Driver intelligenceVulnerableVerified

Kinkajou.sys

Kinkajou.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.

UUID / 56610446-9914-41f6-a028-33640a683c9dADDED / 2026-04-17AUTHOR / Michael Haag

Known samples 1

0 recorded TRUE · 1 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

Kinkajou.sysSample 1 · HVCI FALSE

MD5: eb59b40453b7d61b14559155c176e527
SHA1: 261e06eca5649465b6f18641841ee58f966693c3
SHA256: f5dd6db447868c2964c1d109e7d2cc31ebdace198b3d0a02cfba5b7ef7ae6964
Imphash: 3be76d9d3a7d0bbcdfea3e19cd85f633
Authentihash MD5: 7e2640d868eb4565598c90e4c2f0062d
Authentihash SHA1: 851e088bb12ea2e77324329999694972673e21a7
Authentihash SHA256: c48e5dbc0726c55d22c8682f54321cdeb79e383f78e75e246d1fc54d5c45da9f
Machine: AMD64
Version: Not recorded
Publisher: Not recorded

Download vulnerable sample View on VirusTotal

Recorded command

sc.exe create Kinkajou binPath=C:\windows\temp\Kinkajou.sys type=kernel && sc.exe start Kinkajou

Elevate privileges · Privileges: kernel · OS: Windows 10

Research & references

Acknowledgement: @rainbowdynamix, @DbgPrint