AiRoboForm[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

AiRoboForm.exe
Size

2.8MB
MD5

a9d713e44b590f62d73548cc46bbfdfd
SHA1

cb6528aeb90503b9bad3ebeb755f03f595888149
SHA256

cb43ffc8504140053a752dd33c5f2b98f4406f5fbcfbd86c55ed1ec37cc7c49c
SHA512

847bd33782a1ffe256e57e7750df20c9d74bff2a18045b3002abcd0f4f1afbfed1ff4fec6e4c9ba46678390fa20862eab64db6d6bbaf20d7a57da543479feb33
SSDEEP

49152:+39B4ibUBwn+yAH0BwS/6G+7YGjkS1w63M0qB6BVbZCh6S2N3EbV25vg1gxI:+3zbMOOHUNSBbAKw63q6BVwh6SBbV2RI

Score

1^/10

Malware Config

Signatures

Files

AiRoboForm.exe
.exe windows x86

3011cd366ef63dbc60089a181525e871

Code Sign

52:06:1f:1a:1a:da:bc:de:8f:a0:ef:e3:e8:88:2a:4e
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

27/01/2010, 00:00

Not After

21/02/2012, 23:59

Subject

CN=Siber Systems,OU=SECURE APPLICATION DEVELOPMENT,O=Siber Systems,L=Herndon,ST=Virginia,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

InitializeCriticalSection
HeapCreate
GetVersionExA
GetSystemInfo
HeapAlloc
GetModuleFileNameA
lstrcatA
GetLastError
CreateProcessA
CloseHandle
CreateEventA
DeleteCriticalSection
GetVersion
lstrcmpiA
lstrlenA
Sleep
GetFileAttributesA
lstrcpyA
WriteFile
CreateFileA
RemoveDirectoryA
CreateDirectoryA
GetTempFileNameA
GetTickCount
FlushInstructionCache
GetCurrentProcess
LeaveCriticalSection
GetCurrentThreadId
EnterCriticalSection
LocalFree
FormatMessageA
GetFileSize
GetProcAddress
GetModuleHandleA
SetEndOfFile
SetFilePointer
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GetWindowsDirectoryA
GetShortPathNameA
FindClose
lstrcmpA
FindNextFileA
FindFirstFileA
DeleteFileA
CopyFileA
GetExitCodeProcess
WaitForSingleObject
SetLastError
SetFileTime
GetSystemTimeAsFileTime
CompareFileTime
GetFileTime
GetTempPathA
LocalAlloc
GetLocalTime
GetDriveTypeA
DeviceIoControl
VirtualAlloc
VirtualFree
GetStdHandle
MultiByteToWideChar
WideCharToMultiByte
GetStartupInfoA
GetCommandLineA
ExitProcess
RtlUnwind
RaiseException
HeapFree
TerminateProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetFileType
TlsSetValue
TlsAlloc
TlsGetValue
GetEnvironmentVariableA
GetCPInfo
GetACP
GetOEMCP
SetUnhandledExceptionFilter
HeapReAlloc
IsBadWritePtr
LoadLibraryA
IsBadReadPtr
IsBadCodePtr
InterlockedDecrement
InterlockedIncrement
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetStdHandle
FlushFileBuffers
HeapDestroy

user32

wsprintfA
DestroyWindow
IsWindow
SendMessageA
SetWindowTextA
GetDlgItem
PostQuitMessage
DispatchMessageA
TranslateMessage
PeekMessageA
ShowWindow
CreateDialogParamA
SetWindowPos
MapWindowPoints
GetClientRect
SystemParametersInfoA
GetWindowRect
GetWindow
GetParent
GetWindowLongA
SetWindowLongA
MsgWaitForMultipleObjects
ExitWindowsEx
CharNextA
MessageBoxA

advapi32

RegDeleteValueA
RegOpenKeyExA
RegQueryValueExA
AllocateAndInitializeSid
OpenProcessToken
GetTokenInformation
EqualSid
FreeSid
RegCreateKeyExA
RegSetValueExA
RegCloseKey

comctl32

InitCommonControlsEx

Sections

.text
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3011cd366ef63dbc60089a181525e871

Code Sign

52:06:1f:1a:1a:da:bc:de:8f:a0:ef:e3:e8:88:2a:4eCertificate

Extended Key Usages

0aCertificate

Extended Key Usages

Key Usages

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

kernel32

user32

advapi32

comctl32

Sections

.text Size: 56KB - Virtual size: 56KB

.rdata Size: 6KB - Virtual size: 6KB

.data Size: 18KB - Virtual size: 28KB

.rsrc Size: 9KB - Virtual size: 9KB

52:06:1f:1a:1a:da:bc:de:8f:a0:ef:e3:e8:88:2a:4e
Certificate

0a
Certificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

.text
Size: 56KB - Virtual size: 56KB

.rdata
Size: 6KB - Virtual size: 6KB

.data
Size: 18KB - Virtual size: 28KB

.rsrc
Size: 9KB - Virtual size: 9KB