Driver intelligenceVulnerableVerified

PMAD.sys

PMAD.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.

UUID / ec5012bb-789a-436d-be22-b343c331f7c7ADDED / 2026-04-17AUTHOR / Michael Haag

Known samples 1

0 recorded TRUE · 1 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

PMAD.sysSample 1 · HVCI FALSE

MD5: 53974a34efe846f62c0a192f9673b1f9
SHA1: ba4465ae960baf8d86be7d6fc9eb431e38eb6c78
SHA256: 37784d01f84aa4d60c8738f7a75dac1bf712941fc08ed9f32f3e89d044d9c71f
Imphash: 1dfb4aa99d5e3cf0fa035bedef447fc8
Authentihash MD5: cd32ca59ff2a598beb24b77391ef4217
Authentihash SHA1: b44c72de09962ddb66485ea890c3eeb3f1f547de
Authentihash SHA256: 5a7228ccc80fc1f2760beea3603c856d64c8cae35496af7275e60d646f2671b5
Machine: AMD64
Version: 2.1.2.5
Publisher: Catalyst Enterprises Inc.

Download vulnerable sample View on VirusTotal

Recorded command

sc.exe create PMAD binPath=C:\windows\temp\PMAD.sys type=kernel && sc.exe start PMAD

Elevate privileges · Privileges: kernel · OS: Windows 10

Research & references

Acknowledgement: @rainbowdynamix, @DbgPrint