RoboForm-v9-Setup[.]exe

Resubmissions

12/01/2023, 20:33

230112-zb9h7sed5s 1

12/01/2023, 19:44

230112-yf2hqaad49 8

Sharing

Copy URL Twitter E-mail

General

Target

RoboForm-v9-Setup.exe
Size

29.4MB
MD5

d9c7b99206b3928eab684e4c78289a8a
SHA1

887bbff98c20b46cea4a37be3b5cc903dda66b48
SHA256

2b22ab9e311ffc432fc1456e34b8c2fc126d7ba4fcf391046ca4a13fbfc730df
SHA512

4840f9d06e68a7e6d48cac08467dcc4aa87fc657a1fb47293a65c94152834b39cf779267544b909f2acb6f680dafb2f920467c3fa10eb2ccb7b2dd7b863e2084
SSDEEP

393216:64G+vaTVDUuhmtvVlCxNJEKxuCdSqr/Gc+bQD3ykrw09slvNQ100MtFTVgauN/yR:9wuWmHQQKjdD/MMmkrI5NS6TTTM/KjU2

Score

N/A

Malware Config

Signatures

Files

RoboForm-v9-Setup.exe
.exe windows x86

0abe9ffbdeca0c47dcb7cc18500dc37f

Code Sign

53:ff:64:c3:c5:82:1d:e7:5d:b0:c7:95:be:01:d3:60
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

13/01/2021, 00:00

Not After

13/01/2024, 23:59

Subject

CN=Siber Systems,O=Siber Systems,POSTALCODE=22030,STREET=Suite 400+STREET=3701 Pender Dr STE 400,L=Fairfax,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

12/03/2019, 00:00

Not After

31/12/2028, 23:59

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LoadResource
SizeofResource
CloseHandle
lstrcmpiW
lstrcatW
CreateEventW
LoadLibraryExW
GetModuleFileNameW
GetModuleHandleW
CreateProcessW
FindResourceW
MultiByteToWideChar
EnterCriticalSection
SetErrorMode
GetLastError
WriteConsoleW
GetCurrentThreadId
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
SetFilePointerEx
GetConsoleCP
FlushFileBuffers
LCMapStringW
GetStringTypeW
HeapReAlloc
HeapSize
RaiseException
GetProcAddress
FreeLibrary
InterlockedDecrement
InterlockedIncrement
SetConsoleCtrlHandler
FileTimeToSystemTime
GetSystemInfo
VirtualProtect
VirtualQuery
LoadLibraryExA
GlobalAlloc
GlobalReAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetCurrentProcess
GetCurrentProcessId
SetLastError
GetSystemTime
lstrcpynW
lstrlenW
CreateFileW
CompareStringW
LocalAlloc
LocalFree
DeviceIoControl
GetTickCount
lstrcpyW
LoadLibraryW
GetTempPathW
GetTempFileNameW
GetWindowsDirectoryW
CreateDirectoryW
GetFileAttributesW
DeleteFileW
GetLongPathNameW
GetExitCodeProcess
WaitForSingleObject
WriteFile
GetDriveTypeW
GetFullPathNameW
SetFilePointer
GetFileTime
GetSystemTimeAsFileTime
GetLocalTime
CompareFileTime
lstrcmpW
InitializeCriticalSection
GetFileSize
FormatMessageW
WideCharToMultiByte
GetFileInformationByHandle
GetStdHandle
ReadFile
SetEndOfFile
FindClose
SetFileTime
GetCurrentDirectoryW
RemoveDirectoryW
SetFileAttributesW
GetFileAttributesExW
FindFirstFileW
FindNextFileW
MoveFileExW
GetConsoleMode
SetConsoleMode
GlobalMemoryStatusEx
GetVersion
GetVersionExW
Sleep
GetTimeZoneInformation
GetTimeFormatW
GetDateFormatW
CreateMutexW
SystemTimeToFileTime
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
LoadLibraryA
GetModuleHandleExW
GetACP
GetPrivateProfileStringW
GetShortPathNameW
CopyFileW
IsDebuggerPresent
OutputDebugStringW
EncodePointer
HeapAlloc
HeapFree
GetProcessHeap
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
IsProcessorFeaturePresent
VirtualAlloc
VirtualFree
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
QueryPerformanceCounter
GetFileType
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SwitchToFiber
DeleteFiber
CreateFiber
ConvertFiberToThread
ConvertThreadToFiber
GetEnvironmentVariableW
ReadConsoleA
ReadConsoleW
RtlUnwind
QueryPerformanceFrequency
GetCPInfo
SetStdHandle
ExitProcess
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
DecodePointer

ws2_32

WSAAddressToStringA
getaddrinfo
freeaddrinfo

wininet

HttpSendRequestW
HttpAddRequestHeadersW
HttpOpenRequestW
InternetGetLastResponseInfoW
InternetSetOptionExW
InternetSetOptionW
InternetQueryOptionW
InternetWriteFile
HttpSendRequestExW
InternetConnectW
InternetCloseHandle
InternetOpenW
InternetReadFile
HttpQueryInfoW
HttpEndRequestW

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 37KB - Virtual size: 607KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 92KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

0abe9ffbdeca0c47dcb7cc18500dc37f

Code Sign

53:ff:64:c3:c5:82:1d:e7:5d:b0:c7:95:be:01:d3:60Certificate

Extended Key Usages

Key Usages

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95Certificate

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate

Extended Key Usages

Key Usages

Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

ws2_32

wininet

Sections

.text Size: 1.7MB - Virtual size: 1.7MB

.rdata Size: 1.7MB - Virtual size: 1.7MB

.data Size: 37KB - Virtual size: 607KB

.rsrc Size: 50KB - Virtual size: 49KB

.reloc Size: 92KB - Virtual size: 92KB

53:ff:64:c3:c5:82:1d:e7:5d:b0:c7:95:be:01:d3:60
Certificate

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

.text
Size: 1.7MB - Virtual size: 1.7MB

.rdata
Size: 1.7MB - Virtual size: 1.7MB

.data
Size: 37KB - Virtual size: 607KB

.rsrc
Size: 50KB - Virtual size: 49KB

.reloc
Size: 92KB - Virtual size: 92KB