MICROSOFT[.]SQLSERVER[.]CONFIGURATION[.]CLUSTER[.]DLL

Sharing

Copy URL Twitter E-mail

General

Target
MICROSOFT.SQLSERVER.CONFIGURATION.CLUSTER.DLL
Size 697KB
Sample261023-ank9psvxct
SHA256 8fb756451007f148140f536ac453c134d6c5074ae3e6eee2e36a6f59eb7cf687
MD5 c862bcf57421ab2f1c88b4b76e4e11d8
SHA1 60369e1ab1f36954c6b078647ccb1f40d80e8f2b
SHA512 5992d6561c240f7aa018b4e2a6cf6c82354666347d799443a56229126703c2ad390fe83a1dc45808617ba9874b9c632ab097b51b5cf1cc81f460193fea786ae2
SSDEEP 12288:HJmnAQyfJi42B23JYzYkaQyE7EcqR2iW4ea:pHQZy//WQ
TLSH
T151E40B0173D84A5AF67B6B75A87411158D72BC57A931E38E7A8C009E1FB3780ED72B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

MICROSOFT.SQLSERVER.CONFIGURATION.CLUSTER.DLL

.dll 697KB

MICROSOFT.SQLSERVER.CONFIGURATION.CLUSTER.DLL

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 8fb756451007f148140f536ac453c134d6c5074ae3e6eee2e36a6f59eb7cf687
MD5 c862bcf57421ab2f1c88b4b76e4e11d8
SHA1 60369e1ab1f36954c6b078647ccb1f40d80e8f2b
SHA512 5992d6561c240f7aa018b4e2a6cf6c82354666347d799443a56229126703c2ad390fe83a1dc45808617ba9874b9c632ab097b51b5cf1cc81f460193fea786ae2
SSDEEP 12288:HJmnAQyfJi42B23JYzYkaQyE7EcqR2iW4ea:pHQZy//WQ
TLSH
T151E40B0173D84A5AF67B6B75A87411158D72BC57A931E38E7A8C009E1FB3780ED72B23
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

fc:4f:04:e7:e5:75:02:fa:83:6c:e1:bc:35:31:b4:33:ee:15:a5:46:92:96:c1:d8:9b:18:68:ef:04:85:14:83

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 21, 2014

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

PE Signature issue

Digest

5f:d6:cd:e5:84:25:a6:46:6b:80:17:7d:6b:75:ef:78:7d:2d:dd:8e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 21, 2014

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:33:e5:27:86:a3:0e:4a:2a:80:00:00:00:00:00:33

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 27, 2013 - Jun 27, 2014

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 24, 2013 - Apr 24, 2014

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:1a:77:bb:74:b3:07:d1:16:b8:00:00:00:00:00:1a

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 24, 2013 - Dec 24, 2014

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 1, 2010 - Jul 1, 2025

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:BBEC-30CA-2DBE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:2c:d7:29:77:3b:67:cc:1b:c6:00:00:00:00:00:2c

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 27, 2013 - Jun 27, 2014

Minor OS version

Major OS version

Entry point

703694

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.SqlServer.Configuration.Cluster.pdb

MICROSOFT.SQLSERVER.CONFIGURATION.CLUSTER.DLL

PE Signature issue

mscoree

dotnet