RobloxPlayerInstaller[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
RobloxPlayerInstaller.exe
Size 4.5MB
Sample240203-wax71ahcdq
SHA256 0e774f8533566b6221fdd374f4f6f30551f4e6aeb4848521445d15158f029855
MD5 c9c89a5180728704d9fc8b10fcfa5124
SHA1 6eb7edac4c879645641394eb20db3cf707019b47
SHA512 98fbac35cbfff889ffb7a9b26684aee196237a54a9548285c233c2abf0a6a1f7588eb28d166a3a32e103f974418a7e75477cc699e5f0c8e3e290916b44ffc220
SSDEEP 98304:Smvn+iSkszLaY6ZZBrKv0Log5yGj06VuXJ+2npsbLfNzt:P+iBsGZ7KngtE+YK3fdt
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

RobloxPlayerInstaller.exe

.exe 4.5MB

RobloxPlayerInstaller.exe

IMPHASH 09584d0e75e6fc154c203ded44f9eb49
SHA256 0e774f8533566b6221fdd374f4f6f30551f4e6aeb4848521445d15158f029855
MD5 c9c89a5180728704d9fc8b10fcfa5124
SHA1 6eb7edac4c879645641394eb20db3cf707019b47
SHA512 98fbac35cbfff889ffb7a9b26684aee196237a54a9548285c233c2abf0a6a1f7588eb28d166a3a32e103f974418a7e75477cc699e5f0c8e3e290916b44ffc220
SSDEEP 98304:Smvn+iSkszLaY6ZZBrKv0Log5yGj06VuXJ+2npsbLfNzt:P+iBsGZ7KngtE+YK3fdt
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Digest

0d:a5:c0:18:d8:01:b4:e0:20:1f:e7:3f:4f:49:a7:00:76:00:33:53:2c:7b:ec:4c:51:87:19:ad:d0:f4:ce:67

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=ROBLOX CORPORATION,O=ROBLOX CORPORATION,ST=California,C=US

Chains

Dec 9, 2023

CN=ROBLOX CORPORATION,O=ROBLOX CORPORATION,ST=California,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Digest

dc:a7:29:a0:30:fb:a8:be:1d:38:92:4f:c4:63:34:26:d3:c3:69:af

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=ROBLOX CORPORATION,O=ROBLOX CORPORATION,ST=California,C=US

Chains

Dec 9, 2023

CN=ROBLOX CORPORATION,O=ROBLOX CORPORATION,ST=California,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=ROBLOX CORPORATION,O=ROBLOX CORPORATION,ST=California,C=US

Serial Number

99:0b:eb:6d:8f:b3:ee:bd:30:43:9e:2a:86:fa:49:63

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 13, 2022 - Jul 12, 2024

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=ROBLOX CORPORATION,O=ROBLOX CORPORATION,ST=California,C=US

Serial Number

99:0b:eb:6d:8f:b3:ee:bd:30:43:9e:2a:86:fa:49:63

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 13, 2022 - Jul 12, 2024

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

2923856

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\buildAgent\work\ci_deploy_ninja_boot-x86_git\build.ninja\common\vs2019\x86\release\Installer\Windows\RobloxPlayerInstaller.pdb

comctl32

_TrackMouseEvent InitCommonControlsEx

gdiplus

GdipCreateHBITMAPFromBitmap GdipFree GdiplusStartup GdiplusShutdown GdipCloneImage GdipDisposeImage GdipCreateBitmapFromStream GdipAlloc

shell32

SHGetKnownFolderPath SHGetFolderPathAndSubDirW Shell_NotifyIconW

ws2_32

listen ntohs recv select send setsockopt ntohl socket closesocket htons getsockname bind accept getnameinfo inet_ntop inet_pton freeaddrinfo getaddrinfo WSAIoctl WSACreateEvent WSACloseEvent WSAGetLastError gethostname getsockopt getpeername ioctlsocket connect __WSAFDIsSet htonl WSASetLastError WSACleanup WSAStartup

crypt32

CertGetCertificateContextProperty CertDuplicateCertificateContext CertFindCertificateInStore CertOpenStore CertOpenSystemStoreA CertGetIntendedKeyUsage CertCloseStore CertEnumCertificatesInStore CertFreeCertificateContext CertGetEnhancedKeyUsage

iphlpapi

GetAdaptersAddresses

kernel32

IsDebuggerPresent DebugBreak OutputDebugStringW CloseHandle GetLastError SetLastError HeapAlloc HeapFree GetProcessHeap ReleaseSemaphore ReleaseMutex WaitForSingleObject WaitForSingleObjectEx OpenSemaphoreW CreateMutexExW CreateSemaphoreExW GetCurrentProcessId GetCurrentThreadId GetModuleFileNameA GetModuleHandleW GetModuleHandleExW GetProcAddress FormatMessageW SetSearchPathMode GetCommandLineW VerSetConditionMask GetDiskFreeSpaceExW CreateFileMappingW VerifyVersionInfoW MulDiv LocaleNameToLCID GetUserDefaultLocaleName Sleep FindClose FindFirstFileW FindNextFileW SetEvent CreateEventW OpenEventW CreateProcessW GetSystemTime CreateFileW GetFileSize MapViewOfFile UnmapViewOfFile DeleteFileW TerminateProcess InitializeProcThreadAttributeList UpdateProcThreadAttribute OpenProcess GetModuleFileNameW SystemTimeToFileTime CreateToolhelp32Snapshot Process32FirstW Process32NextW K32GetModuleFileNameExW WideCharToMultiByte GetCurrentProcess GetCurrentProcessorNumber GlobalMemoryStatusEx GetSystemInfo GetSystemTimeAsFileTime GetVersionExA IsWow64Process LoadLibraryA K32GetProcessMemoryInfo DecodePointer RaiseException InitializeCriticalSectionEx DeleteCriticalSection GetModuleHandleA OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency SwitchToThread MultiByteToWideChar GetNativeSystemInfo LoadLibraryExW FileTimeToSystemTime VirtualQuery CreateSemaphoreA DuplicateHandle GetTickCount WaitForMultipleObjectsEx GetExitCodeProcess LocalAlloc FindResourceExW LoadResource LockResource SizeofResource FindResourceW LoadLibraryW GlobalAlloc GlobalFree GlobalUnlock GlobalLock GetFileAttributesW GetFileSizeEx ReadFile RemoveDirectoryW SetFileAttributesW WriteFile CopyFileW CompareStringEx FreeLibrary GetEnvironmentVariableW GetEnvironmentVariableA CompareFileTime ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection SleepEx GetSystemDirectoryA MoveFileExA VirtualAlloc ReleaseSRWLockShared AcquireSRWLockShared GetStdHandle GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree SwitchToFiber DeleteFiber CreateFiber GetFileType ConvertFiberToThread ConvertThreadToFiber InitializeCriticalSection FormatMessageA GetCurrentDirectoryW GetFileAttributesExW GetFileInformationByHandle GetFileTime GetFullPathNameW SetEndOfFile SetFilePointerEx SetFileTime GetTempPathW DeviceIoControl MoveFileExW ResetEvent SetWaitableTimer ResumeThread CreateWaitableTimerA AreFileApisANSI EncodePointer InitOnceComplete InitOnceBeginInitialize SleepConditionVariableSRW SleepConditionVariableCS WakeAllConditionVariable WakeConditionVariable InitializeConditionVariable TryEnterCriticalSection InitializeSRWLock GetExitCodeThread LCMapStringEx GetCPInfo GetLocaleInfoEx GetStringTypeW IsProcessorFeaturePresent InitializeSListHead UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW RtlUnwind InterlockedPushEntrySList GetCommandLineA CreateThread ExitThread FreeLibraryAndExitThread GetConsoleOutputCP SetStdHandle HeapSize GetDriveTypeW PeekNamedPipe SystemTimeToTzSpecificLocalTime SetConsoleCtrlHandler ExitProcess GetTimeZoneInformation GetDateFormatW GetTimeFormatW CompareStringW CreateDirectoryW LocalFree LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers HeapReAlloc FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW WriteConsoleW GetFinalPathNameByHandleW CreateEventA

user32

LoadBitmapW EnumDisplayDevicesA GetWindowThreadProcessId GetShellWindow TranslateAcceleratorW LoadAcceleratorsW DispatchMessageW TranslateMessage GetMessageW DestroyIcon LoadIconW SetWindowLongW GetProcessWindowStation FillRect GetWindowRect InvalidateRect EndPaint BeginPaint GetDC DrawTextW GetSystemMetrics EnableWindow KillTimer SetTimer GetDlgCtrlID GetUserObjectInformationW DefWindowProcW SendMessageW RegisterClassW PostQuitMessage CallWindowProcW CreateWindowExW DestroyWindow MessageBoxW GetWindowLongW ShowWindow GetDlgItem

gdi32

SetDCBrushColor SetDCPenColor SetBkMode SetTextColor SelectObject RoundRect Rectangle GetStockObject GetDeviceCaps DeleteObject DeleteDC CreateSolidBrush CreatePen CreateFontW

ole32

StringFromGUID2 CoTaskMemFree CoTaskMemAlloc CoCreateInstance CoUninitialize CoInitialize CoInitializeEx CoCreateGuid

advapi32

CryptCreateHash SystemFunction036 CryptGetHashParam CryptReleaseContext CryptAcquireContextW GetUserNameW CryptHashData CryptDestroyHash RegCloseKey RegCreateKeyExW RegDeleteValueW RegOpenKeyExW RegSetValueExW RegGetValueW RegOpenKeyExA RegQueryValueExA CryptDestroyKey OpenProcessToken AllocateAndInitializeSid CopySid EqualSid FreeSid GetLengthSid GetTokenInformation IsValidSid RegEnumKeyExW RegQueryInfoKeyW RegQueryValueExW RegDeleteTreeW DeregisterEventSource RegisterEventSourceW ReportEventW CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptDecrypt CryptSignHashW CryptEnumProvidersW

shlwapi

PathFindFileNameW PathFindExtensionW ord12

powrprof

CallNtPowerInformation

winmm

timeBeginPeriod timeGetTime timeSetEvent timeGetDevCaps

bcrypt

BCryptGenRandom

Sharing

General

Malware Config

Signatures

File Explorer

RobloxPlayerInstaller.exe

comctl32

gdiplus

shell32

ws2_32

crypt32

iphlpapi

kernel32

user32

gdi32

ole32

advapi32

shlwapi

powrprof

winmm

bcrypt

generic