ProjectXPlayerLauncher[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

ProjectXPlayerLauncher.exe
Size

873KB
MD5

59728bdc1c21befe5f75978199714d39
SHA1

07b2ad79ea99103f1c2b63c8f0e2f0914b00aa56
SHA256

6fd40d0c186858b2c58dca73d2e78d5114d7e37c100b5c4abb4b5496f26fc063
SHA512

9c9ed80bbd0fdef7fc5a73e5e98831ef41dd0080943bab1fb16205d4396754546d0c5836bd4a0f9fce2dc60d732ba0e751ff8230cc59c30c738aabc3ba671c8c
SSDEEP

24576:1uCmYrfJWZG6MIP52IvYTTa1Z+oMDxgTr/t:1ZPOtvYTTA+oMNEr/t

Score

1^/10

Malware Config

Signatures

Files

ProjectXPlayerLauncher.exe
.exe windows:6 windows x86 arch:x86

685e4624de45f06294a03c7e44ca3ab4

Code Sign

7c:dc:e3:24:07:e0:ca:bd:45:2a:54:99:e9:57:ec:15
Certificate

Issuer

CN=ZetaWare

Not Before

22-03-2024 13:00

Not After

31-12-2039 23:59

Subject

CN=ZetaWare

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03-05-2023 00:00

Not After

02-08-2034 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e5:3b:3c:d7:7c:c3:cf:fd:87:21:8d:35:72:c6:13:39:a9:7c:fe:d2:ca:70:0f:3f:5b:cd:b6:01:4a:b7:5f:84
Signer

Actual PE Digest

e5:3b:3c:d7:7c:c3:cf:fd:87:21:8d:35:72:c6:13:39:a9:7c:fe:d2:ca:70:0f:3f:5b:cd:b6:01:4a:b7:5f:84

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\Shadow\Documents\GitHub\Roblox-Bootstrapper\BootstrapperClient\bin\Release\RobloxPlayerLauncher.pdb

Imports

kernel32

GetDiskFreeSpaceExW
SetFileAttributesW
GetTempPathW
DeleteFileW
GetVersionExW
lstrcmpW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
WaitForSingleObject
InterlockedDecrement
ReleaseMutex
CreateMutexW
SetEvent
ResetEvent
OpenEventW
CreateEventW
CloseHandle
CreateEventA
GetSystemTime
FindClose
FindNextFileW
FindFirstFileW
CompareFileTime
GetGeoInfoW
GetUserGeoID
TerminateProcess
RaiseException
CreateProcessW
FreeLibrary
LoadLibraryW
DuplicateHandle
GetCurrentThread
GetCurrentProcess
GetCurrentThreadId
lstrlenW
CreateDirectoryW
ReleaseSemaphore
GetSystemTimeAsFileTime
HeapFree
GetProcessHeap
HeapAlloc
CreateSemaphoreA
GetModuleHandleA
GetTickCount
TlsFree
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
TlsSetValue
TlsGetValue
Sleep
VerifyVersionInfoW
VerSetConditionMask
SetLastError
InterlockedCompareExchange
GetQueuedCompletionStatus
SetWaitableTimer
CreateIoCompletionPort
PostQueuedCompletionStatus
SleepEx
QueueUserAPC
TerminateThread
WaitForMultipleObjects
InterlockedExchangeAdd
InterlockedExchange
TlsAlloc
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
InterlockedIncrement
OpenProcess
LocalFree
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetLastError
MultiByteToWideChar
GetLocalTime
GetShortPathNameW
FormatMessageW
CreateFileW
GetFileAttributesW
GetFileAttributesExW
GetFileSizeEx
MulDiv
WaitForSingleObjectEx
GetExitCodeProcess
lstrcpyW
lstrcatW
WriteFile
GetFileTime
DosDateTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
HeapDestroy
HeapReAlloc
HeapSize
EncodePointer
DecodePointer
IsDebuggerPresent
IsProcessorFeaturePresent
QueryPerformanceCounter
GetTickCount64
FormatMessageA
OpenEventA
GetCurrentProcessId
ResumeThread
CreateWaitableTimerA
SystemTimeToFileTime
WideCharToMultiByte
RemoveDirectoryW

user32

CreateWindowExW
SetWindowLongW
ShowWindow
InvalidateRect
CallWindowProcW
GetParent
SetWindowTextW
LoadAcceleratorsW
GetMessageW
TranslateAcceleratorW
TranslateMessage
DispatchMessageW
SetFocus
GetWindowRect
MessageBoxW
PostThreadMessageW
GetWindowThreadProcessId
LoadBitmapW
GetDlgItem
PostQuitMessage
BeginPaint
FillRect
EndPaint
LoadIconW
RegisterClassW
GetSystemMetrics
SendMessageW
ReleaseDC
SetTimer
KillTimer
DestroyWindow
EnableWindow
IsWindowVisible
SetForegroundWindow
PostMessageW
GetDC
EnumWindows
DefWindowProcW
GetWindowLongW
AllowSetForegroundWindow
CharNextW
CharUpperW
MessageBoxA
SetWindowPos
GetWindowTextW

gdi32

Rectangle
SelectObject
CreatePen
GetStockObject
CreateSolidBrush
DeleteObject
GetDeviceCaps
SetBkMode
CreateFontW
SetTextColor

advapi32

RegCloseKey
GetUserNameW
RegDeleteKeyW
RegEnumKeyExW
RegDeleteValueW
RegFlushKey
CryptAcquireContextW
CryptCreateHash
CryptReleaseContext
IsValidSid
GetLengthSid
CopySid
OpenProcessToken
OpenThreadToken
GetSidLengthRequired
InitializeSid
GetSidSubAuthority
CheckTokenMembership
DuplicateToken
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
GetTokenInformation
CryptGetHashParam
CryptHashData
CryptDestroyHash

shell32

ShellExecuteW
ShellExecuteExW
SHGetFolderPathAndSubDirW

ole32

CoInitialize
CoCreateInstance
CoCreateGuid
CoUninitialize
StringFromGUID2

oleaut32

VariantClear
VariantInit
RegisterTypeLi
SysFreeString
SysAllocString

shlwapi

StrRChrW
StrCpyW
StrDupW
StrCmpNW
PathAddBackslashW
StrCmpW
PathFileExistsW
StrStrW
SHDeleteKeyW

msvcp110

?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ
?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@H@2@_JHH@Z
?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@H@2@V32@H@Z
?_Gettrue@_Locinfo@std@@QBEPBDXZ
?_Getfalse@_Locinfo@std@@QBEPBDXZ
?_Getlconv@_Locinfo@std@@QBEPBUlconv@@XZ
?id@?$numpunct@D@std@@2V0locale@2@A
?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@XZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAI@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@XZ
?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@H@2@@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
_Mbrtowc
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?id@?$numpunct@_W@std@@2V0locale@2@A
?_Add_vtordisp2@?$basic_ios@DU?$char_traits@D@std@@@std@@UAEXXZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@H@2@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z
?_Syserror_map@std@@YAPBDH@Z
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPBD@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Xlength_error@std@@YAXPBD@Z
?uncaught_exception@std@@YA_NXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?_BADOFF@std@@3_JB
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Add_vtordisp1@?$basic_istream@DU?$char_traits@D@std@@@std@@UAEXXZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?_Add_vtordisp2@?$basic_ostream@DU?$char_traits@D@std@@@std@@UAEXXZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
?id@?$codecvt@DDH@std@@2V0locale@2@A
?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Add_vtordisp1@?$basic_ios@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?always_noconv@codecvt_base@std@@QBE_NXZ
??Bid@locale@std@@QAEIXZ
?classic@locale@std@@SAABV12@XZ
??_7_Facet_base@std@@6B@
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?_Winerror_map@std@@YAPBDH@Z
?_Incref@facet@locale@std@@UAEXXZ
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??1_Locinfo@std@@QAE@XZ
??0_Locinfo@std@@QAE@PBD@Z
??1facet@locale@std@@MAE@XZ
??_7facet@locale@std@@6B@
??0facet@locale@std@@IAE@I@Z
?id@?$ctype@D@std@@2V0locale@2@A
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
??_D?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??_D?$basic_istream@DU?$char_traits@D@std@@@std@@QAEXXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ

msvcr110

_invoke_watson
_controlfp_s
__crtSetUnhandledExceptionFilter
_except_handler4_common
__crtTerminateProcess
__crtUnhandledException
_crt_debugger_hook
_vsnprintf_s
_commode
_fmode
_wcmdln
_initterm
_initterm_e
__setusermatherr
_configthreadlocale
_cexit
_exit
__set_app_type
__wgetmainargs
_amsg_exit
__crtGetShowWindowMode
_XcptFilter
??1type_info@@UAE@XZ
_onexit
__dllonexit
_calloc_crt
_unlock
_lock
?terminate@@YAXXZ
memset
fseek
ftell
ferror
fread
strcpy_s
fopen
wcsstr
ispunct
vswprintf_s
_getpid
__wargv
__argc
wcstombs_s
srand
wcscat_s
wcscpy_s
realloc
_time64
_gmtime64
isspace
_beginthreadex
isdigit
tolower
??0exception@std@@QAE@XZ
_vscprintf
_vsnwprintf_s
memchr
_vscwprintf
atoi
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@ABV01@@Z
??0bad_cast@std@@QAE@PBD@Z
fclose
fflush
setvbuf
fsetpos
fgetpos
_fseeki64
fwrite
_unlock_file
_lock_file
ungetc
fputc
fgetc
??8type_info@@QBE_NABV0@@Z
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABV01@@Z
rand
??0exception@std@@QAE@ABQBDH@Z
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABQBD@Z
longjmp
??2@YAPAXI@Z
memcpy_s
_purecall
??_V@YAXPAX@Z
_recalloc
wcsnlen
malloc
calloc
free
wmemcpy_s
_wtoi
memmove
sprintf_s
_wcsicmp
memmove_s
??3@YAXPAX@Z
exit
strerror
_CxxThrowException
__CxxFrameHandler3
memcpy
_setjmp3
wcsncpy_s
memcmp

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

ws2_32

WSASend
WSARecv
setsockopt
WSAGetLastError
getaddrinfo
getsockopt
WSASetLastError
select
ioctlsocket
closesocket
WSACleanup
freeaddrinfo
connect
WSAStartup
WSASocketW

wininet

HttpSendRequestExW
InternetReadFile
InternetConnectW
InternetOpenW
InternetQueryDataAvailable
InternetCloseHandle
HttpOpenRequestW
HttpAddRequestHeadersW
HttpSendRequestW
HttpQueryInfoW
HttpEndRequestW
InternetWriteFile
InternetSetOptionW

sensapi

IsNetworkAlive

userenv

UnloadUserProfile

comctl32

_TrackMouseEvent
InitCommonControlsEx

psapi

GetProcessImageFileNameW
EnumProcesses

iphlpapi

GetAdaptersInfo

Sections

.text
Size: 279KB - Virtual size: 279KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 120KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 34KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 388KB - Virtual size: 388KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

685e4624de45f06294a03c7e44ca3ab4

Code Sign

7c:dc:e3:24:07:e0:ca:bd:45:2a:54:99:e9:57:ec:15Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

e5:3b:3c:d7:7c:c3:cf:fd:87:21:8d:35:72:c6:13:39:a9:7c:fe:d2:ca:70:0f:3f:5b:cd:b6:01:4a:b7:5f:84Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

msvcp110

msvcr110

version

ws2_32

wininet

sensapi

userenv

comctl32

psapi

iphlpapi

Sections

.text Size: 279KB - Virtual size: 279KB

.rdata Size: 120KB - Virtual size: 120KB

.data Size: 34KB - Virtual size: 35KB

.tls Size: 512B - Virtual size: 2B

.rsrc Size: 388KB - Virtual size: 388KB

.reloc Size: 43KB - Virtual size: 43KB

7c:dc:e3:24:07:e0:ca:bd:45:2a:54:99:e9:57:ec:15
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

e5:3b:3c:d7:7c:c3:cf:fd:87:21:8d:35:72:c6:13:39:a9:7c:fe:d2:ca:70:0f:3f:5b:cd:b6:01:4a:b7:5f:84
Signer

.text
Size: 279KB - Virtual size: 279KB

.rdata
Size: 120KB - Virtual size: 120KB

.data
Size: 34KB - Virtual size: 35KB

.tls
Size: 512B - Virtual size: 2B

.rsrc
Size: 388KB - Virtual size: 388KB

.reloc
Size: 43KB - Virtual size: 43KB