References_Browsers |
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
D:\2.0.4.0\Bin\PDB\jdrl.pdb
LockFileEx
CreateDirectoryW
HeapSize
GetTempPathW
FlushFileBuffers
HeapValidate
HeapCreate
GetFileAttributesA
HeapDestroy
FormatMessageW
Sleep
FormatMessageA
GetSystemTimeAsFileTime
UnlockFileEx
GetTickCount
LockFile
GetFileAttributesW
FileTimeToDosDateTime
lstrcmpW
MulDiv
UnlockFile
InterlockedCompareExchange
HeapFree
GetDiskFreeSpaceW
HeapAlloc
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
CreateMutexW
GetFileSize
CreateFileA
HeapReAlloc
FindFirstFileW
GetFullPathNameA
GetFullPathNameW
InterlockedDecrement
GetPrivateProfileStringW
WritePrivateProfileStringW
RemoveDirectoryW
DeleteFileW
SetFileAttributesW
FindClose
lstrcpyW
GetCommandLineW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
ReadFile
OpenProcess
GetVersionExW
LoadResource
SetSystemTime
GetCurrentProcess
WideCharToMultiByte
GetModuleFileNameW
FreeLibrary
GetProcAddress
LoadLibraryW
CloseHandle
SetFilePointer
CreateFileW
WriteFile
MultiByteToWideChar
GetCurrentDirectoryW
FlushViewOfFile
OpenFileMappingW
GlobalUnlock
GlobalAlloc
GlobalLock
GetVolumeInformationW
DuplicateHandle
GetFileTime
GetFileSizeEx
FileTimeToLocalFileTime
SetEnvironmentVariableA
CompareStringW
FindNextFileW
CopyFileW
GetTimeFormatW
GetDateFormatW
GetPrivateProfileIntW
InitializeCriticalSectionAndSpinCount
lstrcmpiW
FindResourceExW
SetCurrentDirectoryW
InterlockedIncrement
GetLocalTime
SetLastError
FlushInstructionCache
GetCurrentThreadId
GetProcessTimes
InterlockedExchange
WaitForMultipleObjectsEx
DeleteTimerQueueTimer
CreateTimerQueueTimer
CreateTimerQueue
DeleteTimerQueue
RaiseException
QueueUserWorkItem
lstrcpynW
LoadLibraryExW
LockResource
GetComputerNameW
SetEvent
ResetEvent
CreateEventW
TerminateThread
ResumeThread
WaitForSingleObject
CreateProcessW
GetStartupInfoW
CreatePipe
WinExec
TerminateProcess
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetACP
DeleteFileA
AreFileApisANSI
GetSystemTime
LocalFree
GetTempPathA
GetCurrentProcessId
GetVersionExA
GetFileAttributesExW
GetSystemInfo
GetDiskFreeSpaceA
CreateFileMappingW
QueryPerformanceCounter
LoadLibraryA
SetStdHandle
WriteConsoleW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
GetTimeZoneInformation
GetConsoleMode
GetConsoleCP
GetFileType
SetHandleCount
GetLocaleInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetStdHandle
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LCMapStringW
RtlUnwind
HeapSetInformation
GetCommandLineA
VirtualQuery
VirtualProtect
CreateThread
ExitThread
ExitProcess
GetCPInfo
InterlockedPopEntrySList
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
GetProcessHeap
InterlockedPushEntrySList
DecodePointer
EncodePointer
GetStringTypeW
lstrlenA
SystemTimeToFileTime
FileTimeToSystemTime
GetModuleHandleW
FindResourceW
SizeofResource
lstrlenW
DosDateTimeToFileTime
GetLastError
GetActiveWindow
SetWindowPlacement
UnregisterClassA
CharUpperW
SetClipboardData
OpenClipboard
EmptyClipboard
ExitWindowsEx
CloseClipboard
GetWindow
GetMonitorInfoW
EnableWindow
MapWindowPoints
AdjustWindowRectEx
MonitorFromWindow
IsWindowEnabled
GetLastActivePopup
SetWindowRgn
GetWindowRgn
InvalidateRect
GetFocus
GetDlgCtrlID
ReleaseCapture
GetGUIThreadInfo
GetDoubleClickTime
MessageBeep
DrawTextW
AllowSetForegroundWindow
RedrawWindow
GetSysColor
GetClassNameW
GetWindowTextW
BeginPaint
CreateAcceleratorTableW
InvalidateRgn
GetDesktopWindow
IsChild
FillRect
DestroyAcceleratorTable
GetWindowTextLengthW
EndPaint
GetWindowPlacement
LoadImageW
GetCursorPos
PostQuitMessage
GetForegroundWindow
AttachThreadInput
LoadStringA
SetFocus
SetActiveWindow
ClientToScreen
OffsetRect
SetForegroundWindow
PeekMessageW
GetMessageW
TranslateMessage
GetWindowRect
GetDC
DispatchMessageW
MessageBoxW
FindWindowExW
GetWindowLongW
FindWindowW
SetWindowLongW
GetSystemMetrics
CharNextW
RegisterWindowMessageW
PostMessageW
LoadCursorW
GetClassInfoExW
RegisterClassExW
PtInRect
CopyRect
MoveWindow
GetWindowThreadProcessId
CreateWindowExW
GetParent
RegisterDeviceNotificationW
GetDlgItem
SendMessageW
CallWindowProcW
GetIconInfo
LoadStringW
DestroyWindow
IsWindow
ShowWindow
ScreenToClient
ReleaseDC
UpdateLayeredWindow
GetClientRect
IsWindowVisible
SetParent
KillTimer
RegisterHotKey
SystemParametersInfoW
SetTimer
SetWindowPos
IsDialogMessageW
DefWindowProcW
SetCapture
SetWindowTextW
GetPixel
SetPixel
CreateSolidBrush
GetStockObject
BitBlt
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
DeleteDC
GetBitmapBits
GetObjectW
DeleteObject
CreateRoundRectRgn
CreateRectRgn
PtInRegion
CreateDIBSection
GetTextColor
SetTextAlign
EnumFontFamiliesExW
GetTextAlign
Ellipse
LineTo
MoveToEx
ExtCreatePen
GetDeviceCaps
GetOpenFileNameW
GetSaveFileNameW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegDeleteValueW
OpenProcessToken
LookupPrivilegeValueW
RegEnumKeyExW
RegQueryInfoKeyW
RegQueryValueW
RegCreateKeyExW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegDeleteKeyW
RegQueryValueExA
RegOpenKeyExA
RegCreateKeyW
RegOpenKeyW
AdjustTokenPrivileges
ShellExecuteA
SHGetFileInfoW
SHGetSpecialFolderPathA
CommandLineToArgvW
ShellExecuteW
SHGetSpecialFolderPathW
ShellExecuteExW
OleUninitialize
OleInitialize
StringFromGUID2
CreateStreamOnHGlobal
CLSIDFromString
CLSIDFromProgID
OleLockRunning
CoInitialize
CoCreateInstance
CoUninitialize
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoGetClassObject
VariantClear
LoadRegTypeLi
OleCreateFontIndirect
LoadTypeLi
SysStringLen
SysAllocString
VariantInit
VarUI4FromStr
VariantTimeToSystemTime
VarUdateFromDate
SystemTimeToVariantTime
SysAllocStringLen
SysFreeString
VarDateFromStr
PathGetArgsW
StrToIntW
PathFileExistsW
StrCmpNIW
PathUnquoteSpacesW
PathRemoveArgsW
PathIsUNCW
PathStripToRootW
PathFindFileNameW
StrCmpIW
ImageList_GetIconSize
_TrackMouseEvent
ImageList_Draw
HTMLayoutUpdateElementEx
HTMLayoutGetGraphin
HTMLayoutDataReadyAsync
HTMLayoutSetTimer
HTMLayoutSetTimerEx
HTMLayoutIsElementVisible
HTMLayoutGetElementIndex
HTMLayoutShowPopup
HTMLayoutGetChildrenCount
HTMLayoutGetNthChild
HTMLayoutSelectParent
HTMLayoutShowPopupAt
HTMLayoutSetElementInnerText16
HTMLayoutHidePopup
HTMLayoutTrackPopupAt
HTMLayoutGetParentElement
HTMLayoutDeleteElement
HTMLayoutSelectParentW
HTMLayoutInsertElement
HTMLayoutCreateElement
HTMLayoutGetElementLocation
HTMLayoutSetAttributeByName
HTMLayoutGetElementHwnd
HTMLayoutGetElementState
ValueInt64Data
HTMLayoutControlGetValue
ValueCopy
HTMLayoutPostEvent
HTMLayoutSelectElementsW
HTMLayoutControlSetValue
ValueInit
ValueStringDataSet
ValueClear
HTMLayoutUpdateElement
HTMLayoutControlGetType
HTMLayoutSelectElements
HTMLayoutUpdateWindow
HTMLayoutCallBehaviorMethod
HTMLayoutClassNameW
HTMLayoutSetCallback
HTMLayoutLoadHtmlEx
HTMLayoutLoadHtml
HTMLayoutCombineURL
HTMLayoutSetMediaType
HTMLayoutLoadFile
HTMLayoutDataReady
HTMLayoutGetAttributeCount
HTMLayoutGetNthAttribute
HTMLayoutGetAttributeByName
HTMLayout_UseElement
HTMLayoutGetElementInnerTextCB
HTMLayout_UnuseElement
HTMLayoutSetMasterCSS
ValueIntData
HTMLayoutGetElementIntrinsicHeight
HTMLayoutSetEventRoot
HTMLayoutGetScrollInfo
HTMLayoutGetElementByUID
ValueNthElementValue
ValueGetValueOfKey
HTMLayoutAttachEventHandlerEx
HTMLayoutHttpRequest
HTMLayoutEnqueueMeasure
HTMLayoutRequestElementData
HTMLayoutSetCapture
HTMLayoutGetElementUID
ValueElementsCount
HTMLayoutSendEvent
HTMLayoutGetElementIntrinsicWidths
HTMLayoutSortElements
HTMLayoutDetachElement
HTMLayoutIsElementEnabled
HTMLayoutGetElementHtmlCB
HTMLayoutTraverseUIEvent
HTMLayoutSetScrollPos
HTMLayoutElementSetExpando
HTMLayoutSetElementState
HTMLayoutElementGetExpando
HTMLayoutGetFocusElement
HTMLayoutScrollToView
HTMLayoutSetStyleAttribute
HTMLayoutSetElementHtml
ValueFloatDataSet
ValueFloatData
HTMLayoutWindowAttachEventHandler
HTMLayoutGetRootElement
HTMLayoutRender
HTMLayoutGetElementType
HTMLayoutGetMinHeight
HTMLayoutGetStyleAttribute
HTMLayoutGetMinWidth
ValueStringData
ValueToString
ValueIntDataSet
GdipCreateBitmapFromFile
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromScan0
GdipGetImageGraphicsContext
GdipDeleteGraphics
GdipCloneBitmapAreaI
GdipCreateFromHDC
GdipReleaseDC
GdipDeleteBrush
GdipCloneBrush
GdipDeleteFont
GdipCreateFontFamilyFromName
GdipCreateFont
GdipCreateSolidFill
GdipDrawString
GdipCreateMatrix2
GdipCloneImage
GdipRotateMatrix
GdipTranslateMatrix
GdipTransformMatrixPointsI
GdipDrawImagePointsI
GdiplusStartup
GdiplusShutdown
GdipGetGenericFontFamilySansSerif
GdipCreateHICONFromBitmap
GdipFillRectangleI
GdipSetInterpolationMode
GdipDrawImageRectRect
GdipSetSmoothingMode
GdipSetTextRenderingHint
GdipCreatePen1
GdipDeletePen
GdipDrawLineI
GdipAlloc
GdipDisposeImage
GdipFree
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipDrawImage
GdipGetImageWidth
GdipGetImageHeight
GdipDrawImageI
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipDeleteStringFormat
GdipCreateStringFormat
GdipSaveImageToFile
GdipDeleteMatrix
GdipDeleteFontFamily
BT_InstallSehFilter
BT_SetSupportHost
BT_SetSupportPort
BT_SetSupportEMail
BT_SetAppName
BT_SetFlags
BT_SetReportFormat
BT_UninstallSehFilter
closesocket
ntohl
recv
connect
inet_addr
htons
socket
WSACleanup
WSAStartup
Netbios
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
SetupDiGetClassDevsW
SetupDiOpenClassRegKeyExW
CM_Enumerate_Classes
SetupDiGetClassImageIndex
SetupDiGetClassImageList
SetupDiDestroyDeviceInfoList
SetupDiClassGuidsFromNameW
SetupDiEnumDeviceInfo
CM_Get_Parent
CM_Get_Device_IDW
SetupDiClassNameFromGuidW
PlaySoundW
??0CppSQLite3DB@@AAE@ABV0@@Z
??0CppSQLite3DB@@QAE@XZ
??0CppSQLite3Exception@@QAE@ABV0@@Z
??0CppSQLite3Exception@@QAE@HPA_W_N@Z
??0CppSQLite3Query@@QAE@ABV0@@Z
??0CppSQLite3Query@@QAE@PAUsqlite3@@PAUsqlite3_stmt@@_N2@Z
??0CppSQLite3Query@@QAE@XZ
??0CppSQLite3Statement@@QAE@ABV0@@Z
??0CppSQLite3Statement@@QAE@PAUsqlite3@@PAUsqlite3_stmt@@@Z
??0CppSQLite3Statement@@QAE@XZ
??1CppSQLite3DB@@UAE@XZ
??1CppSQLite3Exception@@UAE@XZ
??1CppSQLite3Query@@UAE@XZ
??1CppSQLite3Statement@@UAE@XZ
??4CppSQLite3DB@@AAEAAV0@ABV0@@Z
??4CppSQLite3Exception@@QAEAAV0@ABV0@@Z
??4CppSQLite3Query@@QAEAAV0@ABV0@@Z
??4CppSQLite3Statement@@QAEAAV0@ABV0@@Z
??ECppSQLite3Query@@QAEAAV0@H@Z
??ECppSQLite3Query@@QAEAAV0@XZ
??_7CppSQLite3DB@@6B@
??_7CppSQLite3Exception@@6B@
??_7CppSQLite3Query@@6B@
??_7CppSQLite3Statement@@6B@
?SQLiteVersion@CppSQLite3DB@@SAPBDXZ
?bind@CppSQLite3Statement@@QAEXHH@Z
?bind@CppSQLite3Statement@@QAEXHN@Z
?bind@CppSQLite3Statement@@QAEXHPBEH@Z
?bind@CppSQLite3Statement@@QAEXHPB_W@Z
?bindNull@CppSQLite3Statement@@QAEXH@Z
?checkDB@CppSQLite3DB@@AAEXXZ
?checkDB@CppSQLite3Statement@@AAEXXZ
?checkVM@CppSQLite3Query@@AAEXXZ
?checkVM@CppSQLite3Statement@@AAEXXZ
?close@CppSQLite3DB@@QAEXXZ
?compile@CppSQLite3DB@@AAEPAUsqlite3_stmt@@PB_W@Z
?compileStatement@CppSQLite3DB@@QAE?AVCppSQLite3Statement@@PB_W@Z
?eof@CppSQLite3Query@@QAE_NXZ
?errorCode@CppSQLite3Exception@@QAE?BHXZ
?errorCodeAsString@CppSQLite3Exception@@SAPB_WH@Z
?errorMessage@CppSQLite3Exception@@QAEPB_WXZ
?execDML@CppSQLite3DB@@QAEHPB_W@Z
?execDML@CppSQLite3Statement@@QAEHXZ
?execQuery@CppSQLite3DB@@QAE?AVCppSQLite3Query@@PB_W@Z
?execScalar@CppSQLite3DB@@QAEHPB_W@Z
?execScalarStr@CppSQLite3DB@@QAE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PB_W@Z
?fieldDataType@CppSQLite3Query@@QAEHH@Z
?fieldDeclType@CppSQLite3Query@@QAEPB_WH@Z
?fieldIndex@CppSQLite3Query@@QAEHPB_W@Z
?fieldIsNull@CppSQLite3Query@@QAE_NH@Z
?fieldIsNull@CppSQLite3Query@@QAE_NPB_W@Z
?fieldName@CppSQLite3Query@@QAEPB_WH@Z
?fieldValue@CppSQLite3Query@@QAEPB_WH@Z
?fieldValue@CppSQLite3Query@@QAEPB_WPB_W@Z
?finalize@CppSQLite3Query@@QAEXXZ
?finalize@CppSQLite3Statement@@QAEXXZ
?getBlobField@CppSQLite3Query@@QAEPBEHAAH@Z
?getBlobField@CppSQLite3Query@@QAEPBEPB_WAAH@Z
?getFloatField@CppSQLite3Query@@QAENHN@Z
?getFloatField@CppSQLite3Query@@QAENPB_WN@Z
?getIntField@CppSQLite3Query@@QAEHHH@Z
?getIntField@CppSQLite3Query@@QAEHPB_WH@Z
?getStringField@CppSQLite3Query@@QAEPB_WHPB_W@Z
?getStringField@CppSQLite3Query@@QAEPB_WPB_W0@Z
?interrupt@CppSQLite3DB@@QAEXXZ
?isopen@CppSQLite3DB@@QBE_NXZ
?lastRowId@CppSQLite3DB@@QAE_JXZ
?nextRow@CppSQLite3Query@@QAEXXZ
?numFields@CppSQLite3Query@@QAEHXZ
?open@CppSQLite3DB@@QAEXPB_W@Z
?reset@CppSQLite3Statement@@QAEXXZ
?setBusyTimeout@CppSQLite3DB@@QAEXH@Z
?tableExists@CppSQLite3DB@@QAE_NPB_W@Z
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ