Static task
static1
Behavioral task
behavioral1
Sample
FreeRobux.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
FreeRobux.dll
Resource
win10v2004-20220901-en
General
-
Target
FreeRobux.dll
-
Size
1.7MB
-
MD5
e9b26fc086a5183f3d1ca05c9bc32962
-
SHA1
d14e67ed194c5229d1c1412f75bfec87398899ee
-
SHA256
0c31783351d3bed7e4f19a48498ad3bed087441026b46844faaeb596cb00b400
-
SHA512
278662edc69606a5d055725b1373c10c2a7b6f678ba6a9cce92098ea55f58ebdabb8ba5b1586e7543cc0b4f3a7913363259eeb042b5a9d7c7f014139de5c67a4
-
SSDEEP
24576:UObTOrPyaMY2rP1z6PvviinSJKyiWPcrGDVT1+nFsaeFy1JbPi4zQ4y5+w3jnHsS:UObTOrP7MYBeiWthxtWliEHg7M+3l3l
Malware Config
Signatures
Files
-
FreeRobux.dll.dll windows x64
f60e17a98ccade3bb0fe5e2d4a960ef5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
RaiseException
GetLastError
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
InitializeCriticalSectionEx
DeleteCriticalSection
GlobalFree
MultiByteToWideChar
QueryPerformanceCounter
QueryPerformanceFrequency
Sleep
GetCurrentProcessId
CreateThread
ExitThread
DisableThreadLibraryCalls
FreeLibraryAndExitThread
VirtualProtect
VirtualQuery
CloseHandle
GetCurrentProcess
OpenProcess
CreateToolhelp32Snapshot
Module32FirstW
Module32NextW
GetModuleHandleA
GetProcAddress
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
GlobalAlloc
GlobalUnlock
GlobalLock
K32GetModuleInformation
VirtualAlloc
GetSystemInfo
Thread32Next
Thread32First
FlushInstructionCache
SetThreadContext
GetThreadContext
ResumeThread
SuspendThread
OpenThread
HeapCreate
OutputDebugStringW
InitializeSListHead
GetCurrentThreadId
TerminateProcess
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
WideCharToMultiByte
GetFileInformationByHandleEx
AreFileApisANSI
GetFileAttributesExW
CreateFileW
FormatMessageA
LocalFree
AcquireSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockShared
ReleaseSRWLockExclusive
VirtualFree
user32
OpenClipboard
CloseClipboard
SetClipboardData
GetClipboardData
EmptyClipboard
msvcp140
_Cnd_do_broadcast_at_thread_exit
?_Throw_C_error@std@@YAXH@Z
?_Throw_Cpp_error@std@@YAXH@Z
_Query_perf_counter
_Query_perf_frequency
_Mtx_init_in_situ
_Mtx_destroy_in_situ
_Mtx_lock
_Mtx_unlock
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@F@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
_Thrd_detach
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?uncaught_exception@std@@YA_NXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??Bid@locale@std@@QEAA_KXZ
?_Winerror_map@std@@YAHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Syserror_map@std@@YAPEBDH@Z
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Xbad_function_call@std@@YAXXZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Random_device@std@@YAIXZ
api-ms-win-core-winrt-string-l1-1-0
WindowsDeleteString
WindowsCreateStringReference
WindowsGetStringRawBuffer
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
winmm
PlaySoundA
vcruntime140
memset
memmove
memcpy
_purecall
_CxxThrowException
__std_exception_destroy
__std_exception_copy
__std_terminate
__RTDynamicCast
__std_type_info_compare
__C_specific_handler
__current_exception
__current_exception_context
memchr
__std_type_info_destroy_list
memcmp
strstr
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_wassert
_configure_narrow_argv
_initialize_narrow_environment
_invalid_parameter_noinfo_noreturn
_errno
_initialize_onexit_table
terminate
_register_onexit_function
_execute_onexit_table
_beginthreadex
_initterm
_crt_atexit
_cexit
_invalid_parameter_noinfo
_initterm_e
_seh_filter_dll
api-ms-win-crt-heap-l1-1-0
_callnewh
free
malloc
api-ms-win-crt-convert-l1-1-0
strtol
strtod
strtof
strtoll
strtoull
api-ms-win-crt-string-l1-1-0
toupper
strcpy_s
tolower
strcmp
strnlen
api-ms-win-crt-math-l1-1-0
floorf
sin
fmaxf
fminf
fmodf
roundf
ceilf
fmax
atan2f
cosf
cos
sinf
powf
atan2
round
fmin
asinf
sqrtf
_dsign
_dclass
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf
fsetpos
_fseeki64
fread
fgetpos
fgetc
__stdio_common_vsprintf_s
fflush
fclose
_get_stream_buffer_pointers
__stdio_common_vfprintf
_fsopen
ungetc
setvbuf
fputc
fwrite
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
localeconv
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_mkdir
_lock_file
remove
api-ms-win-crt-utility-l1-1-0
rand
srand
api-ms-win-crt-time-l1-1-0
_time64
Sections
.text Size: 992KB - Virtual size: 992KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 706KB - Virtual size: 705KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 19KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ