UWACPIDriver.sys - Clean (11/100) - DriverShield Analysis

Analysis of UWACPIDriver.sys: clean verdict, risk score 11/100. 0 YARA matches, 0/75 multi-engine detections. SHA256 5b4208d762dad4fe. Kernel imports, IOCTL codes, MITRE ATT&CK, and code-signing details.

UWACPIDriver.sys - Analysis Report

DriverShield analyzed the Windows kernel driver UWACPIDriver.sys and assigned a verdict of Clean with a composite risk score of 11/100, indicating no notable risk signals (0-29 band).

Verdict	Clean (11/100)
YARA matches	0
Multi-engine detections	0 / 75
File size	43776 bytes
Code-signing signer	GlobalSign Extended Validation CodeSigning CA - SHA256 - G3
Analyzed	2026-04-02
SHA256	5b4208d762dad4fec1cfc66adcea29dbb3644e917ba77944306c390b90ce2a20
SHA1	349404f0fc0312bf2da5e4453885270b54db5827
MD5	1c09f0eb631fb1c75e4ee4966f4a6579

How the 11/100 score breaks down

Each component is scored 0-100 and then weighted into the composite. See the analysis methodology for the exact formula.

Component	Sub-score
Multi-engine consensus	0 / 100
YARA signature matches	0 / 100
Dangerous kernel imports	15 / 100
IOCTL dispatch surface	36 / 100
Known-vulnerable corpus	0 / 100
Code-signing state	80 / 100
Packing and entropy	0 / 100
Dynamic behaviour	0 / 100
CVE cross-reference	0 / 100

Kernel imports (3)

Kernel-mode APIs resolved from the Import Address Table of UWACPIDriver.sys, ranked by exploitation relevance.

API	Risk	Why it matters
MmGetSystemRoutineAddress	high	Potentially dangerous - could be used for privilege escalation or security bypass
DbgPrintEx	low	Standard kernel API - generally benign
RtlInitUnicodeString	low	Standard kernel API - generally benign

IOCTL dispatch codes (12)

Control codes reachable through the driver dispatch routine. Codes tied to published exploit code are flagged, since they are the primary Bring Your Own Vulnerable Driver (BYOVD) entry points.

Code	Severity	Transfer	Description
0x0022BB07	high	METHOD_NEITHER	FILE_DEVICE_UNKNOWN Function #3777
0x0080830F	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #195
0x002200F0	medium	METHOD_BUFFERED	FILE_DEVICE_UNKNOWN Function #60
0x00802484	medium	METHOD_BUFFERED	FILE_DEVICE_CUSTOM Function #2337
0x0080248C	medium	METHOD_BUFFERED	FILE_DEVICE_CUSTOM Function #2339
0x9C40A498	medium	METHOD_BUFFERED	CUSTOM_LENOVO Function #2342
0x9C40A4A0	medium	METHOD_BUFFERED	CUSTOM_LENOVO Function #2344
0x9C40A4C0	medium	METHOD_BUFFERED	CUSTOM_LENOVO Function #2352
0x9C40A4E4	medium	METHOD_BUFFERED	CUSTOM_LENOVO Function #2361
0x9C40A504	medium	METHOD_BUFFERED	CUSTOM_LENOVO Function #2369
0x00802494	medium	METHOD_BUFFERED	FILE_DEVICE_CUSTOM Function #2341
0x008002A2	medium	METHOD_OUT_DIRECT	FILE_DEVICE_CUSTOM Function #168

PE sections

Section layout and Shannon entropy. High entropy in a code section is a packing or encryption indicator.

Section	Virtual size	Raw size	Entropy	Flags
.text	0x33A5	0x3400	5.63	CODE, EXEC, READ
.rdata	0x0A88	0x0C00	4.52	IDATA, READ
.data	0x03D0	0x0200	0.85	IDATA, READ, WRITE
.pdata	0x0300	0x0400	3.29	IDATA, READ
PAGE	0x0C8C	0x0E00	5.14	CODE, EXEC, READ
INIT	0x0452	0x0600	4.33	CODE, EXEC, READ, DISCARD
.reloc	0x003C	0x0200	0.75	IDATA, READ, DISCARD

Exploit mitigations

Control Flow Guard	Enabled
ASLR	Enabled
DEP	Enabled
Integrity check	Not enforced
Mitigation score	85 / 100

CFG Enabled - Control Flow Guard is active - indirect calls are validated against a bitmap of valid targets at runtime.
ASLR Enabled - Address Space Layout Randomization is active - base address is randomized on each load.
DEP/NX Enabled - Data Execution Prevention is active - non-executable pages cannot be executed.
Expired Certificate - The driver is signed but the certificate has expired. Windows may still load it depending on revocation policy.

MITRE ATT&CK techniques (5)

Techniques this driver could enable if loaded by an adversary.

ID	Technique	Tactic
T1071	Application Layer Protocol	Command and Control
T1211	Exploitation for Defense Evasion	Defense Evasion
T1543.003	Windows Service	Persistence
T1553.002	Subvert Trust Controls: Code Signing	Defense Evasion
T1652	Device Driver Discovery	Discovery

Code-signing chain

Signer	GlobalSign Extended Validation CodeSigning CA - SHA256 - G3
Signer organisation	GlobalSign nv-sa
Issuer	GlobalSign
Serial	481B6A07A9424C1EAAFEF3CDF10F
Valid from	2016-06-15 00:00 UTC
Valid until	2024-06-15 00:00 UTC (expired)
Signature validity	Not verified

Certificate revision: 0x0200
Certificate type: PKCS#7
Chain: DigiCert Trusted Root G4
Chain: Uniwill Technology Inc.
Chain: DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA
Chain: DigiCert Timestamp 2022 - 2

Symbolic execution

Engine angr, status completed, 82 paths explored at a maximum depth of 82. Vulnerability classes reached: 0. Exploitable paths: 4.

Frequently asked questions about UWACPIDriver.sys

Is UWACPIDriver.sys safe?

Based on DriverShield static and dynamic analysis, UWACPIDriver.sys is assessed as clean, with no notable risk signals. Its composite risk score is 11/100 (verdict: clean). Always validate findings independently before acting.

What is the risk score of UWACPIDriver.sys?

UWACPIDriver.sys has a DriverShield composite risk score of 11/100, placing it in the clean verdict band. SHA256: 5b4208d762dad4fec1cfc66adcea29dbb3644e917ba77944306c390b90ce2a20.

What is UWACPIDriver.sys?

UWACPIDriver.sys is a Windows kernel-mode driver (.sys) analyzed by DriverShield for vulnerabilities, BYOVD abuse potential, and malware indicators. It is code-signed by GlobalSign Extended Validation CodeSigning CA - SHA256 - G3.