← Back to driver explorer
Driver intelligenceVulnerableVerified
vdk.sys
A vulnerable kernel driver that can be used to disable Code Integrity
Known samples 2
0 recorded TRUE · 0 recorded FALSE · 2 unknown for loading despite HVCI. Results apply to individual samples.
vdk.sysSample 1 · HVCI unknown
- MD5
b0b671c32576d55a02c712b15f167a51- SHA1
80dad0a6dbbd6e4535abbf5446f61c010e101aba- SHA256
1ca23e5a2a57522fbca4325eb0cc4c5b4f77610f3557862b7b6548efe2dff26b- Imphash
0314f30067e6b1b0687e9b7ade7720ac- Authentihash MD5
6258cb5a25bb2ea89f1c75d153ce27b2- Authentihash SHA1
402d31b93abd526d901ea28a5b427ee7eba17ffd- Authentihash SHA256
3b9499627b7a87dd611a2de18dec33274f438607fddbd31716119997ddbabee2- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
vdk.sysSample 2 · HVCI unknown
- MD5
411bf69a3b8b498dbad84d2764ea2878- SHA1
a048fb2a98036248292612b5ffb15cdd8af41c95- SHA256
2b5e3d36dcbae483ecbbc29725f21bf17438cd286f2f1c5eeea81502a75e695a- Imphash
0859485bc1a79ac75cbcce07f2ff1c8f- Authentihash MD5
e7fd36b8c455196403998504bda5d2b7- Authentihash SHA1
a7374e62e88952069acc986ebab16f3d24b88063- Authentihash SHA256
093f886ab11212cacdbc5e1eedac657a2d3209987e5fd45c7b164a44fcd63a8b- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
Recorded command
sc.exe create vdk binPath=C:\windows\temp\vdk.sys type=kernel && sc.exe start vdkElevate privileges · Privileges: kernel · OS: Windows 10
Research & references
Acknowledgement: Andrea Monzani, Davide Netti, Antonio Parata