RobloxPlayerInstaller[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
RobloxPlayerInstaller.exe
Size 5.4MB
Sample240517-plyjkshc79
SHA256 4f62cee70845d868afed5b5ad66d7fdc582e6f9b6b69e6d5e9c52a1e24105b60
MD5 1f1ae0eb12231c472e7ab91a6df69b75
SHA1 3c0b44b3b18df2b9be602b551828b27604ef51fe
SHA512 470162197814bcefa52a24e1e88264827e4a6aaa0a110a41f35cd9c392bdcf6bd7deb25bf5c9ccbb994ba01b8a7851d7f5025ed5b9ad9f4ba94eabcf7f103abd
SSDEEP 98304:r3vj6u39OyzUjFE6g7U8CBtg/gRLhiKLCAemBG4UuldUa:Tl3pcJbg/aCABnU+
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

RobloxPlayerInstaller.exe

.exe 5.4MB

RobloxPlayerInstaller.exe

IMPHASH 84dfdbf12a79f153655e14db9a4225d7
SHA256 4f62cee70845d868afed5b5ad66d7fdc582e6f9b6b69e6d5e9c52a1e24105b60
MD5 1f1ae0eb12231c472e7ab91a6df69b75
SHA1 3c0b44b3b18df2b9be602b551828b27604ef51fe
SHA512 470162197814bcefa52a24e1e88264827e4a6aaa0a110a41f35cd9c392bdcf6bd7deb25bf5c9ccbb994ba01b8a7851d7f5025ed5b9ad9f4ba94eabcf7f103abd
SSDEEP 98304:r3vj6u39OyzUjFE6g7U8CBtg/gRLhiKLCAemBG4UuldUa:Tl3pcJbg/aCABnU+
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Digest

d1:99:c7:89:89:d6:bf:9d:77:68:6c:84:7a:07:b4:52:49:c9:fa:f3:a3:2a:99:0b:30:e8:68:60:bc:05:b3:39

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=3780902,CN=Roblox Corporation,O=Roblox Corporation,L=San Mateo,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

May 14, 2024

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

e2:98:94:75:1d:11:c9:c5:e0:f2:01:5b:fa:9f:91:cb:e7:a3:4e:44

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

Chains

May 14, 2024

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

Serial Number

06:17:58:cf:4e:ad:e9:f9:27:96:cf:74:a9:34:b0:67

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 24, 2023 - Oct 23, 2024

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

06:17:58:cf:4e:ad:e9:f9:27:96:cf:74:a9:34:b0:67

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 24, 2023 - Oct 23, 2024

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

3014384

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\buildAgent\work\ci_deploy_ninja_boot-x86_git\build.ninja\common\vs2019\x86\release\Installer\Windows\RobloxPlayerInstaller.pdb

comctl32

_TrackMouseEvent InitCommonControlsEx

gdiplus

GdipFree GdiplusStartup GdiplusShutdown GdipCloneImage GdipDisposeImage GdipCreateBitmapFromStream GdipAlloc GdipCreateHBITMAPFromBitmap

wininet

InternetReadFile InternetConnectW InternetQueryOptionW HttpOpenRequestW InternetCloseHandle HttpAddRequestHeadersW HttpSendRequestW HttpQueryInfoW InternetOpenW InternetQueryDataAvailable

bcrypt

BCryptGenRandom

advapi32

EqualSid CryptEnumProvidersW CryptSignHashW CryptDecrypt CopySid RegDeleteTreeW RegQueryValueExW RegQueryInfoKeyW RegEnumKeyExW IsValidSid GetTokenInformation SystemFunction036 DeregisterEventSource RegisterEventSourceW ReportEventW CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey GetLengthSid GetUserNameW CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash RegCloseKey RegCreateKeyExW RegDeleteValueW RegOpenKeyExW RegSetValueExW RegGetValueW AllocateAndInitializeSid RegOpenKeyExA RegQueryValueExA CryptDestroyKey OpenProcessToken FreeSid

shell32

SHGetFolderPathAndSubDirW Shell_NotifyIconW SHGetKnownFolderPath ShellExecuteExW

iphlpapi

GetAdaptersAddresses

ws2_32

connect __WSAFDIsSet WSAIoctl inet_pton WSAGetLastError freeaddrinfo WSACreateEvent WSACloseEvent getsockopt htonl WSASetLastError WSACleanup WSAStartup setsockopt send select recv listen htons getsockname closesocket bind accept inet_ntop socket ntohs ntohl ioctlsocket getnameinfo gethostname getaddrinfo

crypt32

CertCloseStore CertEnumCertificatesInStore CertFreeCertificateContext CertGetEnhancedKeyUsage CertGetIntendedKeyUsage CertOpenSystemStoreA CertOpenStore CertFindCertificateInStore CertDuplicateCertificateContext CertGetCertificateContextProperty

kernel32

IsProcessorFeaturePresent GetStringTypeW GetLocaleInfoEx GetCPInfo UnhandledExceptionFilter LCMapStringEx EncodePointer InitOnceComplete InitOnceBeginInitialize SleepConditionVariableSRW SleepConditionVariableCS WakeAllConditionVariable WakeConditionVariable RtlUnwind InterlockedPushEntrySList GetCommandLineA CreateThread ExitThread FreeLibraryAndExitThread GetConsoleOutputCP SetStdHandle InitializeSListHead HeapSize GetDriveTypeW InitializeConditionVariable TryEnterCriticalSection InitializeSRWLock GetExitCodeThread PeekNamedPipe SystemTimeToTzSpecificLocalTime SetConsoleCtrlHandler IsDebuggerPresent DebugBreak OutputDebugStringW CloseHandle GetLastError SetLastError HeapAlloc HeapFree GetProcessHeap ReleaseSemaphore ReleaseMutex WaitForSingleObject WaitForSingleObjectEx OpenSemaphoreW CreateMutexExW CreateSemaphoreExW GetCurrentProcessId GetCurrentThreadId GetModuleFileNameA GetModuleHandleW GetModuleHandleExW GetProcAddress FormatMessageW SetSearchPathMode GetCommandLineW VerSetConditionMask GetDiskFreeSpaceExW CreateFileMappingW VerifyVersionInfoW MulDiv ExitProcess GetUserDefaultLocaleName Sleep FindClose FindFirstFileW FindNextFileW SetUnhandledExceptionFilter SetEvent CreateEventW OpenEventW CreateProcessW GetSystemTime CreateFileW GetFileSize MapViewOfFile UnmapViewOfFile DeleteFileW TerminateProcess InitializeProcThreadAttributeList UpdateProcThreadAttribute OpenProcess GetModuleFileNameW SystemTimeToFileTime CreateToolhelp32Snapshot Process32FirstW Process32NextW K32GetModuleFileNameExW GetCurrentProcess GetCurrentProcessorNumber GlobalMemoryStatusEx GetSystemInfo GetSystemTimeAsFileTime GetVersionExA IsWow64Process LoadLibraryA K32GetProcessMemoryInfo GetModuleHandleA OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency CreateEventA SwitchToThread MultiByteToWideChar WideCharToMultiByte GetNativeSystemInfo LoadLibraryExW FileTimeToSystemTime VirtualQuery RaiseException DecodePointer InitializeCriticalSectionEx DeleteCriticalSection CreateSemaphoreA DuplicateHandle GetTickCount WaitForMultipleObjectsEx GetExitCodeProcess LocalAlloc LocalFree FindResourceExW LoadResource LockResource SizeofResource FindResourceW LoadLibraryW GlobalAlloc GlobalFree GlobalUnlock GlobalLock CreateDirectoryW GetFileAttributesW GetFileSizeEx ReadFile RemoveDirectoryW SetFileAttributesW WriteFile CopyFileW CompareStringEx FreeLibrary GetEnvironmentVariableW ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection GetSystemDirectoryA MoveFileExA CompareFileTime GetEnvironmentVariableA SleepEx VirtualAlloc ReleaseSRWLockShared AcquireSRWLockShared FormatMessageA GetCurrentDirectoryW GetFileAttributesExW GetFileInformationByHandle GetFileTime GetFullPathNameW SetEndOfFile SetFilePointerEx SetFileTime GetTempPathW DeviceIoControl MoveFileExW ResetEvent SetWaitableTimer ResumeThread TlsAlloc TlsGetValue TlsSetValue TlsFree CreateWaitableTimerA AreFileApisANSI InitializeCriticalSection GetStdHandle GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW InitializeCriticalSectionAndSpinCount SwitchToFiber DeleteFiber CreateFiber GetFileType ConvertFiberToThread ConvertThreadToFiber GetTimeZoneInformation GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID GetStartupInfoW EnumSystemLocalesW FlushFileBuffers HeapReAlloc FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW WriteConsoleW GetFinalPathNameByHandleW LocaleNameToLCID

user32

GetWindowRect InvalidateRect EndPaint BeginPaint GetDC DrawTextW GetSystemMetrics EnableWindow KillTimer GetShellWindow GetDlgCtrlID FillRect ShowWindow GetWindowLongW GetWindowThreadProcessId GetUserObjectInformationW GetProcessWindowStation SetWindowLongW TranslateAcceleratorW MessageBoxW SendMessageW DefWindowProcW LoadAcceleratorsW DispatchMessageW TranslateMessage GetMessageW DestroyIcon LoadBitmapW EnumDisplayDevicesA GetDlgItem PostQuitMessage CallWindowProcW RegisterClassW CreateWindowExW LoadIconW SetTimer DestroyWindow

gdi32

CreateSolidBrush CreatePen DeleteDC DeleteObject GetDeviceCaps GetStockObject Rectangle RoundRect SelectObject SetDCBrushColor SetDCPenColor SetBkMode SetTextColor CreateFontW

ole32

CoInitializeEx StringFromGUID2 CoCreateInstance CoUninitialize CoInitialize CoTaskMemFree CoCreateGuid CoTaskMemAlloc

shlwapi

PathFindExtensionW PathFindFileNameW ord12

powrprof

CallNtPowerInformation

winmm

timeGetDevCaps timeBeginPeriod timeSetEvent timeGetTime

Sharing

General

Malware Config

Signatures

File Explorer

RobloxPlayerInstaller.exe

comctl32

gdiplus

wininet

bcrypt

advapi32

shell32

iphlpapi

ws2_32

crypt32

kernel32

user32

gdi32

ole32

shlwapi

powrprof

winmm

generic