← Back to driver explorer
Driver intelligenceVulnerableVerified
PDFWKRNL.sys
The Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.
Known samples 4
2 recorded TRUE · 2 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
PDFWKRNL.sysSample 1 · HVCI FALSE
- MD5
057ec65bac5e786affeb97c0a0d1db15- SHA1
16a091bfd1fd616d4607cac367782b1d2ab07491- SHA256
0cf84400c09582ee2911a5b1582332c992d1cd29fcf811cb1dc00fcd61757db0- Imphash
3f4c9025125027e307b7e52dd577303b- Authentihash MD5
88f43386706a10bf13406da24ff3ce17- Authentihash SHA1
2bb6572b167727925c082adbe1f68671c1198fe4- Authentihash SHA256
6370c82c2dbdf93608cccb88d78468edeb27f5d08f9ed0baf161842c0751f6a4- Machine
- AMD64
- Version
- 1.0
- Publisher
- Advanced Micro Devices, Inc.
PDFWKRNL.sysSample 2 · HVCI TRUE
- MD5
0b0447072ada1636a14087574a512c82- SHA1
e28b754d4d332ea57349110c019d841cf4d27356- SHA256
5df689a62003d26df4aefbaed41ec1205abbf3a2e18e1f1d51b97711e8fcdf00- Imphash
f5df2479285c7b593b3630b8357032e3- Authentihash MD5
afe828d66195a0e13579137ca102238b- Authentihash SHA1
b0e839e75e4a607e1697a6a8a246d11bcca712e0- Authentihash SHA256
cd5bff03256b98922b47a2725128540953a0ac15bd2be204196917d0c707a9cb- Machine
- AMD64
- Version
- 1.1
- Publisher
- Advanced Micro Devices, Inc.
PDFWKRNL.sysSample 3 · HVCI TRUE
- MD5
f0db5af13c457a299a64cf524c64b042- SHA1
a24840e32071e0f64e1dff8ca540604896811587- SHA256
6945077a6846af3e4e2f6a2f533702f57e993c5b156b6965a552d6a5d63b7402- Imphash
3f4c9025125027e307b7e52dd577303b- Authentihash MD5
d255a6146ab4e75a6ac362cf07641180- Authentihash SHA1
661a1a28950cec3f2c3d0e72ab2a05d4a173cf9a- Authentihash SHA256
fc23abdcf93928e1db8401a7ff53c86c85230a8637c4168f7434208f9e8b5ded- Machine
- AMD64
- Version
- 1.0
- Publisher
- Advanced Micro Devices, Inc.
PDFWKRNL.sysSample 4 · HVCI FALSE
- MD5
19c0c18384d6a6d65462be891692df9c- SHA1
2ee7b3f6bcc9e95a9ae60bcb9bbc483b0400077d- SHA256
f190919f1668652249fa23d8c0455acbde9d344089fde96566239b1a18b91da2- Imphash
3f4c9025125027e307b7e52dd577303b- Authentihash MD5
813f710d7941bc8df3fd60625dcae48a- Authentihash SHA1
531ae2d8f7aa301b74a37b82b5f3cadbf91962e0- Authentihash SHA256
b49b7bcf44242dac00ca559dca217ec5d935b78c963f23bd0f49f53a610dd569- Machine
- AMD64
- Version
- 1.0
- Publisher
- Advanced Micro Devices, Inc.
Recorded command
sc.exe create PDFWKRNLsys binPath= C:\windows\temp\PDFWKRNLsys.sys type=kernel && sc.exe start PDFWKRNLsysElevate privileges · Privileges: kernel · OS: Windows 10