jhacdrv.sys

Malicious 罗克佳华（重庆）科技有限公司 2021-02-23 06:11 VT 20/73

Driver Name: jhacdrv.sys
MD5: 6fd5f0a344a3f915daec5ed6866e7476
SHA1: d3c3e165773a9e88b9677a15f4abd53f7335988b
SHA256: bd9b4ea827067b624e7f05d3b663e9d61439feefaa800e30e126ff0407301793
Imphash: 60550ac5cd8b9ca236d14dea35864d33
Vhash: 064066651d1516551iz3dxz
Authentihash: 016f6c0433e0f2f3b6373c40b04ed5f7cac915b5dfe87f7f54c2ee29cd11594e
Rich PE header hash: 3d980cca65d1a2c4265f04d4a93e17a8
SSDEEP: 768:RkXTbpEdogqZS+wtHJnzuSh+/nfh+aQDj4vl8cdgfpgloLVZIBFfkpeUerhAb2JZ:CHwjQRFdgSl0IeeUeXt
TLSH: T1B7639D06A7A454E6ED279A3182E4EA53FFB1B586177183DF0328C1594F23BD0AE3C359
Signer: 罗克佳华（重庆）科技有限公司
Signing date: 2021-02-23 06:11
SpcSpOpusInfo: 罗克佳华（重庆）科技有限公司
VT detections: 20/73
Compilation time: 2021-02-23
PDB path: C:\home\work\code\jhacdrv-cpp\x64\Win7Release\jhacdrv.pdb
Country submitter: United States
Flag: Malicious

Description

A file-system minifilter plus kernel APC shellcode injector that watches PsSetCreateProcessNotifyRoutine / PsSetLoadImageNotifyRoutine for a list of mostly Office/PDF targets (WINWORD, EXCEL, POWERPNT, wps/et/wpp/wpspdf, AcroRd32, FoxitReader, notepad, explorer). For each match, it ZwAllocateVirtualMemory(RWX)-allocates one of two OS-build-selected LoadLibraryW stubs — plus the appended module name, jhcpflt.dll or 123.DLL — and schedules it with KeInitializeApc(ApcMode=UserMode) + KeInsertQueueApc so the stub runs in the target thread without a user-mode loader