RobloxPlayerLauncher (1)[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
RobloxPlayerLauncher (1).exe
Size 5.0MB
Sample240214-rla5dsch41
SHA256 987f45a5fa22b34fe09422b4e8fb844c4dfedae522d1ff35b833fbd0ae850d80
MD5 97d5071b4251a88c685a53051e1ae986
SHA1 ef277883334b865db544af96abaff6687a1e4f42
SHA512 d9777d1c766868b3bd51c6fd55ac05fe8381ae2db00ad6072a535ea04814bd2ad92957661e73a13d2feff0812e55e8ced2a1144ee2d805ec951c30faeee22558
SSDEEP 98304:aXvT3ffvvYakoCm4sRE8g/pvTNJcfZdvWbdfNwjbzI+:uTnvvYFPegDLb1uY+
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

RobloxPlayerLauncher (1).exe

.exe 5.0MB

RobloxPlayerLauncher (1).exe

IMPHASH 9d4d4933b951afc14ac1e9f72b5b063e
SHA256 987f45a5fa22b34fe09422b4e8fb844c4dfedae522d1ff35b833fbd0ae850d80
MD5 97d5071b4251a88c685a53051e1ae986
SHA1 ef277883334b865db544af96abaff6687a1e4f42
SHA512 d9777d1c766868b3bd51c6fd55ac05fe8381ae2db00ad6072a535ea04814bd2ad92957661e73a13d2feff0812e55e8ced2a1144ee2d805ec951c30faeee22558
SSDEEP 98304:aXvT3ffvvYakoCm4sRE8g/pvTNJcfZdvWbdfNwjbzI+:uTnvvYFPegDLb1uY+
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Digest

32:e1:9f:bd:b3:15:ce:60:7d:f3:b4:30:85:a7:b5:b0:71:8f:51:91:da:88:0a:c0:43:96:d5:08:bd:d8:f9:13

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=3780902,CN=Roblox Corporation,O=Roblox Corporation,L=San Mateo,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Feb 6, 2024

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

cc:96:80:37:21:a8:59:34:60:0f:11:3c:3f:05:73:6a:00:93:f8:86

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

Chains

Feb 6, 2024

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

Serial Number

06:17:58:cf:4e:ad:e9:f9:27:96:cf:74:a9:34:b0:67

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 24, 2023 - Oct 23, 2024

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

06:17:58:cf:4e:ad:e9:f9:27:96:cf:74:a9:34:b0:67

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 24, 2023 - Oct 23, 2024

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

3342386

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\buildAgent\work\ci_deploy_nbsninja_boot-x86_git\build.ninja\common\vs2019\x86\release\Installer\BootstrapperClient\BootstrapperClient.pdb

ws2_32

gethostname WSAGetLastError WSACloseEvent WSACreateEvent htons getpeername ioctlsocket connect __WSAFDIsSet htonl WSASetLastError WSACleanup WSAStartup setsockopt send select recv getsockopt getsockname closesocket bind accept socket ntohs ntohl inet_ntop freeaddrinfo getaddrinfo getnameinfo inet_pton WSAIoctl listen

crypt32

CertFindCertificateInStore CertDuplicateCertificateContext CertGetCertificateContextProperty CertOpenStore CertOpenSystemStoreA CertGetIntendedKeyUsage CertCloseStore CertEnumCertificatesInStore CertFreeCertificateContext CertGetEnhancedKeyUsage

iphlpapi

GetAdaptersAddresses

shell32

ShellExecuteExW Shell_NotifyIconA ord165 SHGetFolderPathAndSubDirW ShellExecuteW CommandLineToArgvW SHGetKnownFolderPath

powrprof

CallNtPowerInformation

winhttp

WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpOpenRequest WinHttpSendRequest WinHttpCrackUrl WinHttpReadData WinHttpWriteData WinHttpSetOption WinHttpSetTimeouts WinHttpAddRequestHeaders WinHttpReceiveResponse WinHttpQueryHeaders

kernel32

DeleteFileW CloseHandle SetLastError SetEvent ResetEvent ReleaseMutex WaitForSingleObject CreateMutexW CreateEventW OpenEventW GetCurrentProcessId GetModuleHandleW GetProcAddress lstrcmpW MultiByteToWideChar WideCharToMultiByte MulDiv CreateDirectoryW CreateFileW GetFileAttributesW FindResourceExW LoadResource LockResource SizeofResource FindResourceW VerSetConditionMask GetFileSize ReadFile GetTempPathW InitializeCriticalSectionEx LocalAlloc LocalFree FormatMessageW CopyFileW MoveFileW VerifyVersionInfoW GetSystemTimeAsFileTime FindClose FindFirstFileW FindNextFileW GetDiskFreeSpaceExW RemoveDirectoryW SetFileAttributesW DebugBreak Sleep GetCurrentProcess TerminateProcess GetExitCodeProcess GetCurrentThreadId CreateProcessW OpenProcess GetSystemTime GetLocalTime GetTickCount GetVersionExW CreateFileMappingW MapViewOfFile UnmapViewOfFile FreeLibrary GetModuleFileNameA GetModuleFileNameW GetModuleHandleExW LoadLibraryW lstrlenW SystemTimeToFileTime GetGeoInfoW GetUserGeoID GetUserDefaultLCID CreateEventA K32EnumProcesses K32GetProcessImageFileNameW GetCommandLineW IsDebuggerPresent OutputDebugStringW GetShortPathNameW GlobalAlloc GlobalUnlock GlobalLock GlobalFree FlushFileBuffers SetFileTime WriteFile lstrcpyW LoadLibraryA ReleaseSemaphore CreateSemaphoreW GetFileTime CreateSemaphoreA DuplicateHandle GetModuleHandleA WaitForMultipleObjectsEx GetEnvironmentVariableA CompareFileTime QueryPerformanceCounter QueryPerformanceFrequency ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection SleepEx GetSystemDirectoryA InitializeCriticalSectionAndSpinCount OpenSemaphoreW CreateMutexExW CreateSemaphoreExW QueryFullProcessImageNameW CreateToolhelp32Snapshot Process32First Process32Next CreateFileA CreateMutexA GetProcessTimes GetCurrentProcessorNumber GlobalMemoryStatusEx GetSystemInfo HeapSize IsWow64Process K32GetProcessMemoryInfo OutputDebugStringA SwitchToThread VirtualAlloc ReleaseSRWLockShared AcquireSRWLockShared GetStdHandle GetEnvironmentVariableW GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW TlsAlloc TlsGetValue TlsSetValue TlsFree SwitchToFiber DeleteFiber CreateFiber GetFileType ConvertFiberToThread ConvertThreadToFiber InitializeCriticalSection SetUnhandledExceptionFilter CreateThread GetExitCodeThread GetVersion LockFileEx SetEndOfFile UnlockFileEx SetProcessShutdownParameters SetConsoleCtrlHandler FormatMessageA SuspendThread ResumeThread GetProcessId GetThreadContext IsProcessorFeaturePresent GetTimeZoneInformation GetThreadLocale GetSystemDefaultLCID VirtualQueryEx ReadProcessMemory SetNamedPipeHandleState TransactNamedPipe CreateNamedPipeW WaitNamedPipeW GetFileSizeEx SetFilePointerEx FindFirstFileExW MoveFileExW ConnectNamedPipe DisconnectNamedPipe CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus UnregisterWaitEx RegisterWaitForSingleObject InitOnceExecuteOnce FileTimeToSystemTime WriteConsoleW LoadLibraryExW VirtualQuery SetWaitableTimer CreateWaitableTimerA GetCurrentDirectoryW GetFileAttributesExW GetFileInformationByHandle GetFullPathNameW DeviceIoControl AreFileApisANSI HeapFree DeleteCriticalSection MoveFileExA GetProcessHeap HeapReAlloc HeapAlloc HeapDestroy GetLastError RaiseException DecodePointer InitializeSListHead UnhandledExceptionFilter GetStartupInfoW InitializeSRWLock TryEnterCriticalSection InitializeConditionVariable WakeConditionVariable CompareStringEx GetCPInfo GetLocaleInfoEx GetStringTypeW RtlUnwind ExitThread FreeLibraryAndExitThread GetCommandLineA GetConsoleOutputCP GetDriveTypeW PeekNamedPipe SystemTimeToTzSpecificLocalTime SetStdHandle ExitProcess GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale EnumSystemLocalesW IsValidCodePage GetACP WakeAllConditionVariable SleepConditionVariableCS SleepConditionVariableSRW InitOnceBeginInitialize InitOnceComplete GetFinalPathNameByHandleW GetFileInformationByHandleEx EncodePointer LCMapStringEx GetVersionExA GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW WaitForSingleObjectEx GetNativeSystemInfo

user32

ReleaseDC DrawTextW GetSystemMetrics EnableWindow KillTimer SetTimer GetDlgCtrlID GetDlgItem DestroyWindow RegisterClassW PostQuitMessage MessageBoxA SetWindowTextW TranslateAcceleratorW LoadAcceleratorsW PostThreadMessageW DispatchMessageW TranslateMessage GetMessageW GetParent SetWindowLongW GetWindowLongW MessageBoxW GetWindowRect InvalidateRect GetDC EndPaint CreateWindowExW CallWindowProcW DefWindowProcW SendMessageW GetWindowThreadProcessId EnumWindows FindWindowW MessageBoxExW AllowSetForegroundWindow CharNextW CharUpperW SendMessageTimeoutW RegisterWindowMessageW UnregisterClassW LoadIconW LoadBitmapW PostMessageW IsWindowVisible SetForegroundWindow GetWindowTextW EnumDisplayDevicesA GetProcessWindowStation GetUserObjectInformationW BeginPaint ShowWindow FillRect

gdi32

CreateSolidBrush DeleteObject GetDeviceCaps CreatePen GetStockObject Rectangle RoundRect SelectObject SetDCBrushColor SetDCPenColor SetBkMode CreateFontW SetTextColor

ole32

CoCreateInstance CoCreateGuid CoUninitialize CoInitialize CreateStreamOnHGlobal CoInitializeEx StringFromGUID2 CoTaskMemAlloc CoTaskMemFree

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW RegSetValueExW RegCreateKeyExW OpenProcessToken GetUserNameW RegDeleteKeyW RegDeleteKeyExW RegEnumKeyExW RegEnumValueW RegFlushKey RegOpenKeyExA RegQueryInfoKeyW RegQueryValueExA RegGetValueW CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash GetTokenInformation CryptDestroyKey RegDeleteTreeW RegCreateKeyExA RegSetValueExA DeregisterEventSource RegisterEventSourceW ReportEventW CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptDecrypt CryptSignHashW CryptEnumProvidersW SystemFunction036 BuildSecurityDescriptorW BuildExplicitAccessWithNameW ConvertStringSecurityDescriptorToSecurityDescriptorW ImpersonateNamedPipeClient RevertToSelf RegDeleteValueW

shlwapi

PathAppendW SHCopyKeyW StrCmpW StrStrW StrCmpNW SHDeleteKeyW PathFileExistsW PathAddBackslashW PathRemoveFileSpecW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

sensapi

IsNetworkAlive

comctl32

InitCommonControlsEx _TrackMouseEvent ord345

gdiplus

GdiplusShutdown GdiplusStartup GdipFree GdipAlloc GdipCreateBitmapFromStream GdipCreateHBITMAPFromBitmap GdipDisposeImage GdipCloneImage

wininet

InternetCloseHandle InternetConnectW InternetReadFile InternetWriteFile InternetQueryDataAvailable InternetQueryOptionW InternetSetOptionW HttpOpenRequestW HttpAddRequestHeadersA HttpAddRequestHeadersW HttpSendRequestW InternetOpenW HttpEndRequestW HttpQueryInfoA HttpQueryInfoW HttpSendRequestExW

bcrypt

BCryptGenRandom

winmm

timeGetTime timeSetEvent timeBeginPeriod timeGetDevCaps

Name

.text

Size

3.6MB

Virtual Size

3.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

73KB

Virtual Size

7.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

CPADinfo

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

141KB

Virtual Size

141KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

161KB

Virtual Size

161KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

RobloxPlayerLauncher (1).exe

ws2_32

crypt32

iphlpapi

shell32

powrprof

winhttp

kernel32

user32

gdi32

ole32

advapi32

shlwapi

version

sensapi

comctl32

gdiplus

wininet

bcrypt

winmm

generic