PDFWKRNL.sys

USB-C Power Delivery Firmware Update Utility Driver file version info

Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it

A known vulnerable driver

from LOLDrivers

T1068Exploitation for Privilege Escalation

Its entrieshttps://www.loldrivers.io/drivers/ed27c0b8-6177-4132-a7af-5c15bcb386f3/
https://www.loldrivers.io/drivers/fded7e63-0470-40fe-97ed-aa83fd027bad/

6 known samples

1.1 · its entry

5df689a62003d26df4aefbaed41ec1205abbf3a2e18e1f1d51b97711e8fcdf00

1.0 · its entry

0cf84400c09582ee2911a5b1582332c992d1cd29fcf811cb1dc00fcd61757db0

1.0 · its entry

6945077a6846af3e4e2f6a2f533702f57e993c5b156b6965a552d6a5d63b7402

1.0 · its entry

6e8b49cf70bf854e8c59c7d27cefa89406caf8978461190dabb86dafcd8554e1

1.0 · its entry

e9745f1791b2a6374711756e89c7bf2864e52f9ff467974f2f7bdc667f9f28c6

1.0 · its entry

f190919f1668652249fa23d8c0455acbde9d344089fde96566239b1a18b91da2

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real PDFWKRNL.sys?

file version info and known copies

ProductUSB-C Power Delivery Firmware Update Utility Driver, Advanced Micro Devices, Inc.

DescriptionUSB-C Power Delivery Firmware Update Utility Driver

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.

What detects it

Sigma

Sigma names PDFWKRNL.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.