CmdID / Files

BdApiUtil64.sys

Baidu Antivirus BdApi Driver file version info

Driver on Windows LOLDrivers vulnerable driver

A known vulnerable driver

from LOLDrivers

T1068Exploitation for Privilege Escalation

Its entryhttps://www.loldrivers.io/drivers/f8ed41ef-18f0-441c-99b8-def062214d0e/

1 known sample

5,0,3,84333 · its entry

47ec51b5f0ede1e70bd66f3f0152f9eb536d534565dbb7fcc3a05f542dbe4428

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real BdApiUtil64.sys?

file version info and known copies

ProductBaidu Antivirus, Baidu, Inc.

DescriptionBaidu Antivirus BdApi Driver

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.