Analysis of superman.sys: malicious verdict, risk score 88/100. 2 YARA matches, 40/76 multi-engine detections. SHA256 0052aa88e42055a2. Kernel imports, IOCTL codes, MITRE ATT&CK, and code-signing details.
DriverShield analyzed the Windows kernel driver superman.sys and assigned a verdict of Malicious with a composite risk score of 88/100, indicating malicious indicators (80-100 band).
| Verdict | Malicious (88/100) |
| YARA matches | 2 |
| Multi-engine detections | 40 / 76 |
| File size | 56592 bytes |
| Code-signing signer | GlobalSign CodeSigning CA - G2 |
| Analyzed | 2026-09-06 |
| SHA256 | 0052aa88e42055a2eed5ddd17c3499c692360155e5e031a211edfcef577acce3 |
| SHA1 | c80d7fe8279ddfd466505a24b9c8cc7a68b9d0e4 |
| MD5 | 98b8507e725b3d28537fc374eb2de72d |
Version resource data embedded in the superman.sys PE header, as extracted by the analysis engine.
| File description | GMER Driver http://www.gmer.net |
|---|---|
| Product | GMER |
| Company | GMER |
| Original filename | gmer64.sys |
| Internal name | gmer64.sys |
| File version | 2, 0, 6983 built by: WinDDK |
| Copyright | Copyright (C) GMER 2003-2013 |
Each component is scored 0-100 and then weighted into the composite. See the analysis methodology for the exact formula.
| Component | Sub-score |
|---|---|
| Multi-engine consensus | 0 / 100 |
| YARA signature matches | 100 / 100 |
| Dangerous kernel imports | 100 / 100 |
| IOCTL dispatch surface | 100 / 100 |
| Known-vulnerable corpus | 100 / 100 |
| Code-signing state | 80 / 100 |
| Packing and entropy | 0 / 100 |
| Dynamic behaviour | 0 / 100 |
| CVE cross-reference | 0 / 100 |
Kernel-mode APIs resolved from the Import Address Table of superman.sys, ranked by exploitation relevance.
| API | Risk | Why it matters |
|---|---|---|
| ZwMapViewOfSection | critical | Highly dangerous - potential for arbitrary code execution, memory corruption, or process termination |
| MmMapLockedPagesSpecifyCache | critical | Highly dangerous - potential for arbitrary code execution, memory corruption, or process termination |
| ZwTerminateProcess | critical | Highly dangerous - potential for arbitrary code execution, memory corruption, or process termination |
| PsLookupProcessByProcessId | high | Potentially dangerous - could be used for privilege escalation or security bypass |
| MmGetSystemRoutineAddress | high | Potentially dangerous - could be used for privilege escalation or security bypass |
| KeAttachProcess | high | Potentially dangerous - could be used for privilege escalation or security bypass |
| ZwOpenProcess | high | Potentially dangerous - could be used for privilege escalation or security bypass |
| KeBugCheckEx | medium | Moderate risk - system modification capability |
| ZwQuerySystemInformation | medium | Moderate risk - system modification capability |
| ZwDeleteFile | medium | Moderate risk - system modification capability |
| ZwSetInformationFile | medium | Moderate risk - system modification capability |
| ObReferenceObjectByHandle | medium | Moderate risk - system modification capability |
| ObOpenObjectByPointer | medium | Moderate risk - system modification capability |
| IoGetDeviceObjectPointer | medium | Moderate risk - system modification capability |
| ZwDeleteKey | medium | Moderate risk - system modification capability |
| ZwWriteFile | medium | Moderate risk - system modification capability |
| ZwOpenKey | low | Standard kernel API - generally benign |
| ZwQueryInformationFile | low | Standard kernel API - generally benign |
| ZwClose | low | Standard kernel API - generally benign |
| ExAllocatePool | low | Standard kernel API - generally benign |
| IoCreateDevice | low | Standard kernel API - generally benign |
| KeInitializeEvent | low | Standard kernel API - generally benign |
| IoCreateSymbolicLink | low | Standard kernel API - generally benign |
| ZwOpenFile | low | Standard kernel API - generally benign |
| ZwQueryValueKey | low | Standard kernel API - generally benign |
| ZwReadFile | low | Standard kernel API - generally benign |
| RtlInitUnicodeString | low | Standard kernel API - generally benign |
| IoDeleteDevice | low | Standard kernel API - generally benign |
Showing the 28 highest-relevance imports of 33 resolved.
Control codes reachable through the driver dispatch routine. Codes tied to published exploit code are flagged, since they are the primary Bring Your Own Vulnerable Driver (BYOVD) entry points.
| Code | Severity | Transfer | Description |
|---|---|---|---|
| 0x9876C094 | critical (known exploit) | METHOD_BUFFERED | Process termination by PID |
| 0x0080840F | high | METHOD_NEITHER | FILE_DEVICE_CUSTOM Function #259 |
| 0x00808D8B | high | METHOD_NEITHER | FILE_DEVICE_CUSTOM Function #866 |
| 0x002200F0 | medium | METHOD_BUFFERED | FILE_DEVICE_UNKNOWN Function #60 |
| 0x9876C004 | medium | METHOD_BUFFERED | CUSTOM_PROCESS Function #1 |
| 0x9876C050 | medium | METHOD_BUFFERED | CUSTOM_PROCESS Function #20 |
| 0x9876C040 | medium | METHOD_BUFFERED | CUSTOM_PROCESS Function #16 |
| 0x9876C008 | medium | METHOD_BUFFERED | CUSTOM_PROCESS Function #2 |
| 0x9876C084 | medium | METHOD_BUFFERED | CUSTOM_PROCESS Function #33 |
| 0x9876C088 | medium | METHOD_BUFFERED | CUSTOM_PROCESS Function #34 |
| 0x00808F05 | medium | METHOD_IN_DIRECT | FILE_DEVICE_CUSTOM Function #961 |
| 0x9876B941 | medium | METHOD_IN_DIRECT | CUSTOM_PROCESS Function #3664 |
| 0x008024BC | medium | METHOD_BUFFERED | FILE_DEVICE_CUSTOM Function #2351 |
| 0x0080248C | medium | METHOD_BUFFERED | FILE_DEVICE_CUSTOM Function #2339 |
| 0x00802484 | medium | METHOD_BUFFERED | FILE_DEVICE_CUSTOM Function #2337 |
| 0x0080249C | medium | METHOD_BUFFERED | FILE_DEVICE_CUSTOM Function #2343 |
| 0x0080EC81 | medium | METHOD_IN_DIRECT | FILE_DEVICE_CUSTOM Function #2848 |
| 0x0022D315 | medium | METHOD_IN_DIRECT | FILE_DEVICE_UNKNOWN Function #1221 |
| 0x00228F1D | medium | METHOD_IN_DIRECT | FILE_DEVICE_UNKNOWN Function #967 |
| 0x00228B1D | medium | METHOD_IN_DIRECT | FILE_DEVICE_UNKNOWN Function #711 |
| 0x00220116 | medium | METHOD_OUT_DIRECT | FILE_DEVICE_UNKNOWN Function #69 |
| 0x00220120 | medium | METHOD_BUFFERED | FILE_DEVICE_UNKNOWN Function #72 |
| 0x00340308 | medium | METHOD_BUFFERED | FILE_DEVICE_DISK Function #194 |
| 0x00340036 | medium | METHOD_OUT_DIRECT | FILE_DEVICE_DISK Function #13 |
Section layout and Shannon entropy. High entropy in a code section is a packing or encryption indicator.
| Section | Virtual size | Raw size | Entropy | Flags |
|---|---|---|---|---|
| .text | 0x9ED1 | 0xA000 | 6.16 | CODE, EXEC, READ |
| .rdata | 0x0E44 | 0x1000 | 4.18 | IDATA, READ |
| .data | 0x0F50 | 0x0200 | 0.3 | IDATA, READ, WRITE |
| .pdata | 0x0468 | 0x0600 | 3.46 | IDATA, READ |
| INIT | 0x0ACE | 0x0C00 | 4.82 | CODE, EXEC, READ, WRITE, DISCARD |
| .rsrc | 0x0368 | 0x0400 | 2.99 | IDATA, READ, DISCARD |
| Control Flow Guard | Not enabled |
|---|---|
| ASLR | Not enabled |
| DEP | Not enabled |
| Integrity check | Not enforced |
| Mitigation score | 5 / 100 |
| Rule | Severity | Detects |
|---|---|---|
| BYOVD_ProcKill | critical | Process termination EDR killer |
| MAL_EDRKiller | critical | Generic EDR killer pattern |
Techniques this driver could enable if loaded by an adversary.
| ID | Technique | Tactic |
|---|---|---|
| T1003.001 | OS Credential Dumping: LSASS Memory | Credential Access |
| T1055.001 | Process Injection: DLL Injection | Defense Evasion |
| T1055.012 | Process Hollowing | Defense Evasion |
| T1068 | Exploitation for Privilege Escalation | Privilege Escalation |
| T1211 | Exploitation for Defense Evasion | Defense Evasion |
| T1489 | Service Stop | Impact |
| T1543.003 | Windows Service | Persistence |
| T1553.002 | Subvert Trust Controls: Code Signing | Defense Evasion |
| T1562.001 | Disable/Modify Tools | Defense Evasion |
| T1569.002 | Service Execution | Execution |
| T1652 | Device Driver Discovery | Discovery |
| Signer | GlobalSign CodeSigning CA - G2 |
|---|---|
| Signer organisation | GlobalSign nv-sa |
| Issuer | GlobalSign Root CA |
| Serial | 400000000012F4EE1355C |
| Valid from | 2011-04-13 10:00 UTC |
| Valid until | 2019-04-13 10:00 UTC (expired) |
| Signature validity | Not verified |
Engine angr, status static_approximation, 0 paths explored at a maximum depth of 0. Vulnerability classes reached: 0. Exploitable paths: 0.
Corpus match: this hash is present in the known-vulnerable driver corpus DriverShield cross-references during analysis, which is why the score carries a full weighting on that component.
Based on DriverShield static and dynamic analysis, superman.sys is flagged as malicious and should be treated as dangerous. Its composite risk score is 88/100 (verdict: malicious). Always validate findings independently before acting.
superman.sys has a DriverShield composite risk score of 88/100, placing it in the malicious verdict band. SHA256: 0052aa88e42055a2eed5ddd17c3499c692360155e5e031a211edfcef577acce3.
superman.sys is a Windows kernel-mode driver (.sys) analyzed by DriverShield for vulnerabilities, BYOVD abuse potential, and malware indicators. It is code-signed by GlobalSign CodeSigning CA - G2.
Related: Other drivers signed by GlobalSign CodeSigning CA - G2 · What an IOCTL dispatch code is · How YARA matching feeds the score · BYOVD research index · full driver database · CVE library · code signing atlas