Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
Static task
static1
Behavioral task
behavioral1
Sample
sysfilefix.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
sysfilefix.exe
Resource
win10v2004-20240802-en
Target
d666576f81e8b3f3d568213db22f5869_JaffaCakes118
Size
647KB
MD5
d666576f81e8b3f3d568213db22f5869
SHA1
323c0b07e6ccdce780e0929f29b14ad7aafec270
SHA256
cc3675256902bf7776666137931b0218d54af01821f618cfa772e596098de1ed
SHA512
4f100ea7596945ab5b1a60720606004fe2af0f0a271997dcd2ea4e15e7b666e5757ea8bd05f862d22224cdefe8a2ea389521a77cfde8294fe3eb65e0e4661bc5
SSDEEP
12288:gDEVYba3Q3jP/LR/JLLJJwmn+WodRnwAosrikfqKo3u1IiYZOzvb:RVYba3WP/l/JOJTwzsmmvo3uuXZOzz
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
c:\daily_build\svn2\oneshotonekill\trunk\src\OneShotOneKill\SysFileFix\ReleaseKS\sysfilefix.pdb
GetLongPathNameW
FileTimeToSystemTime
GetFileTime
MoveFileW
CopyFileW
CreateDirectoryW
GetCurrentDirectoryW
GetPrivateProfileStringW
SetFilePointer
FlushFileBuffers
GetFileSize
GetEnvironmentVariableW
GetTempPathW
GetFileAttributesExW
SetEndOfFile
FreeResource
GetDriveTypeW
ExpandEnvironmentStringsW
SearchPathW
VirtualAlloc
VirtualFree
WritePrivateProfileStringW
GetEnvironmentVariableA
GetSystemTime
SetEnvironmentVariableA
CompareStringW
CompareStringA
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
GetLocaleInfoW
GetConsoleMode
GetConsoleCP
SetConsoleCtrlHandler
GetSystemTimeAsFileTime
GetCurrentProcessId
FindNextFileW
QueryPerformanceCounter
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
LCMapStringW
LCMapStringA
GetTimeZoneInformation
IsValidCodePage
GetOEMCP
GetCPInfo
GetCurrentThread
TlsFree
TlsSetValue
TlsAlloc
GetSystemDefaultUILanguage
GetModuleFileNameA
GetStdHandle
GetModuleHandleA
HeapCreate
FatalAppExitA
GetVersionExW
GetProcAddress
LoadLibraryW
GetLogicalDriveStringsW
lstrcpyW
GetWindowsDirectoryW
lstrcatW
RemoveDirectoryW
WriteFile
lstrcmpW
CreateFileW
GetFileAttributesW
ReadFile
LocalFree
FindResourceExW
LockResource
FindClose
FindFirstFileW
Process32NextW
DeleteFileW
OpenProcess
Module32NextW
SetFileAttributesW
Module32FirstW
Process32FirstW
CreateToolhelp32Snapshot
TerminateProcess
GetLocalTime
GetLastError
GetSystemDirectoryW
Sleep
ExitProcess
TerminateThread
MoveFileExW
GetCommandLineW
WaitForSingleObject
GetVersion
LeaveCriticalSection
MultiByteToWideChar
InterlockedDecrement
GetCurrentThreadId
InterlockedIncrement
InitializeCriticalSection
SetLastError
SetErrorMode
DeleteCriticalSection
FlushInstructionCache
GetCurrentProcess
lstrcmpiW
FreeLibrary
CreateThread
CloseHandle
GetModuleFileNameW
LoadLibraryExW
EnterCriticalSection
FindResourceW
LoadResource
SizeofResource
GetModuleHandleW
RtlUnwind
GetStartupInfoW
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
ExitThread
HeapSize
HeapReAlloc
HeapDestroy
IsProcessorFeaturePresent
LoadLibraryA
HeapAlloc
GetProcessHeap
HeapFree
InterlockedCompareExchange
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
GetVersionExA
TlsGetValue
WideCharToMultiByte
RaiseException
lstrlenW
GetTickCount
GetWindowTextW
SetWindowLongW
DestroyWindow
CharNextW
DefWindowProcW
DialogBoxParamW
GetActiveWindow
GetDlgCtrlID
GetWindowLongW
SetCursor
PostMessageW
SetWindowPos
LoadCursorW
MapWindowPoints
GetClientRect
GetSysColor
GetParent
DrawTextW
GetWindowRect
CallWindowProcW
SystemParametersInfoW
LoadBitmapW
DrawIcon
MessageBoxW
GetWindow
EndDialog
BeginPaint
GetSystemMetrics
LoadImageW
GetDC
SendMessageW
GetIconInfo
IsCharAlphaNumericW
wsprintfA
DestroyIcon
CharLowerW
SetWindowTextW
ReleaseCapture
UnregisterClassA
SetCapture
InflateRect
InvalidateRect
ReleaseDC
wsprintfW
GetWindowTextLengthW
GetDlgItem
EndPaint
SetBkColor
GetDIBits
CreateDIBSection
BitBlt
LineTo
DeleteDC
ExtTextOutW
MoveToEx
DeleteObject
SelectObject
CreateCompatibleDC
SetTextColor
SetBkMode
CreateFontIndirectW
GetStockObject
GetObjectW
InitializeAcl
RegDeleteValueW
RegSetValueExW
RegGetKeySecurity
RegSetKeySecurity
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAce
AllocateAndInitializeSid
RegSetValueW
RegQueryValueW
RegEnumKeyW
RegOpenKeyW
RegCreateKeyW
StartServiceW
CloseServiceHandle
OpenServiceW
CreateServiceW
OpenSCManagerW
OpenProcessToken
IsValidSid
SetNamedSecurityInfoW
GetLengthSid
GetNamedSecurityInfoW
AdjustTokenPrivileges
GetAce
CopySid
GetSidSubAuthority
InitializeSid
GetAclInformation
GetSidLengthRequired
AddAce
LookupPrivilegeValueW
RegEnumValueW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
RegDeleteKeyW
RegQueryValueExW
RegCreateKeyExW
RegOpenKeyExW
CommandLineToArgvW
ExtractIconW
SHChangeNotify
SHGetFileInfoW
SHFileOperationW
SHGetSpecialFolderPathW
ShellExecuteW
ord59
SHGetFolderPathW
CoGetMalloc
StringFromCLSID
CoTaskMemAlloc
CoInitialize
CoTaskMemFree
CoUninitialize
CoTaskMemRealloc
CoCreateInstance
CoCreateGuid
VarUI4FromStr
SysFreeString
PathRemoveFileSpecW
SHGetValueW
SHSetValueW
StrToIntW
StrStrIW
PathFileExistsW
PathIsDirectoryEmptyW
StrChrW
StrStrW
StrRChrW
PathIsDirectoryW
_TrackMouseEvent
InitCommonControlsEx
TransparentBlt
InternetConnectW
HttpOpenRequestW
InternetSetOptionW
HttpSendRequestW
HttpQueryInfoW
InternetOpenUrlW
InternetOpenW
InternetCrackUrlW
HttpAddRequestHeadersW
InternetCloseHandle
InternetGetConnectedState
InternetReadFile
URLDownloadToFileW
GetModuleFileNameExW
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
GetAdaptersInfo
WSCDeinstallProvider
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ