Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-23_b95af91611e42e3cc911d261901be164_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-23_b95af91611e42e3cc911d261901be164_mafia.exe
Resource
win10v2004-20240412-en
Target
2024-04-23_b95af91611e42e3cc911d261901be164_mafia
Size
335KB
MD5
b95af91611e42e3cc911d261901be164
SHA1
c80b31d8dd54b5e3e925ee6f5180cd84971c057a
SHA256
67f7cfb81a79ca716e4d0f4fdddde928ba8f7c2f0e78a6c5499a3677ba98eefc
SHA512
c91bb99a76c89a44fd48c9556fb3dd78d082bf189ce0bf972a418fd7b36b03587963031a1602fbd0383373fcb8d07144f70573fe3d39ef64ceb08f51fd11c4f3
SSDEEP
6144:/G6z8OZxHnJbm60Su8N+vHg6t/U5zydydTbnnRqqDLu2OLJcztN9XIg:e6hnHl30r8NWA6tOzydynnsqnuPFczvt
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
LocalFree
Sleep
CloseHandle
WaitForSingleObject
GetSystemInfo
GetProcAddress
HeapFree
GetProcessHeap
TlsFree
HeapAlloc
TlsAlloc
CreateEventA
SetEvent
GetTickCount
CreateProcessA
SetUnhandledExceptionFilter
FormatMessageA
GetLastError
GetSystemTimeAsFileTime
ExitThread
LeaveCriticalSection
EnterCriticalSection
InterlockedDecrement
CreateWaitableTimerA
SetWaitableTimer
WaitForMultipleObjects
ResumeThread
ResetEvent
OpenEventA
ReleaseSemaphore
SetEnvironmentVariableA
CompareStringW
SetEndOfFile
WriteConsoleW
SetStdHandle
CreateFileA
GetConsoleMode
GetConsoleCP
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
InterlockedIncrement
InterlockedExchange
FindResourceExW
FindResourceW
LoadResource
SizeofResource
CreateFileW
LockResource
DeleteFileW
GetFileSize
SetFilePointer
GetModuleHandleW
WriteFile
ReadFile
FlushFileBuffers
MultiByteToWideChar
WideCharToMultiByte
SystemTimeToFileTime
GetVolumeInformationW
GetStringTypeW
InterlockedCompareExchange
InitializeCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
RaiseException
RtlUnwind
ExitProcess
GetCommandLineA
HeapSetInformation
GetTimeFormatA
GetDateFormatA
HeapReAlloc
LCMapStringW
GetCPInfo
IsProcessorFeaturePresent
TlsGetValue
TlsSetValue
SetLastError
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
GetStdHandle
GetModuleFileNameW
GetLocaleInfoW
GetTimeZoneInformation
InitializeCriticalSectionAndSpinCount
LoadLibraryW
HeapCreate
HeapDestroy
GetACP
GetOEMCP
IsValidCodePage
HeapSize
GetModuleFileNameA
CreateThread
SetSecurityDescriptorDacl
RegOpenKeyExA
RegEnumKeyExA
RegCloseKey
InitializeSecurityDescriptor
??0server@proxy@af@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@II0ABV?$vector@HV?$allocator@H@std@@@4@_N0H00002102II22@Z
?create_filter@in_direct_filter@proxy@af@@SA?AV?$shared_ptr@Vin_direct_filter@proxy@af@@@boost@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_N@Z
?set_proxy_list_idle_grow@server@proxy@af@@QAEXH@Z
?run@server@proxy@af@@QAEXH@Z
?obfuscate@header@proxy@af@@SAXPAEI@Z
??0http_client@proxy@af@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@I_N0I@Z
?add_header@http_client@proxy@af@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z
?set_follow_redirect@http_client@proxy@af@@QAEX_N@Z
?set_proxy@http_client@proxy@af@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H@Z
?upload@http_client@proxy@af@@QAEHABVaf_stringW@@_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?download@http_client@proxy@af@@QAEHABVaf_stringW@@_N@Z
?is_running@http_client@proxy@af@@QAE_NXZ
?get_error_code@http_client@proxy@af@@QAEHXZ
?result@http_client@proxy@af@@QAEABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?get_error_msg@http_client@proxy@af@@QAEPBDXZ
??1http_client@proxy@af@@QAE@XZ
??0logger@proxy@af@@QAE@PBDW4log_level_enum@012@_N@Z
?add_in_filter@server@proxy@af@@QAEXV?$shared_ptr@Vbasic_in_filter@proxy@af@@@boost@@H@Z
WSACleanup
WSAStartup
gethostname
PathFileExistsW
PathBuildRootW
PathAddBackslashW
GetAdaptersInfo
??0filter@proxy@af@@QAE@XZ
??1filter@proxy@af@@UAE@XZ
??_Flogger@proxy@af@@QAEXXZ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ