PDrv.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2026-06-03 03:37 VT 0/70

Driver Name: PDrv.sys
MD5: 69333331d75d463af8c38a02e002be68
SHA1: be752a8faeea6bb514b06637ad6802148c9de8cb
SHA256: 05c38e6aa925421398bef2b998f074547705241179ad32ff1eb501a92e36f39d
Imphash: 31ecad157d307c0dbfb712b4b48a5d0b
Vhash: 034066651d1516151iz23xz
Authentihash: 6d8474089cd6b1305b6ed445515778dde89160f0b84d8bb3fb8571e6397235d1
Rich PE header hash: ce01e6777a12dd7b9cfd964d6ad50968
SSDEEP: 384:ZWzyJLxkLe5zKHq1amliUYD9vTeqQde5AGNAl20PDNAfoP3h3cscmeR9zxO:XLxka5eK8mlWvTDNqhDNz3c7N9zQ
TLSH: T1A8E25BB262E554C2E9A7D834D274C923FCB5F64B1B22C5EF82A0D4582D337D8D938786
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2026-06-03 03:37
SpcSpOpusInfo: Langtu Digital
VT detections: 0/70
Compilation time: 2026-05-17
PDB path: C:\Users\Administrator\source\repos\MyDriver1\ProxyProtectDriver\x64\Release\ProxyProtectDriver.pdb
Country submitter: China, United States
Flag: Malicious

Description

Functionality: A kernel driver that forces a victim's proxy settings to an attacker-controlled PAC file and blocks anyone from changing them.

- Registry lock: Uses CmRegisterCallbackEx to watch every user's Internet Settings hive and deny writes, deletions, and key operations from any process not on a 32-entry allow-list.

- Proxy hijack: Sets AutoConfigURL to hxxp://107.149.188[.]164:2690/baidu.txt and overwrites the connection-settings blobs, so victim traffic follows the attacker's PAC.

- Persistence: User mode cannot remove the setting.