RobloxPlayerLauncher[.]exe

Resubmissions

12-03-2023 17:12

230312-vqwhnsgf5t 6

12-03-2023 17:08

230312-vnx9gsgf4w 8

Sharing

Copy URL

Twitter E-mail

General

Target

RobloxPlayerLauncher.exe
Size

1.4MB
MD5

57112c13c86348c1d78c82f25fc64533
SHA1

f6e26c12087badd318c00d4b511b04d0fc79bc57
SHA256

df7205a99dcab93956834d0b2bd86e87a61d83f7b50ede1203c4a5b74836e2bb
SHA512

d9cf7534650648fd88ffdef379ee92f1c7c0cd37e2a14c85ac0fe33a333635252dfef690b774191835f0064963c133765410a00d636b4f5ecf4f35afb5ddb516
SSDEEP

24576:dd9mOVYESaJ8QvFnUZ2TbIwhuREVxcJjj6PbKV4leToAyGCLlxtbK3r0TsPE8CGG:dBVYESa7ybJH604lnAyGCLlxtbK3r0T9

Score

1^/10

Malware Config

Signatures

Files

RobloxPlayerLauncher.exe
.exe windows x86

71585ca945fca0374947b55be77bd140

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

04-03-2014 00:00

Not After

03-03-2024 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

59:c1:ab:6c:62:a0:f3:48:0d:bc:e9:c8:37:da:24:32
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

06-08-2019 00:00

Not After

05-08-2022 23:59

Subject

SERIALNUMBER=3780902,CN=Roblox Corporation,O=Roblox Corporation,L=San Mateo,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#130953616e204d6174656f,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

50:60:34:35:09:65:e6:bc:62:63:9d:d7:fe:3f:fb:79:c4:63:e6:9e
Signer

Actual PE Digest

50:60:34:35:09:65:e6:bc:62:63:9d:d7:fe:3f:fb:79:c4:63:e6:9e

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

SERIALNUMBER=3780902,CN=Roblox Corporation,O=Roblox Corporation,L=San Mateo,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#130953616e204d6174656f,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

17-12-2019 01:02
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

powrprof

CallNtPowerInformation

winhttp

WinHttpReadData
WinHttpConnect
WinHttpCloseHandle
WinHttpWriteData
WinHttpOpen
WinHttpCrackUrl
WinHttpSetTimeouts
WinHttpOpenRequest
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpQueryHeaders

kernel32

CreateSemaphoreW
GetTickCount
WaitForSingleObjectEx
VerSetConditionMask
GetFileSize
ReadFile
WriteFile
GetTempPathW
GetVersionExW
LocalFree
FormatMessageW
FindResourceA
VerifyVersionInfoW
GetStdHandle
CompareFileTime
FindClose
FindFirstFileW
FindNextFileW
GetDiskFreeSpaceExW
RemoveDirectoryW
SetFileAttributesW
GetCurrentProcess
TerminateProcess
GetExitCodeProcess
GetCurrentThread
CreateProcessW
OpenProcess
GetSystemTime
GetLocalTime
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
FreeLibrary
GetModuleFileNameW
LoadLibraryW
lstrlenW
BeginUpdateResourceW
UpdateResourceA
EndUpdateResourceW
CopyFileW
SystemTimeToFileTime
GetGeoInfoW
GetUserGeoID
GetUserDefaultLCID
FreeConsole
AttachConsole
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
GetSystemTimeAsFileTime
CreateSemaphoreA
DuplicateHandle
GetModuleHandleA
K32EnumProcesses
K32GetProcessImageFileNameW
GetShortPathNameW
FlushFileBuffers
GetFileAttributesExW
GetFileSizeEx
SetFileTime
lstrcpyW
MoveFileW
OpenEventA
GetCurrentProcessId
IsDebuggerPresent
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
IsWow64Process
QueryPerformanceCounter
QueryPerformanceFrequency
FileTimeToSystemTime
GetFileTime
LocalFileTimeToFileTime
SetFilePointer
DosDateTimeToFileTime
lstrcatW
GetFileType
SetUnhandledExceptionFilter
RaiseException
CreateThread
GetExitCodeThread
Sleep
GetVersion
LockFileEx
SetEndOfFile
InitializeCriticalSectionEx
SetProcessShutdownParameters
SetConsoleCtrlHandler
GetProcessTimes
SuspendThread
ResumeThread
GetProcessId
GetThreadContext
IsProcessorFeaturePresent
GetSystemInfo
GetTimeZoneInformation
GetThreadLocale
GetSystemDefaultLCID
InitializeCriticalSection
FormatMessageA
VirtualQueryEx
ReadProcessMemory
SetNamedPipeHandleState
TransactNamedPipe
CreateNamedPipeW
WaitNamedPipeW
SetFilePointerEx
FindFirstFileExW
ConnectNamedPipe
DisconnectNamedPipe
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
UnregisterWaitEx
RegisterWaitForSingleObject
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
SwitchToThread
WaitForMultipleObjectsEx
SetWaitableTimer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CreateWaitableTimerA
DecodePointer
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetFileInformationByHandle
GetDriveTypeW
GetConsoleCP
ReadConsoleW
GetConsoleMode
GetCommandLineW
GetCommandLineA
LoadLibraryExW
RtlUnwind
InitializeSListHead
MulDiv
GetStartupInfoW
UnhandledExceptionFilter
GetCPInfo
GetStringTypeW
GetLocaleInfoW
LCMapStringW
CompareStringW
EncodePointer
SetLastError
GetCurrentThreadId
FindResourceW
ReleaseSemaphore
SizeofResource
CreateEventA
WideCharToMultiByte
MultiByteToWideChar
lstrcmpW
GetProcAddress
GetModuleHandleW
OpenEventW
CreateEventW
CreateMutexW
WaitForSingleObject
ReleaseMutex
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
GetLastError
CloseHandle
DeleteFileW
LockResource
LoadResource
FindResourceExW
GetFileAttributesW
CreateFileW
CreateDirectoryW
DeleteCriticalSection
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
UnlockFileEx
HeapDestroy
IsValidLocale
EnumSystemLocalesW
SetStdHandle
GetCurrentDirectoryW
GetFullPathNameW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SleepEx
WriteConsoleW

user32

ReleaseDC
DrawTextW
GetSystemMetrics
EnableWindow
KillTimer
SetTimer
GetDlgCtrlID
GetDlgItem
DestroyWindow
EndPaint
FillRect
LoadBitmapW
PostMessageW
IsWindowVisible
SetForegroundWindow
GetWindowTextW
ShowWindow
CreateWindowExW
CallWindowProcW
DefWindowProcW
FindWindowW
MessageBoxA
GetDC
InvalidateRect
GetWindowRect
MessageBoxW
GetWindowLongW
SetWindowLongW
GetParent
UnregisterClassW
GetMessageW
DispatchMessageW
PostThreadMessageW
SetWindowPos
SetFocus
LoadAcceleratorsW
TranslateAcceleratorW
SetWindowTextW
EnumWindows
AllowSetForegroundWindow
CharNextW
CharUpperW
SendMessageW
GetWindowThreadProcessId
LoadIconW
MessageBoxExW
BeginPaint
TranslateMessage
PostQuitMessage
RegisterClassW

gdi32

SelectObject
RoundRect
Rectangle
GetStockObject
SetDCBrushColor
GetDeviceCaps
DeleteObject
CreateSolidBrush
CreateFontW
SetDCPenColor
SetBkMode
CreatePen
SetTextColor

shell32

ShellExecuteExW
SHGetFolderPathAndSubDirW
CommandLineToArgvW
Shell_NotifyIconW
ord165
Shell_NotifyIconA
ShellExecuteW

ole32

CoCreateGuid
StringFromGUID2
CoUninitialize
CoInitialize
CreateStreamOnHGlobal
CoCreateInstance

advapi32

RegQueryValueExW
RegCreateKeyExW
RegDeleteValueW
OpenProcessToken
OpenThreadToken
CheckTokenMembership
CopySid
DuplicateToken
GetLengthSid
GetSidLengthRequired
GetSidSubAuthority
InitializeSid
IsValidSid
GetUserNameW
RegDeleteKeyW
RegEnumKeyExW
RegEnumValueW
RegFlushKey
RegQueryInfoKeyW
GetTokenInformation
CryptAcquireContextW
CryptReleaseContext
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
ImpersonateNamedPipeClient
RevertToSelf
SystemFunction036
RegCloseKey
RegOpenKeyExW
RegSetValueExW

shlwapi

StrRChrW
StrStrW
StrCpyW
SHDeleteKeyW
StrDupW
PathRemoveFileSpecW
PathAppendW
PathRemoveExtensionW
PathFileExistsW
StrCmpW
StrCmpNW
PathAddBackslashW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

wininet

HttpQueryInfoW
InternetConnectW
InternetSetOptionW
InternetReadFile
InternetWriteFile
InternetQueryDataAvailable
InternetOpenW
HttpEndRequestW
HttpSendRequestExW
HttpSendRequestW
HttpAddRequestHeadersW
HttpOpenRequestW
InternetQueryOptionW
InternetCloseHandle

ws2_32

closesocket
connect
htons
send
sendto
socket
WSAStartup
WSACleanup
freeaddrinfo
getaddrinfo
WSAGetLastError

sensapi

IsNetworkAlive

userenv

UnloadUserProfile

comctl32

_TrackMouseEvent
InitCommonControlsEx

gdiplus

GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromStream
GdipDisposeImage
GdipCloneImage
GdiplusShutdown
GdiplusStartup
GdipFree
GdipAlloc

winmm

timeGetTime
timeSetEvent
timeGetDevCaps
timeBeginPeriod

Sections

.text
Size: 973KB - Virtual size: 972KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 279KB - Virtual size: 278KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 344KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

CPADinfo
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 107KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

71585ca945fca0374947b55be77bd140

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49Certificate

Extended Key Usages

Key Usages

59:c1:ab:6c:62:a0:f3:48:0d:bc:e9:c8:37:da:24:32Certificate

Extended Key Usages

Key Usages

50:60:34:35:09:65:e6:bc:62:63:9d:d7:fe:3f:fb:79:c4:63:e6:9eSigner

Signature Validations

Verification

17-12-2019 01:02 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

powrprof

winhttp

kernel32

user32

gdi32

shell32

ole32

advapi32

shlwapi

version

wininet

ws2_32

sensapi

userenv

comctl32

gdiplus

winmm

Sections

.text Size: 973KB - Virtual size: 972KB

.rdata Size: 279KB - Virtual size: 278KB

.data Size: 18KB - Virtual size: 344KB

CPADinfo Size: 512B - Virtual size: 40B

.rsrc Size: 107KB - Virtual size: 107KB

.reloc Size: 47KB - Virtual size: 47KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

59:c1:ab:6c:62:a0:f3:48:0d:bc:e9:c8:37:da:24:32
Certificate

50:60:34:35:09:65:e6:bc:62:63:9d:d7:fe:3f:fb:79:c4:63:e6:9e
Signer

17-12-2019 01:02
Valid: false

.text
Size: 973KB - Virtual size: 972KB

.rdata
Size: 279KB - Virtual size: 278KB

.data
Size: 18KB - Virtual size: 344KB

CPADinfo
Size: 512B - Virtual size: 40B

.rsrc
Size: 107KB - Virtual size: 107KB

.reloc
Size: 47KB - Virtual size: 47KB