0PVDV058[.]DLL | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
0PVDV058.DLL
Size 678KB
Sample261022-138awsvsfw
SHA256 220b06bc7a5b07e4803c98ef4e9f8095473a1a844636d7c8ce29b3e9ed2248a4
MD5 83bbdbe3642c3a2293899cd6df17ab8b
SHA1 97e2992a5b509e668832fcff491533903cd0fa31
SHA512 5d2936f654de5ee4a4c485a6b240d250327ac27de9c237bdcdb2e0b36edfb88fe073ac17fd4e16dbce3bb86392f1bdc903b17a50b66a49e32034b43ace5b5bc4
SSDEEP 6144:ziIpIhxxw0Em4pL3wqtkVJrlsgyAtBZZXNelPbEqITmie+zfyB28ZiwFd5wmt7hu:TChxxwHm4S+MHtRNkjEq7+Mvzs
TLSH
T1D2E43A1233FC5A2AE1BF5BB5E97148099BB4FD522AA6D75F1990911E0CA3740CD323B3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

0PVDV058.DLL

.dll 678KB

0PVDV058.DLL

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 220b06bc7a5b07e4803c98ef4e9f8095473a1a844636d7c8ce29b3e9ed2248a4
MD5 83bbdbe3642c3a2293899cd6df17ab8b
SHA1 97e2992a5b509e668832fcff491533903cd0fa31
SHA512 5d2936f654de5ee4a4c485a6b240d250327ac27de9c237bdcdb2e0b36edfb88fe073ac17fd4e16dbce3bb86392f1bdc903b17a50b66a49e32034b43ace5b5bc4
SSDEEP 6144:ziIpIhxxw0Em4pL3wqtkVJrlsgyAtBZZXNelPbEqITmie+zfyB28ZiwFd5wmt7hu:TChxxwHm4S+MHtRNkjEq7+Mvzs
TLSH
T1D2E43A1233FC5A2AE1BF5BB5E97148099BB4FD522AA6D75F1990911E0CA3740CD323B3
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

57:ef:2d:20:6e:ac:3b:48:09:0a:8a:ed:ca:1a:4d:52:aa:46:5a:c5:d8:ce:b6:cb:a0:4d:6e:db:da:e1:30:68

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 21, 2014

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

PE Signature issue

Digest

8f:25:bc:23:24:e7:38:04:62:46:be:71:2d:29:8b:c6:e3:37:c7:9b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 21, 2014

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:33:e5:27:86:a3:0e:4a:2a:80:00:00:00:00:00:33

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 27, 2013 - Jun 27, 2014

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 24, 2013 - Apr 24, 2014

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:1a:77:bb:74:b3:07:d1:16:b8:00:00:00:00:00:1a

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 24, 2013 - Dec 24, 2014

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 1, 2010 - Jul 1, 2025

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:31C5-30BA-7C91,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:2b:72:aa:2e:f6:49:bb:ec:d7:00:00:00:00:00:2b

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 27, 2013 - Jun 27, 2014

Minor OS version

Major OS version

Entry point

683870

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.AnalysisServices.AdomdClient.pdb

0PVDV058.DLL

PE Signature issue

mscoree

dotnet