plnu3v.sys - Clean (15/100) - DriverShield Analysis

Analysis of plnu3v.sys: clean verdict, risk score 15/100. 0 YARA matches, 0/71 multi-engine detections. SHA256 9924ab761ccb504b. Kernel imports, IOCTL codes, MITRE ATT&CK, and code-signing details.

plnu3v.sys - Analysis Report

DriverShield analyzed the Windows kernel driver plnu3v.sys and assigned a verdict of Clean with a composite risk score of 15/100, indicating no notable risk signals (0-29 band).

VerdictClean (15/100)
YARA matches0
Multi-engine detections0 / 71
File size80256 bytes
Code-signing signerSymantec Time Stamping Services CA - G2
Analyzed2026-07-09
SHA2569924ab761ccb504bd696f72cc6321d9df29865db760a50be3294ac2a3e0680c1
SHA12e718729799004da0d48a36087dbae3d6ad1d530
MD5c545cde084473362b5676dd6a9161e7b

Driver identity

Version resource data embedded in the plnu3v.sys PE header, as extracted by the analysis engine.

File descriptionBasler pylon USB3 Vision Driver
ProductBasler pylon USB3 Vision Protocol Stack
CompanyBasler
Original filenameUXDRV.SYS
Internal nameUXDRV.SYS
File version11.3.0.0 built by: WinDDK
CopyrightCopyright (c) 2012-2019 Basler AG

How the 15/100 score breaks down

Each component is scored 0-100 and then weighted into the composite. See the analysis methodology for the exact formula.

ComponentSub-score
Multi-engine consensus0 / 100
YARA signature matches0 / 100
Dangerous kernel imports30 / 100
IOCTL dispatch surface42 / 100
Known-vulnerable corpus0 / 100
Code-signing state80 / 100
Packing and entropy0 / 100
Dynamic behaviour0 / 100
CVE cross-reference0 / 100

Kernel imports (5)

Kernel-mode APIs resolved from the Import Address Table of plnu3v.sys, ranked by exploitation relevance.

APIRiskWhy it matters
MmGetSystemRoutineAddresshighPotentially dangerous - could be used for privilege escalation or security bypass
KeBugCheckExmediumModerate risk - system modification capability
RtlInitUnicodeStringlowStandard kernel API - generally benign
DbgPrintlowStandard kernel API - generally benign
ExAllocatePoolWithTaglowStandard kernel API - generally benign

IOCTL dispatch codes (14)

Control codes reachable through the driver dispatch routine. Codes tied to published exploit code are flagged, since they are the primary Bring Your Own Vulnerable Driver (BYOVD) entry points.

CodeSeverityTransferDescription
0x002200F0mediumMETHOD_BUFFEREDFILE_DEVICE_UNKNOWN Function #60
0x0034B841mediumMETHOD_IN_DIRECTFILE_DEVICE_DISK Function #3600
0x00802494mediumMETHOD_BUFFEREDFILE_DEVICE_CUSTOM Function #2341
0x0080248CmediumMETHOD_BUFFEREDFILE_DEVICE_CUSTOM Function #2339
0x00802484mediumMETHOD_BUFFEREDFILE_DEVICE_CUSTOM Function #2337
0x0080BA18mediumMETHOD_BUFFEREDFILE_DEVICE_CUSTOM Function #3718
0x0034FDE8mediumMETHOD_BUFFEREDFILE_DEVICE_DISK Function #3962
0x0034A70DmediumMETHOD_IN_DIRECTFILE_DEVICE_DISK Function #2499
0x0080EC81mediumMETHOD_IN_DIRECTFILE_DEVICE_CUSTOM Function #2848
0x0034BA18mediumMETHOD_BUFFEREDFILE_DEVICE_DISK Function #3718
0x00340348mediumMETHOD_BUFFEREDFILE_DEVICE_DISK Function #210
0x00220068mediumMETHOD_BUFFEREDFILE_DEVICE_UNKNOWN Function #26
0x00340025mediumMETHOD_IN_DIRECTFILE_DEVICE_DISK Function #9
0x008002A2mediumMETHOD_OUT_DIRECTFILE_DEVICE_CUSTOM Function #168

PE sections

Section layout and Shannon entropy. High entropy in a code section is a packing or encryption indicator.

SectionVirtual sizeRaw sizeEntropyFlags
.text0x7BD00x7C006.31CODE, EXEC, READ
.rdata0x09140x0A005IDATA, READ
.data0x13200x04001.51IDATA, READ, WRITE
.pdata0x05F40x06004.48IDATA, READ
PAGE0x475B0x48006.32CODE, EXEC, READ
INIT0x07940x08005.87CODE, EXEC, READ, WRITE, DISCARD
.rsrc0x10800x12003.53IDATA, READ, DISCARD
.reloc0x012C0x02001.44IDATA, READ, DISCARD

Exploit mitigations

Control Flow GuardNot enabled
ASLRNot enabled
DEPNot enabled
Integrity checkNot enforced
Mitigation score5 / 100

MITRE ATT&CK techniques (5)

Techniques this driver could enable if loaded by an adversary.

IDTechniqueTactic
T1071Application Layer ProtocolCommand and Control
T1211Exploitation for Defense EvasionDefense Evasion
T1543.003Windows ServicePersistence
T1553.002Subvert Trust Controls: Code SigningDefense Evasion
T1652Device Driver DiscoveryDiscovery

Code-signing chain

SignerSymantec Time Stamping Services CA - G2
Signer organisationSymantec Corporation
IssuerThawte Timestamping CA
Serial7E93EBFB7CC64E59EA4B9A77D406FC3B
Valid from2012-12-21 00:00 UTC
Valid until2020-12-30 23:59 UTC (expired)
Signature validityNot verified

Symbolic execution

Engine angr, status completed, 85 paths explored at a maximum depth of 85. Vulnerability classes reached: 0. Exploitable paths: 4.

Frequently asked questions about plnu3v.sys

Is plnu3v.sys safe?

Based on DriverShield static and dynamic analysis, plnu3v.sys is assessed as clean, with no notable risk signals. Its composite risk score is 15/100 (verdict: clean). Always validate findings independently before acting.

What is the risk score of plnu3v.sys?

plnu3v.sys has a DriverShield composite risk score of 15/100, placing it in the clean verdict band. SHA256: 9924ab761ccb504bd696f72cc6321d9df29865db760a50be3294ac2a3e0680c1.

What is plnu3v.sys?

plnu3v.sys is a Windows kernel-mode driver (.sys) analyzed by DriverShield for vulnerabilities, BYOVD abuse potential, and malware indicators. It is code-signed by Symantec Time Stamping Services CA - G2.

Related: Other drivers signed by Symantec Time Stamping Services CA - G2 · What an IOCTL dispatch code is · BYOVD research index · full driver database · CVE library · code signing atlas


DriverShield © 2025-2026 · Terms · Privacy · Contact