Over last few months I have been publishing various stats pulled out of malware collection that I am batch analyzing. The purpose of analysis is not only just getting interesting numbers and utilizing it as a nice filler for the blog 🙂 – all this data is being retrieved with a purpose of enhancing HexDive and for my other projects.Until now, I have been presenting data from a superset of all malicious PE files in a collection. It crossed my mind recently that it would be interesting to focus on a subset of PE files as well and for starters I picked up kernel drivers.
Getting all strings and then cherrypicking up system functions out of the samples is relatively quick as there is not so many of them – the result of top 100 most popular APIs sorted by number of occurrence is presented below:
18431 RtlInitUnicodeString 16625 IofCompleteRequest 16214 ExAllocatePoolWithTag 14783 ZwClose 12899 MmGetSystemRoutineAddress 12002 ZwOpenKey 11911 ObfDereferenceObject 11719 IoCreateDevice 11430 IoGetCurrentProcess 11411 ExFreePool 11395 IoDeleteDevice 11198 RtlAnsiStringToUnicodeString 10969 ZwCreateFile 10895 wcslen 10848 strncmp 10672 strncpy 10585 wcscpy 10195 IoCreateSymbolicLink 10141 swprintf 9957 wcscat 9899 PsCreateSystemThread 9495 MmIsAddressValid 9466 ZwSetValueKey 9112 PsLookupProcessByProcessId 9106 ObReferenceObjectByHandle 8971 PsGetVersion 8630 ZwCreateKey 8600 RtlCopyUnicodeString 8334 KeDelayExecutionThread 7925 RtlCompareUnicodeString 7886 wcsncpy 7861 ZwQueryValueKey 7525 KeTickCount 7135 KeQuerySystemTime 7052 IoRegisterDriverReinitialization 6674 PsSetCreateProcessNotifyRoutine 5968 ExFreePoolWithTag 5671 ZwEnumerateKey 5427 ZwQuerySystemInformation 5414 ZwSetInformationFile 5249 ZwDeleteKey 5072 wcsstr 5017 KeWaitForSingleObject 4922 ZwCreateSection 4855 ZwMapViewOfSection 4757 IoDeleteSymbolicLink 4747 PsTerminateSystemThread 4708 wcschr 4605 wcsrchr 4540 KeServiceDescriptorTable 4226 KeQueryTimeIncrement 4218 ZwUnmapViewOfSection 4070 IoDeviceObjectType 3941 ZwReadFile 3740 KeInitializeEvent 3706 KeInitializeTimer 3562 ObQueryNameString 3538 ZwWriteFile 3522 KeSetEvent 3495 DbgPrint 3470 KeGetCurrentIrql 3381 KeBugCheckEx 3313 ZwQueryInformationFile 3286 ZwOpenFile 3232 IoFreeMdl 3171 RtlInitAnsiString 3043 memcpy 3037 IofCallDriver 2897 memset 2892 RtlFreeUnicodeString 2870 IoAllocateMdl 2629 MmProbeAndLockPages 2461 MmUnlockPages 2349 RtlUnicodeStringToAnsiString 2340 ZwAllocateVirtualMemory 2291 IoFreeIrp 2265 MmMapLockedPagesSpecifyCache 2144 KeGetCurrentThread 2134 KfReleaseSpinLock 2090 RtlFreeAnsiString 2031 KeStackAttachProcess 2025 KfRaiseIrql 2022 KfLowerIrql 1997 IoAllocateIrp 1997 ExAllocatePool 1994 RtlCompareMemory 1967 ExGetPreviousMode 1930 RtlTimeToTimeFields 1918 sprintf 1896 KeUnstackDetachProcess 1884 KfAcquireSpinLock 1870 ZwOpenProcess 1808 PsGetCurrentProcessId 1795 KeReleaseMutex 1747 RtlAppendUnicodeToString 1746 KeInitializeSpinLock 1740 IoCreateFile 1729 ProbeForRead 1727 KeClearEvent 1713 RtlUnwind