RobloxPlayerLauncher[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
RobloxPlayerLauncher.exe
Size 1.6MB
Sample240411-x2caaadh8z
SHA256 93580834e65af2f5a83aacef47a1ec3ef45fc6ab9683ec4df771bbea713ab38f
MD5 df3c89248671866cfb9e0a407fad20b4
SHA1 2258e20671e6aaba8ce75abb5bc5bca8c4df0035
SHA512 f6658f2653aefebc573518773c97319d87d70cabeb182cd622a5722d4df0417df17318f4b25b7929ab03e982a072e914175971b96e205356c5c6a23a3fedaf01
SSDEEP 49152:NmAhTN2Q5MmBRS+qYNS2+3njUrG+TvamoGXtTOgM7PMQpdAUFTHrPHHoV5N:gAhTkyZBdM2+3njUmrPHA
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

RobloxPlayerLauncher.exe

.exe 1.6MB

RobloxPlayerLauncher.exe

IMPHASH 0adda91eff278fadce620b2e5c5dcc7b
SHA256 93580834e65af2f5a83aacef47a1ec3ef45fc6ab9683ec4df771bbea713ab38f
MD5 df3c89248671866cfb9e0a407fad20b4
SHA1 2258e20671e6aaba8ce75abb5bc5bca8c4df0035
SHA512 f6658f2653aefebc573518773c97319d87d70cabeb182cd622a5722d4df0417df17318f4b25b7929ab03e982a072e914175971b96e205356c5c6a23a3fedaf01
SSDEEP 49152:NmAhTN2Q5MmBRS+qYNS2+3njUrG+TvamoGXtTOgM7PMQpdAUFTHrPHHoV5N:gAhTkyZBdM2+3njUmrPHA
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Digest

aa:7b:d3:64:c6:b1:84:72:5a:fa:59:a4:10:f3:e2:90:c7:1a:f3:ea

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=3780902,CN=Roblox Corporation,O=Roblox Corporation,L=San Mateo,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Nov 17, 2021

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

Serial Number

09:05:eb:c3:60:c3:90:10:8b:39:ff:78:39:d2:a1:c3

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 15, 2021 - Jan 18, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Minor OS version

Major OS version

Entry point

843777

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\teamcity-agent\work\ci_deploy_nbsninja_boot-x86_git\build.ninja\common\vs2017\x86\release\Installer\BootstrapperClient\BootstrapperClient.pdb

powrprof

CallNtPowerInformation

winhttp

WinHttpSendRequest WinHttpSetOption WinHttpSetTimeouts WinHttpOpenRequest WinHttpQueryHeaders WinHttpReceiveResponse WinHttpAddRequestHeaders WinHttpReadData WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpCrackUrl WinHttpWriteData

kernel32

FindResourceA CopyFileW MoveFileW VerifyVersionInfoW GetSystemTimeAsFileTime GetStdHandle FindClose FindFirstFileW FindNextFileW GetDiskFreeSpaceExW RemoveDirectoryW SetFileAttributesW Sleep GetCurrentProcess TerminateProcess GetExitCodeProcess GetCurrentThread CreateProcessW OpenProcess GetSystemTime GetLocalTime GetTickCount GetVersionExW CreateFileMappingW MapViewOfFile UnmapViewOfFile FreeLibrary GetModuleFileNameW LoadLibraryW lstrlenW BeginUpdateResourceW UpdateResourceA EndUpdateResourceW SystemTimeToFileTime GetGeoInfoW GetUserGeoID GetUserDefaultLCID FreeConsole AttachConsole GetConsoleScreenBufferInfo SetConsoleTextAttribute CreateSemaphoreA WaitForSingleObjectEx ReleaseSemaphore DuplicateHandle GetModuleHandleA K32EnumProcesses K32GetProcessImageFileNameW GetCommandLineW GetShortPathNameW SetLastError CreateSemaphoreW IsDebuggerPresent GetCurrentProcessId GlobalAlloc GlobalUnlock GlobalLock GlobalFree IsWow64Process QueryPerformanceCounter QueryPerformanceFrequency FileTimeToSystemTime FlushFileBuffers GetFileSizeEx SetFileTime lstrcpyW OpenEventA LoadLibraryA GetFileTime FormatMessageA GetSystemInfo WaitForMultipleObjectsEx SetWaitableTimer ResumeThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetLogicalProcessorInformation CreateWaitableTimerA GetFileType HeapSize LocalFree CreateThread GetExitCodeThread GetVersion SetProcessShutdownParameters SetConsoleCtrlHandler LockFileEx SetEndOfFile UnlockFileEx GetProcessTimes SuspendThread GetProcessId GetThreadContext IsProcessorFeaturePresent GetTimeZoneInformation GetThreadLocale GetSystemDefaultLCID InitializeCriticalSection VirtualQueryEx ReadProcessMemory SetNamedPipeHandleState TransactNamedPipe CreateNamedPipeW WaitNamedPipeW ConnectNamedPipe DisconnectNamedPipe CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus UnregisterWaitEx RegisterWaitForSingleObject SetFilePointerEx FindFirstFileExW OutputDebugStringW EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection InitOnceExecuteOnce HeapFree ExitProcess SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileInformationByHandle GetDriveTypeW GetModuleHandleExW ExitThread GetConsoleOutputCP ReadConsoleW GetConsoleMode GetCommandLineA RtlUnwind QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList VirtualFree VirtualProtect VirtualAlloc LoadLibraryExW FreeLibraryAndExitThread GetThreadTimes UnregisterWait SetThreadAffinityMask HeapReAlloc GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetThreadPriority SetThreadPriority SignalObjectAndWait CreateTimerQueue InitializeSListHead GetStartupInfoW UnhandledExceptionFilter GetCPInfo GetStringTypeW GetLocaleInfoW LCMapStringW CompareStringW SwitchToThread EncodePointer LocalAlloc InitializeCriticalSectionEx GetTempPathW WriteFile ReadFile GetFileSize VerSetConditionMask GetCurrentThreadId FindResourceW SizeofResource LockResource LoadResource FindResourceExW GetFileAttributesW CreateFileW CreateDirectoryW DeleteCriticalSection FormatMessageW SleepEx GetProcessHeap HeapAlloc HeapDestroy RaiseException DecodePointer MulDiv CreateEventA WideCharToMultiByte MultiByteToWideChar lstrcmpW GetProcAddress GetModuleHandleW OpenEventW CreateEventW CreateMutexW WaitForSingleObject ReleaseMutex ResetEvent SetEvent InitializeCriticalSectionAndSpinCount GetLastError CloseHandle DeleteFileW IsValidLocale EnumSystemLocalesW SetStdHandle GetCurrentDirectoryW GetFullPathNameW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW WriteConsoleW SetUnhandledExceptionFilter

user32

GetSystemMetrics KillTimer ReleaseDC BeginPaint GetDlgCtrlID GetDlgItem DrawTextW SetTimer EnableWindow EndPaint FillRect LoadIconW LoadBitmapW PostMessageW IsWindowVisible SetForegroundWindow GetWindowTextW CharUpperW CharNextW AllowSetForegroundWindow MessageBoxExW SendMessageW DefWindowProcW CallWindowProcW CreateWindowExW ShowWindow GetDC InvalidateRect GetWindowRect MessageBoxW GetWindowLongW SetWindowLongW MessageBoxA RegisterClassW GetParent UnregisterClassW GetMessageW TranslateMessage PostQuitMessage DispatchMessageW PostThreadMessageW LoadAcceleratorsW TranslateAcceleratorW GetWindowThreadProcessId SetWindowTextW EnumWindows DestroyWindow

gdi32

SetDCPenColor SetDCBrushColor SelectObject RoundRect SetBkMode GetStockObject CreatePen GetDeviceCaps DeleteObject CreateSolidBrush CreateFontW SetTextColor Rectangle

shell32

ShellExecuteW SHGetFolderPathAndSubDirW CommandLineToArgvW Shell_NotifyIconA ShellExecuteExW ord165

ole32

CoCreateGuid StringFromGUID2 CoUninitialize CoInitialize CreateStreamOnHGlobal CoCreateInstance

advapi32

CryptReleaseContext RegQueryValueExA RegQueryInfoKeyW RegOpenKeyExA RegFlushKey RegEnumValueW RegEnumKeyExW RegDeleteKeyExW RegDeleteKeyW GetUserNameW OpenProcessToken RegCreateKeyExW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegDeleteValueW RegCloseKey CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash BuildSecurityDescriptorW BuildExplicitAccessWithNameW ConvertStringSecurityDescriptorToSecurityDescriptorW ImpersonateNamedPipeClient RevertToSelf SystemFunction036 GetTokenInformation CryptAcquireContextW

shlwapi

PathAddBackslashW SHDeleteKeyW StrCmpNW StrStrW StrCmpW PathFileExistsW PathRemoveExtensionW SHCopyKeyW PathAppendW PathRemoveFileSpecW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

sensapi

IsNetworkAlive

wininet

HttpSendRequestExW HttpEndRequestW HttpQueryInfoA HttpAddRequestHeadersW InternetOpenW InternetCloseHandle InternetConnectW InternetReadFile InternetWriteFile InternetQueryDataAvailable HttpQueryInfoW InternetQueryOptionW InternetSetOptionW HttpOpenRequestW HttpAddRequestHeadersA HttpSendRequestW

ws2_32

freeaddrinfo inet_ntop getaddrinfo

comctl32

ord345 InitCommonControlsEx _TrackMouseEvent

gdiplus

GdipAlloc GdipFree GdiplusStartup GdiplusShutdown GdipDisposeImage GdipCreateBitmapFromStream GdipCreateHBITMAPFromBitmap GdipCloneImage

winmm

timeSetEvent timeGetDevCaps timeBeginPeriod timeGetTime

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

300KB

Virtual Size

299KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

24KB

Virtual Size

432KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

CPADinfo

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

119KB

Virtual Size

118KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

55KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

RobloxPlayerLauncher.exe

powrprof

winhttp

kernel32

user32

gdi32

shell32

ole32

advapi32

shlwapi

version

sensapi

wininet

ws2_32

comctl32

gdiplus

winmm

generic