DBUtil_2_3.Sys - Malicious (88/100) - DriverShield Analysis

Analysis of DBUtil_2_3.Sys: malicious verdict, risk score 88/100. 3 YARA matches, 1/75 multi-engine detections. SHA256 87e38e7aeaaaa96e. Kernel imports, IOCTL codes, MITRE ATT&CK, and code-signing details.

DBUtil_2_3.Sys - Analysis Report

DriverShield analyzed the Windows kernel driver DBUtil_2_3.Sys and assigned a verdict of Malicious with a composite risk score of 88/100, indicating malicious indicators (80-100 band).

Verdict	Malicious (88/100)
YARA matches	3
Multi-engine detections	1 / 75
File size	13304 bytes
Code-signing signer	VeriSign Time Stamping Services Signer - G2
Analyzed	2026-09-06
SHA256	87e38e7aeaaaa96efe1a74f59fca8371de93544b7af22862eb0e574cec49c7c3
SHA1	c6920171fa6dff2c17eb83befb5fd28e8dddf5f0
MD5	084bd27e151fef55b5d80025c3114d35

How the 88/100 score breaks down

Each component is scored 0-100 and then weighted into the composite. See the analysis methodology for the exact formula.

Component	Sub-score
Multi-engine consensus	0 / 100
YARA signature matches	100 / 100
Dangerous kernel imports	100 / 100
IOCTL dispatch surface	0 / 100
Known-vulnerable corpus	100 / 100
Code-signing state	80 / 100
Packing and entropy	0 / 100
Dynamic behaviour	0 / 100
CVE cross-reference	40 / 100

Kernel imports (10)

Kernel-mode APIs resolved from the Import Address Table of DBUtil_2_3.Sys, ranked by exploitation relevance.

API	Risk	Why it matters
MmMapIoSpace	critical	Highly dangerous - potential for arbitrary code execution, memory corruption, or process termination
MmAllocateContiguousMemorySpecifyCache	high	Potentially dangerous - could be used for privilege escalation or security bypass
MmGetPhysicalAddress	high	Potentially dangerous - could be used for privilege escalation or security bypass
MmUnmapIoSpace	medium	Moderate risk - system modification capability
KeBugCheckEx	medium	Moderate risk - system modification capability
IoCreateDevice	low	Standard kernel API - generally benign
IofCompleteRequest	low	Standard kernel API - generally benign
IoDeleteDevice	low	Standard kernel API - generally benign
IoCreateSymbolicLink	low	Standard kernel API - generally benign
RtlInitUnicodeString	low	Standard kernel API - generally benign

PE sections

Section layout and Shannon entropy. High entropy in a code section is a packing or encryption indicator.

Section	Virtual size	Raw size	Entropy	Flags
.text	0x04B6	0x0600	5.33	CODE, EXEC, READ
.rdata	0x0108	0x0200	3.08	IDATA, READ
.data	0x0060	0x0200	1.4	IDATA, READ, WRITE
PAGE	0x0513	0x0600	5.49	CODE, EXEC, READ
INIT	0x02BA	0x0400	4.19	CODE, EXEC, READ, WRITE, DISCARD
.reloc	0x00A2	0x0200	1.35	IDATA, READ, DISCARD

Exploit mitigations

Control Flow Guard	Not enabled
ASLR	Not enabled
DEP	Not enabled
Integrity check	Not enforced
Mitigation score	5 / 100

No CFG - Control Flow Guard is not enabled. Indirect call targets are not validated, making the driver susceptible to control flow hijacking via corrupted function pointers or vtables.
No ASLR - ASLR is disabled. The driver loads at a predictable address, enabling reliable exploitation of memory corruption vulnerabilities.
No DEP - DEP is disabled. Data pages are executable, allowing shellcode execution from stack/heap buffers.
Expired Certificate - The driver is signed but the certificate has expired. Windows may still load it depending on revocation policy.

YARA rule matches (3)

Rule	Severity	Detects
VULN_DBUtil	critical	Dell dbutil_2_3.sys CVE-2021-21551
BYOVD_MemRW	critical	Phys memory mapping + device creation
SUSP_PhysMem	high	Physical memory mapping

MITRE ATT&CK techniques (10)

Techniques this driver could enable if loaded by an adversary.

ID	Technique	Tactic
T1003	OS Credential Dumping	Credential Access
T1003.001	OS Credential Dumping: LSASS Memory	Credential Access
T1006	Direct Volume Access	Defense Evasion
T1055.012	Process Hollowing	Defense Evasion
T1068	Exploitation for Privilege Escalation	Privilege Escalation
T1071	Application Layer Protocol	Command and Control
T1543.003	Windows Service	Persistence
T1562.001	Impair Defenses	Defense Evasion
T1569.002	Service Execution	Execution
T1652	Device Driver Discovery	Discovery

Code-signing chain

Signer	VeriSign Time Stamping Services Signer - G2
Signer organisation	VeriSign, Inc.
Issuer	VeriSign Time Stamping Services CA
Serial	3825D7FAF861AF9EF490E726B5D65AD5
Valid from	2007-06-15 00:00 UTC
Valid until	2012-06-14 23:59 UTC (expired)
Signature validity	Not verified

Certificate revision: 0x0200
Certificate type: PKCS#7
Chain: VeriSign Time Stamping Services CA
Chain: VeriSign Class 3 Code Signing 2004 CA
Chain: Dell Inc.

Associated CVEs

CVE-2021-21551 - Dell dbutil driver - insufficient access control, local privilege escalation

Symbolic execution

Engine angr, status completed, 4 paths explored at a maximum depth of 4. Vulnerability classes reached: 0. Exploitable paths: 0.

Corpus match: this hash is present in the known-vulnerable driver corpus DriverShield cross-references during analysis, which is why the score carries a full weighting on that component.

Frequently asked questions about DBUtil_2_3.Sys

Is DBUtil_2_3.Sys safe?

Based on DriverShield static and dynamic analysis, DBUtil_2_3.Sys is flagged as malicious and should be treated as dangerous. Its composite risk score is 88/100 (verdict: malicious). Always validate findings independently before acting.

What is the risk score of DBUtil_2_3.Sys?

DBUtil_2_3.Sys has a DriverShield composite risk score of 88/100, placing it in the malicious verdict band. SHA256: 87e38e7aeaaaa96efe1a74f59fca8371de93544b7af22862eb0e574cec49c7c3.

What is DBUtil_2_3.Sys?

DBUtil_2_3.Sys is a Windows kernel-mode driver (.sys) analyzed by DriverShield for vulnerabilities, BYOVD abuse potential, and malware indicators. It is code-signed by VeriSign Time Stamping Services Signer - G2.