838b676b1ee1e44a338b6945b283a7e18285fc463371541f84dd0ae24f20fa55

Sharing

Copy URL Twitter E-mail

General

Target

838b676b1ee1e44a338b6945b283a7e18285fc463371541f84dd0ae24f20fa55
Size

29KB
MD5

1eb9d3dd4f0555f23dfb0466662c9ba0
SHA1

0b74136adba4263c570f831b2dcc4cf51f08aede
SHA256

838b676b1ee1e44a338b6945b283a7e18285fc463371541f84dd0ae24f20fa55
SHA512

f8cdbf112afd77ec25df07a7f01ce292c0d9f030cad8bc228de91271c1f41c16ebf957a1a5bc1c34d881bbd9c316bfc228a58f4b076b9aeefff6921264c61116
SSDEEP

384:+TEDrKYxK0qm8hrNw95H/FI+NYzaIsNBlmvtdoNws40NrZk6kbvC:A+x/qVyI+4aTNBO3gwT0N266vC

Score

1^/10

Malware Config

Signatures

Files

838b676b1ee1e44a338b6945b283a7e18285fc463371541f84dd0ae24f20fa55
.dll windows:6 windows x64 arch:x64

85d437349ec0693f96547d9efc3b04ec

Code Sign

43:c1:0b:1c:00:00:00:00:51:d3:73:da
Certificate

Issuer

CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

10/06/2015, 13:46

Not After

10/11/2030, 14:16

Subject

CN=Entrust Code Signing CA - OVCS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

fc:9c:a2:83:16:f9:b5:58:00:00:00:00:55:66:79:d0
Certificate

Issuer

CN=Entrust Code Signing CA - OVCS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

30/10/2018, 16:32

Not After

05/12/2021, 17:02

Subject

CN=Commvault Systems\, Inc.,O=Commvault Systems\, Inc.,L=Tinton Falls,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

38:63:de:f8
Certificate

Issuer

CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

Not Before

24/12/1999, 17:50

Not After

24/07/2029, 14:15

Subject

CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

58:da:13:ff:00:00:00:00:51:ce:0d:f7
Certificate

Issuer

CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

Not Before

22/07/2015, 19:02

Not After

22/06/2029, 19:32

Subject

CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

8d:ce:15:f3:a7:94:c5:87:00:00:00:00:55:92:33:f4
Certificate

Issuer

CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

22/07/2020, 15:33

Not After

29/12/2030, 16:29

Subject

CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

fc:3d:e0:b5:b9:6a:b8:65:1a:50:68:19:52:52:d7:5e:d5:cd:28:6b:4e:a9:8c:14:8b:ab:7e:ae:b1:a4:3b:e2
Signer

Actual PE Digest

fc:3d:e0:b5:b9:6a:b8:65:1a:50:68:19:52:52:d7:5e:d5:cd:28:6b:4e:a9:8c:14:8b:ab:7e:ae:b1:a4:3b:e2

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\REL_11_0_0_B80\vaultcx\Build\x64\Release\Common\simW2kUtils.pdb

Imports

cvbasiclib

?getGalaxyDirectory@CVPI_Base@@QEAAPEBDXZ
??1CVPI_Base@@QEAA@XZ
??0CVPI_Base@@QEAA@XZ

cvfocus

?setFocus@CVPI_Focus@@SAXPEBDW4COMMVAULT_PRODUCT_TYPE@@_N@Z

kernel32

GetLastError
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead

advapi32

ChangeServiceConfig2A
OpenSCManagerA
OpenServiceA

msvcp140

?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z

vcruntime140

__std_exception_copy
__std_terminate
memmove
__CxxFrameHandler3
__C_specific_handler
memset
__std_exception_destroy
_CxxThrowException
__std_type_info_destroy_list

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn
_initterm_e
_initterm
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll

api-ms-win-crt-heap-l1-1-0

free
_callnewh
malloc

api-ms-win-crt-string-l1-1-0

strncpy

Exports

Exports

simW2KChangeServiceConfig

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 792B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 76B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

85d437349ec0693f96547d9efc3b04ec

Code Sign

43:c1:0b:1c:00:00:00:00:51:d3:73:daCertificate

Extended Key Usages

Key Usages

fc:9c:a2:83:16:f9:b5:58:00:00:00:00:55:66:79:d0Certificate

Extended Key Usages

Key Usages

38:63:de:f8Certificate

Key Usages

58:da:13:ff:00:00:00:00:51:ce:0d:f7Certificate

Extended Key Usages

Key Usages

8d:ce:15:f3:a7:94:c5:87:00:00:00:00:55:92:33:f4Certificate

Extended Key Usages

Key Usages

fc:3d:e0:b5:b9:6a:b8:65:1a:50:68:19:52:52:d7:5e:d5:cd:28:6b:4e:a9:8c:14:8b:ab:7e:ae:b1:a4:3b:e2Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

cvbasiclib

cvfocus

kernel32

advapi32

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

Exports

Exports

Sections

.text Size: 9KB - Virtual size: 8KB

.rdata Size: 6KB - Virtual size: 6KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 1024B - Virtual size: 792B

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 512B - Virtual size: 76B

43:c1:0b:1c:00:00:00:00:51:d3:73:da
Certificate

fc:9c:a2:83:16:f9:b5:58:00:00:00:00:55:66:79:d0
Certificate

38:63:de:f8
Certificate

58:da:13:ff:00:00:00:00:51:ce:0d:f7
Certificate

8d:ce:15:f3:a7:94:c5:87:00:00:00:00:55:92:33:f4
Certificate

fc:3d:e0:b5:b9:6a:b8:65:1a:50:68:19:52:52:d7:5e:d5:cd:28:6b:4e:a9:8c:14:8b:ab:7e:ae:b1:a4:3b:e2
Signer

.text
Size: 9KB - Virtual size: 8KB

.rdata
Size: 6KB - Virtual size: 6KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 1024B - Virtual size: 792B

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 512B - Virtual size: 76B