NTSTATUS 301 (STATUS_VALID_CATALOG_HASH): meaning and diagnosis

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: The calculated file hash was found in a trusted catalog used by Windows Code Integrity.

Could be also:
Constant	Type	OS
ERROR_INVALID_OPLOCK_PROTOCOL	Win32 error	Windows
HTTP_STATUS_MOVED	HTTP Code	Any
VOLSNAP_OVERLAPPED_TABLE_ACCESS	BugCheck Code	Windows

Previous	Next
STATUS_VALID_IMAGE_HASH	STATUS_VALID_STRONG_CODE_HASH

STATUS_VALID_CATALOG_HASH

A catalog supplied the successful integrity match

Windows can authorize a file through a signed catalog rather than an embedded signature in the file itself. This status indicates that the calculated hash matched a catalog member accepted by the current integrity evaluation. The catalog signature authenticates the collection, while the member hash binds the individual file to that collection.

Copying only the binary to another installation can change the result if the required catalog is absent, not trusted, or outside the catalog databases searched by the verifier. Conversely, the file can remain byte-for-byte unchanged while a catalog trust or policy change alters whether it is accepted.

What to inspect

Identify the catalog file and catalog member used for the match, not only the binary that was loaded.
Verify the catalog signature, certificate chain, timestamp, and current policy acceptance independently of the member hash.
Confirm that the calculated digest uses the expected Authenticode or catalog hashing rules.
Compare catalog installation and Code Integrity logs when the same file succeeds on one system and fails on another.

References

Looking for a different code? Search another status or error code.