vgk.sys - Suspicious (32/100) - DriverShield Analysis

Analysis of vgk.sys: suspicious verdict, risk score 32/100. 0 YARA matches, 0/76 multi-engine detections. SHA256 6eb0a1c67cd31f16. Kernel imports, IOCTL codes, MITRE ATT&CK, and code-signing details.

vgk.sys - Analysis Report

DriverShield analyzed the Windows kernel driver vgk.sys and assigned a verdict of Suspicious with a composite risk score of 32/100, indicating some risk signals warranting review (30-59 band).

Verdict	Suspicious (32/100)
YARA matches	0
Multi-engine detections	0 / 76
File size	38039992 bytes
Code-signing signer	DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
Analyzed	2026-04-14
SHA256	6eb0a1c67cd31f16567be689a2cbf9c8b5d2c675eeadf709c4a0c837fc5bc701
SHA1	19967c1b2d6cf5f6c5e07a37f04fc603aad97dd6
MD5	94e3f1f0f23f8ec2f9845fc2ca556d58

Driver identity

Version resource data embedded in the vgk.sys PE header, as extracted by the analysis engine.

File description	Vanguard kernel-mode driver.
Product	Vanguard Driver
Company	Riot Games, Inc.
Original filename	vgk.sys
Internal name	vgk.sys
File version	1.17.13.23
Copyright	Copyright (C) 2021

How the 32/100 score breaks down

Each component is scored 0-100 and then weighted into the composite. See the analysis methodology for the exact formula.

Component	Sub-score
Multi-engine consensus	0 / 100
YARA signature matches	0 / 100
Dangerous kernel imports	90 / 100
IOCTL dispatch surface	100 / 100
Known-vulnerable corpus	0 / 100
Code-signing state	0 / 100
Packing and entropy	80 / 100
Dynamic behaviour	0 / 100
CVE cross-reference	0 / 100

Kernel imports (10)

Kernel-mode APIs resolved from the Import Address Table of vgk.sys, ranked by exploitation relevance.

API	Risk	Why it matters
MmMapLockedPagesSpecifyCache	critical	Highly dangerous - potential for arbitrary code execution, memory corruption, or process termination
ObReferenceObjectByHandle	medium	Moderate risk - system modification capability
ZwQuerySystemInformation	medium	Moderate risk - system modification capability
ZwWriteFile	medium	Moderate risk - system modification capability
KeBugCheckEx	medium	Moderate risk - system modification capability
RtlInitUnicodeString	low	Standard kernel API - generally benign
ZwReadFile	low	Standard kernel API - generally benign
ProbeForRead	low	Standard kernel API - generally benign
ZwClose	low	Standard kernel API - generally benign
ExAllocatePoolWithTag	low	Standard kernel API - generally benign

IOCTL dispatch codes (40)

Control codes reachable through the driver dispatch routine. Codes tied to published exploit code are flagged, since they are the primary Bring Your Own Vulnerable Driver (BYOVD) entry points.

Code	Severity	Transfer	Description
0x00808D8B	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #866
0x98766BCF	high	METHOD_NEITHER	CUSTOM_PROCESS Function #2803
0x0022E013	high	METHOD_NEITHER	FILE_DEVICE_UNKNOWN Function #2052
0x0034011F	high	METHOD_NEITHER	FILE_DEVICE_DISK Function #71
0x0022011F	high	METHOD_NEITHER	FILE_DEVICE_UNKNOWN Function #71
0x0022BBFF	high	METHOD_NEITHER	FILE_DEVICE_UNKNOWN Function #3839
0x0022840F	high	METHOD_NEITHER	FILE_DEVICE_UNKNOWN Function #259
0x0022850F	high	METHOD_NEITHER	FILE_DEVICE_UNKNOWN Function #323
0x00808557	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #341
0x003472CF	high	METHOD_NEITHER	FILE_DEVICE_DISK Function #3251
0x0022A583	high	METHOD_NEITHER	FILE_DEVICE_UNKNOWN Function #2400
0x0080857F	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #351
0x8273173B	high	METHOD_NEITHER	CUSTOM_VIRAGT Function #1486
0x00808D6F	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #859
0x0080EB17	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #2757
0x00225A4B	high	METHOD_NEITHER	FILE_DEVICE_UNKNOWN Function #1682
0x00228C9F	high	METHOD_NEITHER	FILE_DEVICE_UNKNOWN Function #807
0x003419E7	high	METHOD_NEITHER	FILE_DEVICE_DISK Function #1657
0x00347C6B	high	METHOD_NEITHER	FILE_DEVICE_DISK Function #3866
0x00809A4B	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #1682
0x0080CB57	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #725
0x8273FFFF	high	METHOD_NEITHER	CUSTOM_VIRAGT Function #4095
0x00808DEF	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #891
0x00808D57	high	METHOD_NEITHER	FILE_DEVICE_CUSTOM Function #853

Showing 24 of 40 extracted control codes.

PE sections

Section layout and Shannon entropy. High entropy in a code section is a packing or encryption indicator.

Section	Virtual size	Raw size	Entropy	Flags
.text	0x611D0	0x61200	6.11	CODE, IDATA, EXEC, READ
	0x1000	0x1000	0.38	CODE, IDATA, EXEC, READ
_ENTROPY	0x0040	0x0200	0	CODE, IDATA, EXEC, READ
.rdata	0xE4DC	0xE600	5.87	IDATA, READ
.data	0x1122C	0x2A00	5.87	IDATA, READ, WRITE
.pdata	0x24C0	0x2600	7.91	IDATA, READ
.nt	0x4000	0x4000	0	IDATA, READ, WRITE
.edata	0x00C6	0x0200	0.62	IDATA, READ
INIT	0x0958	0x0A00	5.02	IDATA, READ, WRITE
.stub0	0x3F99C	0x3FA00	6.56	CODE, IDATA, EXEC, READ
.reloc	0x041C	0x0600	4.27	IDATA, READ, DISCARD
.rsrc	0x5D4C	0x5E00	3.32	IDATA, READ, DISCARD
.grfn1	0x2330474	0x2330600	6.04	CODE, IDATA, EXEC, READ

Exploit mitigations

Control Flow Guard	Not enabled
ASLR	Enabled
DEP	Enabled
Integrity check	Enforced
Mitigation score	75 / 100

• No CFG - Control Flow Guard is not enabled. Indirect call targets are not validated, making the driver susceptible to control flow hijacking via corrupted function pointers or vtables.
• ASLR Enabled - Address Space Layout Randomization is active - base address is randomized on each load.
• DEP/NX Enabled - Data Execution Prevention is active - non-executable pages cannot be executed.
• Valid Signature - The driver has a valid, non-expired digital signature.
• Force Integrity - IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY is set - the OS validates the signature before loading.
• Packed Section: .pdata - Section has entropy 7.91 (threshold: 7.0), indicating possible packing or encrypted content.

MITRE ATT&CK techniques (9)

Techniques this driver could enable if loaded by an adversary.

ID	Technique	Tactic
T1003.001	OS Credential Dumping: LSASS Memory	Credential Access
T1055.012	Process Hollowing	Defense Evasion
T1068	Exploitation for Privilege Escalation	Privilege Escalation
T1071	Application Layer Protocol	Command and Control
T1211	Exploitation for Defense Evasion	Defense Evasion
T1543.003	Windows Service	Persistence
T1553.002	Subvert Trust Controls: Code Signing	Defense Evasion
T1569.002	Service Execution	Execution
T1652	Device Driver Discovery	Discovery

Code-signing chain

Signer	DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
Signer organisation	DigiCert, Inc.
Issuer	DigiCert Trusted Root G4
Serial	8AD40B260D29C4C9F5ECDA9BD93AED9
Valid from	2021-04-29 00:00 UTC
Valid until	2036-04-28 23:59 UTC
Signature validity	Verified

• Certificate revision: 0x0200
• Certificate type: PKCS#7
• Chain: Riot Games, Inc.

Symbolic execution

Engine angr, status static_approximation, 0 paths explored at a maximum depth of 0. Vulnerability classes reached: 0. Exploitable paths: 0.

Frequently asked questions about vgk.sys

Is vgk.sys safe?

Based on DriverShield static and dynamic analysis, vgk.sys shows some suspicious signals and warrants manual review. Its composite risk score is 32/100 (verdict: suspicious). Always validate findings independently before acting.

What is the risk score of vgk.sys?

vgk.sys has a DriverShield composite risk score of 32/100, placing it in the suspicious verdict band. SHA256: 6eb0a1c67cd31f16567be689a2cbf9c8b5d2c675eeadf709c4a0c837fc5bc701.

What is vgk.sys?

vgk.sys is a Windows kernel-mode driver (.sys) analyzed by DriverShield for vulnerabilities, BYOVD abuse potential, and malware indicators. It is code-signed by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1.

Related: Other drivers signed by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 · What an IOCTL dispatch code is · BYOVD research index · full driver database · CVE library · code signing atlas

---

DriverShield © 2025-2026 · Terms · Privacy · Contact