consent[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

consent.exe
Size

102KB
MD5

242562474262faa1bca77d5dba0f605b
SHA1

1b35edcf6e91c0e5fa30793c95344bc900c3ffa1
SHA256

ec6d2a0bfd2a44680fd4524f5648abea6eae35e9f655b78bdbbadcdf5d2ae3a1
SHA512

fc40616833630ad817a113bef96adfd4e1ae8c72dce84d3bffbfb82005ef81594af9efb154465415e664daf61137994205053f46497731a2f48a7c42fc81536d
SSDEEP

768:xXQjv4Q+tDsfifdK6RXpbMJnn/sXy4M8H20mZkLUM7nEdLrZU9QZU9O3mkMz2:k49dwKK6RFMJ/su8W0mZkLU2nkzlya

Score

1^/10

Malware Config

Signatures

Files

consent.exe
.exe windows x86

ff903081830a82776c763e48048362ba

Code Sign

33:00:00:00:6f:65:2d:58:6d:07:11:46:28:00:00:00:00:00:6f
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:00:35:4c:94:ff:5b:25:be:52:77:00:00:00:00:00:35
Certificate

Issuer

CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/05/2015, 17:48

Not After

14/03/2016, 17:48

Subject

CN=Microsoft Windows,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:07:02:dc:00:00:00:00:00:0b
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

15/09/2005, 21:55

Not After

15/03/2016, 22:05

Subject

CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

01:33:4a:db:7c:92:9b:09:ac:00:18:d8:c5:07:16:52:bd:f3:d1:1d
Signer

Actual PE Digest

01:33:4a:db:7c:92:9b:09:ac:00:18:d8:c5:07:16:52:bd:f3:d1:1d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

GetTokenInformation
RevertToSelf
ImpersonateLoggedOnUser
RegGetValueW
MakeAbsoluteSD
ConvertStringSecurityDescriptorToSecurityDescriptorW
EventRegister
EventWriteTransfer
GetSidSubAuthority
GetSidSubAuthorityCount
InitializeSid
GetSidLengthRequired

kernel32

GetCurrentThreadId
GetCurrentProcessId
ReleaseMutex
Sleep
LoadLibraryW
SetEvent
GetTickCount
GetExitCodeThread
WaitForMultipleObjects
ResumeThread
CreateEventW
GetProcAddress
GetLocaleInfoW
GetCurrentProcess
GetCommandLineW
CreateFileW
SetPriorityClass
HeapSetInformation
UnmapViewOfFile
VirtualQuery
MapViewOfFile
CreateFileMappingW
DelayLoadFailureHook
InterlockedCompareExchange
LoadLibraryExA
GetDriveTypeW
LoadLibraryExW
FreeLibrary
GetUserPreferredUILanguages
SetThreadPreferredUILanguages
QueueUserWorkItem
GetModuleHandleW
WaitForSingleObject
CreateThread
GetModuleHandleExW
CloseHandle
FindResourceExW
LoadResource
LockResource
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoA
InterlockedExchange
LocalAlloc
LocalFree
GetLastError
GlobalFree

gdi32

SetDCBrushColor
GetStockObject
CreateCompatibleDC
CreateDIBSection
SelectObject
DeleteObject
DeleteDC
GetLayout
BitBlt
CreateCompatibleBitmap

user32

GetForegroundWindow
FlashWindowEx
SetPropW
DestroyWindow
PostMessageW
UnregisterClassW
DispatchMessageW
TranslateMessage
GetMessageW
GetDesktopWindow
CreateWindowExW
RegisterClassW
LoadCursorW
GetWindowRect
SendMessageW
SetThreadDesktop
GetParent
GetDC
FillRect
GetAncestor
GetPropW
ShowWindow
DefWindowProcW
BeginPaint
GetWindowDC
ReleaseDC
EndPaint
PostQuitMessage
GetWindowLongW
SetWindowLongW
GetThreadDesktop
OpenInputDesktop
CloseDesktop
GetUserObjectInformationW
LoadIconW
DestroyIcon
GetSystemMetrics
LoadStringW
OpenDesktopW

msvcrt

_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
memset
__p__fmode
wcschr
wcsrchr
_amsg_exit
_wcsicmp
_wtoi
_errno
_wtol
_vsnwprintf
__set_app_type
_controlfp
__setusermatherr
swscanf_s
__p__commode
__getmainargs
?terminate@@YAXXZ
memcpy
_except_handler4_common

ntdll

EtwSendNotification
EtwTraceMessage
RtlSubAuthoritySid
RtlNtStatusToDosError
NtQueryInformationToken
RtlNtStatusToDosErrorNoTeb
NtDuplicateToken
RtlEqualSid
WinSqmAddToStreamEx
RtlImageNtHeaderEx
EtwEventRegister
NtOpenProcess
EtwEventUnregister
NtQueryVolumeInformationFile
NtWriteVirtualMemory
RtlAllocateHeap
NtReadVirtualMemory
NtDuplicateObject
RtlFreeHeap
RtlLengthRequiredSid
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwGetTraceEnableFlags
EtwEventWrite
RtlInitializeSid
RtlAdjustPrivilege
NtClose
RtlInitString
NtAllocateLocallyUniqueId

ole32

CoTaskMemAlloc
CoCreateInstance
StringFromGUID2
CoInitializeEx
CoUninitialize
CoInitializeSecurity
CoTaskMemFree

msimg32

AlphaBlend

wmsgapi

WmsgSendMessage

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW

winmm

PlaySoundW

userenv

LoadUserProfileW
UnloadUserProfile

winsta

WinStationQueryInformationW

crypt32

CertFreeCertificateContext

msctfmonitor

UninitLocalMsCtfMonitor
InitLocalMsCtfMonitor

comctl32

ord345

Sections

.text
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

consent
Size: 512B - Virtual size: 98B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ff903081830a82776c763e48048362ba

Code Sign

33:00:00:00:6f:65:2d:58:6d:07:11:46:28:00:00:00:00:00:6fCertificate

Extended Key Usages

33:00:00:00:35:4c:94:ff:5b:25:be:52:77:00:00:00:00:00:35Certificate

Extended Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

61:07:02:dc:00:00:00:00:00:0bCertificate

Extended Key Usages

Key Usages

01:33:4a:db:7c:92:9b:09:ac:00:18:d8:c5:07:16:52:bd:f3:d1:1dSigner

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

gdi32

user32

msvcrt

ntdll

ole32

msimg32

wmsgapi

wtsapi32

winmm

userenv

winsta

crypt32

msctfmonitor

comctl32

Sections

.text Size: 41KB - Virtual size: 40KB

.data Size: 1KB - Virtual size: 1KB

consent Size: 512B - Virtual size: 98B

.rsrc Size: 49KB - Virtual size: 49KB

.reloc Size: 2KB - Virtual size: 2KB

33:00:00:00:6f:65:2d:58:6d:07:11:46:28:00:00:00:00:00:6f
Certificate

33:00:00:00:35:4c:94:ff:5b:25:be:52:77:00:00:00:00:00:35
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

61:07:02:dc:00:00:00:00:00:0b
Certificate

01:33:4a:db:7c:92:9b:09:ac:00:18:d8:c5:07:16:52:bd:f3:d1:1d
Signer

.text
Size: 41KB - Virtual size: 40KB

.data
Size: 1KB - Virtual size: 1KB

consent
Size: 512B - Virtual size: 98B

.rsrc
Size: 49KB - Virtual size: 49KB

.reloc
Size: 2KB - Virtual size: 2KB