RobloxPlayerBeta[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

RobloxPlayerBeta.exe
Size

58.1MB
MD5

6c52dc27d948b30f53c86bd834405313
SHA1

f5fb6d53c703818ec47c1077253f29fab03cadba
SHA256

e7b4bdd44353cb0777cc69730a57b847d3fcebd87c9bf4548e54485ba5b49ff3
SHA512

e946bb8e413b142e52eeafc46e93800d42dd971f2852290ef76153ed114d6374ebef3664123090d93eeab738cb378848703dc0d388c03d1bf9cce0f58d163d3e
SSDEEP

1572864:HzWJg0P4NjOM/bC8KMC6ZWnR7o4kdf/dZfMVgyaHPT:TAWjC8KMC6ZWyvd1MVgzr

Score

1^/10

Malware Config

Signatures

Files

RobloxPlayerBeta.exe
.exe windows x86

5e0326e114b9953599fd386c02686eba

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

02:19:17:fa:ad:69:b1:d7:5b:b4:3c:5e:86:45:30:2f
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

10/11/2022, 00:00

Not After

09/11/2023, 23:59

Subject

SERIALNUMBER=3780902,CN=Roblox Corporation,O=Roblox Corporation,L=San Mateo,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

15:87:4d:50:cf:d2:25:52:b5:e6:46:15:95:8a:d8:82:9d:c8:c1:63
Signer

Actual PE Digest

15:87:4d:50:cf:d2:25:52:b5:e6:46:15:95:8a:d8:82:9d:c8:c1:63

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

SERIALNUMBER=3780902,CN=Roblox Corporation,O=Roblox Corporation,L=San Mateo,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

01/03/2023, 00:44
Valid: true

Chain 1

SERIALNUMBER=3780902,CN=Roblox Corporation,O=Roblox Corporation,L=San Mateo,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Chain 2

SERIALNUMBER=3780902,CN=Roblox Corporation,O=Roblox Corporation,L=San Mateo,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

imm32

ImmGetOpenStatus
ImmGetCompositionStringA
ImmSetCompositionWindow
ImmReleaseContext
ImmAssociateContext
ImmSetOpenStatus
ImmGetContext
ImmGetDefaultIMEWnd
ImmGetConversionStatus
ImmGetCompositionStringW

sensapi

IsNetworkAlive

urlmon

ObtainUserAgentString
UrlMkSetSessionOption

wininet

InternetGetCookieExA
InternetSetOptionA
InternetSetCookieExA

setupapi

SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsA
SetupDiGetDeviceInterfaceDetailA
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyA

mfplat

MFTEnumEx
MFCreateSample
MFCreateMediaType
MFCreateAlignedMemoryBuffer
MFCreateMemoryBuffer

shell32

SHGetFolderPathW
SHQueryUserNotificationState
ShellExecuteW
ShellExecuteA
SHGetFolderPathAndSubDirW

dbghelp

SymInitialize
SymGetLineFromAddrW64
SymFromAddrW
MiniDumpWriteDump

winmm

waveOutOpen
waveInGetDevCapsW
waveOutClose
waveOutPrepareHeader
waveInUnprepareHeader
waveInReset
waveOutGetDevCapsW
waveInGetNumDevs
waveOutGetNumDevs
waveOutWrite
waveInPrepareHeader
waveInClose
waveInStart
waveInAddBuffer
waveOutGetPosition
timeEndPeriod
timeGetDevCaps
timeBeginPeriod
timeGetTime
timeKillEvent
timeSetEvent
waveInOpen
waveOutUnprepareHeader
waveOutReset

kernel32

WaitForMultipleObjects
OpenEventA
LoadResource
LockResource
GlobalUnlock
LeaveCriticalSection
GlobalHandle
GlobalFree
FindResourceA
lstrcmpA
GetCurrentThreadId
Sleep
LocalAlloc
LocalFree
GetTickCount64
VirtualProtect
OutputDebugStringW
GetSystemDirectoryW
FreeLibrary
lstrcmpiA
IsDBCSLeadByte
SizeofResource
LoadLibraryExA
IsDebuggerPresent
ExitProcess
FindResourceExA
FindResourceW
VirtualAlloc
VirtualFree
CreateFileA
GetCurrentProcessId
GetCurrentProcess
WriteFile
OpenThread
SuspendThread
GetThreadContext
ResumeThread
TerminateProcess
LoadLibraryA
WriteProcessMemory
SetUnhandledExceptionFilter
SetErrorMode
CreateProcessA
GetWindowsDirectoryW
K32EnumProcessModules
K32GetModuleFileNameExW
InitializeCriticalSection
SetThreadPriority
ReleaseSemaphore
DuplicateHandle
CreateSemaphoreA
GetSystemInfo
CreateThread
lstrlenW
GetACP
GetCurrentThread
GetVersionExA
GetLocalTime
WaitForSingleObjectEx
CreateFileW
DeleteFileA
FindResourceExW
FindFirstFileA
FileTimeToSystemTime
FindNextFileA
CompareFileTime
GetShortPathNameW
VerSetConditionMask
VerifyVersionInfoW
IsWow64Process
CreateToolhelp32Snapshot
Module32FirstW
Module32NextW
WaitForMultipleObjectsEx
GetLocaleInfoW
LCMapStringW
LoadLibraryW
VirtualQuery
K32GetProcessMemoryInfo
GetCurrentProcessorNumber
GlobalMemoryStatusEx
GetProcessTimes
SwitchToThread
Process32First
CreateSemaphoreExW
K32GetProcessImageFileNameA
OpenProcess
OpenSemaphoreW
Process32Next
GetModuleHandleA
QueryPerformanceFrequency
QueryPerformanceCounter
SetWaitableTimer
TlsSetValue
GetLogicalProcessorInformation
TlsAlloc
CreateWaitableTimerA
TlsGetValue
TlsFree
CreateDirectoryW
GetFullPathNameW
DeviceIoControl
RemoveDirectoryW
SetFileTime
SetEndOfFile
FindClose
GetFileAttributesW
GetFileInformationByHandle
GetFileAttributesExW
GetDiskFreeSpaceExW
GetCurrentDirectoryW
SetFilePointerEx
MoveFileExW
GetFileTime
AreFileApisANSI
CompareStringW
FlushInstructionCache
GetEnvironmentVariableA
LoadLibraryExW
OpenEventW
FreeConsole
GetProcessAffinityMask
ReadFile
TryEnterCriticalSection
GetFileSizeEx
GetStdHandle
InitializeCriticalSectionAndSpinCount
SetFilePointer
AttachConsole
WriteConsoleW
CreateSemaphoreW
CancelIo
GetOverlappedResult
CreateMutexA
SetThreadContext
VerifyVersionInfoA
SleepEx
RtlCaptureStackBackTrace
lstrcpyW
QueueUserAPC
lstrcpynW
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
InitializeConditionVariable
WakeConditionVariable
SleepConditionVariableCS
WakeAllConditionVariable
GetNativeSystemInfo
GetEnvironmentVariableW
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
SwitchToFiber
DeleteFiber
CreateFiber
GetFileType
ConvertFiberToThread
ConvertThreadToFiber
SleepConditionVariableSRW
InitOnceBeginInitialize
InitOnceComplete
GetExitCodeThread
GetStringTypeW
IsProcessorFeaturePresent
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
EncodePointer
GetGeoInfoA
GetUserGeoID
MapViewOfFile
CreateFileMappingA
FindNextFileW
DeleteFileW
FindFirstFileW
SystemTimeToFileTime
GetSystemTime
GetTempPathW
UnmapViewOfFile
CreateEventA
GlobalLock
GlobalAlloc
EnterCriticalSection
ReleaseMutex
ResetEvent
SetEvent
SetLastError
DebugBreak
GetModuleHandleExW
MulDiv
GetSystemTimeAsFileTime
FormatMessageA
WaitForSingleObject
GetModuleFileNameA
GetModuleFileNameW
GetProcAddress
GetModuleHandleW
CloseHandle
FormatMessageW
HeapDestroy
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
MultiByteToWideChar
WideCharToMultiByte
GetTickCount
DeleteCriticalSection
DecodePointer
RaiseException
GetLastError
InitializeCriticalSectionEx
LCMapStringEx
CompareStringEx
GetCPInfo
GetLocaleInfoEx
CreateEventW
UnhandledExceptionFilter
GetStartupInfoW
RtlUnwind
GetCommandLineA
GetCommandLineW
SetConsoleCtrlHandler
ExitThread
FreeLibraryAndExitThread
SetStdHandle
GetDriveTypeW
SetEnvironmentVariableW
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformation
GetConsoleOutputCP
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
HeapQueryInformation
FindFirstFileExW
IsValidCodePage
CreateMutexW
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
CreateFileMappingW
GetFileAttributesA
CancelIoEx
ReadDirectoryChangesW
SetThreadAffinityMask
GetSystemDirectoryA
OutputDebugStringA
GetTempPathA
SetCurrentDirectoryW
CreateMutexExW
VirtualQuery
GetSystemTimeAsFileTime
GetModuleHandleA
CreateEventA
GetModuleFileNameW
LoadLibraryA
TerminateProcess
GetCurrentProcess
CreateToolhelp32Snapshot
Thread32First
GetCurrentProcessId
GetCurrentThreadId
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
WriteProcessMemory
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
Sleep
FreeLibrary
GetTickCount
SystemTimeToFileTime
FileTimeToSystemTime
GlobalFree
LocalAlloc
LocalFree
GetProcAddress
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetModuleHandleW
LoadResource
MultiByteToWideChar
FindResourceExW
FindResourceExA
WideCharToMultiByte
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
CreateFileW
LoadLibraryW
GetLastError
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetCommandLineA
RaiseException
RtlUnwind
HeapFree
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
HeapReAlloc
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
WriteFile
SetFilePointer
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
SetStdHandle
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

LoadBitmapA
SetWindowContextHelpId
MapDialogRect
EndDialog
GetWindowPlacement
ChangeDisplaySettingsExA
MapVirtualKeyExA
GetRawInputData
TrackMouseEvent
GetForegroundWindow
CloseTouchInputHandle
GetTouchInputInfo
PtInRect
WindowFromPoint
SetRect
ClipCursor
CloseClipboard
GetClipboardData
ActivateKeyboardLayout
UnloadKeyboardLayout
RegisterRawInputDevices
LoadKeyboardLayoutA
GetKeyboardLayout
GetKeyboardLayoutList
GetSystemMetrics
SetWindowPlacement
GetKeyboardLayoutNameW
EnableWindow
DestroyCursor
SetCursor
SetClassLongA
GetClassLongA
CreateIconIndirect
RegisterWindowMessageA
GetWindowTextLengthA
GetWindowTextA
SetWindowTextA
IsChild
SetFocus
GetDlgItem
GetClassNameA
GetSysColor
RedrawWindow
GetClassInfoExA
CreateWindowExA
CreateAcceleratorTableA
ScreenToClient
MoveWindow
SetCapture
ReleaseCapture
FillRect
InvalidateRgn
CallWindowProcA
InvalidateRect
ShowWindow
RegisterTouchWindow
CreateWindowExW
LoadStringW
GetMessageW
PeekMessageW
RegisterClassExW
GetCursorPos
LoadIconW
PostQuitMessage
SetForegroundWindow
UnregisterClassA
CharNextA
SendMessageA
GetFocus
LoadIconA
DestroyAcceleratorTable
DefWindowProcA
LoadCursorA
RegisterClassExA
CreateDialogIndirectParamA
DestroyWindow
IsDialogMessageA
IsWindow
ShowWindowAsync
GetWindowRect
GetClientRect
GetDoubleClickTime
RealGetWindowClassA
PeekMessageA
PostThreadMessageA
ClientToScreen
GetUserObjectInformationW
GetProcessWindowStation
MsgWaitForMultipleObjectsEx
GetWindowInfo
EnumWindows
GetRawInputDeviceInfoA
GetRawInputDeviceList
RegisterClassW
SetTimer
PostThreadMessageW
KillTimer
UnregisterClassW
RegisterDeviceNotificationW
UnregisterDeviceNotification
GetActiveWindow
EmptyClipboard
SetClipboardData
GetAsyncKeyState
EnumDisplayDevicesA
CallWindowProcW
LoadCursorW
GetClassInfoExW
PostMessageW
MapVirtualKeyW
DispatchMessageA
MapVirtualKeyA
GetParent
GetWindowLongA
SetWindowLongA
ReleaseDC
EndPaint
GetDC
BeginPaint
MonitorFromWindow
GetMonitorInfoA
MessageBoxA
PostMessageA
MessageBoxW
SetWindowTextW
DefWindowProcW
GetWindow
SetWindowPos
MapWindowPoints
SetWindowRgn
CopyRect
DispatchMessageW
TranslateMessage
GetDesktopWindow
UpdateWindow
SetRectEmpty
GetWindowThreadProcessId
OpenClipboard
EnumDisplaySettingsExA
GetProcessWindowStation
GetUserObjectInformationW
CharUpperBuffW
MessageBoxW
GetProcessWindowStation
GetUserObjectInformationW

gdi32

FillRgn
SwapBuffers
SetPixelFormat
ChoosePixelFormat
CreateFontW
CreateRoundRectRgn
SetBkColor
SetTextColor
SelectObject
CombineRgn
CreateRectRgnIndirect
CreateBitmap
CreateDIBSection
CreateSolidBrush
CreateCompatibleDC
CreateCompatibleBitmap
DeleteObject
BitBlt
DeleteDC
GetStockObject
GetObjectA
GetDeviceCaps

ole32

OleInitialize
CoTaskMemAlloc
OleUninitialize
StringFromGUID2
OleLockRunning
CoUninitialize
CoGetClassObject
PropVariantClear
CoInitializeSecurity
CoSetProxyBlanket
CreateStreamOnHGlobal
CLSIDFromProgID
CLSIDFromString
CoTaskMemRealloc
CoInitialize
CoFreeUnusedLibraries
CoInitializeEx
CoCreateInstance
CoTaskMemFree
CoCreateGuid

oleaut32

SysAllocStringLen
SysStringLen
SysAllocString
OleCreateFontIndirect
LoadRegTypeLi
LoadTypeLi
VariantClear
VariantInit
VarUI4FromStr
SysStringByteLen
SysAllocStringByteLen
OleCreatePropertyFrame
SysFreeString

advapi32

RegQueryInfoKeyW
OpenProcessToken
RegDeleteValueA
RegCreateKeyExA
RegSetValueExA
RegEnumKeyExA
RegDeleteKeyA
RegGetValueW
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
RegQueryInfoKeyA
CryptEnumProvidersW
CryptSignHashW
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
ReportEventW
RegisterEventSourceW
DeregisterEventSource
SystemFunction036
EqualSid
AllocateAndInitializeSid
FreeSid
GetSidSubAuthority
GetSidSubAuthorityCount
CryptDestroyKey
CryptVerifySignatureA
CryptAcquireContextA
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptImportKey
CryptGetHashParam
CryptReleaseContext
RegOpenKeyExW
GetTokenInformation

shlwapi

PathAddBackslashA
PathFindFileNameW
PathAppendA
PathFindFileNameA

version

VerQueryValueA
GetFileVersionInfoSizeW
GetFileVersionInfoW

wintrust

WinVerifyTrust

crypt32

CryptUnprotectData
CryptDecodeObjectEx
CryptStringToBinaryA
CryptProtectData
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty

powrprof

CallNtPowerInformation

opengl32

glCopyTexSubImage2D
glReadBuffer
glScissor
glViewport
wglGetCurrentContext
glPixelStorei
wglMakeCurrent
wglCreateContext
glDisable
wglGetProcAddress
glDeleteTextures
glBindTexture
glGenTextures
glGetIntegerv
glGetError
glGetString
glTexSubImage2D
glEnable
glPolygonMode
glCullFace
glPolygonOffset
glColorMask
glBlendFunc
glDepthFunc
glDepthMask
glStencilFunc
glStencilOp
glStencilMask
glClearColor
glClearDepth
glClearStencil
glClear
glDrawElements
glDrawArrays
glTexImage2D
wglGetCurrentDC
glGetTexImage
glReadPixels
glTexParameterfv
glTexParameterf
glTexParameteri
wglDeleteContext

ws2_32

inet_pton
freeaddrinfo
getaddrinfo
WSACleanup
htonl
ntohl
htons
ntohs
WSAStartup
inet_ntop
bind
socket
closesocket
setsockopt
send
select
__WSAFDIsSet
recvfrom
sendto
getsockname
WSACloseEvent
WSACreateEvent
WSASetEvent
WSAEventSelect
WSAResetEvent
WSAWaitForMultipleEvents
WSAGetLastError
gethostname
ioctlsocket
WSAEnumNetworkEvents
accept
listen
getsockopt
recv
connect
shutdown
getnameinfo
WSAIoctl
WSASetLastError
getpeername

bcrypt

BCryptGenRandom

msacm32

acmStreamPrepareHeader
acmFormatSuggest
acmStreamUnprepareHeader
acmStreamConvert
acmStreamSize
acmStreamOpen

msdmo

MoFreeMediaType
MoInitMediaType

secur32

CompleteAuthToken
DeleteSecurityContext
InitializeSecurityContextA
FreeCredentialsHandle
AcquireCredentialsHandleA

iphlpapi

GetAdaptersAddresses

comctl32

ImageList_AddMasked
ImageList_Create

wtsapi32

WTSSendMessageW

Exports

Exports

AmdPowerXpressRequestHighPerformance
NvOptimusEnablement
VR_RuntimePath

Sections

.text
Size: 35.9MB - Virtual size: 35.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 19.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 5.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmpx
Size: 1024B - Virtual size: 632B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: - Virtual size: 87KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 4.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 20.9MB - Virtual size: 20.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 82KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5e0326e114b9953599fd386c02686eba

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

02:19:17:fa:ad:69:b1:d7:5b:b4:3c:5e:86:45:30:2fCertificate

Extended Key Usages

Key Usages

15:87:4d:50:cf:d2:25:52:b5:e6:46:15:95:8a:d8:82:9d:c8:c1:63Signer

Signature Validations

Verification

01/03/2023, 00:44 Valid: true

Chain 1

Chain 2

Headers

DLL Characteristics

File Characteristics

Imports

imm32

sensapi

urlmon

wininet

setupapi

mfplat

shell32

dbghelp

winmm

kernel32

user32

gdi32

ole32

oleaut32

advapi32

shlwapi

version

wintrust

crypt32

powrprof

opengl32

ws2_32

bcrypt

msacm32

msdmo

secur32

iphlpapi

comctl32

wtsapi32

Exports

Exports

Sections

.text Size: 35.9MB - Virtual size: 35.9MB

.rdata Size: - Virtual size: 19.9MB

.data Size: - Virtual size: 5.3MB

.rodata Size: - Virtual size: 2KB

.vmpx Size: 1024B - Virtual size: 632B

_RDATA Size: - Virtual size: 87KB

.vmp0 Size: - Virtual size: 4.2MB

.vmp1 Size: 20.9MB - Virtual size: 20.9MB

.reloc Size: 1.2MB - Virtual size: 1.2MB

.rsrc Size: 82KB - Virtual size: 82KB

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

02:19:17:fa:ad:69:b1:d7:5b:b4:3c:5e:86:45:30:2f
Certificate

15:87:4d:50:cf:d2:25:52:b5:e6:46:15:95:8a:d8:82:9d:c8:c1:63
Signer

01/03/2023, 00:44
Valid: true

.text
Size: 35.9MB - Virtual size: 35.9MB

.rdata
Size: - Virtual size: 19.9MB

.data
Size: - Virtual size: 5.3MB

.rodata
Size: - Virtual size: 2KB

.vmpx
Size: 1024B - Virtual size: 632B

_RDATA
Size: - Virtual size: 87KB

.vmp0
Size: - Virtual size: 4.2MB

.vmp1
Size: 20.9MB - Virtual size: 20.9MB

.reloc
Size: 1.2MB - Virtual size: 1.2MB

.rsrc
Size: 82KB - Virtual size: 82KB