AiRoboForm[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

AiRoboForm.exe
Size

2.1MB
MD5

1000ce6e3253dcb7f2c32cf72f762abb
SHA1

b78cc7f3ce3e0cffcc1b91b96c83aea096210da0
SHA256

d8e019052a98774d9acf6a51a7a82f776215b87ac2485ebdc97b00240060abb5
SHA512

15f9b07d23dd82d33a4ab71fe55d36f95d3c1dec2e89c0647c16b0a188b65223713524cbedf38ba870d7ea4ef2530e6851b18bb4d0351ee7e75d06a5aeef1dd7
SSDEEP

49152:veqkiyawem1xlYz5VzI+xaHETSwnIltR/8/PBmQ0lLt8x5aw:vhWR1xy5VRTjQRkHBmpLtI

Score

N/A

Malware Config

Signatures

Files

AiRoboForm.exe
.exe windows x86

4c4dd6284723d40173721c98ae676791

Code Sign

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

63:e8:57:91:41:24:18:1f:0d:64:62:a4:dc:4e:f5:f6
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

01/02/2006, 00:00

Not After

22/02/2008, 23:59

Subject

CN=Siber Systems,OU=SECURE APPLICATION DEVELOPMENT,O=Siber Systems,L=Herndon,ST=Virginia,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetWindowsDirectoryA
GetTempFileNameA
lstrcmpiA
lstrlenA
CreateDirectoryA
GetFileAttributesA
LocalFree
GetProcAddress
GetModuleHandleA
LocalAlloc
CreateFileA
WriteFile
SetFilePointer
GetLocalTime
CopyFileA
Sleep
GetModuleFileNameA
RemoveDirectoryA
GetTickCount
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
FlushInstructionCache
GetCurrentProcess
FormatMessageA
GetFileSize
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GetShortPathNameA
FindClose
lstrcmpA
lstrcpyA
FindFirstFileA
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
SetLastError
SetFileTime
GetSystemTimeAsFileTime
SetStdHandle
LoadLibraryA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
IsBadCodePtr
IsBadReadPtr
IsBadWritePtr
HeapReAlloc
SetUnhandledExceptionFilter
FlushFileBuffers
GetEnvironmentVariableA
GetFileType
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
TerminateProcess
GetOEMCP
GetACP
GetCPInfo
DeleteFileA
lstrcatA
GetTempPathA
DeleteCriticalSection
HeapDestroy
InitializeCriticalSection
HeapCreate
GetVersionExA
GetSystemInfo
HeapAlloc
CreateEventA
GetLastError
FindNextFileA
CloseHandle
VirtualAlloc
VirtualFree
GetStdHandle
MultiByteToWideChar
WideCharToMultiByte
RtlUnwind
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
RaiseException
HeapFree

user32

ExitWindowsEx
GetWindowLongA
GetParent
GetWindow
GetWindowRect
SystemParametersInfoA
GetClientRect
MapWindowPoints
SetWindowPos
SetWindowLongA
CreateDialogParamA
TranslateMessage
DispatchMessageA
PostQuitMessage
SetWindowTextA
IsWindow
GetDlgItem
SendMessageA
ShowWindow
wsprintfA
DestroyWindow
CharNextA
MessageBoxA
PeekMessageA

comctl32

InitCommonControlsEx

advapi32

RegDeleteValueA
RegQueryValueExA
AllocateAndInitializeSid
OpenProcessToken
GetTokenInformation
EqualSid
FreeSid
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegOpenKeyExA

Sections

.text
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4c4dd6284723d40173721c98ae676791

Code Sign

0aCertificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

63:e8:57:91:41:24:18:1f:0d:64:62:a4:dc:4e:f5:f6Certificate

Extended Key Usages

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88Certificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

kernel32

user32

comctl32

advapi32

Sections

.text Size: 46KB - Virtual size: 45KB

.rdata Size: 6KB - Virtual size: 5KB

.data Size: 16KB - Virtual size: 25KB

.rsrc Size: 9KB - Virtual size: 8KB

0a
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

63:e8:57:91:41:24:18:1f:0d:64:62:a4:dc:4e:f5:f6
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

.text
Size: 46KB - Virtual size: 45KB

.rdata
Size: 6KB - Virtual size: 5KB

.data
Size: 16KB - Virtual size: 25KB

.rsrc
Size: 9KB - Virtual size: 8KB