Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-17_91d037f062fac6a5f1902d673485b408_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-10-17_91d037f062fac6a5f1902d673485b408_mafia.exe
Resource
win10v2004-20241007-en
Target
2024-10-17_91d037f062fac6a5f1902d673485b408_mafia
Size
1.0MB
MD5
91d037f062fac6a5f1902d673485b408
SHA1
6c009ae005efc54db8760439b556103cfba46071
SHA256
a9ccba437566d22eee4cbec50a7b383125850b2e65d31bdefc2a61b05bd8347e
SHA512
d724026cc4a0bf739ae7ea4b400667669fdc8f7ec2f209264ccf84a6b942108b304a9677b8d6ab502471c729f508b8175bb2f0c7da753a222802b76112039294
SSDEEP
24576:ewXhW6CTY4mFYUvfgHlc27nL7Qsv8r3NDoRGqJ4aAZ+p+uC5204OUw:LNYUMcMh8r3doRR4aAZ+o389OUw
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
D:\dev\tags\rev-4.09\apps\win\Release\Win32\cmw_srv.pdb
GetExitCodeProcess
TerminateProcess
ResetEvent
FindFirstFileW
FindClose
FindNextFileW
GetSystemWindowsDirectoryW
CreateProcessW
GetVersionExW
SetConsoleCtrlHandler
OpenEventW
CreateToolhelp32Snapshot
Process32NextW
VerSetConditionMask
VerifyVersionInfoW
CreateFileW
SetFilePointer
GetStartupInfoW
GetStdHandle
GetModuleFileNameW
FreeLibrary
LoadLibraryW
LocalFree
ReleaseMutex
GetProcAddress
GetSystemInfo
FormatMessageA
InitializeCriticalSectionAndSpinCount
CreateIoCompletionPort
CreateEventW
SetEvent
SleepEx
TlsSetValue
SetWaitableTimer
SetLastError
GetQueuedCompletionStatus
WaitForMultipleObjects
InterlockedExchangeAdd
TerminateThread
QueueUserAPC
WaitForSingleObject
InterlockedDecrement
DeleteCriticalSection
InterlockedCompareExchange
Sleep
InterlockedIncrement
TlsGetValue
PostQueuedCompletionStatus
EnterCriticalSection
LeaveCriticalSection
InterlockedExchange
CreateEventA
CloseHandle
HeapAlloc
TlsAlloc
TlsFree
HeapFree
CreateWaitableTimerA
ResumeThread
OpenEventA
SetEnvironmentVariableA
CompareStringW
SetEndOfFile
SetStdHandle
CreateFileA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetConsoleMode
GetConsoleCP
GetCurrentProcessId
QueryPerformanceCounter
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetTimeZoneInformation
IsValidCodePage
GetOEMCP
GetACP
HeapDestroy
HeapCreate
ExitProcess
HeapSize
GetLocaleInfoW
IsProcessorFeaturePresent
IsDebuggerPresent
SetUnhandledExceptionFilter
ProcessIdToSessionId
LoadLibraryA
CompareFileTime
GetVolumeInformationW
UnhandledExceptionFilter
GetCPInfo
LCMapStringW
RtlUnwind
RaiseException
HeapReAlloc
GetDateFormatA
GetTimeFormatA
GetSystemDirectoryW
Process32FirstW
FileTimeToSystemTime
SystemTimeToFileTime
OutputDebugStringA
GetFileType
WriteConsoleW
HeapSetInformation
GetCommandLineW
CreateThread
GetCurrentThreadId
ExitThread
InitializeCriticalSection
DecodePointer
EncodePointer
GetStringTypeW
GetProcessHeap
GetLastError
OpenMutexW
CreateMutexW
GetTempFileNameW
FindResourceExW
FindResourceW
LoadResource
MoveFileExW
CreateDirectoryW
SetFileTime
CopyFileW
SizeofResource
GetTempPathW
LockResource
RemoveDirectoryW
GetFileTime
DeleteFileW
GetFileSize
GetModuleHandleW
WriteFile
ReadFile
FlushFileBuffers
ReleaseSemaphore
CreateSemaphoreA
GetSystemTimeAsFileTime
CreateWaitableTimerW
UnregisterWaitEx
RegisterWaitForSingleObject
DuplicateHandle
GetCurrentProcess
GetTickCount
MultiByteToWideChar
WideCharToMultiByte
SetCurrentDirectoryW
RegQueryValueExW
SetSecurityDescriptorDacl
OpenProcessToken
GetTokenInformation
RegOpenKeyExA
RegEnumKeyExA
RegCloseKey
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW
RegisterEventSourceW
SetServiceStatus
OpenSCManagerW
CreateServiceW
CloseServiceHandle
RegCreateKeyW
OpenServiceW
StartServiceW
QueryServiceStatus
ControlService
DeleteService
RegisterServiceCtrlHandlerExW
ChangeServiceConfig2W
StartServiceCtrlDispatcherW
DeregisterEventSource
ReportEventW
InitializeSecurityDescriptor
??0logger@proxy@af@@QAE@PBDW4log_level_enum@012@_N@Z
?set_timeout@http_client@proxy@af@@QAEXI@Z
?get_listen_port@server@proxy@af@@QAEHXZ
?set_log_level@http_client@proxy@af@@SAXW4log_level_enum@logger@23@@Z
?set_server_name@server@proxy@af@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z
?set_root@server@proxy@af@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??0server@proxy@af@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@II0ABV?$vector@HV?$allocator@H@std@@@4@_N0H000021I02II22@Z
?get_web_cb@server@proxy@af@@QAE?AV?$function@$$A6AHABUweb_callback_param@@AAUweb_callback_out@@@Z@boost@@XZ
?run@server@proxy@af@@QAEXH@Z
?set_url@http_client@proxy@af@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?download@http_client@proxy@af@@QAEHABVaf_stringA@@_N@Z
??1server@proxy@af@@QAE@XZ
?stop@server@proxy@af@@QAEXXZ
?set_web_cb@server@proxy@af@@QAEXV?$function@$$A6AHABUweb_callback_param@@AAUweb_callback_out@@@Z@boost@@@Z
?upload@http_client@proxy@af@@QAEHABVaf_stringA@@_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?upload@http_client@proxy@af@@QAEHABVaf_stringW@@_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?get_host@http_client@proxy@af@@QAEIPADI@Z
?web_cb_copy_content@server@proxy@af@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$vector@EV?$allocator@E@std@@@5@@Z
?stop@http_client@proxy@af@@QAEXXZ
?download@http_client@proxy@af@@QAEHABVaf_stringW@@_N@Z
?set_proxy@http_client@proxy@af@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H@Z
?set_follow_redirect@http_client@proxy@af@@QAEX_N@Z
?add_header@http_client@proxy@af@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z
?set_content_encoding@http_client@proxy@af@@QAEXW4form_enc_type@request@23@@Z
?set_form_string@http_client@proxy@af@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z
??0http_client@proxy@af@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@I_N0I@Z
??1http_client@proxy@af@@QAE@XZ
?result@http_client@proxy@af@@QAEABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?add_rule@filter_rule_list@proxy@af@@UAEXAAVfilter_rule@23@@Z
?apply@ua_in_filter@proxy@af@@UAEPAVfilter_rule@23@PAVhttp_msg@23@@Z
?apply@in_filter@proxy@af@@UAEPAVfilter_rule@23@PAVhttp_msg@23@@Z
WSAIoctl
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
socket
getsockname
bind
WSASocketW
listen
ntohs
htons
gethostname
WSARecv
shutdown
WSASend
setsockopt
ioctlsocket
closesocket
WSAStartup
freeaddrinfo
WSACleanup
htonl
ntohl
WSAAddressToStringA
WSASetLastError
WSAGetLastError
WSAStringToAddressA
inet_ntoa
select
getaddrinfo
GetAcceptExSockaddrs
AcceptEx
PathIsRootW
PathIsDirectoryW
SHCopyKeyW
PathFileExistsW
PathAddBackslashW
PathBuildRootW
PathAppendW
SetupDiClassGuidsFromNameExW
SetupDiGetClassDevsExW
SetupDiEnumDeviceInfo
SetupDiGetDeviceInfoListDetailW
CM_Get_Device_ID_ExW
SetupDiGetDeviceRegistryPropertyW
mixerGetControlDetailsW
mixerOpen
mixerGetLineInfoW
mixerClose
mixerGetLineControlsW
GetAdaptersInfo
InternetCrackUrlA
SHGetFolderPathW
StringFromGUID2
??0filter@proxy@af@@QAE@XZ
??0in_filter@proxy@af@@QAE@XZ
??0in_filter_base@proxy@af@@QAE@XZ
??0unblock_in_filter@proxy@af@@QAE@XZ
??1filter@proxy@af@@UAE@XZ
??1in_filter@proxy@af@@UAE@XZ
??1in_filter_base@proxy@af@@UAE@XZ
??1localdomain_in_filter@proxy@af@@UAE@XZ
??1localhost_in_filter@proxy@af@@UAE@XZ
??1localip_in_filter@proxy@af@@UAE@XZ
??1ua_in_filter@proxy@af@@UAE@XZ
??1unblock_in_filter@proxy@af@@UAE@XZ
??_Flogger@proxy@af@@QAEXXZ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ