RblxExecutor[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
RblxExecutor.exe
Size 1.6MB
Sample240522-xbe89acd77
SHA256 e9397b42b5c3f7770b873a76355bd59cbe097f30dc9b9349e9787832bbe9767a
MD5 3a235f7f491d95d4727320239c0b4cb7
SHA1 b66d02b69f9d2cf011164406c6bc93a6728a65eb
SHA512 fa40f2d94bbe25372fc5eecb87168c3a55fb3fff1486ebd57d1f944760b43cc77a891fdbc246d5379e02b88b7f4f6abea0c94162e88ff87cabd246c7d8a5d83b
SSDEEP 24576:O83AQ99hyIMVdMJgsIX3b9M5Mm2f+qnbyy3q3PIMPKgPe8CWZoPJRMyoE:OWAE9AInJfF8dbRiteGmJKy
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
RblxExecutor.exe

File Explorer

RblxExecutor.exe

.exe 1.6MB

RblxExecutor.exe

IMPHASH ddfbec1e57a15a494158d464b7a3aba5
SHA256 e9397b42b5c3f7770b873a76355bd59cbe097f30dc9b9349e9787832bbe9767a
MD5 3a235f7f491d95d4727320239c0b4cb7
SHA1 b66d02b69f9d2cf011164406c6bc93a6728a65eb
SHA512 fa40f2d94bbe25372fc5eecb87168c3a55fb3fff1486ebd57d1f944760b43cc77a891fdbc246d5379e02b88b7f4f6abea0c94162e88ff87cabd246c7d8a5d83b
SSDEEP 24576:O83AQ99hyIMVdMJgsIX3b9M5Mm2f+qnbyy3q3PIMPKgPe8CWZoPJRMyoE:OWAE9AInJfF8dbRiteGmJKy
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

42364

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

Sleep Process32NextW Process32FirstW GetProcAddress GetModuleHandleW GetTickCount CreateToolhelp32Snapshot CheckRemoteDebuggerPresent SetConsoleTextAttribute GetStdHandle SetEndOfFile WriteConsoleW HeapSize CreateFileW GetModuleHandleA GetSystemTimes GetCurrentProcess CreateProcessW IsDebuggerPresent CloseHandle SetStdHandle GetProcessHeap SetEnvironmentVariableW GetCurrentThreadId WaitForSingleObjectEx GetExitCodeThread WideCharToMultiByte QueryPerformanceCounter QueryPerformanceFrequency ReleaseSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx WakeAllConditionVariable GetSystemTimeAsFileTime GetStringTypeW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleFileNameW WriteFile GetCommandLineA GetCommandLineW GetFileSizeEx SetFilePointerEx GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapFree HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadFile ReadConsoleW WaitForSingleObject GetExitCodeProcess GetFileAttributesExW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW RtlUnwind

user32

FindWindowA MessageBoxW

advapi32

RegQueryValueExA RegCloseKey RegOpenKeyExA

iphlpapi

GetAdaptersInfo

ntdll

RtlLookupFunctionEntry RtlVirtualUnwind RtlCaptureContext

Name

.text

Size

183KB

Virtual Size

182KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

71KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

RblxExecutor.exe

kernel32

user32

advapi32

iphlpapi

ntdll

generic