Driver intelligenceVulnerableVerified

OAToolx64.sys

OAToolx64.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.

UUID / 3a56286a-d6e2-4782-bd43-1e04869da8ccADDED / 2026-04-17AUTHOR / Michael Haag

Known samples 1

0 recorded TRUE · 1 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

OAToolx64.sysSample 1 · HVCI FALSE

MD5: 48342338a7d5a3a133bb2a565e2b15a2
SHA1: 04d9cb48852fc7b5dce26f610dc589cb2ff3fbe2
SHA256: e8d2424037f63aa395085c546aeac0cd7a09567a4e304c509e087d1b3ce199da
Imphash: 64be892635195c62ad5be44af59b50d3
Authentihash MD5: bac2003bb2025b381b438015a7bb2025
Authentihash SHA1: a1cddbb5d9a6bd00550fa134b3a7ea9e25af3d80
Authentihash SHA256: 4e81c37afc22d3e6cf3af7eafd660cb5919cf32b95b3359da30855b5f665e6ee
Machine: AMD64
Version: 1, 0, 0, 2
Publisher: Insyde Software

Download vulnerable sample View on VirusTotal

Recorded command

sc.exe create OAToolx64 binPath=C:\windows\temp\OAToolx64.sys type=kernel && sc.exe start OAToolx64

Elevate privileges · Privileges: kernel · OS: Windows 10

Research & references

Acknowledgement: @rainbowdynamix, @DbgPrint