roblox-studio-1-6-1-9670[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
roblox-studio-1-6-1-9670.exe
Size 2.0MB
Sample240518-2w4jsscd81
SHA256 1e1fb1cb0fc22a347e8f402ddf40323f977e88d230202baa3565d254c52116c0
MD5 cc3b5563ce4a227d4c1b54e602e96b4f
SHA1 3b0b352f174b3670ab59bb26b59f96a702ac1d88
SHA512 e2aa05f41f2d93383784d899ba30134cf812457b3e35a06164ee9ff697c46ce94df80e8f0d54fe4814d8c37068f5847fc544b902ec39d0d1abe70e151f7e4305
SSDEEP 49152:+U9I4Ct2gBhlgwJ1slmbnSsTO3a+PEKbTjhMDPMQ3d2FeTLbhh/x6jjg:+U9gt2YlgwXslmbn+Mbhh/xX
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

roblox-studio-1-6-1-9670.exe

.exe 2.0MB

roblox-studio-1-6-1-9670.exe

IMPHASH db519f9c15208ec4c5a70a1452b05032
SHA256 1e1fb1cb0fc22a347e8f402ddf40323f977e88d230202baa3565d254c52116c0
MD5 cc3b5563ce4a227d4c1b54e602e96b4f
SHA1 3b0b352f174b3670ab59bb26b59f96a702ac1d88
SHA512 e2aa05f41f2d93383784d899ba30134cf812457b3e35a06164ee9ff697c46ce94df80e8f0d54fe4814d8c37068f5847fc544b902ec39d0d1abe70e151f7e4305
SSDEEP 49152:+U9I4Ct2gBhlgwJ1slmbnSsTO3a+PEKbTjhMDPMQ3d2FeTLbhh/x6jjg:+U9gt2YlgwXslmbn+Mbhh/xX
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Password

Espera que TE

Digest

86:d6:c9:4a:54:e8:c3:96:50:44:e7:71:84:ee:f0:88:48:5a:ea:c8

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=3780902,CN=Roblox Corporation,O=Roblox Corporation,L=San Mateo,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Jan 10, 2023

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

Serial Number

06:f0:6d:d2:b7:5b:ab:64:14:ef:83:d4:5f:d0:ca:2f

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 15, 2021 - Jan 18, 2023

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 21, 2022 - Nov 21, 2033

Minor OS version

Major OS version

Entry point

1129554

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\buildAgent\work\ci_deploy_nbsninja_boot-x86_git\build.ninja\common\vs2019\x86\release\Installer\BootstrapperQTStudio\BootstrapperQTStudio.pdb

shell32

ShellExecuteExW Shell_NotifyIconA ord165 CommandLineToArgvW SHGetFolderPathAndSubDirW ShellExecuteW

powrprof

CallNtPowerInformation

winhttp

WinHttpConnect WinHttpOpenRequest WinHttpCloseHandle WinHttpQueryHeaders WinHttpOpen WinHttpAddRequestHeaders WinHttpSetTimeouts WinHttpSetOption WinHttpWriteData WinHttpReadData WinHttpCrackUrl WinHttpSendRequest WinHttpReceiveResponse

kernel32

MoveFileW VerifyVersionInfoW GetSystemTimeAsFileTime GetStdHandle FindClose FindFirstFileW FindNextFileW GetDiskFreeSpaceExW RemoveDirectoryW SetFileAttributesW DebugBreak Sleep GetCurrentProcess TerminateProcess GetExitCodeProcess GetCurrentThreadId CreateProcessW OpenProcess GetSystemTime GetLocalTime GetTickCount GetVersionExW CreateFileMappingW MapViewOfFile UnmapViewOfFile FreeLibrary GetModuleFileNameA GetModuleFileNameW GetModuleHandleExW BeginUpdateResourceW UpdateResourceA EndUpdateResourceW SystemTimeToFileTime GetGeoInfoW GetUserGeoID GetUserDefaultLCID FreeConsole AttachConsole GetConsoleScreenBufferInfo SetConsoleTextAttribute CreateEventA K32EnumProcesses K32GetProcessImageFileNameW GetCommandLineW IsDebuggerPresent OutputDebugStringW SetLastError IsWow64Process MulDiv GlobalAlloc GlobalUnlock GlobalLock GlobalFree FlushFileBuffers GetFileAttributesExW GetFileSizeEx SetFileTime lstrcpyW GetShortPathNameW LoadLibraryA ReleaseSemaphore CreateSemaphoreW WideCharToMultiByte GetFileTime CreateFileA WaitForSingleObjectEx CreateMutexA GetModuleHandleA GetProcessTimes GlobalMemoryStatusEx GetSystemInfo GetVersionExA OutputDebugStringA GetCurrentProcessId QueryPerformanceCounter QueryPerformanceFrequency OpenSemaphoreW CreateMutexExW CreateSemaphoreExW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection CopyFileW LoadLibraryW FormatMessageA WaitForMultipleObjectsEx SetWaitableTimer ResumeThread FindResourceA TlsGetValue TlsSetValue TlsFree CreateWaitableTimerA GetCurrentDirectoryW GetFileInformationByHandle GetFullPathNameW SetEndOfFile SetFilePointerEx AreFileApisANSI LockResource SetUnhandledExceptionFilter SleepEx CreateThread GetExitCodeThread GetVersion SetProcessShutdownParameters SetConsoleCtrlHandler LockFileEx UnlockFileEx SuspendThread GetProcessId GetThreadContext IsProcessorFeaturePresent GetTimeZoneInformation GetThreadLocale GetSystemDefaultLCID DuplicateHandle VirtualQueryEx ReadProcessMemory SetNamedPipeHandleState TransactNamedPipe CreateNamedPipeW WaitNamedPipeW ConnectNamedPipe DisconnectNamedPipe CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus UnregisterWaitEx RegisterWaitForSingleObject FindFirstFileExW InitializeCriticalSectionAndSpinCount TryEnterCriticalSection InitOnceExecuteOnce LoadLibraryExW GetEnvironmentVariableW InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS SleepConditionVariableSRW InitOnceBeginInitialize InitOnceComplete GetFileInformationByHandleEx EncodePointer LCMapStringEx LoadResource FindResourceExW GetFileAttributesW CreateFileW FileTimeToSystemTime CreateDirectoryW GetProcAddress GetModuleHandleW OpenEventW CreateEventW OpenMutexW CreateMutexW WaitForSingleObject ReleaseMutex ResetEvent SetEvent CloseHandle DeleteCriticalSection InitializeCriticalSectionEx GetProcessHeap GetConsoleMode FormatMessageW LocalFree LocalAlloc GetTempPathW WriteFile ReadFile GetFileSize DeleteFileW VerSetConditionMask MultiByteToWideChar FindResourceW TlsAlloc SizeofResource GetCommandLineA FreeLibraryAndExitThread ExitThread RtlUnwind GetCPInfo GetStringTypeW HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError RaiseException DecodePointer ReadConsoleW GetConsoleOutputCP SetStdHandle GetDriveTypeW PeekNamedPipe SystemTimeToTzSpecificLocalTime ExitProcess CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale EnumSystemLocalesW AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock InitializeSListHead SetSearchPathMode GetFileType lstrlenW GetStartupInfoW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW WriteConsoleW UnhandledExceptionFilter

user32

BeginPaint EndPaint ReleaseDC GetDC DrawTextW GetSystemMetrics EnableWindow KillTimer MessageBoxExW SetTimer GetDlgCtrlID FillRect DestroyWindow RegisterClassW PostQuitMessage MessageBoxA GetWindowThreadProcessId EnumWindows MessageBoxW SetWindowTextW AllowSetForegroundWindow TranslateAcceleratorW LoadAcceleratorsW CharNextW CharUpperW PostThreadMessageW DispatchMessageW TranslateMessage GetMessageW GetParent SetWindowLongW GetWindowLongW GetWindowRect InvalidateRect ShowWindow CreateWindowExW CallWindowProcW DefWindowProcW SendMessageW UnregisterClassW EnumDisplayDevicesA LoadIconW LoadBitmapW PostMessageW IsWindowVisible SetForegroundWindow GetWindowTextW MonitorFromWindow GetDlgItem GetMonitorInfoA

gdi32

SetTextColor SetBkMode SetDCPenColor SetDCBrushColor SelectObject RoundRect Rectangle GetStockObject GetDeviceCaps CreatePen CreateFontW DeleteObject CreateSolidBrush

ole32

CoTaskMemFree CoCreateGuid CoCreateInstance CoUninitialize StringFromGUID2 CoInitialize CreateStreamOnHGlobal CoTaskMemAlloc

advapi32

CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW GetTokenInformation RegGetValueW RegQueryValueExA RegQueryInfoKeyW RegOpenKeyExA RegFlushKey RegEnumValueW RegEnumKeyExW RegDeleteKeyExW RegDeleteKeyW GetUserNameW OpenProcessToken RegQueryValueExW RegDeleteValueW RegSetKeyValueW RegSetValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey RegDeleteTreeW RegCreateKeyExA RegSetValueExA SystemFunction036 BuildSecurityDescriptorW BuildExplicitAccessWithNameW ConvertStringSecurityDescriptorToSecurityDescriptorW ImpersonateNamedPipeClient RevertToSelf CryptDestroyHash

shlwapi

PathRemoveFileSpecW PathAppendW PathAddBackslashW SHDeleteKeyW StrCmpNW StrStrW StrCmpW PathFileExistsW PathRemoveExtensionW SHCopyKeyW

iphlpapi

GetAdaptersInfo

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

sensapi

IsNetworkAlive

comctl32

ord345 _TrackMouseEvent InitCommonControlsEx

gdiplus

GdiplusStartup GdiplusShutdown GdipCloneImage GdipDisposeImage GdipCreateBitmapFromStream GdipCreateHBITMAPFromBitmap GdipFree GdipAlloc

wininet

InternetReadFile InternetConnectW InternetCloseHandle InternetOpenW InternetSetOptionW HttpOpenRequestW HttpAddRequestHeadersA HttpAddRequestHeadersW HttpSendRequestW HttpSendRequestExW HttpEndRequestW HttpQueryInfoA HttpQueryInfoW InternetQueryDataAvailable InternetQueryOptionW InternetWriteFile

ws2_32

getaddrinfo freeaddrinfo inet_ntop

winmm

timeGetTime timeSetEvent timeBeginPeriod timeGetDevCaps

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

480KB

Virtual Size

479KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

30KB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

CPADinfo

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

112KB

Virtual Size

112KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

62KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

roblox-studio-1-6-1-9670.exe

shell32

powrprof

winhttp

kernel32

user32

gdi32

ole32

advapi32

shlwapi

iphlpapi

version

sensapi

comctl32

gdiplus

wininet

ws2_32

winmm

generic