Driver intelligenceVulnerableVerified

gibepext.sys

gibepext.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.

UUID / 1e69f91e-4ec5-4c6a-b4a4-2279808b6545ADDED / 2026-04-17AUTHOR / Michael Haag

Known samples 1

1 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

gibepext.sysSample 1 · HVCI TRUE

MD5: 98b2adeb673ec8dfd390af389c32513f
SHA1: 0e6f6c0ff3b3146e7c82615869327d0a8d29fab4
SHA256: 912ee11b2ea9d30519f56735e8a4720101bcacd077c6634cf32eb228b2d96e13
Imphash: 253b4102bf3b989b207f0c458f8a3abe
Authentihash MD5: 827ddc66b64293dc87140d228f892258
Authentihash SHA1: 06207fcb4c90d84877410e334b2fe77fa151d5ea
Authentihash SHA256: 59dca87987273c41d84a4da4c67dc05ba1d560c683bd4d9405e003fb81db6a9b
Machine: AMD64
Version: 1.2.37.0
Publisher: Group-IB LTD.

Download vulnerable sample View on VirusTotal

Recorded command

sc.exe create gibepext binPath=C:\windows\temp\gibepext.sys type=kernel && sc.exe start gibepext

Elevate privileges · Privileges: kernel · OS: Windows 10

Research & references

Acknowledgement: @rainbowdynamix, @DbgPrint