CmdID / Files

ktapi.sys

Kontron Technology Application Programming Interface file version info

Driver on Windows LOLDrivers vulnerable driver

A known vulnerable driver

from LOLDrivers

T1562.001

Its entryhttps://www.loldrivers.io/drivers/8a6aebaa-34aa-46e8-a864-4189a55fd17b/

3 known samples

1.0.2118 built by: WinDDK · its entry

89ba754861e11d9db4440b2b5db61fd5bee16752e4623c4271b8fdd0a666c677

1.0.2118 built by: WinDDK · its entry

9ca9432b0d29204cb5420a1a6b01533d4552130c2a8a5ecd7837efadefb4a046

1.0.1899 built by: WinDDK · its entry

7ee17efef04bb7c9de90d5210263ed6993f867e5a11f86e65e3bb1362c7de237

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real ktapi.sys?

file version info and known copies

ProductKTAPI System Driver, Kontron Technology A/S

DescriptionKontron Technology Application Programming Interface

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.