kEvP64.sys - Malicious (88/100) - DriverShield Analysis

Analysis of kEvP64.sys: malicious verdict, risk score 88/100. 7 YARA matches, 35/75 multi-engine detections. SHA256 1aaa9aef39cb3c0a. Kernel imports, IOCTL codes, MITRE ATT&CK, and code-signing details.

kEvP64.sys - Analysis Report

DriverShield analyzed the Windows kernel driver kEvP64.sys and assigned a verdict of Malicious with a composite risk score of 88/100, indicating malicious indicators (80-100 band).

VerdictMalicious (88/100)
YARA matches7
Multi-engine detections35 / 75
File size177816 bytes
Code-signing signerSymantec Time Stamping Services CA - G2
Analyzed2026-09-06
SHA2561aaa9aef39cb3c0a854ecb4ca7d3b213458f302025e0ec5bfbdef973cca9111c
SHA1f3db629cfe37a73144d5258e64d9dd8b38084cf4
MD520125794b807116617d43f02b616e092

Driver identity

Version resource data embedded in the kEvP64.sys PE header, as extracted by the analysis engine.

File descriptionPowerTool
ProductPowerTool
CompanyPowerTool
Original filenamekEvP64.sys
Internal namekEvP64.sys
File version1.0.1.0 built by: WinDDK
CopyrightPowerTool

How the 88/100 score breaks down

Each component is scored 0-100 and then weighted into the composite. See the analysis methodology for the exact formula.

ComponentSub-score
Multi-engine consensus0 / 100
YARA signature matches100 / 100
Dangerous kernel imports100 / 100
IOCTL dispatch surface100 / 100
Known-vulnerable corpus100 / 100
Code-signing state80 / 100
Packing and entropy0 / 100
Dynamic behaviour0 / 100
CVE cross-reference0 / 100

Kernel imports (36)

Kernel-mode APIs resolved from the Import Address Table of kEvP64.sys, ranked by exploitation relevance.

APIRiskWhy it matters
MmMapIoSpacecriticalHighly dangerous - potential for arbitrary code execution, memory corruption, or process termination
ZwTerminateProcesscriticalHighly dangerous - potential for arbitrary code execution, memory corruption, or process termination
MmMapLockedPagesSpecifyCachecriticalHighly dangerous - potential for arbitrary code execution, memory corruption, or process termination
PsSetCreateProcessNotifyRoutinehighPotentially dangerous - could be used for privilege escalation or security bypass
ObRegisterCallbackshighPotentially dangerous - could be used for privilege escalation or security bypass
MmGetSystemRoutineAddresshighPotentially dangerous - could be used for privilege escalation or security bypass
HalSetBusDataByOffsethighPotentially dangerous - could be used for privilege escalation or security bypass
PsLookupProcessByProcessIdhighPotentially dangerous - could be used for privilege escalation or security bypass
HalGetBusDataByOffsethighPotentially dangerous - could be used for privilege escalation or security bypass
KeBugCheckExmediumModerate risk - system modification capability
ObOpenObjectByPointermediumModerate risk - system modification capability
PsSetLoadImageNotifyRoutinemediumModerate risk - system modification capability
MmUnmapIoSpacemediumModerate risk - system modification capability
ObReferenceObjectByHandlemediumModerate risk - system modification capability
IoGetDeviceObjectPointermediumModerate risk - system modification capability
PsSetCreateThreadNotifyRoutinemediumModerate risk - system modification capability
ZwQuerySystemInformationmediumModerate risk - system modification capability
IofCompleteRequestlowStandard kernel API - generally benign
KeWaitForSingleObjectlowStandard kernel API - generally benign
ProbeForWritelowStandard kernel API - generally benign
IoCreateDevicelowStandard kernel API - generally benign
DbgPrintlowStandard kernel API - generally benign
IoDeleteDevicelowStandard kernel API - generally benign
ProbeForReadlowStandard kernel API - generally benign
KeInitializeEventlowStandard kernel API - generally benign
ExAllocatePoolWithTaglowStandard kernel API - generally benign
KeSetEventlowStandard kernel API - generally benign
ExAllocatePoollowStandard kernel API - generally benign

Showing the 28 highest-relevance imports of 36 resolved.

IOCTL dispatch codes (40)

Control codes reachable through the driver dispatch routine. Codes tied to published exploit code are flagged, since they are the primary Bring Your Own Vulnerable Driver (BYOVD) entry points.

CodeSeverityTransferDescription
0x0022201Ccritical (known exploit)METHOD_BUFFEREDProcess termination by PID (wsftprm)
0x00347883highMETHOD_NEITHERFILE_DEVICE_DISK Function #3616
0x002205C7highMETHOD_NEITHERFILE_DEVICE_UNKNOWN Function #369
0x00345453highMETHOD_NEITHERFILE_DEVICE_DISK Function #1300
0x00345243highMETHOD_NEITHERFILE_DEVICE_DISK Function #1168
0x0080083BhighMETHOD_NEITHERFILE_DEVICE_CUSTOM Function #526
0x0022015BhighMETHOD_NEITHERFILE_DEVICE_UNKNOWN Function #86
0x002200F0mediumMETHOD_BUFFEREDFILE_DEVICE_UNKNOWN Function #60
0x0080C981mediumMETHOD_IN_DIRECTFILE_DEVICE_CUSTOM Function #608
0x008024BCmediumMETHOD_BUFFEREDFILE_DEVICE_CUSTOM Function #2351
0x00802484mediumMETHOD_BUFFEREDFILE_DEVICE_CUSTOM Function #2337
0x0080248CmediumMETHOD_BUFFEREDFILE_DEVICE_CUSTOM Function #2339
0x0080B841mediumMETHOD_IN_DIRECTFILE_DEVICE_CUSTOM Function #3600
0x0034247CmediumMETHOD_BUFFEREDFILE_DEVICE_DISK Function #2335
0x00802531mediumMETHOD_IN_DIRECTFILE_DEVICE_CUSTOM Function #2380
0x00803D00mediumMETHOD_BUFFEREDFILE_DEVICE_CUSTOM Function #3904
0x00342444mediumMETHOD_BUFFEREDFILE_DEVICE_DISK Function #2321
0x00802494mediumMETHOD_BUFFEREDFILE_DEVICE_CUSTOM Function #2341
0x00222190mediumMETHOD_BUFFEREDFILE_DEVICE_UNKNOWN Function #2148
0x0022219CmediumMETHOD_BUFFEREDFILE_DEVICE_UNKNOWN Function #2151
0x002221A4mediumMETHOD_BUFFEREDFILE_DEVICE_UNKNOWN Function #2153
0x0080C481mediumMETHOD_IN_DIRECTFILE_DEVICE_CUSTOM Function #288
0x0034B315mediumMETHOD_IN_DIRECTFILE_DEVICE_DISK Function #3269
0x00340036mediumMETHOD_OUT_DIRECTFILE_DEVICE_DISK Function #13

Showing 24 of 40 extracted control codes.

PE sections

Section layout and Shannon entropy. High entropy in a code section is a packing or encryption indicator.

SectionVirtual sizeRaw sizeEntropyFlags
.text0x1BECD0x1C0005.6CODE, EXEC, READ
.rdata0x3AB80x3C005.01IDATA, READ
.data0x6C800x68004.88IDATA, READ, WRITE
.pdata0x0A8C0x0C004.61IDATA, READ
PAGE0x0D0D0x0E005.33CODE, EXEC, READ
INIT0x0FD40x10005.5CODE, EXEC, READ, WRITE, DISCARD
.rsrc0x03180x04002.65IDATA, READ, DISCARD
.reloc0x00180x02000.12IDATA, READ, DISCARD

Exploit mitigations

Control Flow GuardNot enabled
ASLRNot enabled
DEPNot enabled
Integrity checkNot enforced
Mitigation score5 / 100

YARA rule matches (7)

RuleSeverityDetects
PUA_VULN_Driver_Powertool_Kevpsys_Powertool_09B0mediumDetects vulnerable driver mentioned in known-vulnerable driver corpus project using VersionInfo values from the PE header - kEvP64.sys. Investigate matches in context: expected filenames or standard v...
PUA_VULN_Driver_Powertool_Kevpsys_Powertool_7C0FmediumDetects vulnerable driver mentioned in known-vulnerable driver corpus project using VersionInfo values from the PE header - kEvP64.sys
BYOVD_MemRWcriticalPhys memory mapping + device creation
BYOVD_ProcKillcriticalProcess termination EDR killer
SUSP_PhysMemhighPhysical memory mapping
SUSP_CallbacksmediumKernel callback registration
MAL_EDRKillercriticalGeneric EDR killer pattern

MITRE ATT&CK techniques (19)

Techniques this driver could enable if loaded by an adversary.

IDTechniqueTactic
T1003OS Credential DumpingCredential Access
T1003.001OS Credential Dumping: LSASS MemoryCredential Access
T1006Direct Volume AccessDefense Evasion
T1014RootkitDefense Evasion
T1055.001Process Injection: DLL InjectionDefense Evasion
T1055.012Process HollowingDefense Evasion
T1068Exploitation for Privilege EscalationPrivilege Escalation
T1071Application Layer ProtocolCommand and Control
T1211Exploitation for Defense EvasionDefense Evasion
T1489Service StopImpact
T1542.001Pre-OS Boot: System FirmwarePersistence
T1543.003Windows ServicePersistence
T1553.002Subvert Trust Controls: Code SigningDefense Evasion
T1562.001Disable/Modify ToolsDefense Evasion
T1562.006Indicator BlockingDefense Evasion
T1564.001Hidden Files and DirectoriesDefense Evasion
T1569.002Service ExecutionExecution
T1601Modify System ImageDefense Evasion
T1652Device Driver DiscoveryDiscovery

Code-signing chain

SignerSymantec Time Stamping Services CA - G2
Signer organisationSymantec Corporation
IssuerThawte Timestamping CA
Serial7E93EBFB7CC64E59EA4B9A77D406FC3B
Valid from2012-12-21 00:00 UTC
Valid until2020-12-30 23:59 UTC (expired)
Signature validityNot verified

Symbolic execution

Engine angr, status completed, 27 paths explored at a maximum depth of 27. Vulnerability classes reached: 0. Exploitable paths: 0.

Corpus match: this hash is present in the known-vulnerable driver corpus DriverShield cross-references during analysis, which is why the score carries a full weighting on that component.

Frequently asked questions about kEvP64.sys

Is kEvP64.sys safe?

Based on DriverShield static and dynamic analysis, kEvP64.sys is flagged as malicious and should be treated as dangerous. Its composite risk score is 88/100 (verdict: malicious). Always validate findings independently before acting.

What is the risk score of kEvP64.sys?

kEvP64.sys has a DriverShield composite risk score of 88/100, placing it in the malicious verdict band. SHA256: 1aaa9aef39cb3c0a854ecb4ca7d3b213458f302025e0ec5bfbdef973cca9111c.

What is kEvP64.sys?

kEvP64.sys is a Windows kernel-mode driver (.sys) analyzed by DriverShield for vulnerabilities, BYOVD abuse potential, and malware indicators. It is code-signed by Symantec Time Stamping Services CA - G2.

Related: Other drivers signed by Symantec Time Stamping Services CA - G2 · What an IOCTL dispatch code is · How YARA matching feeds the score · BYOVD research index · full driver database · CVE library · code signing atlas


DriverShield © 2025-2026 · Terms · Privacy · Contact