Static task
static1
Behavioral task
behavioral1
Sample
RobloxPlayerLauncher_14.exe
Resource
win10v2004-20230703-en
General
-
Target
RobloxPlayerLauncher_14.exe
-
Size
782KB
-
MD5
17e8d42d4144b005d39a38602b5e281c
-
SHA1
aefcd64bb38cd4bf6c251e6bded095f4b59b7003
-
SHA256
3a1020b06724e0469b781c16b842f137e63e8fd1200fbdf504e92671f1be666e
-
SHA512
1f0e6b7dcaacc26ff55ad3c2ea24a3ed91af44220815cac0c0ae71e0fe14ec74bd682a256c9262227fe269a8674cf4a24d42daf18bb72f3db393d86b15b31230
-
SSDEEP
12288:pgKAYQ1LOE/6x6HQWTtqDowaOS+fMDc3:p7AJUYbTMdat+fMDE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource RobloxPlayerLauncher_14.exe
Files
-
RobloxPlayerLauncher_14.exe.exe windows x86
764fe31565ed317d50757780eb9b3823
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
VerSetConditionMask
SetLastError
TlsGetValue
TlsSetValue
SizeofResource
GetTempPathW
DeleteFileW
GetVersionExW
lstrcmpW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
VerifyVersionInfoW
SetWaitableTimer
CreateIoCompletionPort
PostQueuedCompletionStatus
SleepEx
QueueUserAPC
TerminateThread
WaitForMultipleObjects
TlsAlloc
FormatMessageA
LeaveCriticalSection
EnterCriticalSection
FormatMessageW
LocalFree
GetQueuedCompletionStatus
Sleep
QueryPerformanceFrequency
WaitForSingleObjectEx
GetCurrentThreadId
GetCurrentThread
LoadLibraryW
FreeLibrary
CreateProcessW
TerminateProcess
WaitForSingleObject
GetUserGeoID
GetGeoInfoW
CompareFileTime
LockResource
FindNextFileW
FindClose
lstrlenW
GetLocalTime
OpenProcess
CreateDirectoryW
GetDiskFreeSpaceExW
SetFileAttributesW
RemoveDirectoryW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetShortPathNameW
CreateFileW
GetFileAttributesW
GetFileAttributesExW
GetFileSizeEx
MulDiv
GetExitCodeProcess
lstrcpyW
lstrcatW
WriteFile
GetFileTime
DosDateTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
IsDebuggerPresent
OutputDebugStringW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
WaitForMultipleObjectsEx
OpenEventA
ResumeThread
GetModuleHandleA
CreateWaitableTimerA
LoadResource
FindResourceW
FindResourceExW
TlsFree
GetSystemTimeAsFileTime
CreateSemaphoreA
GetCurrentProcess
DuplicateHandle
ReleaseSemaphore
FindFirstFileW
InterlockedDecrement
ReleaseMutex
CreateMutexW
ResetEvent
SetEvent
CloseHandle
OpenEventW
CreateEventW
CreateEventA
GetSystemTime
WideCharToMultiByte
GetProcessHeap
DeleteCriticalSection
HeapDestroy
HeapAlloc
RaiseException
HeapReAlloc
GetLastError
MultiByteToWideChar
HeapSize
InitializeCriticalSectionAndSpinCount
GetTickCount
HeapFree
QueryPerformanceCounter
user32
CharNextW
AllowSetForegroundWindow
GetWindowLongW
SendMessageW
GetWindowRect
GetParent
CallWindowProcW
GetSystemMetrics
LoadBitmapW
CharUpperW
SetWindowLongW
ShowWindow
InvalidateRect
RegisterClassW
LoadIconW
EndPaint
GetDC
FillRect
CreateWindowExW
MessageBoxA
BeginPaint
PostQuitMessage
GetDlgItem
EnumWindows
GetWindowThreadProcessId
PostThreadMessageW
MessageBoxW
SetWindowPos
GetWindowTextW
PostMessageW
SetForegroundWindow
IsWindowVisible
EnableWindow
DestroyWindow
KillTimer
SetTimer
ReleaseDC
SetWindowTextW
LoadAcceleratorsW
GetMessageW
TranslateAcceleratorW
TranslateMessage
DispatchMessageW
DefWindowProcW
SetFocus
gdi32
CreateFontW
GetStockObject
Rectangle
SelectObject
CreatePen
SetBkMode
SetTextColor
GetDeviceCaps
DeleteObject
CreateSolidBrush
advapi32
GetTokenInformation
CryptHashData
CryptDestroyHash
CryptReleaseContext
CryptCreateHash
CryptAcquireContextW
RegFlushKey
RegDeleteValueW
RegEnumKeyExW
RegDeleteKeyW
DuplicateToken
CheckTokenMembership
GetSidSubAuthority
InitializeSid
GetSidLengthRequired
OpenThreadToken
OpenProcessToken
CopySid
GetLengthSid
IsValidSid
CryptGetHashParam
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
GetUserNameW
shell32
ShellExecuteW
ShellExecuteExW
SHGetFolderPathAndSubDirW
ole32
CoCreateGuid
CoUninitialize
CoInitialize
CoCreateInstance
StringFromGUID2
oleaut32
SysFreeString
SysAllocString
VariantInit
VariantClear
RegisterTypeLi
shlwapi
PathFileExistsW
SHDeleteKeyW
StrStrW
StrCmpW
PathAddBackslashW
StrDupW
StrRChrW
StrCpyW
StrCmpNW
msvcp140
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Gettrue@_Locinfo@std@@QBEPBDXZ
?_Getfalse@_Locinfo@std@@QBEPBDXZ
?_Getlconv@_Locinfo@std@@QBEPBUlconv@@XZ
?id@?$numpunct@D@std@@2V0locale@2@A
?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@U_Mbstatet@@@2@V32@H@Z
?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@U_Mbstatet@@@2@_JHH@Z
?__ExceptionPtrCopyException@@YAXPAXPBX1@Z
?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHH@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAI@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@U_Mbstatet@@@2@@Z
?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
_Mbrtowc
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?id@?$numpunct@_W@std@@2V0locale@2@A
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@U_Mbstatet@@@2@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@N@Z
?uncaught_exception@std@@YA_NXZ
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?id@?$ctype@D@std@@2V0locale@2@A
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ
??0_Locinfo@std@@QAE@PBD@Z
??1_Locinfo@std@@QAE@XZ
?_Incref@facet@locale@std@@UAEXXZ
??_D?$basic_istream@DU?$char_traits@D@std@@@std@@QAEXXZ
??_D?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??1facet@locale@std@@MAE@XZ
??0facet@locale@std@@IAE@I@Z
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?classic@locale@std@@SAABV12@XZ
?__ExceptionPtrRethrow@@YAXPBX@Z
?__ExceptionPtrAssign@@YAXPAXPBX@Z
?__ExceptionPtrCreate@@YAXPAX@Z
?__ExceptionPtrCurrentException@@YAXPAX@Z
?__ExceptionPtrCopy@@YAXPAXPBX@Z
?__ExceptionPtrDestroy@@YAXPAX@Z
??Bid@locale@std@@QAEIXZ
?always_noconv@codecvt_base@std@@QBE_NXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?_BADOFF@std@@3_JB
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
ws2_32
freeaddrinfo
connect
getsockopt
getaddrinfo
WSASocketW
WSASend
WSARecv
select
ioctlsocket
closesocket
WSAGetLastError
WSACleanup
WSAStartup
WSASetLastError
setsockopt
wininet
InternetWriteFile
HttpQueryInfoW
HttpSendRequestExW
InternetReadFile
InternetQueryDataAvailable
HttpAddRequestHeadersW
InternetSetOptionW
InternetConnectW
InternetCloseHandle
HttpSendRequestW
InternetOpenW
HttpEndRequestW
HttpOpenRequestW
sensapi
IsNetworkAlive
userenv
UnloadUserProfile
comctl32
_TrackMouseEvent
InitCommonControlsEx
psapi
GetProcessImageFileNameW
EnumProcesses
vcruntime140
memmove
__std_terminate
longjmp
__std_exception_copy
__std_exception_destroy
__std_type_info_compare
_purecall
memchr
wcsstr
memset
__CxxFrameHandler3
__vcrt_InitializeCriticalSectionEx
_CxxThrowException
_except_handler4_common
memcpy
_setjmp3
memcmp
api-ms-win-crt-string-l1-1-0
wcsnlen
wmemcpy_s
wcsncpy_s
isspace
strncpy
tolower
ispunct
strcpy_s
wcscpy_s
wcscat_s
_wcsicmp
api-ms-win-crt-heap-l1-1-0
free
malloc
_recalloc
calloc
_callnewh
realloc
_set_new_mode
api-ms-win-crt-convert-l1-1-0
wcstombs_s
_wtoi
atoi
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf_s
fread
fopen
_set_fmode
fputc
ungetc
fflush
setvbuf
fsetpos
_fseeki64
fgetpos
fwrite
fseek
ferror
_get_stream_buffer_pointers
fclose
ftell
__stdio_common_vsnprintf_s
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf
__stdio_common_vsprintf
__p__commode
__stdio_common_vswprintf_s
fgetc
api-ms-win-crt-runtime-l1-1-0
_initterm
_beginthreadex
terminate
_configure_wide_argv
_initialize_wide_environment
_set_app_type
__p___argc
_cexit
_crt_atexit
_get_wide_winmain_command_line
_register_onexit_function
_initialize_onexit_table
__p___wargv
exit
_exit
_getpid
_initterm_e
strerror
_register_thread_local_exe_atexit_callback
_c_exit
_controlfp_s
_invalid_parameter_noinfo_noreturn
_seh_filter_exe
_errno
_invalid_parameter_noinfo
api-ms-win-crt-utility-l1-1-0
rand
srand
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
api-ms-win-crt-time-l1-1-0
_gmtime64
_time64
api-ms-win-crt-math-l1-1-0
_except1
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
iphlpapi
GetAdaptersInfo
Sections
.text Size: 247KB - Virtual size: 247KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 115KB - Virtual size: 114KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 108B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 388KB - Virtual size: 388KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ