RobloxPlayerLauncher[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
RobloxPlayerLauncher.exe
Size 2.0MB
Sample240224-s9em6agg21
SHA256 d850cffddbe3d1c2186df708f4ea4f88a5477d4056093303fed745b9d882905d
MD5 b6b6178ef259793f88029049d116fed2
SHA1 d19161f3c39ef545911dbe3e1f144df1f5502b00
SHA512 856f7e6f80603059ad72d125892b16ca141660d5124c4e7b3140f42bdfe1951e89a98665a3ad2317883d608ee3cbe3fbea7adaaf41330a9bb1cd61a9ca9de11a
SSDEEP 49152:zGhY9Tuw0lyixF8O7h83sr1vTKWaf0CD7TyGMkPMQ3d2f+Tsb6rgUOp0:zOSTuwkxF983dubfc
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

RobloxPlayerLauncher.exe

.exe 2.0MB

RobloxPlayerLauncher.exe

IMPHASH a3e5eaede189d774194167fb1433b359
SHA256 d850cffddbe3d1c2186df708f4ea4f88a5477d4056093303fed745b9d882905d
MD5 b6b6178ef259793f88029049d116fed2
SHA1 d19161f3c39ef545911dbe3e1f144df1f5502b00
SHA512 856f7e6f80603059ad72d125892b16ca141660d5124c4e7b3140f42bdfe1951e89a98665a3ad2317883d608ee3cbe3fbea7adaaf41330a9bb1cd61a9ca9de11a
SSDEEP 49152:zGhY9Tuw0lyixF8O7h83sr1vTKWaf0CD7TyGMkPMQ3d2f+Tsb6rgUOp0:zOSTuwkxF983dubfc
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Password

123

Digest

f1:04:96:fa:44:e3:05:a0:8c:00:52:b0:83:00:f1:20:c1:13:08:31

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=3780902,CN=Roblox Corporation,O=Roblox Corporation,L=San Mateo,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Nov 30, 2022

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

Serial Number

09:05:eb:c3:60:c3:90:10:8b:39:ff:78:39:d2:a1:c3

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 15, 2021 - Jan 18, 2024

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 21, 2022 - Nov 21, 2033

Minor OS version

Major OS version

Entry point

1130034

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\buildAgent\work\ci_deploy_nbsninja_boot-x86_git\build.ninja\common\vs2019\x86\release\Installer\BootstrapperClient\BootstrapperClient.pdb

ws2_32

freeaddrinfo inet_ntop getaddrinfo

shell32

Shell_NotifyIconA ord165 ShellExecuteExW CommandLineToArgvW ShellExecuteW SHGetFolderPathAndSubDirW

powrprof

CallNtPowerInformation

winhttp

WinHttpConnect WinHttpOpenRequest WinHttpSendRequest WinHttpCrackUrl WinHttpReadData WinHttpWriteData WinHttpSetOption WinHttpSetTimeouts WinHttpAddRequestHeaders WinHttpCloseHandle WinHttpReceiveResponse WinHttpQueryHeaders WinHttpOpen

kernel32

GetFileSize ReadFile WriteFile GetTempPathW InitializeCriticalSectionEx LocalAlloc LocalFree FormatMessageW FindResourceA CopyFileW MoveFileW VerifyVersionInfoW GetSystemTimeAsFileTime GetStdHandle FindClose FindFirstFileW FindNextFileW GetDiskFreeSpaceExW RemoveDirectoryW SetFileAttributesW DebugBreak Sleep GetCurrentProcess TerminateProcess GetExitCodeProcess GetCurrentThreadId CreateProcessW OpenProcess GetSystemTime GetLocalTime GetTickCount GetVersionExW CreateFileMappingW MapViewOfFile UnmapViewOfFile FreeLibrary GetModuleFileNameA GetModuleFileNameW GetModuleHandleExW LoadLibraryW lstrlenW BeginUpdateResourceW UpdateResourceA EndUpdateResourceW SystemTimeToFileTime GetGeoInfoW GetUserGeoID GetUserDefaultLCID FreeConsole AttachConsole GetConsoleScreenBufferInfo SetConsoleTextAttribute CreateEventA K32EnumProcesses K32GetProcessImageFileNameW GetCommandLineW GetShortPathNameW SetLastError ReleaseSemaphore CreateSemaphoreW GlobalAlloc GlobalUnlock GlobalLock GlobalFree IsWow64Process FlushFileBuffers GetFileSizeEx SetFileTime lstrcpyW LoadLibraryA IsDebuggerPresent OutputDebugStringW GetFileTime CreateFileA WaitForSingleObjectEx CreateMutexA GetModuleHandleA GetProcessTimes GetSystemInfo GetVersionExA GetCurrentProcessId QueryPerformanceCounter QueryPerformanceFrequency OpenSemaphoreW CreateMutexExW CreateSemaphoreExW VerSetConditionMask DeleteCriticalSection InitializeCriticalSection EnterCriticalSection LeaveCriticalSection SizeofResource FormatMessageA OpenEventA WaitForMultipleObjectsEx SetWaitableTimer ResumeThread TlsAlloc TlsGetValue TlsSetValue TlsFree CreateMutexW CreateWaitableTimerA GetCurrentDirectoryW GetFileInformationByHandle GetFullPathNameW SetEndOfFile SetFilePointerEx GetFileType SetUnhandledExceptionFilter SleepEx CreateThread GetExitCodeThread GetVersion SetProcessShutdownParameters SetConsoleCtrlHandler LockFileEx UnlockFileEx SuspendThread GetProcessId GetThreadContext IsProcessorFeaturePresent GetTimeZoneInformation GetThreadLocale GetSystemDefaultLCID DuplicateHandle VirtualQueryEx ReadProcessMemory SetNamedPipeHandleState TransactNamedPipe CreateNamedPipeW WaitNamedPipeW ConnectNamedPipe DisconnectNamedPipe CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus UnregisterWaitEx RegisterWaitForSingleObject FindFirstFileExW TryEnterCriticalSection InitOnceExecuteOnce SleepConditionVariableCS SleepConditionVariableSRW InitOnceBeginInitialize WaitForSingleObject ReleaseMutex ResetEvent SetEvent InitOnceComplete EncodePointer LCMapStringEx FindResourceW CloseHandle InitializeCriticalSectionAndSpinCount GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError RaiseException DecodePointer ExitThread FreeLibraryAndExitThread GetCommandLineA GetConsoleMode ReadConsoleW GetConsoleOutputCP SetStdHandle GetDriveTypeW PeekNamedPipe SystemTimeToTzSpecificLocalTime LoadLibraryExW LockResource LoadResource FindResourceExW GetFileAttributesW CreateFileW CreateDirectoryW MulDiv WideCharToMultiByte MultiByteToWideChar lstrcmpW GetProcAddress GetModuleHandleW OpenEventW FileTimeToSystemTime RtlUnwind GetCPInfo GetStringTypeW ExitProcess CompareStringW LCMapStringW WakeAllConditionVariable WakeConditionVariable InitializeConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock InitializeSListHead GetStartupInfoW GetLocaleInfoW IsValidLocale EnumSystemLocalesW IsValidCodePage GetACP GetOEMCP CreateEventW DeleteFileW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW WriteConsoleW UnhandledExceptionFilter

user32

EnableWindow GetSystemMetrics DrawTextW ReleaseDC BeginPaint EndPaint KillTimer SetTimer GetDlgItem RegisterClassW PostQuitMessage LoadBitmapW GetWindowThreadProcessId FillRect GetDlgCtrlID EnumWindows SetWindowTextW TranslateAcceleratorW LoadAcceleratorsW PostThreadMessageW DispatchMessageW TranslateMessage GetMessageW GetParent SetWindowLongW GetWindowLongW MessageBoxW GetWindowRect InvalidateRect GetDC ShowWindow CreateWindowExW CallWindowProcW DefWindowProcW SendMessageW MessageBoxExW AllowSetForegroundWindow CharNextW CharUpperW UnregisterClassW PostMessageW IsWindowVisible LoadIconW SetForegroundWindow GetWindowTextW MessageBoxA DestroyWindow

gdi32

SetTextColor SetBkMode SetDCPenColor SetDCBrushColor SelectObject RoundRect Rectangle GetStockObject CreatePen GetDeviceCaps DeleteObject CreateSolidBrush CreateFontW

ole32

CoCreateGuid CreateStreamOnHGlobal CoInitialize CoUninitialize CoCreateInstance StringFromGUID2

advapi32

RegQueryInfoKeyW RegFlushKey RegEnumValueW RegEnumKeyExW RegDeleteKeyExW RegDeleteKeyW GetUserNameW OpenProcessToken RegCreateKeyExW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegDeleteValueW RegCloseKey RegQueryValueExA GetTokenInformation CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash RegGetValueW RegDeleteTreeW RegCreateKeyExA RegSetValueExA SystemFunction036 BuildSecurityDescriptorW BuildExplicitAccessWithNameW ConvertStringSecurityDescriptorToSecurityDescriptorW ImpersonateNamedPipeClient RevertToSelf RegOpenKeyExA

shlwapi

PathRemoveFileSpecW PathAppendW SHCopyKeyW PathRemoveExtensionW PathFileExistsW StrCmpW StrStrW PathAddBackslashW SHDeleteKeyW StrCmpNW

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

sensapi

IsNetworkAlive

wininet

HttpAddRequestHeadersA HttpOpenRequestW InternetSetOptionW InternetQueryOptionW InternetQueryDataAvailable InternetWriteFile HttpSendRequestExW InternetConnectW InternetCloseHandle InternetOpenW HttpEndRequestW HttpQueryInfoA HttpQueryInfoW InternetReadFile HttpSendRequestW HttpAddRequestHeadersW

comctl32

_TrackMouseEvent InitCommonControlsEx ord345

gdiplus

GdipCloneImage GdipDisposeImage GdipCreateBitmapFromStream GdipCreateHBITMAPFromBitmap GdipFree GdipAlloc GdiplusShutdown GdiplusStartup

winmm

timeGetTime timeSetEvent timeGetDevCaps timeBeginPeriod

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

478KB

Virtual Size

477KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

30KB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

CPADinfo

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

139KB

Virtual Size

139KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

62KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

RobloxPlayerLauncher.exe

ws2_32

shell32

powrprof

winhttp

kernel32

user32

gdi32

ole32

advapi32

shlwapi

version

sensapi

wininet

comctl32

gdiplus

winmm

generic